feat: v3.4 — boot reliability, log readability, USB export, screen resolution, GRUB UEFI fix, memtest, KVM console stability

Web UI / logs:
- Strip ANSI escape codes and handle \r (progress bars) in task log output
- Add USB export API + UI card on Export page (list removable devices, write audit JSON or support bundle)
- Add Display Resolution card in Tools (xrandr-based, per-output mode selector)
- Dashboard: audit status banner with auto-reload when audit task completes

Boot & install:
- bee-web starts immediately with no dependencies (was blocked by audit + network)
- bee-audit.service redesigned: waits for bee-web healthz, sleeps 60s, enqueues audit via /api/audit/run (task system)
- bee-install: fix GRUB UEFI — grub-install exit code was silently ignored (|| true); add --no-nvram fallback; always copy EFI/BOOT/BOOTX64.EFI fallback path
- Add grub-efi-amd64, grub-pc, grub-efi-amd64-signed, shim-signed to package list (grub-install requires these, not just -bin variants)
- memtest hook: fix binary/boot/ not created before cp; handle both Debian (no extension) and upstream (x64.efi) naming
- bee-openbox-session: increase healthz wait from 30s to 120s

KVM console stability:
- runCmdJob: syscall.Setpriority(PRIO_PROCESS, pid, 10) on all stress subprocesses
- lightdm.service.d: Nice=-5 so X server preempts stress processes

Packages: add btop

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

iso/builder/config/hooks/normal/9100-memtest.hook.binary

@@ -4,16 +4,23 @@
 # not inside the squashfs).
 #
 # Primary: copy from chroot/boot/ (populated by package postinst).
-# Fallback: extract directly from the cached .deb if postinst didn't place
-#           the files (happens in chroot environments without grub triggers).
+# Naming fallbacks:
+#   Debian Bookworm: /boot/memtest86+       — EFI PE64 (no extension)
+#                    /boot/memtest86+.bin    — legacy binary
+#   Upstream/Ubuntu: /boot/memtest86+x64.efi, /boot/memtest86+x64.bin, etc.
+# Last resort: extract directly from the cached .deb if postinst didn't place
+#              the files (happens in chroot environments without grub triggers).
 set -e
 
 MEMTEST_FILES="memtest86+x64.bin memtest86+x64.efi memtest86+ia32.bin memtest86+ia32.efi"
 
+# Ensure destination directory exists (absence caused silent copy failures).
+mkdir -p binary/boot
+
 echo "memtest: scanning chroot/boot/ for memtest files:"
 ls chroot/boot/memtest* 2>/dev/null || echo "memtest: WARNING: no memtest files in chroot/boot/"
 
-# Primary path: copy from chroot/boot/
+# Primary path: copy upstream-named files from chroot/boot/
 for f in ${MEMTEST_FILES}; do
     src="chroot/boot/${f}"
     if [ -f "${src}" ]; then
@@ -22,14 +29,23 @@ for f in ${MEMTEST_FILES}; do
     fi
 done
 
-# Fallback: if EFI binary still missing, extract from cached .deb
+# Debian Bookworm naming fallback: /boot/memtest86+ (no extension) is the EFI binary.
+if [ ! -f "binary/boot/memtest86+x64.efi" ] && [ -f "chroot/boot/memtest86+" ]; then
+    cp "chroot/boot/memtest86+" "binary/boot/memtest86+x64.efi"
+    echo "memtest: copied /boot/memtest86+ as memtest86+x64.efi (Debian naming)"
+fi
+if [ ! -f "binary/boot/memtest86+x64.bin" ] && [ -f "chroot/boot/memtest86+.bin" ]; then
+    cp "chroot/boot/memtest86+.bin" "binary/boot/memtest86+x64.bin"
+    echo "memtest: copied /boot/memtest86+.bin as memtest86+x64.bin (Debian naming)"
+fi
+
+# Last resort: if EFI binary still missing, extract from cached .deb
 if [ ! -f "binary/boot/memtest86+x64.efi" ]; then
     echo "memtest: EFI binary missing — attempting extraction from .deb cache"
     deb=$(find chroot/var/cache/apt/archives/ chroot/var/lib/apt/lists/ \
               -name 'memtest86+_*.deb' -o -name 'memtest86+*.deb' 2>/dev/null \
           | head -1)
     if [ -z "$deb" ]; then
-        # Also check lb package cache
         deb=$(find cache/ -name 'memtest86+_*.deb' -o -name 'memtest86+*.deb' 2>/dev/null | head -1)
     fi
     if [ -n "$deb" ]; then
@@ -45,6 +61,11 @@ if [ ! -f "binary/boot/memtest86+x64.efi" ]; then
                 echo "memtest: extracted ${f} from .deb"
             fi
         done
+        # Debian naming fallback inside .deb as well
+        if [ ! -f "binary/boot/memtest86+x64.efi" ] && [ -f "${EXTRACT_DIR}/boot/memtest86+" ]; then
+            cp "${EXTRACT_DIR}/boot/memtest86+" "binary/boot/memtest86+x64.efi"
+            echo "memtest: extracted /boot/memtest86+ as memtest86+x64.efi from .deb"
+        fi
         rm -rf "${EXTRACT_DIR}"
     else
         echo "memtest: WARNING: no memtest86+ .deb found in cache — memtest will not be available"

iso/builder/config/package-lists/bee.list.chroot

@@ -21,8 +21,14 @@ openssh-server
 # Disk installer
 squashfs-tools
 parted
+# grub-pc / grub-efi-amd64 provide grub-install + grub2-common (required for chroot install).
+# The -bin variants only carry binary modules and do NOT include grub-install itself.
+grub-pc
 grub-pc-bin
+grub-efi-amd64
 grub-efi-amd64-bin
+grub-efi-amd64-signed
+shim-signed
 
 # Filesystem support for USB export targets
 exfatprogs
@@ -39,6 +45,7 @@ vim-tiny
 mc
 htop
 nvtop
+btop
 sudo
 zstd
 mstflint

iso/overlay/etc/systemd/system/bee-audit.service

@@ -1,14 +1,25 @@
 [Unit]
-Description=Bee: run hardware audit
-After=bee-network.service bee-nvidia.service bee-preflight.service
-Before=bee-web.service
+Description=Bee: schedule startup hardware audit via task queue
+# Start AFTER bee-web, not before — bee-web must not wait for audit.
+After=bee-web.service
+Wants=bee-web.service
 
 [Service]
 Type=oneshot
-ExecStart=/usr/local/bin/bee-log-run /appdata/bee/export/bee-audit.log /bin/sh -c '/usr/local/bin/bee audit --runtime livecd --output file:/appdata/bee/export/bee-audit.json; rc=$?; if [ "$rc" -ne 0 ]; then echo "[bee-audit] WARN: audit exited with rc=$rc"; fi; exit 0'
+RemainAfterExit=yes
+# Wait up to 90s for bee-web to respond on /healthz, then sleep 60s for
+# the system to settle (GPU drivers, sensors), then enqueue the audit as
+# a background task so it appears in the task list and logs.
+ExecStart=/bin/sh -c '\
+  i=0; \
+  while [ $i -lt 90 ]; do \
+    if curl -sf http://localhost/healthz >/dev/null 2>&1; then break; fi; \
+    sleep 1; i=$((i+1)); \
+  done; \
+  sleep 60; \
+  curl -sf -X POST http://localhost/api/audit/run >/dev/null'
 StandardOutput=journal
 StandardError=journal
-RemainAfterExit=yes
 
 [Install]
 WantedBy=multi-user.target

iso/overlay/etc/systemd/system/bee-web.service

@@ -1,7 +1,5 @@
 [Unit]
 Description=Bee: hardware audit web viewer
-After=bee-network.service
-Wants=bee-audit.service
 
 [Service]
 Type=simple
@@ -11,6 +9,9 @@ RestartSec=2
 StandardOutput=journal
 StandardError=journal
 LimitMEMLOCK=infinity
+# Keep the web server responsive during GPU/CPU stress (children inherit nice+10
+# via Setpriority in runCmdJob, but the bee-web parent stays at 0).
+Nice=0
 
 [Install]
 WantedBy=multi-user.target

iso/overlay/etc/systemd/system/lightdm.service.d/bee-limits.conf

@@ -4,3 +4,6 @@
 RestartSec=10
 StartLimitIntervalSec=60
 StartLimitBurst=3
+# Raise scheduling priority of the X server so the graphical console (KVM/IPMI)
+# stays responsive during GPU/CPU stress tests running at nice+10.
+Nice=-5

iso/overlay/usr/local/bin/bee-install

@@ -158,20 +158,56 @@ mount --bind /sys  "${MOUNT_ROOT}/sys"
 
 # ------------------------------------------------------------------
 log "--- Step 7/7: Installing GRUB bootloader ---"
+
+# Helper: run a chroot command, log all output, return its exit code.
+# Needed because "cmd | while" pipelines hide the exit code of cmd.
+chroot_log() {
+    local rc=0
+    local out
+    out=$(chroot "$MOUNT_ROOT" "$@" 2>&1) || rc=$?
+    echo "$out" | while IFS= read -r line; do log "  $line"; done
+    return $rc
+}
+
 if [ "$UEFI" = "1" ]; then
-    chroot "$MOUNT_ROOT" grub-install \
-        --target=x86_64-efi \
-        --efi-directory=/boot/efi \
-        --bootloader-id=bee \
-        --recheck 2>&1 | while read -r line; do log "  $line"; done || true
+    # Primary attempt: write EFI NVRAM entry (requires writable efivars)
+    if ! chroot_log grub-install \
+            --target=x86_64-efi \
+            --efi-directory=/boot/efi \
+            --bootloader-id=bee \
+            --recheck; then
+        log "  WARNING: grub-install (with NVRAM) failed — retrying with --no-nvram"
+        # --no-nvram: write grubx64.efi but skip EFI variable update.
+        # Needed on headless servers where efivars is read-only or unavailable.
+        chroot_log grub-install \
+            --target=x86_64-efi \
+            --efi-directory=/boot/efi \
+            --bootloader-id=bee \
+            --no-nvram \
+            --recheck || log "  WARNING: grub-install --no-nvram also failed — check logs"
+    fi
+
+    # Always install the UEFI fallback path EFI/BOOT/BOOTX64.EFI.
+    # Many UEFI implementations (especially server BMCs and some firmware)
+    # ignore the NVRAM boot entry and only look for this path.
+    GRUB_EFI="${MOUNT_ROOT}/boot/efi/EFI/bee/grubx64.efi"
+    FALLBACK_DIR="${MOUNT_ROOT}/boot/efi/EFI/BOOT"
+    if [ -f "$GRUB_EFI" ]; then
+        mkdir -p "$FALLBACK_DIR"
+        cp "$GRUB_EFI" "${FALLBACK_DIR}/BOOTX64.EFI"
+        log "  Fallback EFI binary installed: EFI/BOOT/BOOTX64.EFI"
+    else
+        log "  WARNING: grubx64.efi not found at $GRUB_EFI — UEFI fallback path not set"
+    fi
 else
-    chroot "$MOUNT_ROOT" grub-install \
+    chroot_log grub-install \
         --target=i386-pc \
         --recheck \
-        "$DEVICE" 2>&1 | while read -r line; do log "  $line"; done || true
+        "$DEVICE" || log "  WARNING: grub-install (BIOS) failed — check logs"
 fi
-chroot "$MOUNT_ROOT" update-grub 2>&1 | while read -r line; do log "  $line"; done || true
-log "  GRUB installed."
+
+chroot_log update-grub || log "  WARNING: update-grub failed — check logs"
+log "  GRUB step complete."
 
 # ------------------------------------------------------------------
 # Cleanup

iso/overlay/usr/local/bin/bee-openbox-session

@@ -8,13 +8,16 @@ xset -dpms
 xset s noblank
 
 tint2 &
-# Wait for bee-web to bind (Go starts fast, usually <2s)
+
+# Wait up to 120s for bee-web to bind. The web server starts immediately now
+# (audit is deferred), so this should succeed in a few seconds on most hardware.
 i=0
-while [ $i -lt 30 ]; do
+while [ $i -lt 120 ]; do
     if curl -sf http://localhost/healthz >/dev/null 2>&1; then break; fi
     sleep 1
     i=$((i+1))
 done
+
 chromium \
     --disable-infobars \
     --disable-translate \