Fix memtest ISO validation false negatives

- Burn tab: replace 6 flat cards with 3 grouped cards (GPU Stress,
  Compute Stress, Platform Thermal Cycling) + global Burn Profile
- Run All button at top enqueues all enabled tests across all cards
- GPU Stress: tool checkboxes enabled/disabled via new /api/gpu/tools
  endpoint based on driver status (/dev/nvidia0, /dev/kfd)
- Compute Stress: checkboxes for cpu/memory-stress/stressapptest
- Platform Thermal Cycling: component checkboxes (cpu/nvidia/amd)
  with platform_components param wired through to PlatformStressOptions
- bee-gpu-burn: default size-mb changed from 64 to 0 (auto); script
  now queries nvidia-smi memory.total per GPU and uses 95% of it
- platform_stress: removed hardcoded --size-mb 64; respects Components
  field to selectively run CPU and/or GPU load goroutines

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

audit/internal/app/support_bundle.go

@@ -36,6 +36,8 @@ var supportBundleCommands = []struct {
 	{name: "system/dmesg-tail.txt", cmd: []string{"sh", "-c", "dmesg | tail -n 200"}},
 }
 
+const supportBundleGlob = "bee-support-*.tar.gz"
+
 func BuildSupportBundle(exportDir string) (string, error) {
 	exportDir = strings.TrimSpace(exportDir)
 	if exportDir == "" {
@@ -86,34 +88,64 @@ func BuildSupportBundle(exportDir string) (string, error) {
 	return archivePath, nil
 }
 
+func LatestSupportBundlePath() (string, error) {
+	return latestSupportBundlePath(os.TempDir())
+}
+
 func cleanupOldSupportBundles(dir string) error {
-	matches, err := filepath.Glob(filepath.Join(dir, "bee-support-*.tar.gz"))
+	matches, err := filepath.Glob(filepath.Join(dir, supportBundleGlob))
 	if err != nil {
 		return err
 	}
-	type entry struct {
-		path string
-		mod  time.Time
+	entries := supportBundleEntries(matches)
+	for path, mod := range entries {
+		if time.Since(mod) > 24*time.Hour {
+			_ = os.Remove(path)
+			delete(entries, path)
+		}
 	}
-	list := make([]entry, 0, len(matches))
+	ordered := orderSupportBundles(entries)
+	if len(ordered) > 3 {
+		for _, old := range ordered[3:] {
+			_ = os.Remove(old)
+		}
+	}
+	return nil
+}
+
+func latestSupportBundlePath(dir string) (string, error) {
+	matches, err := filepath.Glob(filepath.Join(dir, supportBundleGlob))
+	if err != nil {
+		return "", err
+	}
+	ordered := orderSupportBundles(supportBundleEntries(matches))
+	if len(ordered) == 0 {
+		return "", os.ErrNotExist
+	}
+	return ordered[0], nil
+}
+
+func supportBundleEntries(matches []string) map[string]time.Time {
+	entries := make(map[string]time.Time, len(matches))
 	for _, match := range matches {
 		info, err := os.Stat(match)
 		if err != nil {
 			continue
 		}
-		if time.Since(info.ModTime()) > 24*time.Hour {
-			_ = os.Remove(match)
-			continue
-		}
-		list = append(list, entry{path: match, mod: info.ModTime()})
+		entries[match] = info.ModTime()
 	}
-	sort.Slice(list, func(i, j int) bool { return list[i].mod.After(list[j].mod) })
-	if len(list) > 3 {
-		for _, old := range list[3:] {
-			_ = os.Remove(old.path)
-		}
+	return entries
+}
+
+func orderSupportBundles(entries map[string]time.Time) []string {
+	ordered := make([]string, 0, len(entries))
+	for path := range entries {
+		ordered = append(ordered, path)
 	}
-	return nil
+	sort.Slice(ordered, func(i, j int) bool {
+		return entries[ordered[i]].After(entries[ordered[j]])
+	})
+	return ordered
 }
 
 func writeJournalDump(dst string) error {

audit/internal/platform/live_metrics.go

@@ -68,18 +68,20 @@ func SampleLiveMetrics() LiveMetricSample {
 
 // sampleCPULoadPct reads two /proc/stat snapshots 200ms apart and returns
 // the overall CPU utilisation percentage.
-var cpuStatPrev [2]uint64 // [total, idle]
-
 func sampleCPULoadPct() float64 {
-	total, idle := readCPUStat()
-	if total == 0 {
+	total0, idle0 := readCPUStat()
+	if total0 == 0 {
 		return 0
 	}
-	prevTotal, prevIdle := cpuStatPrev[0], cpuStatPrev[1]
-	cpuStatPrev = [2]uint64{total, idle}
-	if prevTotal == 0 {
+	time.Sleep(200 * time.Millisecond)
+	total1, idle1 := readCPUStat()
+	if total1 == 0 {
 		return 0
 	}
+	return cpuLoadPctBetween(total0, idle0, total1, idle1)
+}
+
+func cpuLoadPctBetween(prevTotal, prevIdle, total, idle uint64) float64 {
 	dt := float64(total - prevTotal)
 	di := float64(idle - prevIdle)
 	if dt <= 0 {

audit/internal/platform/live_metrics_test.go

@@ -42,3 +42,53 @@ func TestCompactAmbientTempName(t *testing.T) {
 		t.Fatalf("got %q", got)
 	}
 }
+
+func TestCPULoadPctBetween(t *testing.T) {
+	tests := []struct {
+		name      string
+		prevTotal uint64
+		prevIdle  uint64
+		total     uint64
+		idle      uint64
+		want      float64
+	}{
+		{
+			name:      "busy half",
+			prevTotal: 100,
+			prevIdle:  40,
+			total:     200,
+			idle:      90,
+			want:      50,
+		},
+		{
+			name:      "fully busy",
+			prevTotal: 100,
+			prevIdle:  40,
+			total:     200,
+			idle:      40,
+			want:      100,
+		},
+		{
+			name:      "no progress",
+			prevTotal: 100,
+			prevIdle:  40,
+			total:     100,
+			idle:      40,
+			want:      0,
+		},
+		{
+			name:      "idle delta larger than total clamps to zero",
+			prevTotal: 100,
+			prevIdle:  40,
+			total:     200,
+			idle:      150,
+			want:      0,
+		},
+	}
+
+	for _, tc := range tests {
+		if got := cpuLoadPctBetween(tc.prevTotal, tc.prevIdle, tc.total, tc.idle); got != tc.want {
+			t.Fatalf("%s: cpuLoadPctBetween(...)=%v want %v", tc.name, got, tc.want)
+		}
+	}
+}

audit/internal/platform/nvidia_stress.go

@@ -16,7 +16,7 @@ func (s *System) RunNvidiaStressPack(ctx context.Context, baseDir string, opts N
 		return "", err
 	}
 
-	return runAcceptancePackCtx(ctx, baseDir, "gpu-nvidia-stress", []satJob{
+	return runAcceptancePackCtx(ctx, baseDir, nvidiaStressArchivePrefix(opts.Loader), []satJob{
 		{name: "01-nvidia-smi-q.log", cmd: []string{"nvidia-smi", "-q"}},
 		{name: "02-nvidia-smi-list.log", cmd: []string{"nvidia-smi", "-L"}},
 		job,
@@ -24,6 +24,17 @@ func (s *System) RunNvidiaStressPack(ctx context.Context, baseDir string, opts N
 	}, logFunc)
 }
 
+func nvidiaStressArchivePrefix(loader string) string {
+	switch strings.TrimSpace(strings.ToLower(loader)) {
+	case NvidiaStressLoaderJohn:
+		return "gpu-nvidia-john"
+	case NvidiaStressLoaderNCCL:
+		return "gpu-nvidia-nccl"
+	default:
+		return "gpu-nvidia-burn"
+	}
+}
+
 func buildNvidiaStressJob(opts NvidiaStressOptions) (satJob, error) {
 	selected, err := resolveNvidiaGPUSelection(opts.GPUIndices, opts.ExcludeGPUIndices)
 	if err != nil {
@@ -84,9 +95,7 @@ func normalizeNvidiaStressOptions(opts *NvidiaStressOptions) {
 	if opts.DurationSec <= 0 {
 		opts.DurationSec = 300
 	}
-	if opts.SizeMB <= 0 {
-		opts.SizeMB = 64
-	}
+	// SizeMB=0 means "auto" — bee-gpu-burn will query per-GPU memory at runtime.
 	switch strings.TrimSpace(strings.ToLower(opts.Loader)) {
 	case "", NvidiaStressLoaderBuiltin:
 		opts.Loader = NvidiaStressLoaderBuiltin

audit/internal/platform/platform_stress.go

@@ -10,9 +10,11 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"runtime"
 	"strconv"
 	"strings"
 	"sync"
+	"syscall"
 	"time"
 )
 
@@ -24,7 +26,8 @@ type PlatformStressCycle struct {
 
 // PlatformStressOptions controls the thermal cycling test.
 type PlatformStressOptions struct {
-	Cycles []PlatformStressCycle
+	Cycles     []PlatformStressCycle
+	Components []string // if empty: run all; values: "cpu", "gpu"
 }
 
 // platformStressRow is one second of telemetry.
@@ -66,8 +69,11 @@ func (s *System) RunPlatformStress(
 		return "", fmt.Errorf("mkdir run dir: %w", err)
 	}
 
+	hasCPU := len(opts.Components) == 0 || containsComponent(opts.Components, "cpu")
+	hasGPU := len(opts.Components) == 0 || containsComponent(opts.Components, "gpu")
+
 	vendor := s.DetectGPUVendor()
-	logFunc(fmt.Sprintf("Platform Thermal Cycling — %d cycle(s), GPU vendor: %s", len(opts.Cycles), vendor))
+	logFunc(fmt.Sprintf("Platform Thermal Cycling — %d cycle(s), GPU vendor: %s, cpu=%v gpu=%v", len(opts.Cycles), vendor, hasCPU, hasGPU))
 
 	var rows []platformStressRow
 	start := time.Now()
@@ -86,27 +92,31 @@ func (s *System) RunPlatformStress(
 		var wg sync.WaitGroup
 
 		// CPU stress
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			cpuCmd, err := buildCPUStressCmd(loadCtx)
-			if err != nil {
-				logFunc("CPU stress: " + err.Error())
-				return
-			}
-			_ = cpuCmd.Wait() // exits when loadCtx times out (SIGKILL)
-		}()
+		if hasCPU {
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				cpuCmd, err := buildCPUStressCmd(loadCtx)
+				if err != nil {
+					logFunc("CPU stress: " + err.Error())
+					return
+				}
+				_ = cpuCmd.Wait() // exits when loadCtx times out (SIGKILL)
+			}()
+		}
 
 		// GPU stress
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			gpuCmd := buildGPUStressCmd(loadCtx, vendor)
-			if gpuCmd == nil {
-				return
-			}
-			_ = gpuCmd.Wait()
-		}()
+		if hasGPU {
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				gpuCmd := buildGPUStressCmd(loadCtx, vendor)
+				if gpuCmd == nil {
+					return
+				}
+				_ = gpuCmd.Wait()
+			}()
+		}
 
 		// Monitoring goroutine for load phase
 		loadRows := collectPhase(loadCtx, cycleNum, "load", start)
@@ -374,10 +384,17 @@ func buildCPUStressCmd(ctx context.Context) (*exec.Cmd, error) {
 		return nil, fmt.Errorf("stressapptest not found: %w", err)
 	}
 	// Use a very long duration; the context timeout will kill it at the right time.
-	cmd := exec.CommandContext(ctx, path, "-s", "86400", "-W", "--cc_test")
+	cmdArgs := []string{"-s", "86400", "-W", "--cc_test"}
+	if threads := platformStressCPUThreads(); threads > 0 {
+		cmdArgs = append(cmdArgs, "-m", strconv.Itoa(threads))
+	}
+	if mb := platformStressMemoryMB(); mb > 0 {
+		cmdArgs = append(cmdArgs, "-M", strconv.Itoa(mb))
+	}
+	cmd := exec.CommandContext(ctx, path, cmdArgs...)
 	cmd.Stdout = nil
 	cmd.Stderr = nil
-	if err := cmd.Start(); err != nil {
+	if err := startLowPriorityCmd(cmd, 15); err != nil {
 		return nil, fmt.Errorf("stressapptest start: %w", err)
 	}
 	return cmd, nil
@@ -418,7 +435,7 @@ func buildAMDGPUStressCmd(ctx context.Context) *exec.Cmd {
 	cmd := exec.CommandContext(ctx, rvsPath, "-c", cfgFile)
 	cmd.Stdout = nil
 	cmd.Stderr = nil
-	_ = cmd.Start()
+	_ = startLowPriorityCmd(cmd, 10)
 	return cmd
 }
 
@@ -430,13 +447,62 @@ func buildNvidiaGPUStressCmd(ctx context.Context) *exec.Cmd {
 	if err != nil {
 		return nil
 	}
-	cmd := exec.CommandContext(ctx, path, "--seconds", "86400", "--size-mb", "64")
+	cmd := exec.CommandContext(ctx, path, "--seconds", "86400")
 	cmd.Stdout = nil
 	cmd.Stderr = nil
-	_ = cmd.Start()
+	_ = startLowPriorityCmd(cmd, 10)
 	return cmd
 }
 
+func startLowPriorityCmd(cmd *exec.Cmd, nice int) error {
+	if err := cmd.Start(); err != nil {
+		return err
+	}
+	if cmd.Process != nil {
+		_ = syscall.Setpriority(syscall.PRIO_PROCESS, cmd.Process.Pid, nice)
+	}
+	return nil
+}
+
+func platformStressCPUThreads() int {
+	if n := envInt("BEE_PLATFORM_STRESS_THREADS", 0); n > 0 {
+		return n
+	}
+	cpus := runtime.NumCPU()
+	switch {
+	case cpus <= 2:
+		return 1
+	case cpus <= 8:
+		return cpus - 1
+	default:
+		return cpus - 2
+	}
+}
+
+func platformStressMemoryMB() int {
+	if mb := envInt("BEE_PLATFORM_STRESS_MB", 0); mb > 0 {
+		return mb
+	}
+	free := freeMemBytes()
+	if free <= 0 {
+		return 0
+	}
+	mb := int((free * 60) / 100 / (1024 * 1024))
+	if mb < 1024 {
+		return 1024
+	}
+	return mb
+}
+
+func containsComponent(components []string, name string) bool {
+	for _, c := range components {
+		if c == name {
+			return true
+		}
+	}
+	return false
+}
+
 func packPlatformDir(dir, dest string) error {
 	f, err := os.Create(dest)
 	if err != nil {

audit/internal/platform/platform_stress_test.go

@@ -0,0 +1,34 @@
+package platform
+
+import (
+	"runtime"
+	"testing"
+)
+
+func TestPlatformStressCPUThreadsOverride(t *testing.T) {
+	t.Setenv("BEE_PLATFORM_STRESS_THREADS", "7")
+	if got := platformStressCPUThreads(); got != 7 {
+		t.Fatalf("platformStressCPUThreads=%d want 7", got)
+	}
+}
+
+func TestPlatformStressCPUThreadsDefaultLeavesHeadroom(t *testing.T) {
+	t.Setenv("BEE_PLATFORM_STRESS_THREADS", "")
+	got := platformStressCPUThreads()
+	if got < 1 {
+		t.Fatalf("platformStressCPUThreads=%d want >= 1", got)
+	}
+	if got > runtime.NumCPU() {
+		t.Fatalf("platformStressCPUThreads=%d want <= NumCPU=%d", got, runtime.NumCPU())
+	}
+	if runtime.NumCPU() > 2 && got >= runtime.NumCPU() {
+		t.Fatalf("platformStressCPUThreads=%d want headroom below NumCPU=%d", got, runtime.NumCPU())
+	}
+}
+
+func TestPlatformStressMemoryMBOverride(t *testing.T) {
+	t.Setenv("BEE_PLATFORM_STRESS_MB", "8192")
+	if got := platformStressMemoryMB(); got != 8192 {
+		t.Fatalf("platformStressMemoryMB=%d want 8192", got)
+	}
+}

audit/internal/platform/sat.go

@@ -684,7 +684,11 @@ func resolveSATCommand(cmd []string) ([]string, error) {
 	case "rvs":
 		return resolveRVSCommand(cmd[1:]...)
 	}
-	return cmd, nil
+	path, err := satLookPath(cmd[0])
+	if err != nil {
+		return nil, fmt.Errorf("%s not found in PATH: %w", cmd[0], err)
+	}
+	return append([]string{path}, cmd[1:]...), nil
 }
 
 func resolveRVSCommand(args ...string) ([]string, error) {

audit/internal/platform/sat_fan_stress.go

@@ -51,6 +51,18 @@ type FanStressRow struct {
 	SysPowerW    float64 // DCMI system power reading
 }
 
+type cachedPowerReading struct {
+	Value     float64
+	UpdatedAt time.Time
+}
+
+var (
+	systemPowerCacheMu sync.Mutex
+	systemPowerCache   cachedPowerReading
+)
+
+const systemPowerHoldTTL = 15 * time.Second
+
 // RunFanStressTest runs a two-phase GPU stress test while monitoring fan speeds,
 // temperatures, and power draw every second. Exports metrics.csv and fan-sensors.csv.
 // Designed to reproduce case-04 fan-speed lag and detect GPU thermal throttling.
@@ -508,11 +520,17 @@ func sampleCPUTempViaSensors() float64 {
 
 // sampleSystemPower reads system power draw via DCMI.
 func sampleSystemPower() float64 {
+	now := time.Now()
+	current := 0.0
 	out, err := exec.Command("ipmitool", "dcmi", "power", "reading").Output()
-	if err != nil {
-		return 0
+	if err == nil {
+		current = parseDCMIPowerReading(string(out))
 	}
-	return parseDCMIPowerReading(string(out))
+	systemPowerCacheMu.Lock()
+	defer systemPowerCacheMu.Unlock()
+	value, updated := effectiveSystemPowerReading(systemPowerCache, current, now)
+	systemPowerCache = updated
+	return value
 }
 
 // parseDCMIPowerReading extracts the instantaneous power reading from ipmitool dcmi output.
@@ -535,6 +553,17 @@ func parseDCMIPowerReading(raw string) float64 {
 	return 0
 }
 
+func effectiveSystemPowerReading(cache cachedPowerReading, current float64, now time.Time) (float64, cachedPowerReading) {
+	if current > 0 {
+		cache = cachedPowerReading{Value: current, UpdatedAt: now}
+		return current, cache
+	}
+	if cache.Value > 0 && !cache.UpdatedAt.IsZero() && now.Sub(cache.UpdatedAt) <= systemPowerHoldTTL {
+		return cache.Value, cache
+	}
+	return 0, cache
+}
+
 // analyzeThrottling returns true if any GPU reported an active throttle reason
 // during either load phase.
 func analyzeThrottling(rows []FanStressRow) bool {

audit/internal/platform/sat_fan_stress_test.go

@@ -1,6 +1,9 @@
 package platform
 
-import "testing"
+import (
+	"testing"
+	"time"
+)
 
 func TestParseFanSpeeds(t *testing.T) {
 	raw := "FAN1 | 2400.000 | RPM | ok\nFAN2 | 1800 RPM | ok | ok\nFAN3 | na | RPM | ns\n"
@@ -25,3 +28,40 @@ func TestFirstFanInputValue(t *testing.T) {
 		t.Fatalf("got=%v ok=%v", got, ok)
 	}
 }
+
+func TestParseDCMIPowerReading(t *testing.T) {
+	raw := `
+Instantaneous power reading:                   512 Watts
+Minimum during sampling period:               498 Watts
+`
+	if got := parseDCMIPowerReading(raw); got != 512 {
+		t.Fatalf("parseDCMIPowerReading()=%v want 512", got)
+	}
+}
+
+func TestEffectiveSystemPowerReading(t *testing.T) {
+	now := time.Now()
+	cache := cachedPowerReading{Value: 480, UpdatedAt: now.Add(-5 * time.Second)}
+
+	got, updated := effectiveSystemPowerReading(cache, 0, now)
+	if got != 480 {
+		t.Fatalf("got=%v want cached 480", got)
+	}
+	if updated.Value != 480 {
+		t.Fatalf("updated=%+v", updated)
+	}
+
+	got, updated = effectiveSystemPowerReading(cache, 530, now)
+	if got != 530 {
+		t.Fatalf("got=%v want 530", got)
+	}
+	if updated.Value != 530 {
+		t.Fatalf("updated=%+v", updated)
+	}
+
+	expired := cachedPowerReading{Value: 480, UpdatedAt: now.Add(-systemPowerHoldTTL - time.Second)}
+	got, _ = effectiveSystemPowerReading(expired, 0, now)
+	if got != 0 {
+		t.Fatalf("expired cache returned %v want 0", got)
+	}
+}

audit/internal/platform/sat_test.go

@@ -162,6 +162,25 @@ func TestBuildNvidiaStressJobUsesNCCLLoader(t *testing.T) {
 	}
 }
 
+func TestNvidiaStressArchivePrefixByLoader(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		loader string
+		want   string
+	}{
+		{loader: NvidiaStressLoaderBuiltin, want: "gpu-nvidia-burn"},
+		{loader: NvidiaStressLoaderJohn, want: "gpu-nvidia-john"},
+		{loader: NvidiaStressLoaderNCCL, want: "gpu-nvidia-nccl"},
+		{loader: "", want: "gpu-nvidia-burn"},
+	}
+	for _, tt := range tests {
+		if got := nvidiaStressArchivePrefix(tt.loader); got != tt.want {
+			t.Fatalf("loader=%q prefix=%q want %q", tt.loader, got, tt.want)
+		}
+	}
+}
+
 func TestEnvIntFallback(t *testing.T) {
 	os.Unsetenv("BEE_MEMTESTER_SIZE_MB")
 	if got := envInt("BEE_MEMTESTER_SIZE_MB", 123); got != 123 {
@@ -237,6 +256,44 @@ func TestResolveROCmSMICommandFromPATH(t *testing.T) {
 	}
 }
 
+func TestResolveSATCommandUsesLookPathForGenericTools(t *testing.T) {
+	oldLookPath := satLookPath
+	satLookPath = func(file string) (string, error) {
+		if file == "stress-ng" {
+			return "/usr/bin/stress-ng", nil
+		}
+		return "", exec.ErrNotFound
+	}
+	t.Cleanup(func() { satLookPath = oldLookPath })
+
+	cmd, err := resolveSATCommand([]string{"stress-ng", "--cpu", "0"})
+	if err != nil {
+		t.Fatalf("resolveSATCommand error: %v", err)
+	}
+	if len(cmd) != 3 {
+		t.Fatalf("cmd len=%d want 3 (%v)", len(cmd), cmd)
+	}
+	if cmd[0] != "/usr/bin/stress-ng" {
+		t.Fatalf("cmd[0]=%q want /usr/bin/stress-ng", cmd[0])
+	}
+}
+
+func TestResolveSATCommandFailsForMissingGenericTool(t *testing.T) {
+	oldLookPath := satLookPath
+	satLookPath = func(file string) (string, error) {
+		return "", exec.ErrNotFound
+	}
+	t.Cleanup(func() { satLookPath = oldLookPath })
+
+	_, err := resolveSATCommand([]string{"stress-ng", "--cpu", "0"})
+	if err == nil {
+		t.Fatal("expected error")
+	}
+	if !strings.Contains(err.Error(), "stress-ng not found in PATH") {
+		t.Fatalf("error=%q", err)
+	}
+}
+
 func TestResolveROCmSMICommandFallsBackToROCmTree(t *testing.T) {
 	tmp := t.TempDir()
 	execPath := filepath.Join(tmp, "opt", "rocm", "bin", "rocm-smi")

audit/internal/webui/api.go

@@ -2,11 +2,12 @@ package webui
 
 import (
 	"bufio"
-	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
+	"os"
 	"os/exec"
 	"path/filepath"
 	"regexp"
@@ -85,15 +86,16 @@ func streamJob(w http.ResponseWriter, r *http.Request, j *jobState) {
 	}
 }
 
-// runCmdJob runs an exec.Cmd as a background job, streaming stdout+stderr lines.
-func runCmdJob(j *jobState, cmd *exec.Cmd) {
+// streamCmdJob runs an exec.Cmd and streams stdout+stderr lines into j.
+func streamCmdJob(j *jobState, cmd *exec.Cmd) error {
 	pr, pw := io.Pipe()
 	cmd.Stdout = pw
 	cmd.Stderr = pw
 
 	if err := cmd.Start(); err != nil {
-		j.finish(err.Error())
-		return
+		_ = pw.Close()
+		_ = pr.Close()
+		return err
 	}
 	// Lower the CPU scheduling priority of stress/audit subprocesses to nice+10
 	// so the X server and kernel interrupt handling remain responsive under load
@@ -102,8 +104,10 @@ func runCmdJob(j *jobState, cmd *exec.Cmd) {
 		_ = syscall.Setpriority(syscall.PRIO_PROCESS, cmd.Process.Pid, 10)
 	}
 
+	scanDone := make(chan error, 1)
 	go func() {
 		scanner := bufio.NewScanner(pr)
+		scanner.Buffer(make([]byte, 0, 64*1024), 1024*1024)
 		for scanner.Scan() {
 			// Split on \r to handle progress-bar style output (e.g. \r overwrites)
 			// and strip ANSI escape codes so logs are readable in the browser.
@@ -115,15 +119,21 @@ func runCmdJob(j *jobState, cmd *exec.Cmd) {
 				}
 			}
 		}
+		if err := scanner.Err(); err != nil && !errors.Is(err, io.ErrClosedPipe) {
+			scanDone <- err
+			return
+		}
+		scanDone <- nil
 	}()
 
 	err := cmd.Wait()
 	_ = pw.Close()
+	scanErr := <-scanDone
+	_ = pr.Close()
 	if err != nil {
-		j.finish(err.Error())
-	} else {
-		j.finish("")
+		return err
 	}
+	return scanErr
 }
 
 // ── Audit ─────────────────────────────────────────────────────────────────────
@@ -171,27 +181,23 @@ func (h *handler) handleAPISATRun(target string) http.HandlerFunc {
 		}
 
 		var body struct {
-			Duration          int    `json:"duration"`
-			DiagLevel         int    `json:"diag_level"`
-			GPUIndices        []int  `json:"gpu_indices"`
-			ExcludeGPUIndices []int  `json:"exclude_gpu_indices"`
-			Loader            string `json:"loader"`
-			Profile           string `json:"profile"`
-			DisplayName       string `json:"display_name"`
+			Duration           int      `json:"duration"`
+			DiagLevel          int      `json:"diag_level"`
+			GPUIndices         []int    `json:"gpu_indices"`
+			ExcludeGPUIndices  []int    `json:"exclude_gpu_indices"`
+			Loader             string   `json:"loader"`
+			Profile            string   `json:"profile"`
+			DisplayName        string   `json:"display_name"`
+			PlatformComponents []string `json:"platform_components"`
 		}
-		if r.ContentLength > 0 {
-			_ = json.NewDecoder(r.Body).Decode(&body)
-		}
-
-		name := taskNames[target]
-		if body.Profile != "" {
-			if n, ok := burnNames[target]; ok {
-				name = n
+		if r.Body != nil {
+			if err := json.NewDecoder(r.Body).Decode(&body); err != nil && !errors.Is(err, io.EOF) {
+				writeError(w, http.StatusBadRequest, "invalid request body")
+				return
 			}
 		}
-		if name == "" {
-			name = target
-		}
+
+		name := taskDisplayName(target, body.Profile, body.Loader)
 		t := &Task{
 			ID:        newJobID("sat-" + target),
 			Name:      name,
@@ -199,13 +205,14 @@ func (h *handler) handleAPISATRun(target string) http.HandlerFunc {
 			Status:    TaskPending,
 			CreatedAt: time.Now(),
 			params: taskParams{
-				Duration:          body.Duration,
-				DiagLevel:         body.DiagLevel,
-				GPUIndices:        body.GPUIndices,
-				ExcludeGPUIndices: body.ExcludeGPUIndices,
-				Loader:            body.Loader,
-				BurnProfile:       body.Profile,
-				DisplayName:       body.DisplayName,
+				Duration:           body.Duration,
+				DiagLevel:          body.DiagLevel,
+				GPUIndices:         body.GPUIndices,
+				ExcludeGPUIndices:  body.ExcludeGPUIndices,
+				Loader:             body.Loader,
+				BurnProfile:        body.Profile,
+				DisplayName:        body.DisplayName,
+				PlatformComponents: body.PlatformComponents,
 			},
 		}
 		if strings.TrimSpace(body.DisplayName) != "" {
@@ -420,15 +427,23 @@ func (h *handler) handleAPIExportList(w http.ResponseWriter, r *http.Request) {
 }
 
 func (h *handler) handleAPIExportBundle(w http.ResponseWriter, r *http.Request) {
-	archive, err := app.BuildSupportBundle(h.opts.ExportDir)
-	if err != nil {
-		writeError(w, http.StatusInternalServerError, err.Error())
+	if globalQueue.hasActiveTarget("support-bundle") {
+		writeError(w, http.StatusConflict, "support bundle task is already pending or running")
 		return
 	}
+	t := &Task{
+		ID:        newJobID("support-bundle"),
+		Name:      "Support Bundle",
+		Target:    "support-bundle",
+		Status:    TaskPending,
+		CreatedAt: time.Now(),
+	}
+	globalQueue.enqueue(t)
 	writeJSON(w, map[string]string{
-		"status": "ok",
-		"path":   archive,
-		"url":    "/export/support.tar.gz",
+		"status":  "queued",
+		"task_id": t.ID,
+		"job_id":  t.ID,
+		"url":     "/export/support.tar.gz",
 	})
 }
 
@@ -499,6 +514,26 @@ func (h *handler) handleAPIGPUPresence(w http.ResponseWriter, r *http.Request) {
 	})
 }
 
+// ── GPU tools ─────────────────────────────────────────────────────────────────
+
+func (h *handler) handleAPIGPUTools(w http.ResponseWriter, _ *http.Request) {
+	type toolEntry struct {
+		ID        string `json:"id"`
+		Available bool   `json:"available"`
+		Vendor    string `json:"vendor"` // "nvidia" | "amd"
+	}
+	_, nvidiaErr := os.Stat("/dev/nvidia0")
+	_, amdErr := os.Stat("/dev/kfd")
+	nvidiaUp := nvidiaErr == nil
+	amdUp := amdErr == nil
+	writeJSON(w, []toolEntry{
+		{ID: "bee-gpu-burn", Available: nvidiaUp, Vendor: "nvidia"},
+		{ID: "john", Available: nvidiaUp, Vendor: "nvidia"},
+		{ID: "nccl", Available: nvidiaUp, Vendor: "nvidia"},
+		{ID: "rvs", Available: amdUp, Vendor: "amd"},
+	})
+}
+
 // ── System ────────────────────────────────────────────────────────────────────
 
 func (h *handler) handleAPIRAMStatus(w http.ResponseWriter, r *http.Request) {
@@ -516,10 +551,7 @@ func (h *handler) handleAPIInstallToRAM(w http.ResponseWriter, r *http.Request)
 		writeError(w, http.StatusServiceUnavailable, "app not configured")
 		return
 	}
-	h.installMu.Lock()
-	installRunning := h.installJob != nil && !h.installJob.isDone()
-	h.installMu.Unlock()
-	if installRunning {
+	if globalQueue.hasActiveTarget("install") {
 		writeError(w, http.StatusConflict, "install to disk is already running")
 		return
 	}
@@ -634,39 +666,43 @@ func (h *handler) handleAPIInstallRun(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusConflict, "install to RAM task is already pending or running")
 		return
 	}
-
-	h.installMu.Lock()
-	if h.installJob != nil && !h.installJob.isDone() {
-		h.installMu.Unlock()
-		writeError(w, http.StatusConflict, "install already running")
+	if globalQueue.hasActiveTarget("install") {
+		writeError(w, http.StatusConflict, "install task is already pending or running")
 		return
 	}
-	j := &jobState{}
-	h.installJob = j
-	h.installMu.Unlock()
-
-	logFile := platform.InstallLogPath(req.Device)
-	go runCmdJob(j, exec.CommandContext(context.Background(), "bee-install", req.Device, logFile))
-
-	w.WriteHeader(http.StatusNoContent)
-}
-
-func (h *handler) handleAPIInstallStream(w http.ResponseWriter, r *http.Request) {
-	h.installMu.Lock()
-	j := h.installJob
-	h.installMu.Unlock()
-	if j == nil {
-		if !sseStart(w) {
-			return
-		}
-		sseWrite(w, "done", "")
-		return
+	t := &Task{
+		ID:        newJobID("install"),
+		Name:      "Install to Disk",
+		Target:    "install",
+		Priority:  20,
+		Status:    TaskPending,
+		CreatedAt: time.Now(),
+		params: taskParams{
+			Device: req.Device,
+		},
 	}
-	streamJob(w, r, j)
+	globalQueue.enqueue(t)
+	writeJSON(w, map[string]string{"task_id": t.ID, "job_id": t.ID})
 }
 
 // ── Metrics SSE ───────────────────────────────────────────────────────────────
 
+func (h *handler) handleAPIMetricsLatest(w http.ResponseWriter, r *http.Request) {
+	sample, ok := h.latestMetric()
+	if !ok {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte("{}"))
+		return
+	}
+	b, err := json.Marshal(sample)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	_, _ = w.Write(b)
+}
+
 func (h *handler) handleAPIMetricsStream(w http.ResponseWriter, r *http.Request) {
 	if !sseStart(w) {
 		return
@@ -917,8 +953,31 @@ func parseXrandrOutput(out string) []displayInfo {
 	return infos
 }
 
+func xrandrCommand(args ...string) *exec.Cmd {
+	cmd := exec.Command("xrandr", args...)
+	env := append([]string{}, os.Environ()...)
+	hasDisplay := false
+	hasXAuthority := false
+	for _, kv := range env {
+		if strings.HasPrefix(kv, "DISPLAY=") && strings.TrimPrefix(kv, "DISPLAY=") != "" {
+			hasDisplay = true
+		}
+		if strings.HasPrefix(kv, "XAUTHORITY=") && strings.TrimPrefix(kv, "XAUTHORITY=") != "" {
+			hasXAuthority = true
+		}
+	}
+	if !hasDisplay {
+		env = append(env, "DISPLAY=:0")
+	}
+	if !hasXAuthority {
+		env = append(env, "XAUTHORITY=/home/bee/.Xauthority")
+	}
+	cmd.Env = env
+	return cmd
+}
+
 func (h *handler) handleAPIDisplayResolutions(w http.ResponseWriter, _ *http.Request) {
-	out, err := exec.Command("xrandr").Output()
+	out, err := xrandrCommand().Output()
 	if err != nil {
 		writeError(w, http.StatusInternalServerError, "xrandr: "+err.Error())
 		return
@@ -945,7 +1004,7 @@ func (h *handler) handleAPIDisplaySet(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, "invalid output name")
 		return
 	}
-	if out, err := exec.Command("xrandr", "--output", req.Output, "--mode", req.Mode).CombinedOutput(); err != nil {
+	if out, err := xrandrCommand("--output", req.Output, "--mode", req.Mode).CombinedOutput(); err != nil {
 		writeError(w, http.StatusInternalServerError, "xrandr: "+strings.TrimSpace(string(out)))
 		return
 	}

audit/internal/webui/api_test.go

@@ -0,0 +1,102 @@
+package webui
+
+import (
+	"encoding/json"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"bee/audit/internal/app"
+)
+
+func TestXrandrCommandAddsDefaultX11Env(t *testing.T) {
+	t.Setenv("DISPLAY", "")
+	t.Setenv("XAUTHORITY", "")
+
+	cmd := xrandrCommand("--query")
+
+	var hasDisplay bool
+	var hasXAuthority bool
+	for _, kv := range cmd.Env {
+		if kv == "DISPLAY=:0" {
+			hasDisplay = true
+		}
+		if kv == "XAUTHORITY=/home/bee/.Xauthority" {
+			hasXAuthority = true
+		}
+	}
+	if !hasDisplay {
+		t.Fatalf("DISPLAY not injected: %v", cmd.Env)
+	}
+	if !hasXAuthority {
+		t.Fatalf("XAUTHORITY not injected: %v", cmd.Env)
+	}
+}
+
+func TestHandleAPISATRunDecodesBodyWithoutContentLength(t *testing.T) {
+	globalQueue.mu.Lock()
+	originalTasks := globalQueue.tasks
+	globalQueue.tasks = nil
+	globalQueue.mu.Unlock()
+	t.Cleanup(func() {
+		globalQueue.mu.Lock()
+		globalQueue.tasks = originalTasks
+		globalQueue.mu.Unlock()
+	})
+
+	h := &handler{opts: HandlerOptions{App: &app.App{}}}
+	req := httptest.NewRequest("POST", "/api/sat/cpu/run", strings.NewReader(`{"profile":"smoke"}`))
+	req.ContentLength = -1
+	rec := httptest.NewRecorder()
+
+	h.handleAPISATRun("cpu").ServeHTTP(rec, req)
+
+	if rec.Code != 200 {
+		t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	globalQueue.mu.Lock()
+	defer globalQueue.mu.Unlock()
+	if len(globalQueue.tasks) != 1 {
+		t.Fatalf("tasks=%d want 1", len(globalQueue.tasks))
+	}
+	if got := globalQueue.tasks[0].params.BurnProfile; got != "smoke" {
+		t.Fatalf("burn profile=%q want smoke", got)
+	}
+}
+
+func TestHandleAPIExportBundleQueuesTask(t *testing.T) {
+	globalQueue.mu.Lock()
+	originalTasks := globalQueue.tasks
+	globalQueue.tasks = nil
+	globalQueue.mu.Unlock()
+	t.Cleanup(func() {
+		globalQueue.mu.Lock()
+		globalQueue.tasks = originalTasks
+		globalQueue.mu.Unlock()
+	})
+
+	h := &handler{opts: HandlerOptions{ExportDir: t.TempDir()}}
+	req := httptest.NewRequest("POST", "/api/export/bundle", nil)
+	rec := httptest.NewRecorder()
+
+	h.handleAPIExportBundle(rec, req)
+
+	if rec.Code != 200 {
+		t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	var body map[string]string
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if body["task_id"] == "" {
+		t.Fatalf("missing task_id in response: %v", body)
+	}
+	globalQueue.mu.Lock()
+	defer globalQueue.mu.Unlock()
+	if len(globalQueue.tasks) != 1 {
+		t.Fatalf("tasks=%d want 1", len(globalQueue.tasks))
+	}
+	if got := globalQueue.tasks[0].Target; got != "support-bundle" {
+		t.Fatalf("target=%q want support-bundle", got)
+	}
+}

audit/internal/webui/metricsdb.go

@@ -4,6 +4,8 @@ import (
 	"database/sql"
 	"encoding/csv"
 	"io"
+	"os"
+	"path/filepath"
 	"strconv"
 	"time"
 
@@ -20,6 +22,9 @@ type MetricsDB struct {
 
 // openMetricsDB opens (or creates) the metrics database at the given path.
 func openMetricsDB(path string) (*MetricsDB, error) {
+	if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+		return nil, err
+	}
 	db, err := sql.Open("sqlite", path+"?_journal=WAL&_busy_timeout=5000")
 	if err != nil {
 		return nil, err
@@ -132,7 +137,7 @@ func (m *MetricsDB) loadSamples(query string, args ...any) ([]platform.LiveMetri
 	defer rows.Close()
 
 	type sysRow struct {
-		ts          int64
+		ts            int64
 		cpu, mem, pwr float64
 	}
 	var sysRows []sysRow
@@ -156,7 +161,10 @@ func (m *MetricsDB) loadSamples(query string, args ...any) ([]platform.LiveMetri
 	maxTS := sysRows[len(sysRows)-1].ts
 
 	// Load GPU rows in range
-	type gpuKey struct{ ts int64; idx int }
+	type gpuKey struct {
+		ts  int64
+		idx int
+	}
 	gpuData := map[gpuKey]platform.GPUMetricRow{}
 	gRows, err := m.db.Query(
 		`SELECT ts,gpu_index,temp_c,usage_pct,mem_usage_pct,power_w FROM gpu_metrics WHERE ts>=? AND ts<=? ORDER BY ts,gpu_index`,
@@ -174,7 +182,10 @@ func (m *MetricsDB) loadSamples(query string, args ...any) ([]platform.LiveMetri
 	}
 
 	// Load fan rows in range
-	type fanKey struct{ ts int64; name string }
+	type fanKey struct {
+		ts   int64
+		name string
+	}
 	fanData := map[fanKey]float64{}
 	fRows, err := m.db.Query(
 		`SELECT ts,name,rpm FROM fan_metrics WHERE ts>=? AND ts<=?`, minTS, maxTS,
@@ -192,7 +203,10 @@ func (m *MetricsDB) loadSamples(query string, args ...any) ([]platform.LiveMetri
 	}
 
 	// Load temp rows in range
-	type tempKey struct{ ts int64; name string }
+	type tempKey struct {
+		ts   int64
+		name string
+	}
 	tempData := map[tempKey]platform.TempReading{}
 	tRows, err := m.db.Query(
 		`SELECT ts,name,grp,celsius FROM temp_metrics WHERE ts>=? AND ts<=?`, minTS, maxTS,

audit/internal/webui/pages.go

@@ -289,7 +289,7 @@ func renderAudit() string {
 func renderHardwareSummaryCard(opts HandlerOptions) string {
 	data, err := loadSnapshot(opts.AuditPath)
 	if err != nil {
-		return `<div class="card"><div class="card-head">Hardware Summary</div><div class="card-body"><span class="badge badge-unknown">No audit data</span></div></div>`
+		return `<div class="card"><div class="card-head">Hardware Summary</div><div class="card-body"><button class="btn btn-primary" onclick="auditModalRun()">&#9654; Run Audit</button></div></div>`
 	}
 	// Parse just enough fields for the summary banner
 	var snap struct {
@@ -532,16 +532,10 @@ function refreshCharts() {
 }
 setInterval(refreshCharts, 3000);
 
-const es = new EventSource('/api/metrics/stream');
-es.addEventListener('metrics', e => {
-  const d = JSON.parse(e.data);
-
-  // Show/hide Fan RPM card based on data availability
+fetch('/api/metrics/latest').then(r => r.json()).then(d => {
   const fanCard = document.getElementById('card-server-fans');
   if (fanCard) fanCard.style.display = (d.fans && d.fans.length > 0) ? '' : 'none';
-
-});
-es.onerror = () => {};
+}).catch(() => {});
 </script>`
 }
 
@@ -663,96 +657,210 @@ func renderSATCard(id, label, extra string) string {
 func renderBurn() string {
 	return `<div class="alert alert-warn" style="margin-bottom:16px"><strong>&#9888; Warning:</strong> Stress tests on this page run hardware at maximum load. Repeated or prolonged use may reduce hardware lifespan (storage endurance, GPU wear). Use only when necessary.</div>
 <p style="color:var(--muted);font-size:13px;margin-bottom:16px">Tasks continue in the background — view progress in <a href="/tasks">Tasks</a>.</p>
-<div class="card"><div class="card-head">Burn Profile</div><div class="card-body">
-<div class="form-row" style="max-width:320px"><label>Preset</label><select id="burn-profile"><option value="smoke" selected>Smoke: quick check (~5 min CPU / DCGM level 1)</option><option value="acceptance">Acceptance: 1 hour (DCGM level 3)</option><option value="overnight">Overnight: 8 hours (DCGM level 4)</option></select></div>
-<p style="color:var(--muted);font-size:12px">Applied to all tests on this page. NVIDIA SAT on the Validate page still uses DCGM. NVIDIA GPU Stress on this page uses the selected stress loader for the preset duration.</p>
-</div></div>
-<div class="grid3">
-<div class="card"><div class="card-head">NVIDIA GPU Stress</div><div class="card-body">
-<div class="form-row"><label>Load Tool</label><select id="nvidia-stress-loader"><option value="builtin" selected>bee-gpu-burn</option><option value="nccl">NCCL all_reduce_perf</option><option value="john">John the Ripper jumbo (OpenCL)</option></select></div>
-<div class="form-row"><label>Exclude GPU indices</label><input type="text" id="nvidia-stress-exclude" placeholder="e.g. 1,3"></div>
-<p style="color:var(--muted);font-size:12px;margin-bottom:8px"><code>bee-gpu-burn</code> runs on all detected NVIDIA GPUs by default. <code>NCCL all_reduce_perf</code> is useful for multi-GPU / interconnect load. Use exclusions only when one or more cards must be skipped.</p>
-<button id="sat-btn-nvidia-stress" class="btn btn-primary" onclick="runBurnIn('nvidia-stress')">&#9654; Start NVIDIA Stress</button>
-</div></div>
-<div class="card"><div class="card-head">CPU Stress</div><div class="card-body">
-<button class="btn btn-primary" onclick="runBurnIn('cpu')">&#9654; Start CPU Stress</button>
-</div></div>
-<div class="card"><div class="card-head">AMD GPU Stress</div><div class="card-body">
-<p style="color:var(--muted);font-size:12px;margin-bottom:8px">Runs ROCm compute stress together with VRAM copy/load activity via RVS GST and records a separate <code>rocm-bandwidth-test</code> snapshot. Missing tools reported as UNSUPPORTED.</p>
-<button id="sat-btn-amd-stress" class="btn btn-primary" onclick="runBurnIn('amd-stress')">&#9654; Start AMD Stress</button>
-</div></div>
-<div class="card"><div class="card-head">Memory Stress</div><div class="card-body">
-<p style="color:var(--muted);font-size:12px;margin-bottom:8px">stress-ng --vm writes and verifies memory patterns across all of RAM. Env: <code>BEE_VM_STRESS_SECONDS</code> (default 300), <code>BEE_VM_STRESS_SIZE_MB</code> (default 80%).</p>
-<button class="btn btn-primary" onclick="runBurnIn('memory-stress')">&#9654; Start Memory Stress</button>
-</div></div>
-<div class="card"><div class="card-head">SAT Stress (stressapptest)</div><div class="card-body">
-<p style="color:var(--muted);font-size:12px;margin-bottom:8px">Google stressapptest saturates CPU, memory and cache buses simultaneously. Env: <code>BEE_SAT_STRESS_SECONDS</code> (default 300), <code>BEE_SAT_STRESS_MB</code> (default auto).</p>
-<button class="btn btn-primary" onclick="runBurnIn('sat-stress')">&#9654; Start SAT Stress</button>
-</div></div>
-<div class="card"><div class="card-head">Platform Thermal Cycling</div><div class="card-body">
-<p style="color:var(--muted);font-size:12px;margin-bottom:8px">Runs CPU + GPU stress simultaneously across multiple load/idle cycles with varying durations. Detects cooling systems that fail to recover under repeated load cycles. Smoke: 2 cycles ~5 min. Acceptance: 4 cycles ~25 min.</p>
-<button class="btn btn-primary" onclick="runBurnIn('platform-stress')">&#9654; Start Thermal Cycling</button>
-</div></div>
+
+<div class="card" style="margin-bottom:16px">
+  <div class="card-head">Burn Profile</div>
+  <div class="card-body" style="display:flex;align-items:center;gap:16px;flex-wrap:wrap">
+    <div class="form-row" style="margin:0;max-width:380px"><label>Preset</label><select id="burn-profile">
+      <option value="smoke" selected>Smoke — quick check (~5 min)</option>
+      <option value="acceptance">Acceptance — 1 hour</option>
+      <option value="overnight">Overnight — 8 hours</option>
+    </select></div>
+    <button class="btn btn-primary" onclick="runAll()">&#9654; Run All</button>
+    <span id="burn-all-status" style="font-size:12px;color:var(--muted)"></span>
+  </div>
 </div>
+
+<div class="grid3" style="margin-bottom:16px">
+
+<div class="card">
+  <div class="card-head">GPU Stress</div>
+  <div class="card-body">
+    <p style="font-size:12px;color:var(--muted);margin:0 0 10px">Tests run on all GPUs in the system. Availability determined by driver status.</p>
+    <div id="gpu-tools-list">
+      <label class="cb-row"><input type="checkbox" id="burn-gpu-bee" value="bee-gpu-burn" disabled><span>bee-gpu-burn <span class="cb-note" id="note-bee"></span></span></label>
+      <label class="cb-row"><input type="checkbox" id="burn-gpu-john" value="john" disabled><span>John the Ripper (OpenCL) <span class="cb-note" id="note-john"></span></span></label>
+      <label class="cb-row"><input type="checkbox" id="burn-gpu-nccl" value="nccl" disabled><span>NCCL all_reduce_perf <span class="cb-note" id="note-nccl"></span></span></label>
+      <label class="cb-row"><input type="checkbox" id="burn-gpu-rvs" value="rvs" disabled><span>RVS GST (AMD) <span class="cb-note" id="note-rvs"></span></span></label>
+    </div>
+    <button class="btn btn-primary" style="margin-top:10px" onclick="runGPUStress()">&#9654; Run GPU Stress</button>
+  </div>
+</div>
+
+<div class="card">
+  <div class="card-head">Compute Stress</div>
+  <div class="card-body">
+    <p style="font-size:12px;color:var(--muted);margin:0 0 10px">Select which subsystems to stress. Each checked item runs as a separate task.</p>
+    <label class="cb-row"><input type="checkbox" id="burn-cpu" checked><span>CPU stress (stress-ng)</span></label>
+    <label class="cb-row"><input type="checkbox" id="burn-mem-stress" checked><span>Memory stress (stress-ng --vm)</span></label>
+    <label class="cb-row"><input type="checkbox" id="burn-sat-stress"><span>stressapptest (CPU + memory bus)</span></label>
+    <button class="btn btn-primary" style="margin-top:10px" onclick="runComputeStress()">&#9654; Run Compute Stress</button>
+  </div>
+</div>
+
+<div class="card">
+  <div class="card-head">Platform Thermal Cycling</div>
+  <div class="card-body">
+    <p style="font-size:12px;color:var(--muted);margin:0 0 10px">Repeated load+idle cycles. Detects cooling recovery failures and GPU throttle. Smoke: 2×90s. Acceptance: 4×300s.</p>
+    <p style="font-size:12px;font-weight:600;margin:0 0 6px">Load components:</p>
+    <label class="cb-row"><input type="checkbox" id="burn-pt-cpu" checked><span>CPU (stressapptest)</span></label>
+    <label class="cb-row"><input type="checkbox" id="burn-pt-nvidia" disabled><span>NVIDIA GPU <span class="cb-note" id="note-pt-nvidia"></span></span></label>
+    <label class="cb-row"><input type="checkbox" id="burn-pt-amd" disabled><span>AMD GPU <span class="cb-note" id="note-pt-amd"></span></span></label>
+    <button class="btn btn-primary" style="margin-top:10px" onclick="runPlatformStress()">&#9654; Run Thermal Cycling</button>
+  </div>
+</div>
+
+</div>
+
 <div id="bi-output" style="display:none;margin-top:16px" class="card">
   <div class="card-head">Output <span id="bi-title"></span></div>
   <div class="card-body"><div id="bi-terminal" class="terminal"></div></div>
 </div>
+
+<style>
+.cb-row { display:flex; align-items:center; gap:8px; padding:4px 0; cursor:pointer; font-size:13px; }
+.cb-row input[type=checkbox] { width:16px; height:16px; flex-shrink:0; }
+.cb-row input[type=checkbox]:disabled { opacity:0.4; cursor:not-allowed; }
+.cb-row input[type=checkbox]:disabled ~ span { opacity:0.45; cursor:not-allowed; }
+.cb-note { font-size:11px; color:var(--muted); font-style:italic; }
+</style>
+
 <script>
 let biES = null;
-function parseGPUIndexList(raw) {
-  return (raw || '')
-    .split(',')
-    .map(v => v.trim())
-    .filter(v => v !== '')
-    .map(v => Number(v))
-    .filter(v => Number.isInteger(v) && v >= 0);
+
+function profile() { return document.getElementById('burn-profile').value || 'smoke'; }
+
+function enqueueTask(target, extra) {
+  const body = Object.assign({ profile: profile() }, extra || {});
+  return fetch('/api/sat/'+target+'/run', {
+    method: 'POST', headers: {'Content-Type':'application/json'}, body: JSON.stringify(body)
+  }).then(r => r.json());
 }
-function runBurnIn(target) {
+
+function streamTask(taskId, label) {
   if (biES) { biES.close(); biES = null; }
-  const body = { profile: document.getElementById('burn-profile').value || 'smoke' };
-  if (target === 'nvidia-stress') {
-    body.loader = document.getElementById('nvidia-stress-loader').value || 'builtin';
-    body.exclude_gpu_indices = parseGPUIndexList(document.getElementById('nvidia-stress-exclude').value);
-  }
-  document.getElementById('bi-output').style.display='block';
-  const loaderLabel = body.loader ? ' / ' + body.loader : '';
-  document.getElementById('bi-title').textContent = '— ' + target + loaderLabel + ' [' + body.profile + ']';
+  document.getElementById('bi-output').style.display = 'block';
+  document.getElementById('bi-title').textContent = '— ' + label + ' [' + profile() + ']';
   const term = document.getElementById('bi-terminal');
-  term.textContent = 'Enqueuing ' + target + ' stress...\n';
-  fetch('/api/sat/'+target+'/run', {method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify(body)})
-    .then(r => r.json())
-    .then(d => {
-      term.textContent += 'Task ' + d.task_id + ' queued.\n';
-      biES = new EventSource('/api/tasks/'+d.task_id+'/stream');
-      biES.onmessage = e => { term.textContent += e.data+'\n'; term.scrollTop=term.scrollHeight; };
-      biES.addEventListener('done', e => { biES.close(); biES=null; term.textContent += (e.data ? '\nERROR: '+e.data : '\nCompleted.')+'\n'; });
-    });
+  term.textContent = 'Task ' + taskId + ' queued. Streaming...\n';
+  biES = new EventSource('/api/tasks/'+taskId+'/stream');
+  biES.onmessage = e => { term.textContent += e.data+'\n'; term.scrollTop = term.scrollHeight; };
+  biES.addEventListener('done', e => {
+    biES.close(); biES = null;
+    term.textContent += (e.data ? '\nERROR: '+e.data : '\nCompleted.')+'\n';
+  });
 }
-</script>
-<script>
-fetch('/api/gpu/presence').then(r=>r.json()).then(gp => {
-    if (!gp.nvidia) disableSATCard('nvidia-stress', 'No NVIDIA GPU detected');
-    if (!gp.amd) disableSATCard('amd-stress', 'No AMD GPU detected');
-});
-function disableSATCard(id, reason) {
-    const btn = document.getElementById('sat-btn-' + id);
-    if (!btn) return;
-    btn.disabled = true;
-    btn.title = reason;
-    btn.style.opacity = '0.4';
-    const card = btn.closest('.card');
-    if (card) {
-        let note = card.querySelector('.sat-unavail');
-        if (!note) {
-            note = document.createElement('p');
-            note.className = 'sat-unavail';
-            note.style.cssText = 'color:var(--muted);font-size:12px;margin-top:6px';
-            btn.parentNode.insertBefore(note, btn.nextSibling);
-        }
-        note.textContent = reason;
+
+function runGPUStress() {
+  const ids = ['burn-gpu-bee','burn-gpu-john','burn-gpu-nccl','burn-gpu-rvs'];
+  const loaderMap = {'burn-gpu-bee':'builtin','burn-gpu-john':'john','burn-gpu-nccl':'nccl','burn-gpu-rvs':'rvs'};
+  const targetMap = {'burn-gpu-bee':'nvidia-stress','burn-gpu-john':'nvidia-stress','burn-gpu-nccl':'nvidia-stress','burn-gpu-rvs':'amd-stress'};
+  let last = null;
+  ids.filter(id => {
+    const el = document.getElementById(id);
+    return el && el.checked && !el.disabled;
+  }).forEach(id => {
+    const target = targetMap[id];
+    const extra = target === 'nvidia-stress' ? {loader: loaderMap[id]} : {};
+    enqueueTask(target, extra).then(d => { last = d; streamTask(d.task_id, target + ' / ' + loaderMap[id]); });
+  });
+}
+
+function runComputeStress() {
+  const tasks = [
+    {id:'burn-cpu', target:'cpu'},
+    {id:'burn-mem-stress', target:'memory-stress'},
+    {id:'burn-sat-stress', target:'sat-stress'},
+  ];
+  let last = null;
+  tasks.filter(t => {
+    const el = document.getElementById(t.id);
+    return el && el.checked;
+  }).forEach(t => {
+    enqueueTask(t.target).then(d => { last = d; streamTask(d.task_id, t.target); });
+  });
+}
+
+function runPlatformStress() {
+  const comps = [];
+  if (document.getElementById('burn-pt-cpu').checked) comps.push('cpu');
+  const nv = document.getElementById('burn-pt-nvidia');
+  if (nv && nv.checked && !nv.disabled) comps.push('gpu');
+  const am = document.getElementById('burn-pt-amd');
+  if (am && am.checked && !am.disabled) comps.push('gpu');
+  const extra = comps.length > 0 ? {platform_components: comps} : {};
+  enqueueTask('platform-stress', extra).then(d => streamTask(d.task_id, 'platform-stress'));
+}
+
+function runAll() {
+  const status = document.getElementById('burn-all-status');
+  status.textContent = 'Enqueuing...';
+  let count = 0;
+  const done = () => { count++; status.textContent = count + ' tasks queued.'; };
+
+  // GPU tests
+  const gpuIds = ['burn-gpu-bee','burn-gpu-john','burn-gpu-nccl','burn-gpu-rvs'];
+  const loaderMap = {'burn-gpu-bee':'builtin','burn-gpu-john':'john','burn-gpu-nccl':'nccl','burn-gpu-rvs':'rvs'};
+  const gpuTargetMap = {'burn-gpu-bee':'nvidia-stress','burn-gpu-john':'nvidia-stress','burn-gpu-nccl':'nvidia-stress','burn-gpu-rvs':'amd-stress'};
+  gpuIds.filter(id => { const el = document.getElementById(id); return el && el.checked && !el.disabled; }).forEach(id => {
+    const target = gpuTargetMap[id];
+    const extra = target === 'nvidia-stress' ? {loader: loaderMap[id]} : {};
+    enqueueTask(target, extra).then(d => { streamTask(d.task_id, target); done(); });
+  });
+
+  // Compute tests
+  [{id:'burn-cpu',target:'cpu'},{id:'burn-mem-stress',target:'memory-stress'},{id:'burn-sat-stress',target:'sat-stress'}]
+    .filter(t => { const el = document.getElementById(t.id); return el && el.checked; })
+    .forEach(t => enqueueTask(t.target).then(d => { streamTask(d.task_id, t.target); done(); }));
+
+  // Platform
+  const comps = [];
+  if (document.getElementById('burn-pt-cpu').checked) comps.push('cpu');
+  const nv = document.getElementById('burn-pt-nvidia');
+  if (nv && nv.checked && !nv.disabled) comps.push('gpu');
+  const am = document.getElementById('burn-pt-amd');
+  if (am && am.checked && !am.disabled) comps.push('gpu');
+  const ptExtra = comps.length > 0 ? {platform_components: comps} : {};
+  enqueueTask('platform-stress', ptExtra).then(d => { streamTask(d.task_id, 'platform-stress'); done(); });
+}
+
+// Load GPU tool availability
+fetch('/api/gpu/tools').then(r => r.json()).then(tools => {
+  const nvidiaMap = {'bee-gpu-burn':'burn-gpu-bee','john':'burn-gpu-john','nccl':'burn-gpu-nccl','rvs':'burn-gpu-rvs'};
+  const noteMap = {'bee-gpu-burn':'note-bee','john':'note-john','nccl':'note-nccl','rvs':'note-rvs'};
+  tools.forEach(t => {
+    const cb = document.getElementById(nvidiaMap[t.id]);
+    const note = document.getElementById(noteMap[t.id]);
+    if (!cb) return;
+    if (t.available) {
+      cb.disabled = false;
+      if (t.id === 'bee-gpu-burn') cb.checked = true;
+    } else {
+      const reason = t.vendor === 'nvidia' ? 'NVIDIA driver not running' : 'AMD driver not running';
+      if (note) note.textContent = '— ' + reason;
     }
-}
+  });
+}).catch(() => {});
+
+// Load GPU presence for platform thermal cycling
+fetch('/api/gpu/presence').then(r => r.json()).then(gp => {
+  const nvCb = document.getElementById('burn-pt-nvidia');
+  const amCb = document.getElementById('burn-pt-amd');
+  const nvNote = document.getElementById('note-pt-nvidia');
+  const amNote = document.getElementById('note-pt-amd');
+  if (gp.nvidia) {
+    nvCb.disabled = false;
+    nvCb.checked = true;
+  } else {
+    if (nvNote) nvNote.textContent = '— NVIDIA driver not running';
+  }
+  if (gp.amd) {
+    amCb.disabled = false;
+    amCb.checked = true;
+  } else {
+    if (amNote) amNote.textContent = '— AMD driver not running';
+  }
+}).catch(() => {});
 </script>`
 }
 
@@ -932,7 +1040,7 @@ func renderExport(exportDir string) string {
 	return `<div class="grid2">
 <div class="card"><div class="card-head">Support Bundle</div><div class="card-body">
 <p style="font-size:13px;color:var(--muted);margin-bottom:12px">Creates a tar.gz archive of all audit files, SAT results, and logs.</p>
-<a class="btn btn-primary" href="/export/support.tar.gz">&#8595; Download Support Bundle</a>
+` + renderSupportBundleInline() + `
 </div></div>
 <div class="card"><div class="card-head">Export Files</div><div class="card-body">
 <table><tr><th>File</th></tr>` + rows.String() + `</table>
@@ -1030,6 +1138,77 @@ func listExportFiles(exportDir string) ([]string, error) {
 	return entries, nil
 }
 
+func renderSupportBundleInline() string {
+	return `<button id="support-bundle-btn" class="btn btn-primary" onclick="supportBundleBuild()">Build Support Bundle</button>
+<a id="support-bundle-download" class="btn btn-secondary" href="/export/support.tar.gz" style="display:none">&#8595; Download Support Bundle</a>
+<div id="support-bundle-status" style="margin-top:12px;font-size:13px;color:var(--muted)">No support bundle built in this session.</div>
+<div id="support-bundle-log" class="terminal" style="display:none;margin-top:12px;max-height:260px"></div>
+<script>
+(function(){
+var _supportBundleES = null;
+window.supportBundleBuild = function() {
+  var btn = document.getElementById('support-bundle-btn');
+  var status = document.getElementById('support-bundle-status');
+  var log = document.getElementById('support-bundle-log');
+  var download = document.getElementById('support-bundle-download');
+  if (_supportBundleES) {
+    _supportBundleES.close();
+    _supportBundleES = null;
+  }
+  btn.disabled = true;
+  btn.textContent = 'Building...';
+  status.textContent = 'Queueing support bundle task...';
+  status.style.color = 'var(--muted)';
+  log.style.display = '';
+  log.textContent = '';
+  download.style.display = 'none';
+
+  fetch('/api/export/bundle', {method:'POST'}).then(function(r){
+    return r.json().then(function(j){
+      if (!r.ok) throw new Error(j.error || r.statusText);
+      return j;
+    });
+  }).then(function(data){
+    if (!data.task_id) throw new Error('missing task id');
+    status.textContent = 'Building support bundle...';
+    _supportBundleES = new EventSource('/api/tasks/' + data.task_id + '/stream');
+    _supportBundleES.onmessage = function(e) {
+      log.textContent += e.data + '\n';
+      log.scrollTop = log.scrollHeight;
+    };
+    _supportBundleES.addEventListener('done', function(e) {
+      _supportBundleES.close();
+      _supportBundleES = null;
+      btn.disabled = false;
+      btn.textContent = 'Build Support Bundle';
+      if (e.data) {
+        status.textContent = 'Error: ' + e.data;
+        status.style.color = 'var(--crit-fg)';
+        return;
+      }
+      status.textContent = 'Support bundle ready.';
+      status.style.color = 'var(--ok-fg)';
+      download.style.display = '';
+    });
+    _supportBundleES.onerror = function() {
+      if (_supportBundleES) _supportBundleES.close();
+      _supportBundleES = null;
+      btn.disabled = false;
+      btn.textContent = 'Build Support Bundle';
+      status.textContent = 'Support bundle stream disconnected.';
+      status.style.color = 'var(--crit-fg)';
+    };
+  }).catch(function(e){
+    btn.disabled = false;
+    btn.textContent = 'Build Support Bundle';
+    status.textContent = 'Error: ' + e;
+    status.style.color = 'var(--crit-fg)';
+  });
+};
+})();
+</script>`
+}
+
 // ── Display Resolution ────────────────────────────────────────────────────────
 
 func renderDisplayInline() string {
@@ -1119,7 +1298,7 @@ function installToRAM() {
 
 <div class="card"><div class="card-head">Support Bundle</div><div class="card-body">
 <p style="font-size:13px;color:var(--muted);margin-bottom:12px">Downloads a tar.gz archive of all audit files, SAT results, and logs.</p>
-<a class="btn btn-primary" href="/export/support.tar.gz">&#8595; Download Support Bundle</a>
+` + renderSupportBundleInline() + `
 </div></div>
 
 <div class="card"><div class="card-head">Tool Check <button class="btn btn-sm btn-secondary" onclick="checkTools()" style="margin-left:auto">&#8635; Check</button></div>
@@ -1298,21 +1477,23 @@ function installStart() {
     headers: {'Content-Type': 'application/json'},
     body: JSON.stringify({device: _installSelected.device})
   }).then(function(r){
-    if (r.status === 204) {
-      installStreamLog();
-    } else {
-      return r.json().then(function(j){ throw new Error(j.error || r.statusText); });
-    }
+    return r.json().then(function(j){
+      if (!r.ok) throw new Error(j.error || r.statusText);
+      return j;
+    });
+  }).then(function(j){
+    if (!j.task_id) throw new Error('missing task id');
+    installStreamLog(j.task_id);
   }).catch(function(e){
     status.textContent = 'Error: ' + e;
     status.style.color = 'var(--crit-fg)';
   });
 }
 
-function installStreamLog() {
+function installStreamLog(taskId) {
   var term = document.getElementById('install-terminal');
   var status = document.getElementById('install-status');
-  var es = new EventSource('/api/install/stream');
+  var es = new EventSource('/api/tasks/' + taskId + '/stream');
   es.onmessage = function(e) {
     term.textContent += e.data + '\n';
     term.scrollTop = term.scrollHeight;

audit/internal/webui/server.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"html"
+	"log/slog"
 	"mime"
 	"net/http"
 	"os"
@@ -143,9 +144,6 @@ type handler struct {
 	latest   *platform.LiveMetricSample
 	// metrics persistence (nil if DB unavailable)
 	metricsDB *MetricsDB
-	// install job (at most one at a time)
-	installJob *jobState
-	installMu  sync.Mutex
 	// pending network change (rollback on timeout)
 	pendingNet   *pendingNetChange
 	pendingNetMu sync.Mutex
@@ -180,7 +178,11 @@ func NewHandler(opts HandlerOptions) http.Handler {
 			if len(samples) > 0 {
 				h.setLatestMetric(samples[len(samples)-1])
 			}
+		} else {
+			slog.Warn("metrics history unavailable", "path", metricsDBPath, "err", err)
 		}
+	} else {
+		slog.Warn("metrics db disabled", "path", metricsDBPath, "err", err)
 	}
 	h.startMetricsCollector()
 
@@ -253,8 +255,9 @@ func NewHandler(opts HandlerOptions) http.Handler {
 	mux.HandleFunc("GET /api/display/resolutions", h.handleAPIDisplayResolutions)
 	mux.HandleFunc("POST /api/display/set", h.handleAPIDisplaySet)
 
-	// GPU presence
+	// GPU presence / tools
 	mux.HandleFunc("GET /api/gpu/presence", h.handleAPIGPUPresence)
+	mux.HandleFunc("GET /api/gpu/tools", h.handleAPIGPUTools)
 
 	// System
 	mux.HandleFunc("GET /api/system/ram-status", h.handleAPIRAMStatus)
@@ -266,10 +269,10 @@ func NewHandler(opts HandlerOptions) http.Handler {
 	// Install
 	mux.HandleFunc("GET /api/install/disks", h.handleAPIInstallDisks)
 	mux.HandleFunc("POST /api/install/run", h.handleAPIInstallRun)
-	mux.HandleFunc("GET /api/install/stream", h.handleAPIInstallStream)
 
 	// Metrics — SSE stream of live sensor data + server-side SVG charts + CSV export
 	mux.HandleFunc("GET /api/metrics/stream", h.handleAPIMetricsStream)
+	mux.HandleFunc("GET /api/metrics/latest", h.handleAPIMetricsLatest)
 	mux.HandleFunc("GET /api/metrics/chart/", h.handleMetricsChartSVG)
 	mux.HandleFunc("GET /api/metrics/export.csv", h.handleAPIMetricsExportCSV)
 
@@ -365,9 +368,13 @@ func (h *handler) handleRuntimeHealthJSON(w http.ResponseWriter, r *http.Request
 }
 
 func (h *handler) handleSupportBundleDownload(w http.ResponseWriter, r *http.Request) {
-	archive, err := app.BuildSupportBundle(h.opts.ExportDir)
+	archive, err := app.LatestSupportBundlePath()
 	if err != nil {
-		http.Error(w, fmt.Sprintf("build support bundle: %v", err), http.StatusInternalServerError)
+		if errors.Is(err, os.ErrNotExist) {
+			http.Error(w, "support bundle not built yet", http.StatusNotFound)
+			return
+		}
+		http.Error(w, fmt.Sprintf("locate support bundle: %v", err), http.StatusInternalServerError)
 		return
 	}
 	w.Header().Set("Cache-Control", "no-store")
@@ -510,6 +517,7 @@ func (h *handler) handleMetricsChartSVG(w http.ResponseWriter, r *http.Request)
 	case path == "server-power":
 		title = "System Power"
 		vPower, l := h.ringPower.snapshot()
+		vPower = normalizePowerSeries(vPower)
 		labels = l
 		datasets = [][]float64{vPower}
 		names = []string{"Power W"}
@@ -722,9 +730,11 @@ func chartDataFromSamples(path string, samples []platform.LiveMetricSample) ([][
 		for i, s := range samples {
 			power[i] = s.PowerW
 		}
+		power = normalizePowerSeries(power)
 		datasets = [][]float64{power}
 		names = []string{"Power W"}
-		yMin, yMax = autoBounds120(power)
+		yMin = floatPtr(0)
+		yMax = autoMax120(power)
 
 	case path == "server-fans":
 		title = "Fan RPM"
@@ -922,6 +932,27 @@ func coalesceDataset(ds []float64, n int) []float64 {
 	return make([]float64, n)
 }
 
+func normalizePowerSeries(ds []float64) []float64 {
+	if len(ds) == 0 {
+		return nil
+	}
+	out := make([]float64, len(ds))
+	copy(out, ds)
+	last := 0.0
+	haveLast := false
+	for i, v := range out {
+		if v > 0 {
+			last = v
+			haveLast = true
+			continue
+		}
+		if haveLast {
+			out[i] = last
+		}
+	}
+	return out
+}
+
 // floatPtr returns a pointer to a float64 value.
 func floatPtr(v float64) *float64 { return &v }
 
@@ -1230,13 +1261,6 @@ probe();
 func (h *handler) handlePage(w http.ResponseWriter, r *http.Request) {
 	page := strings.TrimPrefix(r.URL.Path, "/")
 	if page == "" {
-		// Serve loading page until audit snapshot exists
-		if _, err := os.Stat(h.opts.AuditPath); err != nil {
-			w.Header().Set("Cache-Control", "no-store")
-			w.Header().Set("Content-Type", "text/html; charset=utf-8")
-			_, _ = w.Write([]byte(loadingPageHTML))
-			return
-		}
 		page = "dashboard"
 	}
 	// Redirect old routes to new names

audit/internal/webui/server_test.go

@@ -89,6 +89,19 @@ func TestChartDataFromSamplesUsesFullHistory(t *testing.T) {
 	}
 }
 
+func TestNormalizePowerSeriesHoldsLastPositive(t *testing.T) {
+	got := normalizePowerSeries([]float64{0, 480, 0, 0, 510, 0})
+	want := []float64{0, 480, 480, 480, 510, 510}
+	if len(got) != len(want) {
+		t.Fatalf("len=%d want %d", len(got), len(want))
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("got[%d]=%v want %v", i, got[i], want[i])
+		}
+	}
+}
+
 func TestRootRendersDashboard(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "audit.json")
@@ -136,6 +149,33 @@ func TestRootRendersDashboard(t *testing.T) {
 	}
 }
 
+func TestRootShowsRunAuditButtonWhenSnapshotMissing(t *testing.T) {
+	dir := t.TempDir()
+	exportDir := filepath.Join(dir, "export")
+	if err := os.MkdirAll(exportDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+
+	handler := NewHandler(HandlerOptions{
+		Title:     "Bee Hardware Audit",
+		AuditPath: filepath.Join(dir, "missing-audit.json"),
+		ExportDir: exportDir,
+	})
+
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/", nil))
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status=%d", rec.Code)
+	}
+	body := rec.Body.String()
+	if !strings.Contains(body, `Run Audit`) {
+		t.Fatalf("dashboard missing run audit button: %s", body)
+	}
+	if strings.Contains(body, `No audit data`) {
+		t.Fatalf("dashboard still shows empty audit badge: %s", body)
+	}
+}
+
 func TestAuditPageRendersViewerFrameAndActions(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "audit.json")
@@ -232,6 +272,17 @@ func TestSupportBundleEndpointReturnsArchive(t *testing.T) {
 	if err := os.WriteFile(filepath.Join(exportDir, "bee-audit.log"), []byte("audit log"), 0644); err != nil {
 		t.Fatal(err)
 	}
+	archive, err := os.CreateTemp(os.TempDir(), "bee-support-server-test-*.tar.gz")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = os.Remove(archive.Name()) })
+	if _, err := archive.WriteString("support-bundle"); err != nil {
+		t.Fatal(err)
+	}
+	if err := archive.Close(); err != nil {
+		t.Fatal(err)
+	}
 
 	handler := NewHandler(HandlerOptions{ExportDir: exportDir})
 	rec := httptest.NewRecorder()

audit/internal/webui/tasks.go

@@ -6,8 +6,10 @@ import (
 	"fmt"
 	"net/http"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"sort"
+	"strings"
 	"sync"
 	"time"
 
@@ -39,6 +41,7 @@ var taskNames = map[string]string{
 	"sat-stress":      "SAT Stress (stressapptest)",
 	"platform-stress": "Platform Thermal Cycling",
 	"audit":           "Audit",
+	"support-bundle":  "Support Bundle",
 	"install":         "Install to Disk",
 	"install-to-ram":  "Install to RAM",
 }
@@ -51,6 +54,33 @@ var burnNames = map[string]string{
 	"amd":    "AMD GPU Burn-in",
 }
 
+func nvidiaStressTaskName(loader string) string {
+	switch strings.TrimSpace(strings.ToLower(loader)) {
+	case platform.NvidiaStressLoaderJohn:
+		return "NVIDIA GPU Stress (John/OpenCL)"
+	case platform.NvidiaStressLoaderNCCL:
+		return "NVIDIA GPU Stress (NCCL)"
+	default:
+		return "NVIDIA GPU Stress (bee-gpu-burn)"
+	}
+}
+
+func taskDisplayName(target, profile, loader string) string {
+	name := taskNames[target]
+	if profile != "" {
+		if n, ok := burnNames[target]; ok {
+			name = n
+		}
+	}
+	if target == "nvidia-stress" {
+		name = nvidiaStressTaskName(loader)
+	}
+	if name == "" {
+		name = target
+	}
+	return name
+}
+
 // Task represents one unit of work in the queue.
 type Task struct {
 	ID        string     `json:"id"`
@@ -76,9 +106,10 @@ type taskParams struct {
 	GPUIndices        []int  `json:"gpu_indices,omitempty"`
 	ExcludeGPUIndices []int  `json:"exclude_gpu_indices,omitempty"`
 	Loader            string `json:"loader,omitempty"`
-	BurnProfile       string `json:"burn_profile,omitempty"`
-	DisplayName       string `json:"display_name,omitempty"`
-	Device            string `json:"device,omitempty"` // for install
+	BurnProfile        string   `json:"burn_profile,omitempty"`
+	DisplayName        string   `json:"display_name,omitempty"`
+	Device             string   `json:"device,omitempty"` // for install
+	PlatformComponents []string `json:"platform_components,omitempty"`
 }
 
 type persistedTask struct {
@@ -185,6 +216,10 @@ var (
 	runSATStressPackCtx = func(a *app.App, ctx context.Context, baseDir string, durationSec int, logFunc func(string)) (string, error) {
 		return a.RunSATStressPackCtx(ctx, baseDir, durationSec, logFunc)
 	}
+	buildSupportBundle = app.BuildSupportBundle
+	installCommand     = func(ctx context.Context, device string, logPath string) *exec.Cmd {
+		return exec.CommandContext(ctx, "bee-install", device, logPath)
+	}
 )
 
 // enqueue adds a task to the queue and notifies the worker.
@@ -382,9 +417,9 @@ func setCPUGovernor(governor string) {
 
 // runTask executes the work for a task, writing output to j.
 func (q *taskQueue) runTask(t *Task, j *jobState, ctx context.Context) {
-	if q.opts == nil || q.opts.App == nil {
-		j.append("ERROR: app not configured")
-		j.finish("app not configured")
+	if q.opts == nil {
+		j.append("ERROR: handler options not configured")
+		j.finish("handler options not configured")
 		return
 	}
 	a := q.opts.App
@@ -401,6 +436,10 @@ func (q *taskQueue) runTask(t *Task, j *jobState, ctx context.Context) {
 
 	switch t.Target {
 	case "nvidia":
+		if a == nil {
+			err = fmt.Errorf("app not configured")
+			break
+		}
 		diagLevel := t.params.DiagLevel
 		if t.params.BurnProfile != "" && diagLevel <= 0 {
 			diagLevel = resolveBurnPreset(t.params.BurnProfile).NvidiaDiag
@@ -418,6 +457,10 @@ func (q *taskQueue) runTask(t *Task, j *jobState, ctx context.Context) {
 			archive, err = a.RunNvidiaAcceptancePack("", j.append)
 		}
 	case "nvidia-stress":
+		if a == nil {
+			err = fmt.Errorf("app not configured")
+			break
+		}
 		dur := t.params.Duration
 		if t.params.BurnProfile != "" && dur <= 0 {
 			dur = resolveBurnPreset(t.params.BurnProfile).DurationSec
@@ -429,10 +472,22 @@ func (q *taskQueue) runTask(t *Task, j *jobState, ctx context.Context) {
 			ExcludeGPUIndices: t.params.ExcludeGPUIndices,
 		}, j.append)
 	case "memory":
+		if a == nil {
+			err = fmt.Errorf("app not configured")
+			break
+		}
 		archive, err = runMemoryAcceptancePackCtx(a, ctx, "", j.append)
 	case "storage":
+		if a == nil {
+			err = fmt.Errorf("app not configured")
+			break
+		}
 		archive, err = runStorageAcceptancePackCtx(a, ctx, "", j.append)
 	case "cpu":
+		if a == nil {
+			err = fmt.Errorf("app not configured")
+			break
+		}
 		dur := t.params.Duration
 		if t.params.BurnProfile != "" && dur <= 0 {
 			dur = resolveBurnPreset(t.params.BurnProfile).DurationSec
@@ -440,35 +495,69 @@ func (q *taskQueue) runTask(t *Task, j *jobState, ctx context.Context) {
 		if dur <= 0 {
 			dur = 60
 		}
+		j.append(fmt.Sprintf("CPU stress duration: %ds", dur))
 		archive, err = runCPUAcceptancePackCtx(a, ctx, "", dur, j.append)
 	case "amd":
+		if a == nil {
+			err = fmt.Errorf("app not configured")
+			break
+		}
 		archive, err = runAMDAcceptancePackCtx(a, ctx, "", j.append)
 	case "amd-mem":
+		if a == nil {
+			err = fmt.Errorf("app not configured")
+			break
+		}
 		archive, err = runAMDMemIntegrityPackCtx(a, ctx, "", j.append)
 	case "amd-bandwidth":
+		if a == nil {
+			err = fmt.Errorf("app not configured")
+			break
+		}
 		archive, err = runAMDMemBandwidthPackCtx(a, ctx, "", j.append)
 	case "amd-stress":
+		if a == nil {
+			err = fmt.Errorf("app not configured")
+			break
+		}
 		dur := t.params.Duration
 		if t.params.BurnProfile != "" && dur <= 0 {
 			dur = resolveBurnPreset(t.params.BurnProfile).DurationSec
 		}
 		archive, err = runAMDStressPackCtx(a, ctx, "", dur, j.append)
 	case "memory-stress":
+		if a == nil {
+			err = fmt.Errorf("app not configured")
+			break
+		}
 		dur := t.params.Duration
 		if t.params.BurnProfile != "" && dur <= 0 {
 			dur = resolveBurnPreset(t.params.BurnProfile).DurationSec
 		}
 		archive, err = runMemoryStressPackCtx(a, ctx, "", dur, j.append)
 	case "sat-stress":
+		if a == nil {
+			err = fmt.Errorf("app not configured")
+			break
+		}
 		dur := t.params.Duration
 		if t.params.BurnProfile != "" && dur <= 0 {
 			dur = resolveBurnPreset(t.params.BurnProfile).DurationSec
 		}
 		archive, err = runSATStressPackCtx(a, ctx, "", dur, j.append)
 	case "platform-stress":
+		if a == nil {
+			err = fmt.Errorf("app not configured")
+			break
+		}
 		opts := resolvePlatformStressPreset(t.params.BurnProfile)
+		opts.Components = t.params.PlatformComponents
 		archive, err = a.RunPlatformStress(ctx, "", opts, j.append)
 	case "audit":
+		if a == nil {
+			err = fmt.Errorf("app not configured")
+			break
+		}
 		result, e := a.RunAuditNow(q.opts.RuntimeMode)
 		if e != nil {
 			err = e
@@ -477,7 +566,22 @@ func (q *taskQueue) runTask(t *Task, j *jobState, ctx context.Context) {
 				j.append(line)
 			}
 		}
+	case "support-bundle":
+		j.append("Building support bundle...")
+		archive, err = buildSupportBundle(q.opts.ExportDir)
+	case "install":
+		if strings.TrimSpace(t.params.Device) == "" {
+			err = fmt.Errorf("device is required")
+			break
+		}
+		installLogPath := platform.InstallLogPath(t.params.Device)
+		j.append("Install log: " + installLogPath)
+		err = streamCmdJob(j, installCommand(ctx, t.params.Device, installLogPath))
 	case "install-to-ram":
+		if a == nil {
+			err = fmt.Errorf("app not configured")
+			break
+		}
 		err = a.RunInstallToRAM(ctx, j.append)
 	default:
 		j.append("ERROR: unknown target: " + t.Target)

audit/internal/webui/tasks_test.go

@@ -3,7 +3,9 @@ package webui
 import (
 	"context"
 	"os"
+	"os/exec"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 
@@ -95,9 +97,24 @@ func TestResolveBurnPreset(t *testing.T) {
 	}
 }
 
-func TestRunTaskHonorsCancel(t *testing.T) {
-	t.Parallel()
+func TestTaskDisplayNameUsesNvidiaStressLoader(t *testing.T) {
+	tests := []struct {
+		loader string
+		want   string
+	}{
+		{loader: "", want: "NVIDIA GPU Stress (bee-gpu-burn)"},
+		{loader: "builtin", want: "NVIDIA GPU Stress (bee-gpu-burn)"},
+		{loader: "john", want: "NVIDIA GPU Stress (John/OpenCL)"},
+		{loader: "nccl", want: "NVIDIA GPU Stress (NCCL)"},
+	}
+	for _, tc := range tests {
+		if got := taskDisplayName("nvidia-stress", "acceptance", tc.loader); got != tc.want {
+			t.Fatalf("taskDisplayName(loader=%q)=%q want %q", tc.loader, got, tc.want)
+		}
+	}
+}
 
+func TestRunTaskHonorsCancel(t *testing.T) {
 	blocked := make(chan struct{})
 	released := make(chan struct{})
 	aRun := func(_ any, ctx context.Context, _ string, _ int, _ func(string)) (string, error) {
@@ -154,3 +171,111 @@ func TestRunTaskHonorsCancel(t *testing.T) {
 		t.Fatal("runTask did not return after cancel")
 	}
 }
+
+func TestRunTaskUsesBurnProfileDurationForCPU(t *testing.T) {
+	var gotDuration int
+	q := &taskQueue{
+		opts: &HandlerOptions{App: &app.App{}},
+	}
+	tk := &Task{
+		ID:        "cpu-burn-1",
+		Name:      "CPU Burn-in",
+		Target:    "cpu",
+		Status:    TaskRunning,
+		CreatedAt: time.Now(),
+		params:    taskParams{BurnProfile: "smoke"},
+	}
+	j := &jobState{}
+
+	orig := runCPUAcceptancePackCtx
+	runCPUAcceptancePackCtx = func(_ *app.App, _ context.Context, _ string, durationSec int, _ func(string)) (string, error) {
+		gotDuration = durationSec
+		return "/tmp/cpu-burn.tar.gz", nil
+	}
+	defer func() { runCPUAcceptancePackCtx = orig }()
+
+	q.runTask(tk, j, context.Background())
+
+	if gotDuration != 5*60 {
+		t.Fatalf("duration=%d want %d", gotDuration, 5*60)
+	}
+}
+
+func TestRunTaskBuildsSupportBundleWithoutApp(t *testing.T) {
+	dir := t.TempDir()
+	q := &taskQueue{
+		opts: &HandlerOptions{ExportDir: dir},
+	}
+	tk := &Task{
+		ID:        "support-bundle-1",
+		Name:      "Support Bundle",
+		Target:    "support-bundle",
+		Status:    TaskRunning,
+		CreatedAt: time.Now(),
+	}
+	j := &jobState{}
+
+	var gotExportDir string
+	orig := buildSupportBundle
+	buildSupportBundle = func(exportDir string) (string, error) {
+		gotExportDir = exportDir
+		return filepath.Join(exportDir, "bundle.tar.gz"), nil
+	}
+	defer func() { buildSupportBundle = orig }()
+
+	q.runTask(tk, j, context.Background())
+
+	if gotExportDir != dir {
+		t.Fatalf("exportDir=%q want %q", gotExportDir, dir)
+	}
+	if j.err != "" {
+		t.Fatalf("unexpected error: %q", j.err)
+	}
+	if !strings.Contains(strings.Join(j.lines, "\n"), "Archive: "+filepath.Join(dir, "bundle.tar.gz")) {
+		t.Fatalf("lines=%v", j.lines)
+	}
+}
+
+func TestRunTaskInstallUsesSharedCommandStreaming(t *testing.T) {
+	q := &taskQueue{
+		opts: &HandlerOptions{},
+	}
+	tk := &Task{
+		ID:        "install-1",
+		Name:      "Install to Disk",
+		Target:    "install",
+		Status:    TaskRunning,
+		CreatedAt: time.Now(),
+		params:    taskParams{Device: "/dev/sda"},
+	}
+	j := &jobState{}
+
+	var gotDevice string
+	var gotLogPath string
+	orig := installCommand
+	installCommand = func(ctx context.Context, device string, logPath string) *exec.Cmd {
+		gotDevice = device
+		gotLogPath = logPath
+		return exec.CommandContext(ctx, "sh", "-c", "printf 'line1\nline2\n'")
+	}
+	defer func() { installCommand = orig }()
+
+	q.runTask(tk, j, context.Background())
+
+	if gotDevice != "/dev/sda" {
+		t.Fatalf("device=%q want /dev/sda", gotDevice)
+	}
+	if gotLogPath == "" {
+		t.Fatal("expected install log path")
+	}
+	logs := strings.Join(j.lines, "\n")
+	if !strings.Contains(logs, "Install log: ") {
+		t.Fatalf("missing install log line: %v", j.lines)
+	}
+	if !strings.Contains(logs, "line1") || !strings.Contains(logs, "line2") {
+		t.Fatalf("missing streamed output: %v", j.lines)
+	}
+	if j.err != "" {
+		t.Fatalf("unexpected error: %q", j.err)
+	}
+}

bible-local/architecture/runtime-flows.md

@@ -60,6 +60,8 @@ Rules:
 - Chromium opens `http://localhost/` — the full interactive web UI
 - SSH is independent from the desktop path
 - serial console support is enabled for VM boot debugging
+- Default boot keeps the server-safe graphics path (`nomodeset` + forced `fbdev`) for IPMI/BMC consoles
+- Higher-resolution mode selection is expected only when booting through an explicit `bee.display=kms` menu entry, which disables the forced `fbdev` Xorg config before `lightdm`
 
 ## ISO build sequence
 

bible-local/decisions/2026-04-01-memtest-build-strategy.md

@@ -0,0 +1,146 @@
+# Decision: Treat memtest as explicit ISO content, not as trusted live-build magic
+
+**Date:** 2026-04-01
+**Status:** active
+
+## Context
+
+We have already iterated on `memtest` multiple times and kept cycling between the same ideas.
+The commit history shows several distinct attempts:
+
+- `f91bce8` — fixed Bookworm memtest file names to `memtest86+x64.bin` / `memtest86+x64.efi`
+- `5857805` — added a binary hook to copy memtest files from the build tree into the ISO root
+- `f96b149` — added fallback extraction from the cached `.deb` when `chroot/boot/` stayed empty
+- `d43a9ae` — removed the custom hook and switched back to live-build built-in memtest integration
+- `60cb8f8` — restored explicit memtest menu entries and added ISO validation
+- `3dbc218` / `3869788` — added archived build logs and better memtest diagnostics
+
+Current evidence from the archived `easy-bee-nvidia-v3.14-amd64` logs dated 2026-04-01:
+
+- `lb binary_memtest` does run and installs `memtest86+`
+- but the final ISO still does **not** contain `boot/memtest86+x64.bin`
+- the final ISO also does **not** contain memtest menu entries in `boot/grub/grub.cfg` or `isolinux/live.cfg`
+
+So the assumption "live-build built-in memtest integration is enough on this stack" is currently false for this project until proven otherwise by a real built ISO.
+
+Additional evidence from the archived `easy-bee-nvidia-v3.17-dirty-amd64` logs dated 2026-04-01:
+
+- the build now completes successfully because memtest is non-blocking by default
+- `lb binary_memtest` still runs and installs `memtest86+`
+- the project-owned hook `config/hooks/normal/9100-memtest.hook.binary` does execute
+- but it executes too early for its current target paths:
+  - `binary/boot/grub/grub.cfg` is still missing at hook time
+  - `binary/isolinux/live.cfg` is still missing at hook time
+  - memtest binaries are also still absent in `binary/boot/`
+- later in the build, live-build does create intermediate bootloader configs with memtest lines in the workdir
+- but the final ISO still lacks memtest binaries and still lacks memtest lines in extracted ISO `boot/grub/grub.cfg` and `isolinux/live.cfg`
+
+So the assumption "the current normal binary hook path is late enough to patch final memtest artifacts" is also false.
+
+Correction after inspecting the real `easy-bee-nvidia-v3.20-5-g76a9100-amd64.iso`
+artifact dated 2026-04-01:
+
+- the final ISO does contain `boot/memtest86+x64.bin`
+- the final ISO does contain `boot/memtest86+x64.efi`
+- the final ISO does contain memtest menu entries in both `boot/grub/grub.cfg`
+  and `isolinux/live.cfg`
+- so `v3.20-5-g76a9100` was **not** another real memtest regression in the
+  shipped ISO
+- the regression was in the build-time validator/debug path in `build.sh`
+
+Root cause of the false alarm:
+
+- `build.sh` treated "ISO reader command exists" as equivalent to "ISO reader
+  successfully listed/extracted members"
+- `iso_list_files` / `iso_extract_file` failures were collapsed into the same
+  observable output as "memtest content missing"
+- this made a reader failure look identical to a missing memtest payload
+- as a result, we re-entered the same memtest investigation loop even though
+  the real ISO was already correct
+
+## Known Failed Attempts
+
+These approaches were already tried and should not be repeated blindly:
+
+1. Built-in live-build memtest only.
+Reason it failed:
+- `lb binary_memtest` runs, but the final ISO still misses memtest binaries and menu entries.
+
+2. Fixing only the memtest file names for Debian Bookworm.
+Reason it failed:
+- correct file names alone do not make the files appear in the final ISO.
+
+3. Copying memtest from `chroot/boot/` into `binary/boot/` via a binary hook.
+Reason it failed:
+- in this stack `chroot/boot/` is often empty for memtest payloads at the relevant time.
+
+4. Fallback extraction from cached `memtest86+` `.deb`.
+Reason it failed:
+- this was explored already and was not enough to stabilize the final ISO path end-to-end.
+
+5. Restoring explicit memtest menu entries in source bootloader templates only.
+Reason it failed:
+- memtest lines in source templates or intermediate workdir configs do not guarantee the final ISO contains them.
+
+6. Patching `binary/boot/grub/grub.cfg` and `binary/isolinux/live.cfg` from the current `config/hooks/normal/9100-memtest.hook.binary`.
+Reason it failed:
+- the hook runs before those files exist, so the hook cannot patch them there.
+
+## What This Means
+
+When revisiting memtest later, start from the constraints above rather than retrying the same patterns:
+
+- do not assume the built-in memtest stage is sufficient
+- do not assume `chroot/boot/` will contain memtest payloads
+- do not assume source bootloader templates are the last writer of final ISO configs
+- do not assume the current normal binary hook timing is late enough for final patching
+
+Any future memtest fix must explicitly identify:
+
+- where the memtest binaries are reliably available at build time
+- which exact build stage writes the final bootloader configs that land in the ISO
+- and a post-build proof from a real ISO, not only from intermediate workdir files
+- whether the ISO inspection step itself succeeded, rather than merely whether
+  the validator printed a memtest warning
+
+## Decision
+
+For `bee`, memtest must be treated as an explicit ISO artifact with explicit post-build validation.
+
+Project rules from now on:
+
+- Do **not** trust `--memtest memtest86+` by itself.
+- A memtest implementation is considered valid only if the produced ISO actually contains:
+  - `boot/memtest86+x64.bin`
+  - `boot/memtest86+x64.efi`
+  - a GRUB menu entry
+  - an isolinux menu entry
+- If live-build built-in integration does not produce those artifacts, use an explicit project-owned mechanism such as:
+  - a binary hook copying files into `binary/boot/`
+  - extraction from the cached `memtest86+` `.deb`
+  - another deterministic build-time copy step
+- Do **not** remove such explicit logic later unless a fresh real ISO build proves that built-in integration alone produces all required files and menu entries.
+
+Current implementation direction:
+
+- keep the live-build memtest stage enabled if it helps package acquisition
+- do not rely on the current early `binary_hooks` timing for final patching
+- prefer a post-`lb build` recovery step in `build.sh` that:
+  - patches the fully materialized `LB_DIR/binary` tree
+  - injects memtest binaries there
+  - ensures final bootloader entries there
+  - reruns late binary stages (`binary_checksums`, `binary_iso`, `binary_zsync`) after the patch
+- also treat ISO validation tooling as part of the critical path:
+  - install a stable ISO reader in the builder image
+  - fail with an explicit reader error if ISO listing/extraction fails
+  - do not treat reader failure as evidence that memtest is missing
+
+## Consequences
+
+- Future memtest changes must begin by reading this ADR and the commits listed above.
+- Future memtest changes must also begin by reading the failed-attempt list above.
+- We should stop re-introducing "prefer built-in live-build memtest" as a default assumption without new evidence.
+- Memtest validation in `build.sh` is not optional; it is the acceptance gate that prevents another silent regression.
+- But validation output is only trustworthy if ISO reading itself succeeded. A
+  "missing memtest" warning without a successful ISO read is not evidence.
+- If we change memtest strategy again, we must update this ADR with the exact build evidence that justified the change.

bible-local/decisions/README.md

@@ -5,3 +5,4 @@ One file per decision, named `YYYY-MM-DD-short-topic.md`.
 | Date | Decision | Status |
 |---|---|---|
 | 2026-03-05 | Use NVIDIA proprietary driver | active |
+| 2026-04-01 | Treat memtest as explicit ISO content | active |

bible-local/docs/iso-build-rules.md

@@ -13,9 +13,50 @@ Use one of:
 
 This applies to:
 - `iso/builder/config/package-lists/*.list.chroot`
-- Any package referenced in `grub.cfg`, hooks, or overlay scripts (e.g. file paths like `/boot/memtest86+x64.bin`)
+- Any package referenced in bootloader configs, hooks, or overlay scripts
 
-## Example of what goes wrong without this
+## Memtest rule
 
-`memtest86+` in Debian bookworm installs `/boot/memtest86+x64.bin`, not `/boot/memtest86+.bin`.
-Guessing the filename caused a broken GRUB entry that only surfaced at boot time, after a full rebuild.
+Do not assume live-build's built-in memtest integration is sufficient for `bee`.
+We already tried that path and regressed again on 2026-04-01: `lb binary_memtest`
+ran, but the final ISO still lacked memtest binaries and menu entries.
+
+For this project, memtest is accepted only when the produced ISO actually
+contains all of the following:
+
+- `boot/memtest86+x64.bin`
+- `boot/memtest86+x64.efi`
+- a memtest entry in `boot/grub/grub.cfg`
+- a memtest entry in `isolinux/live.cfg`
+
+Rules:
+
+- Keep explicit post-build memtest validation in `build.sh`.
+- Treat ISO reader success as a separate prerequisite from memtest content.
+  If the reader cannot list or extract from the ISO, that is a validator
+  failure, not proof that memtest is missing.
+- If built-in integration does not produce the artifacts above, use a
+  deterministic project-owned copy/extract step instead of hoping live-build
+  will "start working".
+- Do not switch back to built-in-only memtest without fresh build evidence from
+  a real ISO.
+- If you reference memtest files manually, verify the exact package file list
+  first for the target Debian release.
+
+Known bad loops for this repository:
+
+- Do not retry built-in-only memtest without new evidence. We already proved
+  that `lb binary_memtest` can run while the final ISO still has no memtest.
+- Do not assume fixing memtest file names is enough. Correct names did not fix
+  the final artifact path.
+- Do not assume `chroot/boot/` contains memtest payloads at the time hooks run.
+- Do not assume source `grub.cfg` / `live.cfg.in` are the final writers of ISO
+  bootloader configs.
+- Do not assume the current `config/hooks/normal/9100-memtest.hook.binary`
+  timing is late enough to patch final `binary/boot/grub/grub.cfg` or
+  `binary/isolinux/live.cfg`; logs from 2026-04-01 showed those files were not
+  present yet when the hook executed.
+- Do not treat a validator warning as ground truth until you have confirmed the
+  ISO reader actually succeeded. On 2026-04-01 we misdiagnosed another memtest
+  regression because the final ISO was correct but the validator produced a
+  false negative.

iso/builder/Dockerfile

@@ -17,6 +17,7 @@ RUN apt-get update -qq && apt-get install -y \
     wget \
     curl \
     tar \
+    libarchive-tools \
     xz-utils \
     rsync \
     build-essential \

iso/builder/auto/config

@@ -29,7 +29,7 @@ lb config noauto \
     --security true \
     --linux-flavours "amd64" \
     --linux-packages "${LB_LINUX_PACKAGES}" \
-    --memtest none \
+    --memtest memtest86+ \
     --iso-volume "EASY_BEE_${BEE_GPU_VENDOR_UPPER:-NVIDIA}" \
     --iso-application "EASY-BEE-${BEE_GPU_VENDOR_UPPER:-NVIDIA}" \
     --bootappend-live "boot=live components video=1920x1080 console=tty0 console=ttyS0,115200n8 loglevel=7 username=bee user-fullname=Bee modprobe.blacklist=nouveau" \

iso/builder/bee-gpu-stress.c

@@ -36,6 +36,7 @@ typedef void *CUstream;
 #define MAX_CUBLAS_PROFILES 5
 #define MIN_PROFILE_BUDGET_BYTES ((size_t)4u * 1024u * 1024u)
 #define MIN_STREAM_BUDGET_BYTES ((size_t)64u * 1024u * 1024u)
+#define STRESS_LAUNCH_DEPTH 8
 
 static const char *ptx_source =
     ".version 6.0\n"
@@ -422,24 +423,31 @@ static int run_ptx_fallback(struct cuda_api *api,
     double deadline = start + (double)seconds;
     while (now_seconds() < deadline) {
         launches_per_wave = 0;
-        for (int lane = 0; lane < stream_count; lane++) {
-            unsigned int blocks = (unsigned int)((words[lane] + threads - 1) / threads);
-            if (!check_rc(api,
-                          "cuLaunchKernel",
-                          api->cuLaunchKernel(kernel,
-                                              blocks,
-                                              1,
-                                              1,
-                                              threads,
-                                              1,
-                                              1,
-                                              0,
-                                              streams[lane],
-                                              params[lane],
-                                              NULL))) {
-                goto fail;
+        for (int depth = 0; depth < STRESS_LAUNCH_DEPTH && now_seconds() < deadline; depth++) {
+            int launched_this_batch = 0;
+            for (int lane = 0; lane < stream_count; lane++) {
+                unsigned int blocks = (unsigned int)((words[lane] + threads - 1) / threads);
+                if (!check_rc(api,
+                              "cuLaunchKernel",
+                              api->cuLaunchKernel(kernel,
+                                                  blocks,
+                                                  1,
+                                                  1,
+                                                  threads,
+                                                  1,
+                                                  1,
+                                                  0,
+                                                  streams[lane],
+                                                  params[lane],
+                                                  NULL))) {
+                    goto fail;
+                }
+                launches_per_wave++;
+                launched_this_batch++;
+            }
+            if (launched_this_batch <= 0) {
+                break;
             }
-            launches_per_wave++;
         }
         if (launches_per_wave <= 0) {
             goto fail;
@@ -460,10 +468,11 @@ static int run_ptx_fallback(struct cuda_api *api,
     report->iterations = iterations;
     snprintf(report->details,
              sizeof(report->details),
-             "fallback_int32=OK requested_mb=%d actual_mb=%d streams=%d per_stream_mb=%zu iterations=%lu\n",
+             "fallback_int32=OK requested_mb=%d actual_mb=%d streams=%d queue_depth=%d per_stream_mb=%zu iterations=%lu\n",
              size_mb,
              report->buffer_mb,
              report->stream_count,
+             STRESS_LAUNCH_DEPTH,
              bytes_per_stream[0] / (1024u * 1024u),
              iterations);
 
@@ -1184,10 +1193,11 @@ static int run_cublaslt_stress(struct cuda_api *cuda,
     report->buffer_mb = (int)(total_budget / (1024u * 1024u));
     append_detail(report->details,
                   sizeof(report->details),
-                  "requested_mb=%d actual_mb=%d streams=%d mp_count=%d per_worker_mb=%zu\n",
+                  "requested_mb=%d actual_mb=%d streams=%d queue_depth=%d mp_count=%d per_worker_mb=%zu\n",
                   size_mb,
                   report->buffer_mb,
                   report->stream_count,
+                  STRESS_LAUNCH_DEPTH,
                   mp_count,
                   per_profile_budget / (1024u * 1024u));
 
@@ -1239,26 +1249,33 @@ static int run_cublaslt_stress(struct cuda_api *cuda,
     double deadline = now_seconds() + (double)seconds;
     while (now_seconds() < deadline) {
         wave_launches = 0;
-        for (int i = 0; i < prepared_count; i++) {
-            if (!prepared[i].ready) {
-                continue;
-            }
-            if (!run_cublas_profile(handle, &cublas, &prepared[i])) {
-                append_detail(report->details,
-                              sizeof(report->details),
-                              "%s=FAILED runtime\n",
-                              prepared[i].desc.name);
-                for (int j = 0; j < prepared_count; j++) {
-                    destroy_profile(&cublas, cuda, &prepared[j]);
+        for (int depth = 0; depth < STRESS_LAUNCH_DEPTH && now_seconds() < deadline; depth++) {
+            int launched_this_batch = 0;
+            for (int i = 0; i < prepared_count; i++) {
+                if (!prepared[i].ready) {
+                    continue;
                 }
-                cublas.cublasLtDestroy(handle);
-                destroy_streams(cuda, streams, stream_count);
-                cuda->cuCtxDestroy(ctx);
-                return 0;
+                if (!run_cublas_profile(handle, &cublas, &prepared[i])) {
+                    append_detail(report->details,
+                                  sizeof(report->details),
+                                  "%s=FAILED runtime\n",
+                                  prepared[i].desc.name);
+                    for (int j = 0; j < prepared_count; j++) {
+                        destroy_profile(&cublas, cuda, &prepared[j]);
+                    }
+                    cublas.cublasLtDestroy(handle);
+                    destroy_streams(cuda, streams, stream_count);
+                    cuda->cuCtxDestroy(ctx);
+                    return 0;
+                }
+                prepared[i].iterations++;
+                report->iterations++;
+                wave_launches++;
+                launched_this_batch++;
+            }
+            if (launched_this_batch <= 0) {
+                break;
             }
-            prepared[i].iterations++;
-            report->iterations++;
-            wave_launches++;
         }
         if (wave_launches <= 0) {
             break;

iso/builder/build-nvidia-module.sh

@@ -46,7 +46,10 @@ CACHE_DIR="${DIST_DIR}/nvidia-${NVIDIA_VERSION}-${KVER}"
 CACHE_ROOT="${BEE_CACHE_DIR:-${DIST_DIR}/cache}"
 DOWNLOAD_CACHE_DIR="${CACHE_ROOT}/nvidia-downloads"
 EXTRACT_CACHE_DIR="${CACHE_ROOT}/nvidia-extract"
+CACHE_LAYOUT_VERSION="2"
+CACHE_LAYOUT_MARKER="${CACHE_DIR}/.cache-layout-v${CACHE_LAYOUT_VERSION}"
 if [ -d "$CACHE_DIR/modules" ] && [ -f "$CACHE_DIR/bin/nvidia-smi" ] \
+        && [ -f "$CACHE_LAYOUT_MARKER" ] \
         && [ "$(ls "$CACHE_DIR/lib/libnvidia-ptxjitcompiler.so."* 2>/dev/null | wc -l)" -gt 0 ]; then
     echo "=== NVIDIA cached, skipping build ==="
     echo "cache: $CACHE_DIR"
@@ -130,24 +133,30 @@ else
     echo "WARNING: no firmware/ dir found in installer (may be needed for Hopper GPUs)"
 fi
 
-# Copy ALL userspace library files.
-# libnvidia-ptxjitcompiler is required by libcuda for PTX JIT compilation
-# (cuModuleLoadDataEx with PTX source) — without it CUDA_ERROR_JIT_COMPILER_NOT_FOUND.
+# Copy NVIDIA userspace libraries broadly instead of whitelisting a few names.
+# Newer driver branches add extra runtime deps (for example OpenCL/compiler side
+# libraries). If we only copy a narrow allowlist, clinfo/John can see nvidia.icd
+# but still fail with "no OpenCL platforms" because one dependent .so is absent.
+copied_libs=0
+for f in $(find "$EXTRACT_DIR" -maxdepth 1 \( -name 'libnvidia*.so.*' -o -name 'libcuda.so.*' \) -type f 2>/dev/null | sort); do
+    cp "$f" "$CACHE_DIR/lib/"
+    copied_libs=$((copied_libs+1))
+done
+
+if [ "$copied_libs" -eq 0 ]; then
+    echo "ERROR: no NVIDIA userspace libraries found in $EXTRACT_DIR"
+    ls "$EXTRACT_DIR/"*.so* 2>/dev/null | head -40 || true
+    exit 1
+fi
+
 for lib in \
     libnvidia-ml \
     libcuda \
     libnvidia-ptxjitcompiler \
-    libnvidia-opencl \
-    libnvidia-compiler \
-    libnvidia-nvvm \
-    libnvidia-fatbinaryloader; do
-    count=0
-    for f in $(find "$EXTRACT_DIR" -maxdepth 1 -name "${lib}.so.*" 2>/dev/null); do
-        cp "$f" "$CACHE_DIR/lib/" && count=$((count+1))
-    done
-    if [ "$count" -eq 0 ]; then
-        echo "ERROR: ${lib}.so.* not found in $EXTRACT_DIR"
-        ls "$EXTRACT_DIR/"*.so* 2>/dev/null | head -20 || true
+    libnvidia-opencl; do
+    if ! ls "$CACHE_DIR/lib/${lib}.so."* >/dev/null 2>&1; then
+        echo "ERROR: required ${lib}.so.* not found in extracted userspace libs"
+        ls "$CACHE_DIR/lib/" | sort >&2 || true
         exit 1
     fi
 done
@@ -156,23 +165,17 @@ done
 ko_count=$(ls "$CACHE_DIR/modules/"*.ko 2>/dev/null | wc -l)
 [ "$ko_count" -gt 0 ] || { echo "ERROR: no .ko files built in $CACHE_DIR/modules/"; exit 1; }
 
-# Create soname symlinks: use [0-9][0-9]* to avoid circular symlink (.so.1 has single digit)
-for lib in \
-    libnvidia-ml \
-    libcuda \
-    libnvidia-ptxjitcompiler \
-    libnvidia-opencl \
-    libnvidia-compiler \
-    libnvidia-nvvm \
-    libnvidia-fatbinaryloader; do
-    versioned=$(ls "$CACHE_DIR/lib/${lib}.so."[0-9][0-9]* 2>/dev/null | head -1)
-    [ -n "$versioned" ] || continue
+# Create soname symlinks for every copied versioned library.
+for versioned in "$CACHE_DIR"/lib/*.so.*; do
+    [ -f "$versioned" ] || continue
     base=$(basename "$versioned")
-    ln -sf "$base" "$CACHE_DIR/lib/${lib}.so.1"
-    ln -sf "${lib}.so.1" "$CACHE_DIR/lib/${lib}.so" 2>/dev/null || true
-    echo "${lib}: .so.1 -> $base"
+    stem=${base%%.so.*}
+    ln -sf "$base" "$CACHE_DIR/lib/${stem}.so.1"
+    ln -sf "${stem}.so.1" "$CACHE_DIR/lib/${stem}.so" 2>/dev/null || true
 done
 
+touch "$CACHE_LAYOUT_MARKER"
+
 echo "=== NVIDIA build complete ==="
 echo "cache: $CACHE_DIR"
 echo "modules: $ko_count .ko files"

iso/builder/build.sh

@@ -38,6 +38,7 @@ export BEE_GPU_VENDOR
 
 . "${BUILDER_DIR}/VERSIONS"
 export PATH="$PATH:/usr/local/go/bin"
+: "${BEE_REQUIRE_MEMTEST:=0}"
 
 # Allow git to read the bind-mounted repo (different UID inside container).
 git config --global safe.directory "${REPO_ROOT}"
@@ -111,8 +112,625 @@ resolve_iso_version() {
     resolve_audit_version
 }
 
+iso_list_files() {
+    iso_path="$1"
+
+    if command -v bsdtar >/dev/null 2>&1; then
+        bsdtar -tf "$iso_path"
+        return $?
+    fi
+
+    if command -v xorriso >/dev/null 2>&1; then
+        xorriso -indev "$iso_path" -find / -type f -print 2>/dev/null | sed 's#^/##'
+        return $?
+    fi
+
+    return 127
+}
+
+iso_extract_file() {
+    iso_path="$1"
+    iso_member="$2"
+
+    if command -v bsdtar >/dev/null 2>&1; then
+        bsdtar -xOf "$iso_path" "$iso_member"
+        return $?
+    fi
+
+    if command -v xorriso >/dev/null 2>&1; then
+        xorriso -osirrox on -indev "$iso_path" -cat "/$iso_member" 2>/dev/null
+        return $?
+    fi
+
+    return 127
+}
+
+iso_read_file_list() {
+    iso_path="$1"
+    out_path="$2"
+
+    iso_list_files "$iso_path" > "$out_path" || return 1
+    [ -s "$out_path" ] || return 1
+    return 0
+}
+
+iso_read_member() {
+    iso_path="$1"
+    iso_member="$2"
+    out_path="$3"
+
+    iso_extract_file "$iso_path" "$iso_member" > "$out_path" || return 1
+    [ -s "$out_path" ] || return 1
+    return 0
+}
+
+require_iso_reader() {
+    command -v bsdtar >/dev/null 2>&1 && return 0
+    command -v xorriso >/dev/null 2>&1 && return 0
+    memtest_fail "ISO reader is required for validation/debug (expected bsdtar or xorriso)" "${1:-}"
+}
+
+dump_memtest_debug() {
+    phase="$1"
+    lb_dir="${2:-}"
+    iso_path="${3:-}"
+    phase_slug="$(printf '%s' "${phase}" | tr ' /' '__')"
+    memtest_log="${LOG_DIR:-}/memtest-${phase_slug}.log"
+
+    (
+        echo "=== memtest debug: ${phase} ==="
+
+        echo "-- auto/config --"
+        if [ -f "${BUILDER_DIR}/auto/config" ]; then
+            grep -n -- '--memtest' "${BUILDER_DIR}/auto/config" || echo "  (no --memtest line found)"
+        else
+            echo "  (missing ${BUILDER_DIR}/auto/config)"
+        fi
+
+        echo "-- source bootloader templates --"
+        for cfg in \
+            "${BUILDER_DIR}/config/bootloaders/grub-pc/grub.cfg" \
+            "${BUILDER_DIR}/config/bootloaders/isolinux/live.cfg.in"; do
+            if [ -f "$cfg" ]; then
+                echo "  file: $cfg"
+                grep -n 'Memory Test\|memtest' "$cfg" || echo "    (no memtest lines)"
+            fi
+        done
+
+        echo "-- source binary hooks --"
+        for hook in \
+            "${BUILDER_DIR}/config/hooks/normal/9100-memtest.hook.binary"; do
+            if [ -f "$hook" ]; then
+                echo "  hook: $hook"
+            else
+                echo "  (missing $hook)"
+            fi
+        done
+
+        if [ -n "$lb_dir" ] && [ -d "$lb_dir" ]; then
+            echo "-- live-build workdir package lists --"
+            for pkg in \
+                "$lb_dir/config/package-lists/bee.list.chroot" \
+                "$lb_dir/config/package-lists/bee-gpu.list.chroot" \
+                "$lb_dir/config/package-lists/bee-nvidia.list.chroot"; do
+                if [ -f "$pkg" ]; then
+                    echo "  file: $pkg"
+                    grep -n 'memtest' "$pkg" || echo "    (no memtest lines)"
+                fi
+            done
+
+            echo "-- live-build chroot/boot --"
+            if [ -d "$lb_dir/chroot/boot" ]; then
+                find "$lb_dir/chroot/boot" -maxdepth 1 -name 'memtest*' -print | sed 's/^/  /' || true
+            else
+                echo "  (missing $lb_dir/chroot/boot)"
+            fi
+
+            echo "-- live-build binary/boot --"
+            if [ -d "$lb_dir/binary/boot" ]; then
+                find "$lb_dir/binary/boot" -maxdepth 1 -name 'memtest*' -print | sed 's/^/  /' || true
+            else
+                echo "  (missing $lb_dir/binary/boot)"
+            fi
+
+            echo "-- live-build binary grub cfg --"
+            if [ -f "$lb_dir/binary/boot/grub/grub.cfg" ]; then
+                grep -n 'Memory Test\|memtest' "$lb_dir/binary/boot/grub/grub.cfg" || echo "  (no memtest lines)"
+            else
+                echo "  (missing $lb_dir/binary/boot/grub/grub.cfg)"
+            fi
+
+            echo "-- live-build binary isolinux cfg --"
+            if [ -f "$lb_dir/binary/isolinux/live.cfg" ]; then
+                grep -n 'Memory Test\|memtest' "$lb_dir/binary/isolinux/live.cfg" || echo "  (no memtest lines)"
+            else
+                echo "  (missing $lb_dir/binary/isolinux/live.cfg)"
+            fi
+
+            echo "-- live-build package cache --"
+            if [ -d "$lb_dir/cache/packages.chroot" ]; then
+                find "$lb_dir/cache/packages.chroot" -maxdepth 1 -name 'memtest86+*.deb' -print | sed 's/^/  /' || true
+            else
+                echo "  (missing $lb_dir/cache/packages.chroot)"
+            fi
+        fi
+
+        if [ -n "$iso_path" ] && [ -f "$iso_path" ]; then
+            iso_files="$(mktemp)"
+            iso_grub_cfg="$(mktemp)"
+            iso_isolinux_cfg="$(mktemp)"
+
+            echo "-- ISO memtest files --"
+            if iso_read_file_list "$iso_path" "$iso_files"; then
+                grep 'memtest' "$iso_files" | sed 's/^/  /' || echo "  (no memtest files in ISO)"
+            else
+                echo "  (failed to list ISO contents)"
+            fi
+
+            echo "-- ISO GRUB memtest lines --"
+            if iso_read_member "$iso_path" boot/grub/grub.cfg "$iso_grub_cfg"; then
+                grep -n 'Memory Test\|memtest' "$iso_grub_cfg" || echo "  (no memtest lines in boot/grub/grub.cfg)"
+            else
+                echo "  (failed to read boot/grub/grub.cfg from ISO)"
+            fi
+
+            echo "-- ISO isolinux memtest lines --"
+            if iso_read_member "$iso_path" isolinux/live.cfg "$iso_isolinux_cfg"; then
+                grep -n 'Memory Test\|memtest' "$iso_isolinux_cfg" || echo "  (no memtest lines in isolinux/live.cfg)"
+            else
+                echo "  (failed to read isolinux/live.cfg from ISO)"
+            fi
+
+            rm -f "$iso_files" "$iso_grub_cfg" "$iso_isolinux_cfg"
+        fi
+
+        echo "=== end memtest debug: ${phase} ==="
+    ) | {
+        if [ -n "${LOG_DIR:-}" ] && [ -d "${LOG_DIR}" ]; then
+            tee "${memtest_log}"
+        else
+            cat
+        fi
+    }
+}
+
+memtest_fail() {
+    msg="$1"
+    iso_path="${2:-}"
+    level="WARNING"
+    if [ "${BEE_REQUIRE_MEMTEST:-0}" = "1" ]; then
+        level="ERROR"
+    fi
+    echo "${level}: ${msg}" >&2
+    dump_memtest_debug "failure" "${LB_DIR:-}" "$iso_path" >&2
+    if [ "${BEE_REQUIRE_MEMTEST:-0}" = "1" ]; then
+        exit 1
+    fi
+    return 0
+}
+
+iso_memtest_present() {
+    iso_path="$1"
+    iso_files="$(mktemp)"
+
+    [ -f "$iso_path" ] || return 1
+
+    if command -v bsdtar >/dev/null 2>&1; then
+        :
+    elif command -v xorriso >/dev/null 2>&1; then
+        :
+    else
+        return 2
+    fi
+
+    iso_read_file_list "$iso_path" "$iso_files" || {
+        rm -f "$iso_files"
+        return 2
+    }
+
+    grep -q '^boot/memtest86+x64\.bin$' "$iso_files" || {
+        rm -f "$iso_files"
+        return 1
+    }
+    grep -q '^boot/memtest86+x64\.efi$' "$iso_files" || {
+        rm -f "$iso_files"
+        return 1
+    }
+
+    grub_cfg="$(mktemp)"
+    isolinux_cfg="$(mktemp)"
+
+    iso_read_member "$iso_path" boot/grub/grub.cfg "$grub_cfg" || {
+        rm -f "$iso_files" "$grub_cfg" "$isolinux_cfg"
+        return 2
+    }
+    iso_read_member "$iso_path" isolinux/live.cfg "$isolinux_cfg" || {
+        rm -f "$iso_files" "$grub_cfg" "$isolinux_cfg"
+        return 2
+    }
+
+    grep -q 'Memory Test (memtest86+)' "$grub_cfg" || {
+        rm -f "$iso_files" "$grub_cfg" "$isolinux_cfg"
+        return 1
+    }
+    grep -q '/boot/memtest86+x64\.efi' "$grub_cfg" || {
+        rm -f "$iso_files" "$grub_cfg" "$isolinux_cfg"
+        return 1
+    }
+    grep -q '/boot/memtest86+x64\.bin' "$grub_cfg" || {
+        rm -f "$iso_files" "$grub_cfg" "$isolinux_cfg"
+        return 1
+    }
+    grep -q 'Memory Test (memtest86+)' "$isolinux_cfg" || {
+        rm -f "$iso_files" "$grub_cfg" "$isolinux_cfg"
+        return 1
+    }
+    grep -q '/boot/memtest86+x64\.bin' "$isolinux_cfg" || {
+        rm -f "$iso_files" "$grub_cfg" "$isolinux_cfg"
+        return 1
+    }
+
+    rm -f "$iso_files" "$grub_cfg" "$isolinux_cfg"
+    return 0
+}
+
+validate_iso_memtest() {
+    iso_path="$1"
+    echo "=== validating memtest in ISO ==="
+
+    [ -f "$iso_path" ] || {
+        memtest_fail "ISO not found for validation: $iso_path" "$iso_path"
+        return 0
+    }
+    require_iso_reader "$iso_path" || return 0
+
+    iso_files="$(mktemp)"
+    iso_read_file_list "$iso_path" "$iso_files" || {
+        memtest_fail "failed to list ISO contents while validating memtest" "$iso_path"
+        rm -f "$iso_files"
+        return 0
+    }
+
+    grep -q '^boot/memtest86+x64\.bin$' "$iso_files" || {
+        memtest_fail "memtest BIOS binary missing in ISO: boot/memtest86+x64.bin" "$iso_path"
+        rm -f "$iso_files"
+        return 0
+    }
+    grep -q '^boot/memtest86+x64\.efi$' "$iso_files" || {
+        memtest_fail "memtest EFI binary missing in ISO: boot/memtest86+x64.efi" "$iso_path"
+        rm -f "$iso_files"
+        return 0
+    }
+
+    grub_cfg="$(mktemp)"
+    isolinux_cfg="$(mktemp)"
+
+    iso_read_member "$iso_path" boot/grub/grub.cfg "$grub_cfg" || {
+        memtest_fail "failed to read boot/grub/grub.cfg from ISO" "$iso_path"
+        rm -f "$iso_files" "$grub_cfg" "$isolinux_cfg"
+        return 0
+    }
+    iso_read_member "$iso_path" isolinux/live.cfg "$isolinux_cfg" || {
+        memtest_fail "failed to read isolinux/live.cfg from ISO" "$iso_path"
+        rm -f "$iso_files" "$grub_cfg" "$isolinux_cfg"
+        return 0
+    }
+
+    grep -q 'Memory Test (memtest86+)' "$grub_cfg" || {
+        memtest_fail "GRUB menu entry for memtest is missing" "$iso_path"
+        rm -f "$iso_files" "$grub_cfg" "$isolinux_cfg"
+        return 0
+    }
+    grep -q '/boot/memtest86+x64\.efi' "$grub_cfg" || {
+        memtest_fail "GRUB memtest EFI path is missing" "$iso_path"
+        rm -f "$iso_files" "$grub_cfg" "$isolinux_cfg"
+        return 0
+    }
+    grep -q '/boot/memtest86+x64\.bin' "$grub_cfg" || {
+        memtest_fail "GRUB memtest BIOS path is missing" "$iso_path"
+        rm -f "$iso_files" "$grub_cfg" "$isolinux_cfg"
+        return 0
+    }
+    grep -q 'Memory Test (memtest86+)' "$isolinux_cfg" || {
+        memtest_fail "isolinux menu entry for memtest is missing" "$iso_path"
+        rm -f "$iso_files" "$grub_cfg" "$isolinux_cfg"
+        return 0
+    }
+    grep -q '/boot/memtest86+x64\.bin' "$isolinux_cfg" || {
+        memtest_fail "isolinux memtest path is missing" "$iso_path"
+        rm -f "$iso_files" "$grub_cfg" "$isolinux_cfg"
+        return 0
+    }
+
+    rm -f "$iso_files" "$grub_cfg" "$isolinux_cfg"
+    echo "=== memtest validation OK ==="
+}
+
+append_memtest_grub_entry() {
+    grub_cfg="$1"
+    [ -f "$grub_cfg" ] || return 1
+    grep -q 'Memory Test (memtest86+)' "$grub_cfg" && return 0
+    grep -q '### BEE MEMTEST ###' "$grub_cfg" && return 0
+
+    cat >> "$grub_cfg" <<'EOF'
+
+### BEE MEMTEST ###
+if [ "${grub_platform}" = "efi" ]; then
+    menuentry "Memory Test (memtest86+)" {
+        chainloader /boot/memtest86+x64.efi
+    }
+else
+    menuentry "Memory Test (memtest86+)" {
+        linux16 /boot/memtest86+x64.bin
+    }
+fi
+### /BEE MEMTEST ###
+EOF
+}
+
+append_memtest_isolinux_entry() {
+    isolinux_cfg="$1"
+    [ -f "$isolinux_cfg" ] || return 1
+    grep -q 'Memory Test (memtest86+)' "$isolinux_cfg" && return 0
+    grep -q '### BEE MEMTEST ###' "$isolinux_cfg" && return 0
+
+    cat >> "$isolinux_cfg" <<'EOF'
+
+# ### BEE MEMTEST ###
+label memtest
+    menu label ^Memory Test (memtest86+)
+    linux /boot/memtest86+x64.bin
+# ### /BEE MEMTEST ###
+EOF
+}
+
+copy_memtest_from_deb() {
+    deb="$1"
+    dst_boot="$2"
+    tmpdir="$(mktemp -d)"
+
+    dpkg-deb -x "$deb" "$tmpdir"
+    for f in memtest86+x64.bin memtest86+x64.efi; do
+        if [ -f "$tmpdir/boot/$f" ]; then
+            cp "$tmpdir/boot/$f" "$dst_boot/$f"
+        fi
+    done
+    rm -rf "$tmpdir"
+}
+
+reset_live_build_stage() {
+    lb_dir="$1"
+    stage="$2"
+
+    for root in \
+        "$lb_dir/.build" \
+        "$lb_dir/.stage" \
+        "$lb_dir/auto"; do
+        [ -d "$root" ] || continue
+        find "$root" -maxdepth 1 \( -name "${stage}" -o -name "${stage}.*" -o -name "*${stage}*" \) -exec rm -rf {} + 2>/dev/null || true
+    done
+}
+
+recover_iso_memtest() {
+    lb_dir="$1"
+    iso_path="$2"
+    binary_boot="$lb_dir/binary/boot"
+    grub_cfg="$lb_dir/binary/boot/grub/grub.cfg"
+    isolinux_cfg="$lb_dir/binary/isolinux/live.cfg"
+
+    echo "=== attempting memtest recovery in binary tree ==="
+
+    mkdir -p "$binary_boot"
+
+    for root in \
+        "$lb_dir/chroot/boot" \
+        "/boot"; do
+        for f in memtest86+x64.bin memtest86+x64.efi; do
+            if [ ! -f "$binary_boot/$f" ] && [ -f "$root/$f" ]; then
+                cp "$root/$f" "$binary_boot/$f"
+                echo "memtest recovery: copied $f from $root"
+            fi
+        done
+    done
+
+    if [ ! -f "$binary_boot/memtest86+x64.bin" ] || [ ! -f "$binary_boot/memtest86+x64.efi" ]; then
+        for dir in \
+            "$lb_dir/cache/packages.binary" \
+            "$lb_dir/cache/packages.chroot" \
+            "$lb_dir/chroot/var/cache/apt/archives" \
+            "${BEE_CACHE_DIR:-${DIST_DIR}/cache}/lb-packages" \
+            "/var/cache/apt/archives"; do
+            [ -d "$dir" ] || continue
+            deb="$(find "$dir" -maxdepth 1 -type f -name 'memtest86+*.deb' 2>/dev/null | head -1)"
+            [ -n "$deb" ] || continue
+            echo "memtest recovery: extracting payload from $deb"
+            copy_memtest_from_deb "$deb" "$binary_boot"
+            break
+        done
+    fi
+
+    if [ ! -f "$binary_boot/memtest86+x64.bin" ] || [ ! -f "$binary_boot/memtest86+x64.efi" ]; then
+        tmpdl="$(mktemp -d)"
+        if (
+            cd "$tmpdl" && apt-get download memtest86+ >/dev/null 2>&1
+        ); then
+            deb="$(find "$tmpdl" -maxdepth 1 -type f -name 'memtest86+*.deb' 2>/dev/null | head -1)"
+            if [ -n "$deb" ]; then
+                echo "memtest recovery: downloaded $deb"
+                copy_memtest_from_deb "$deb" "$binary_boot"
+            fi
+        fi
+        rm -rf "$tmpdl"
+    fi
+
+    if [ -f "$grub_cfg" ]; then
+        append_memtest_grub_entry "$grub_cfg" && echo "memtest recovery: ensured GRUB entry"
+    else
+        echo "memtest recovery: WARNING: missing $grub_cfg"
+    fi
+
+    if [ -f "$isolinux_cfg" ]; then
+        append_memtest_isolinux_entry "$isolinux_cfg" && echo "memtest recovery: ensured isolinux entry"
+    else
+        echo "memtest recovery: WARNING: missing $isolinux_cfg"
+    fi
+
+    reset_live_build_stage "$lb_dir" "binary_checksums"
+    reset_live_build_stage "$lb_dir" "binary_iso"
+    reset_live_build_stage "$lb_dir" "binary_zsync"
+
+    run_optional_step_sh "rebuild live-build checksums after memtest recovery" "91-lb-checksums" "lb binary_checksums 2>&1"
+    run_optional_step_sh "rebuild ISO after memtest recovery" "92-lb-binary-iso" "rm -f '$iso_path' && lb binary_iso 2>&1"
+    run_optional_step_sh "rebuild zsync after memtest recovery" "93-lb-zsync" "lb binary_zsync 2>&1"
+
+    if [ ! -f "$iso_path" ]; then
+        memtest_fail "ISO rebuild was skipped or failed after memtest recovery: $iso_path" "$iso_path"
+    fi
+}
+
 AUDIT_VERSION_EFFECTIVE="$(resolve_audit_version)"
 ISO_VERSION_EFFECTIVE="$(resolve_iso_version)"
+ISO_BASENAME="easy-bee-${BEE_GPU_VENDOR}-v${ISO_VERSION_EFFECTIVE}-amd64"
+LOG_DIR="${DIST_DIR}/${ISO_BASENAME}.logs"
+LOG_ARCHIVE="${DIST_DIR}/${ISO_BASENAME}.logs.tar.gz"
+ISO_OUT="${DIST_DIR}/${ISO_BASENAME}.iso"
+LOG_OUT="${LOG_DIR}/build.log"
+
+cleanup_build_log() {
+    status="${1:-$?}"
+    trap - EXIT INT TERM HUP
+
+    if [ "${STEP_LOG_ACTIVE:-0}" = "1" ]; then
+        cleanup_step_log "${status}" || true
+    fi
+
+    if [ "${BUILD_LOG_ACTIVE:-0}" = "1" ]; then
+        BUILD_LOG_ACTIVE=0
+        exec 1>&3 2>&4
+        exec 3>&- 4>&-
+        if [ -n "${BUILD_TEE_PID:-}" ]; then
+            wait "${BUILD_TEE_PID}" 2>/dev/null || true
+        fi
+        rm -f "${BUILD_LOG_PIPE}"
+    fi
+
+    if [ -n "${LOG_DIR:-}" ] && [ -d "${LOG_DIR}" ] && command -v tar >/dev/null 2>&1; then
+        rm -f "${LOG_ARCHIVE}"
+        tar -czf "${LOG_ARCHIVE}" -C "${DIST_DIR}" "$(basename "${LOG_DIR}")" 2>/dev/null || true
+    fi
+
+    exit "${status}"
+}
+
+start_build_log() {
+    command -v tee >/dev/null 2>&1 || {
+        echo "ERROR: tee is required for build logging" >&2
+        exit 1
+    }
+
+    rm -rf "${LOG_DIR}"
+    rm -f "${LOG_ARCHIVE}"
+    mkdir -p "${LOG_DIR}"
+    BUILD_LOG_PIPE="$(mktemp -u "${TMPDIR:-/tmp}/bee-build-log.XXXXXX")"
+    mkfifo "${BUILD_LOG_PIPE}"
+
+    exec 3>&1 4>&2
+    tee "${LOG_OUT}" < "${BUILD_LOG_PIPE}" &
+    BUILD_TEE_PID=$!
+    exec > "${BUILD_LOG_PIPE}" 2>&1
+    BUILD_LOG_ACTIVE=1
+
+    trap 'cleanup_build_log "$?"' EXIT INT TERM HUP
+
+    echo "=== build log dir: ${LOG_DIR} ==="
+    echo "=== build log: ${LOG_OUT} ==="
+    echo "=== build log archive: ${LOG_ARCHIVE} ==="
+}
+
+cleanup_step_log() {
+    status="${1:-$?}"
+
+    if [ "${STEP_LOG_ACTIVE:-0}" = "1" ]; then
+        STEP_LOG_ACTIVE=0
+        exec 1>&5 2>&6
+        exec 5>&- 6>&-
+        if [ -n "${STEP_TEE_PID:-}" ]; then
+            wait "${STEP_TEE_PID}" 2>/dev/null || true
+        fi
+        rm -f "${STEP_LOG_PIPE}"
+    fi
+
+    return "${status}"
+}
+
+run_step() {
+    step_name="$1"
+    step_slug="$2"
+    shift 2
+
+    step_log="${LOG_DIR}/${step_slug}.log"
+    echo ""
+    echo "=== step: ${step_name} ==="
+    echo "=== step log: ${step_log} ==="
+
+    STEP_LOG_PIPE="$(mktemp -u "${TMPDIR:-/tmp}/bee-step-log.XXXXXX")"
+    mkfifo "${STEP_LOG_PIPE}"
+
+    exec 5>&1 6>&2
+    tee "${step_log}" < "${STEP_LOG_PIPE}" >&5 &
+    STEP_TEE_PID=$!
+    exec > "${STEP_LOG_PIPE}" 2>&1
+    STEP_LOG_ACTIVE=1
+
+    set +e
+    "$@"
+    step_status=$?
+    set -e
+
+    cleanup_step_log "${step_status}"
+    if [ "${step_status}" -ne 0 ]; then
+        echo "ERROR: step failed: ${step_name} (see ${step_log})" >&2
+        exit "${step_status}"
+    fi
+
+    echo "=== step OK: ${step_name} ==="
+}
+
+run_step_sh() {
+    step_name="$1"
+    step_slug="$2"
+    step_script="$3"
+
+    run_step "${step_name}" "${step_slug}" sh -c "${step_script}"
+}
+
+run_optional_step_sh() {
+    step_name="$1"
+    step_slug="$2"
+    step_script="$3"
+
+    if [ "${BEE_REQUIRE_MEMTEST:-0}" = "1" ]; then
+        run_step_sh "${step_name}" "${step_slug}" "${step_script}"
+        return 0
+    fi
+
+    step_log="${LOG_DIR}/${step_slug}.log"
+    echo ""
+    echo "=== optional step: ${step_name} ==="
+    echo "=== optional step log: ${step_log} ==="
+    set +e
+    sh -c "${step_script}" > "${step_log}" 2>&1
+    step_status=$?
+    set -e
+    cat "${step_log}"
+    if [ "${step_status}" -ne 0 ]; then
+        echo "WARNING: optional step failed: ${step_name} (see ${step_log})" >&2
+    else
+        echo "=== optional step OK: ${step_name} ==="
+    fi
+}
+
+start_build_log
 
 # Auto-detect kernel ABI: refresh apt index, then query current linux-image-amd64 dependency.
 # If headers for the detected ABI are not yet installed (kernel updated since image build),
@@ -147,8 +765,8 @@ echo "Debian: ${DEBIAN_VERSION}, Kernel ABI: ${DEBIAN_KERNEL_ABI}, Go: ${GO_VERS
 echo "Audit version: ${AUDIT_VERSION_EFFECTIVE}, ISO version: ${ISO_VERSION_EFFECTIVE}"
 echo ""
 
-echo "=== syncing git submodules ==="
-git -C "${REPO_ROOT}" submodule update --init --recursive
+run_step "sync git submodules" "05-git-submodules" \
+    git -C "${REPO_ROOT}" submodule update --init --recursive
 
 # --- compile bee binary (static, Linux amd64) ---
 # Shared between variants — built once, reused on second pass.
@@ -160,13 +778,13 @@ if [ -f "$BEE_BIN" ]; then
 fi
 
 if [ "$NEED_BUILD" = "1" ]; then
-    echo "=== building bee binary ==="
-    cd "${REPO_ROOT}/audit"
-    GOOS=linux GOARCH=amd64 CGO_ENABLED=0 \
-        go build \
-        -ldflags "-s -w -X main.Version=${AUDIT_VERSION_EFFECTIVE}" \
-        -o "$BEE_BIN" \
-        ./cmd/bee
+    run_step_sh "build bee binary" "10-build-bee" \
+        "cd '${REPO_ROOT}/audit' && \
+        env GOOS=linux GOARCH=amd64 CGO_ENABLED=0 \
+            go build \
+            -ldflags '-s -w -X main.Version=${AUDIT_VERSION_EFFECTIVE}' \
+            -o '${BEE_BIN}' \
+            ./cmd/bee"
     echo "binary: $BEE_BIN"
     if command -v stat >/dev/null 2>&1; then
         BEE_SIZE_BYTES="$(stat -c '%s' "$BEE_BIN" 2>/dev/null || stat -f '%z' "$BEE_BIN")"
@@ -185,9 +803,8 @@ fi
 # --- NVIDIA-only build steps ---
 GPU_BURN_WORKER_BIN="${DIST_DIR}/bee-gpu-burn-worker-linux-amd64"
 if [ "$BEE_GPU_VENDOR" = "nvidia" ]; then
-    echo ""
-    echo "=== downloading cuBLAS/cuBLASLt/cudart ${NCCL_CUDA_VERSION} userspace ==="
-    sh "${BUILDER_DIR}/build-cublas.sh" \
+    run_step "download cuBLAS/cuBLASLt/cudart ${NCCL_CUDA_VERSION} userspace" "20-cublas" \
+        sh "${BUILDER_DIR}/build-cublas.sh" \
         "${CUBLAS_VERSION}" \
         "${CUDA_USERSPACE_VERSION}" \
         "${NCCL_CUDA_VERSION}" \
@@ -201,8 +818,8 @@ if [ "$BEE_GPU_VENDOR" = "nvidia" ]; then
     fi
 
     if [ "$GPU_STRESS_NEED_BUILD" = "1" ]; then
-        echo "=== building bee-gpu-burn worker ==="
-        gcc -O2 -s -Wall -Wextra \
+        run_step "build bee-gpu-burn worker" "21-gpu-burn-worker" \
+            gcc -O2 -s -Wall -Wextra \
             -I"${CUBLAS_CACHE}/include" \
             -o "$GPU_BURN_WORKER_BIN" \
             "${BUILDER_DIR}/bee-gpu-stress.c" \
@@ -245,13 +862,13 @@ rm -f \
     "${OVERLAY_STAGE_DIR}/etc/bee-release" \
     "${OVERLAY_STAGE_DIR}/root/.ssh/authorized_keys" \
     "${OVERLAY_STAGE_DIR}/usr/local/bin/bee" \
-    "${OVERLAY_STAGE_DIR}/usr/local/bin/bee-gpu-stress" \
     "${OVERLAY_STAGE_DIR}/usr/local/bin/bee-nccl-gpu-stress" \
     "${OVERLAY_STAGE_DIR}/usr/local/bin/john" \
     "${OVERLAY_STAGE_DIR}/usr/local/lib/bee/bee-gpu-burn-worker" \
-    "${OVERLAY_STAGE_DIR}/usr/local/lib/bee/john" \
     "${OVERLAY_STAGE_DIR}/usr/local/bin/bee-smoketest" \
     "${OVERLAY_STAGE_DIR}/usr/local/bin/all_reduce_perf"
+rm -rf \
+    "${OVERLAY_STAGE_DIR}/usr/local/lib/bee/john"
 
 # Remove NVIDIA-specific overlay files for non-nvidia variants
 if [ "$BEE_GPU_VENDOR" != "nvidia" ]; then
@@ -304,7 +921,6 @@ if [ "$BEE_GPU_VENDOR" = "nvidia" ] && [ -f "$GPU_BURN_WORKER_BIN" ]; then
     chmod +x "${OVERLAY_STAGE_DIR}/usr/local/bin/bee-gpu-burn" 2>/dev/null || true
     chmod +x "${OVERLAY_STAGE_DIR}/usr/local/bin/bee-john-gpu-stress" 2>/dev/null || true
     chmod +x "${OVERLAY_STAGE_DIR}/usr/local/bin/bee-nccl-gpu-stress" 2>/dev/null || true
-    ln -sfn bee-gpu-burn "${OVERLAY_STAGE_DIR}/usr/local/bin/bee-gpu-stress"
 fi
 
 # --- inject smoketest into overlay so it runs directly on the live CD ---
@@ -324,9 +940,8 @@ done
 
 # --- NVIDIA kernel modules and userspace libs ---
 if [ "$BEE_GPU_VENDOR" = "nvidia" ]; then
-    echo ""
-    echo "=== building NVIDIA ${NVIDIA_DRIVER_VERSION} modules ==="
-    sh "${BUILDER_DIR}/build-nvidia-module.sh" "${NVIDIA_DRIVER_VERSION}" "${DIST_DIR}" "${DEBIAN_KERNEL_ABI}"
+    run_step "build NVIDIA ${NVIDIA_DRIVER_VERSION} modules" "40-nvidia-module" \
+        sh "${BUILDER_DIR}/build-nvidia-module.sh" "${NVIDIA_DRIVER_VERSION}" "${DIST_DIR}" "${DEBIAN_KERNEL_ABI}"
 
     KVER="${DEBIAN_KERNEL_ABI}-amd64"
     NVIDIA_CACHE="${DIST_DIR}/nvidia-${NVIDIA_DRIVER_VERSION}-${KVER}"
@@ -354,9 +969,8 @@ if [ "$BEE_GPU_VENDOR" = "nvidia" ]; then
     fi
 
     # --- build / download NCCL ---
-    echo ""
-    echo "=== downloading NCCL ${NCCL_VERSION}+cuda${NCCL_CUDA_VERSION} ==="
-    sh "${BUILDER_DIR}/build-nccl.sh" "${NCCL_VERSION}" "${NCCL_CUDA_VERSION}" "${DIST_DIR}" "${NCCL_SHA256:-}"
+    run_step "download NCCL ${NCCL_VERSION}+cuda${NCCL_CUDA_VERSION}" "50-nccl" \
+        sh "${BUILDER_DIR}/build-nccl.sh" "${NCCL_VERSION}" "${NCCL_CUDA_VERSION}" "${DIST_DIR}" "${NCCL_SHA256:-}"
 
     NCCL_CACHE="${DIST_DIR}/nccl-${NCCL_VERSION}+cuda${NCCL_CUDA_VERSION}"
 
@@ -369,9 +983,8 @@ if [ "$BEE_GPU_VENDOR" = "nvidia" ]; then
     echo "=== cuBLAS: $(ls "${CUBLAS_CACHE}/lib/" | wc -l) files injected into /usr/lib/ ==="
 
     # --- build nccl-tests ---
-    echo ""
-    echo "=== building nccl-tests ${NCCL_TESTS_VERSION} ==="
-    sh "${BUILDER_DIR}/build-nccl-tests.sh" \
+    run_step "build nccl-tests ${NCCL_TESTS_VERSION}" "60-nccl-tests" \
+        sh "${BUILDER_DIR}/build-nccl-tests.sh" \
         "${NCCL_TESTS_VERSION}" \
         "${NCCL_VERSION}" \
         "${NCCL_CUDA_VERSION}" \
@@ -385,9 +998,8 @@ if [ "$BEE_GPU_VENDOR" = "nvidia" ]; then
     cp "${NCCL_TESTS_CACHE}/lib/"* "${OVERLAY_STAGE_DIR}/usr/lib/" 2>/dev/null || true
     echo "=== all_reduce_perf injected ==="
 
-    echo ""
-    echo "=== building john jumbo ${JOHN_JUMBO_COMMIT} ==="
-    sh "${BUILDER_DIR}/build-john.sh" "${JOHN_JUMBO_COMMIT}" "${DIST_DIR}"
+    run_step "build john jumbo ${JOHN_JUMBO_COMMIT}" "70-john" \
+        sh "${BUILDER_DIR}/build-john.sh" "${JOHN_JUMBO_COMMIT}" "${DIST_DIR}"
     JOHN_CACHE="${DIST_DIR}/john-${JOHN_JUMBO_COMMIT}"
     mkdir -p "${OVERLAY_STAGE_DIR}/usr/local/lib/bee/john"
     rsync -a --delete "${JOHN_CACHE}/run/" "${OVERLAY_STAGE_DIR}/usr/local/lib/bee/john/run/"
@@ -508,9 +1120,10 @@ BEE_GPU_VENDOR_UPPER="$(echo "${BEE_GPU_VENDOR}" | tr 'a-z' 'A-Z')"
 export BEE_GPU_VENDOR_UPPER
 
 cd "${LB_DIR}"
-lb clean 2>&1 | tail -3
-lb config 2>&1 | tail -5
-lb build 2>&1
+run_step_sh "live-build clean" "80-lb-clean" "lb clean 2>&1 | tail -3"
+run_step_sh "live-build config" "81-lb-config" "lb config 2>&1 | tail -5"
+dump_memtest_debug "pre-build" "${LB_DIR}"
+run_step_sh "live-build build" "90-lb-build" "lb build 2>&1"
 
 # --- persist deb package cache back to shared location ---
 # This allows the second variant to reuse all downloaded packages.
@@ -521,8 +1134,17 @@ fi
 
 # live-build outputs live-image-amd64.hybrid.iso in LB_DIR
 ISO_RAW="${LB_DIR}/live-image-amd64.hybrid.iso"
-ISO_OUT="${DIST_DIR}/easy-bee-${BEE_GPU_VENDOR}-v${ISO_VERSION_EFFECTIVE}-amd64.iso"
 if [ -f "$ISO_RAW" ]; then
+    dump_memtest_debug "post-build" "${LB_DIR}" "$ISO_RAW"
+    iso_memtest_present "$ISO_RAW"
+    memtest_status=$?
+    if [ "$memtest_status" -eq 1 ]; then
+        recover_iso_memtest "${LB_DIR}" "$ISO_RAW"
+        dump_memtest_debug "post-recovery" "${LB_DIR}" "$ISO_RAW"
+    elif [ "$memtest_status" -eq 2 ]; then
+        memtest_fail "failed to inspect ISO for memtest before recovery" "$ISO_RAW"
+    fi
+    validate_iso_memtest "$ISO_RAW"
     cp "$ISO_RAW" "$ISO_OUT"
     echo ""
     echo "=== done (${BEE_GPU_VENDOR}) ==="

iso/builder/config/bootloaders/grub-pc/grub.cfg

@@ -14,6 +14,11 @@ menuentry "EASY-BEE" {
     initrd  @INITRD_LIVE@
 }
 
+menuentry "EASY-BEE (graphics/KMS)" {
+    linux   @KERNEL_LIVE@ @APPEND_LIVE@ bee.display=kms bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable nowatchdog nosoftlockup
+    initrd  @INITRD_LIVE@
+}
+
 menuentry "EASY-BEE (load to RAM)" {
     linux   @KERNEL_LIVE@ @APPEND_LIVE@ toram nomodeset bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable nowatchdog nosoftlockup
     initrd  @INITRD_LIVE@
@@ -24,6 +29,11 @@ menuentry "EASY-BEE (NVIDIA GSP=off)" {
     initrd  @INITRD_LIVE@
 }
 
+menuentry "EASY-BEE (graphics/KMS, GSP=off)" {
+    linux   @KERNEL_LIVE@ @APPEND_LIVE@ bee.display=kms bee.nvidia.mode=gsp-off net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable nowatchdog nosoftlockup
+    initrd  @INITRD_LIVE@
+}
+
 menuentry "EASY-BEE (fail-safe)" {
     linux   @KERNEL_LIVE@ @APPEND_LIVE@ bee.nvidia.mode=gsp-off memtest noapic noapm nodma nomce nolapic nosmp vga=normal net.ifnames=0 biosdevname=0
     initrd  @INITRD_LIVE@

iso/builder/config/bootloaders/isolinux/live.cfg.in

@@ -5,6 +5,12 @@ label live-@FLAVOUR@-normal
     initrd @INITRD@
     append @APPEND_LIVE@ bee.nvidia.mode=normal
 
+label live-@FLAVOUR@-kms
+    menu label EASY-BEE (^graphics/KMS)
+    linux @LINUX@
+    initrd @INITRD@
+    append @APPEND_LIVE@ bee.display=kms bee.nvidia.mode=normal
+
 label live-@FLAVOUR@-toram
     menu label EASY-BEE (^load to RAM)
     linux @LINUX@
@@ -17,8 +23,18 @@ label live-@FLAVOUR@-gsp-off
     initrd @INITRD@
     append @APPEND_LIVE@ nomodeset bee.nvidia.mode=gsp-off
 
+label live-@FLAVOUR@-kms-gsp-off
+    menu label EASY-BEE (g^raphics/KMS, GSP=off)
+    linux @LINUX@
+    initrd @INITRD@
+    append @APPEND_LIVE@ bee.display=kms bee.nvidia.mode=gsp-off
+
 label live-@FLAVOUR@-failsafe
     menu label EASY-BEE (^fail-safe)
     linux @LINUX@
     initrd @INITRD@
     append @APPEND_LIVE@ bee.nvidia.mode=gsp-off memtest noapic noapm nodma nomce nolapic nosmp vga=normal
+
+label memtest
+    menu label ^Memory Test (memtest86+)
+    linux /boot/memtest86+x64.bin

iso/builder/config/hooks/normal/9100-memtest.hook.binary

@@ -1,76 +1,139 @@
 #!/bin/sh
-# Copy memtest86+ binaries from chroot /boot into the ISO boot directory
-# so GRUB can chainload them directly (they must be on the ISO filesystem,
-# not inside the squashfs).
-#
-# Primary: copy from chroot/boot/ (populated by package postinst).
-# Naming fallbacks:
-#   Debian Bookworm: /boot/memtest86+       — EFI PE64 (no extension)
-#                    /boot/memtest86+.bin    — legacy binary
-#   Upstream/Ubuntu: /boot/memtest86+x64.efi, /boot/memtest86+x64.bin, etc.
-# Last resort: extract directly from the cached .deb if postinst didn't place
-#              the files (happens in chroot environments without grub triggers).
+# Ensure memtest is present in the final ISO even if live-build's built-in
+# memtest stage does not copy the binaries or expose menu entries.
 set -e
 
-MEMTEST_FILES="memtest86+x64.bin memtest86+x64.efi memtest86+ia32.bin memtest86+ia32.efi"
+: "${BEE_REQUIRE_MEMTEST:=0}"
 
-# Ensure destination directory exists (absence caused silent copy failures).
-mkdir -p binary/boot
+MEMTEST_FILES="memtest86+x64.bin memtest86+x64.efi"
+BINARY_BOOT_DIR="binary/boot"
+GRUB_CFG="binary/boot/grub/grub.cfg"
+ISOLINUX_CFG="binary/isolinux/live.cfg"
 
-echo "memtest: scanning chroot/boot/ for memtest files:"
-ls chroot/boot/memtest* 2>/dev/null || echo "memtest: WARNING: no memtest files in chroot/boot/"
+log() {
+    echo "memtest hook: $*"
+}
 
-# Primary path: copy upstream-named files from chroot/boot/
-for f in ${MEMTEST_FILES}; do
-    src="chroot/boot/${f}"
-    if [ -f "${src}" ]; then
-        cp "${src}" "binary/boot/${f}"
-        echo "memtest: copied ${f} from chroot/boot/"
+fail_or_warn() {
+    msg="$1"
+    if [ "${BEE_REQUIRE_MEMTEST}" = "1" ]; then
+        log "ERROR: ${msg}"
+        exit 1
     fi
-done
+    log "WARNING: ${msg}"
+    return 0
+}
 
-# Debian Bookworm naming fallback: /boot/memtest86+ (no extension) is the EFI binary.
-if [ ! -f "binary/boot/memtest86+x64.efi" ] && [ -f "chroot/boot/memtest86+" ]; then
-    cp "chroot/boot/memtest86+" "binary/boot/memtest86+x64.efi"
-    echo "memtest: copied /boot/memtest86+ as memtest86+x64.efi (Debian naming)"
-fi
-if [ ! -f "binary/boot/memtest86+x64.bin" ] && [ -f "chroot/boot/memtest86+.bin" ]; then
-    cp "chroot/boot/memtest86+.bin" "binary/boot/memtest86+x64.bin"
-    echo "memtest: copied /boot/memtest86+.bin as memtest86+x64.bin (Debian naming)"
-fi
+copy_memtest_file() {
+    src="$1"
+    base="$(basename "$src")"
+    dst="${BINARY_BOOT_DIR}/${base}"
 
-# Last resort: if EFI binary still missing, extract from cached .deb
-if [ ! -f "binary/boot/memtest86+x64.efi" ]; then
-    echo "memtest: EFI binary missing — attempting extraction from .deb cache"
-    deb=$(find chroot/var/cache/apt/archives/ chroot/var/lib/apt/lists/ \
-              -name 'memtest86+_*.deb' -o -name 'memtest86+*.deb' 2>/dev/null \
-          | head -1)
-    if [ -z "$deb" ]; then
-        deb=$(find cache/ -name 'memtest86+_*.deb' -o -name 'memtest86+*.deb' 2>/dev/null | head -1)
-    fi
-    if [ -n "$deb" ]; then
-        echo "memtest: extracting from ${deb}"
-        EXTRACT_DIR="$(mktemp -d)"
-        dpkg-deb -x "${deb}" "${EXTRACT_DIR}"
-        echo "memtest: files found in .deb:"
-        find "${EXTRACT_DIR}/boot" -type f 2>/dev/null || echo "  (none in /boot)"
-        for f in ${MEMTEST_FILES}; do
-            src="${EXTRACT_DIR}/boot/${f}"
-            if [ -f "${src}" ]; then
-                cp "${src}" "binary/boot/${f}"
-                echo "memtest: extracted ${f} from .deb"
-            fi
-        done
-        # Debian naming fallback inside .deb as well
-        if [ ! -f "binary/boot/memtest86+x64.efi" ] && [ -f "${EXTRACT_DIR}/boot/memtest86+" ]; then
-            cp "${EXTRACT_DIR}/boot/memtest86+" "binary/boot/memtest86+x64.efi"
-            echo "memtest: extracted /boot/memtest86+ as memtest86+x64.efi from .deb"
+    [ -f "$src" ] || return 1
+    mkdir -p "${BINARY_BOOT_DIR}"
+    cp "$src" "$dst"
+    log "copied ${base} from ${src}"
+}
+
+extract_memtest_from_deb() {
+    deb="$1"
+    tmpdir="$(mktemp -d)"
+
+    log "extracting memtest payload from ${deb}"
+    dpkg-deb -x "$deb" "$tmpdir"
+    for f in ${MEMTEST_FILES}; do
+        if [ -f "${tmpdir}/boot/${f}" ]; then
+            copy_memtest_file "${tmpdir}/boot/${f}"
         fi
-        rm -rf "${EXTRACT_DIR}"
-    else
-        echo "memtest: WARNING: no memtest86+ .deb found in cache — memtest will not be available"
-    fi
-fi
+    done
+    rm -rf "$tmpdir"
+}
 
-echo "memtest: binary/boot/ contents:"
-ls binary/boot/memtest* 2>/dev/null || echo "  (none)"
+ensure_memtest_binaries() {
+    missing=0
+    for f in ${MEMTEST_FILES}; do
+        [ -f "${BINARY_BOOT_DIR}/${f}" ] || missing=1
+    done
+    [ "$missing" -eq 1 ] || return 0
+
+    for root in chroot/boot /boot; do
+        for f in ${MEMTEST_FILES}; do
+            [ -f "${BINARY_BOOT_DIR}/${f}" ] || copy_memtest_file "${root}/${f}" || true
+        done
+    done
+
+    missing=0
+    for f in ${MEMTEST_FILES}; do
+        [ -f "${BINARY_BOOT_DIR}/${f}" ] || missing=1
+    done
+    [ "$missing" -eq 1 ] || return 0
+
+    for root in cache chroot/var/cache/apt/archives /var/cache/apt/archives; do
+        [ -d "$root" ] || continue
+        deb="$(find "$root" -type f \( -name 'memtest86+_*.deb' -o -name 'memtest86+*.deb' \) 2>/dev/null | head -1)"
+        [ -n "$deb" ] || continue
+        extract_memtest_from_deb "$deb"
+        break
+    done
+
+    missing=0
+    for f in ${MEMTEST_FILES}; do
+        if [ ! -f "${BINARY_BOOT_DIR}/${f}" ]; then
+            fail_or_warn "missing ${BINARY_BOOT_DIR}/${f}"
+            missing=1
+        fi
+    done
+    [ "$missing" -eq 0 ] || return 0
+}
+
+ensure_grub_entry() {
+    [ -f "$GRUB_CFG" ] || {
+        fail_or_warn "missing ${GRUB_CFG}"
+        return 0
+    }
+
+    grep -q '### BEE MEMTEST ###' "$GRUB_CFG" && return 0
+
+    cat >> "$GRUB_CFG" <<'EOF'
+
+### BEE MEMTEST ###
+if [ "${grub_platform}" = "efi" ]; then
+    menuentry "Memory Test (memtest86+)" {
+        chainloader /boot/memtest86+x64.efi
+    }
+else
+    menuentry "Memory Test (memtest86+)" {
+        linux16 /boot/memtest86+x64.bin
+    }
+fi
+### /BEE MEMTEST ###
+EOF
+
+    log "appended memtest entry to ${GRUB_CFG}"
+}
+
+ensure_isolinux_entry() {
+    [ -f "$ISOLINUX_CFG" ] || {
+        fail_or_warn "missing ${ISOLINUX_CFG}"
+        return 0
+    }
+
+    grep -q '### BEE MEMTEST ###' "$ISOLINUX_CFG" && return 0
+
+    cat >> "$ISOLINUX_CFG" <<'EOF'
+
+# ### BEE MEMTEST ###
+label memtest
+    menu label ^Memory Test (memtest86+)
+    linux /boot/memtest86+x64.bin
+# ### /BEE MEMTEST ###
+EOF
+
+    log "appended memtest entry to ${ISOLINUX_CFG}"
+}
+
+log "ensuring memtest binaries and menu entries in binary image"
+ensure_memtest_binaries
+ensure_grub_entry
+ensure_isolinux_entry
+log "memtest assets ready"

iso/builder/config/package-lists/bee.list.chroot

@@ -21,14 +21,15 @@ openssh-server
 # Disk installer
 squashfs-tools
 parted
-# grub-pc / grub-efi-amd64 provide grub-install + grub2-common (required for chroot install).
-# The -bin variants only carry binary modules and do NOT include grub-install itself.
-grub-pc
+# Keep GRUB install tools without selecting a single active platform package.
+# grub-pc and grub-efi-amd64 conflict with each other, but grub2-common
+# provides grub-install/update-grub and the *-bin packages provide BIOS/UEFI modules.
+grub2-common
 grub-pc-bin
-grub-efi-amd64
 grub-efi-amd64-bin
 grub-efi-amd64-signed
 shim-signed
+efibootmgr
 
 # Filesystem support for USB export targets
 exfatprogs
@@ -50,7 +51,6 @@ sudo
 zstd
 mstflint
 memtester
-memtest86+
 stress-ng
 stressapptest
 

iso/builder/smoketest.sh

@@ -109,6 +109,40 @@ else
     fail "nvidia-smi: not found in PATH"
 fi
 
+echo ""
+echo "-- OpenCL / John --"
+if [ -f /etc/OpenCL/vendors/nvidia.icd ]; then
+    ok "OpenCL ICD present: /etc/OpenCL/vendors/nvidia.icd"
+else
+    fail "OpenCL ICD missing: /etc/OpenCL/vendors/nvidia.icd"
+fi
+
+if ldconfig -p 2>/dev/null | grep -q "libnvidia-opencl.so.1"; then
+    ok "libnvidia-opencl.so.1 present in linker cache"
+else
+    fail "libnvidia-opencl.so.1 missing from linker cache"
+fi
+
+if command -v clinfo >/dev/null 2>&1; then
+    if clinfo -l 2>/dev/null | grep -q "Platform"; then
+        ok "clinfo: OpenCL platform detected"
+    else
+        fail "clinfo: no OpenCL platform detected"
+    fi
+else
+    fail "clinfo: not found in PATH"
+fi
+
+if command -v john >/dev/null 2>&1; then
+    if john --list=opencl-devices 2>/dev/null | grep -q "Device #"; then
+        ok "john: OpenCL devices detected"
+    else
+        fail "john: no OpenCL devices detected"
+    fi
+else
+    fail "john: not found in PATH"
+fi
+
 echo ""
 echo "-- lib symlinks --"
 for lib in libnvidia-ml libcuda; do

iso/overlay/etc/systemd/system/bee-audit.service

@@ -1,23 +1,12 @@
 [Unit]
-Description=Bee: schedule startup hardware audit via task queue
-# Start AFTER bee-web, not before — bee-web must not wait for audit.
-After=bee-web.service
-Wants=bee-web.service
+Description=Bee: hardware audit
+After=bee-preflight.service bee-network.service bee-nvidia.service
+Before=bee-web.service
 
 [Service]
 Type=oneshot
 RemainAfterExit=yes
-# Wait up to 90s for bee-web to respond on /healthz, then sleep 60s for
-# the system to settle (GPU drivers, sensors), then enqueue the audit as
-# a background task so it appears in the task list and logs.
-ExecStart=/bin/sh -c '\
-  i=0; \
-  while [ $i -lt 90 ]; do \
-    if curl -sf http://localhost/healthz >/dev/null 2>&1; then break; fi; \
-    sleep 1; i=$((i+1)); \
-  done; \
-  sleep 60; \
-  curl -sf -X POST http://localhost/api/audit/run >/dev/null'
+ExecStart=/usr/local/bin/bee-log-run /appdata/bee/export/bee-audit.log /usr/local/bin/bee audit --runtime auto --output file:/appdata/bee/export/bee-audit.json
 StandardOutput=journal
 StandardError=journal
 

iso/overlay/etc/systemd/system/bee-web.service

@@ -1,5 +1,6 @@
 [Unit]
 Description=Bee: hardware audit web viewer
+After=bee-audit.service
 
 [Service]
 Type=simple

iso/overlay/etc/systemd/system/lightdm.service.d/bee-display-mode.conf

@@ -0,0 +1,6 @@
+[Unit]
+Wants=bee-preflight.service
+After=bee-preflight.service
+
+[Service]
+ExecStartPre=/usr/local/bin/bee-display-mode

iso/overlay/usr/local/bin/bee-display-mode

@@ -0,0 +1,54 @@
+#!/bin/sh
+# Select Xorg display mode based on kernel cmdline.
+# Default is the current server-safe path: keep forced fbdev.
+set -eu
+
+cmdline_param() {
+    key="$1"
+    for token in $(cat /proc/cmdline 2>/dev/null); do
+        case "$token" in
+            "$key"=*)
+                echo "${token#*=}"
+                return 0
+                ;;
+        esac
+    done
+    return 1
+}
+
+log() {
+    echo "bee-display-mode: $*"
+}
+
+mode="$(cmdline_param bee.display || true)"
+if [ -z "$mode" ]; then
+    mode="safe"
+fi
+
+xorg_dir="/etc/X11/xorg.conf.d"
+fbdev_conf="${xorg_dir}/10-fbdev.conf"
+fbdev_park="${xorg_dir}/10-fbdev.conf.disabled"
+
+mkdir -p "$xorg_dir"
+
+case "$mode" in
+    kms|auto)
+        if [ -f "$fbdev_conf" ]; then
+            mv "$fbdev_conf" "$fbdev_park"
+            log "mode=${mode}; disabled forced fbdev config"
+        else
+            log "mode=${mode}; fbdev config already disabled"
+        fi
+        ;;
+    safe|fbdev|"")
+        if [ -f "$fbdev_park" ] && [ ! -f "$fbdev_conf" ]; then
+            mv "$fbdev_park" "$fbdev_conf"
+            log "mode=${mode}; restored forced fbdev config"
+        else
+            log "mode=${mode}; keeping forced fbdev config"
+        fi
+        ;;
+    *)
+        log "unknown bee.display=${mode}; keeping forced fbdev config"
+        ;;
+esac

iso/overlay/usr/local/bin/bee-gpu-burn

@@ -2,7 +2,7 @@
 set -eu
 
 SECONDS=5
-SIZE_MB=64
+SIZE_MB=0
 DEVICES=""
 EXCLUDE=""
 WORKER="/usr/local/lib/bee/bee-gpu-burn-worker"
@@ -68,8 +68,17 @@ trap 'rm -rf "${TMP_DIR}"' EXIT INT TERM
 WORKERS=""
 for id in $(echo "${FINAL}" | tr ',' ' '); do
     log="${TMP_DIR}/gpu-${id}.log"
-    echo "starting gpu ${id}"
-    "${WORKER}" --device "${id}" --seconds "${SECONDS}" --size-mb "${SIZE_MB}" >"${log}" 2>&1 &
+    gpu_size_mb="${SIZE_MB}"
+    if [ "${gpu_size_mb}" -le 0 ] 2>/dev/null; then
+        total_mb=$(nvidia-smi --id="${id}" --query-gpu=memory.total --format=csv,noheader,nounits 2>/dev/null | tr -d '[:space:]')
+        if [ -n "${total_mb}" ] && [ "${total_mb}" -gt 0 ] 2>/dev/null; then
+            gpu_size_mb=$(( total_mb * 95 / 100 ))
+        else
+            gpu_size_mb=512
+        fi
+    fi
+    echo "starting gpu ${id} size=${gpu_size_mb}MB"
+    "${WORKER}" --device "${id}" --seconds "${SECONDS}" --size-mb "${gpu_size_mb}" >"${log}" 2>&1 &
     pid=$!
     WORKERS="${WORKERS} ${pid}:${id}:${log}"
 done

iso/overlay/usr/local/bin/bee-install

@@ -12,17 +12,55 @@
 
 set -euo pipefail
 
+usage() {
+    cat >&2 <<'EOF'
+Usage: bee-install <device> [logfile]
+
+  Installs the live system to a local disk (WIPES the target).
+
+  device   Target block device, e.g. /dev/sda or /dev/nvme0n1
+           Must be a hard disk or NVMe — NOT a CD-ROM (/dev/sr*)
+  logfile  Optional path for progress log (default: /tmp/bee-install.log)
+
+Examples:
+  bee-install /dev/sda
+  bee-install /dev/nvme0n1
+  bee-install /dev/sdb /tmp/my-install.log
+
+WARNING: ALL DATA ON <device> WILL BE ERASED.
+
+Layout (UEFI):  GPT — partition 1: EFI 512MB vfat, partition 2: root ext4
+Layout (BIOS):  MBR — partition 1: root ext4
+EOF
+    exit 1
+}
+
 DEVICE="${1:-}"
 LOGFILE="${2:-/tmp/bee-install.log}"
 
-if [ -z "$DEVICE" ]; then
-    echo "Usage: bee-install <device> [logfile]" >&2
-    exit 1
+if [ -z "$DEVICE" ] || [ "$DEVICE" = "--help" ] || [ "$DEVICE" = "-h" ]; then
+    usage
 fi
 if [ ! -b "$DEVICE" ]; then
     echo "ERROR: $DEVICE is not a block device" >&2
+    echo "Run 'lsblk' to list available disks." >&2
     exit 1
 fi
+# Block CD-ROM devices
+case "$DEVICE" in
+    /dev/sr*|/dev/scd*)
+        echo "ERROR: $DEVICE is a CD-ROM/optical device — cannot install to it." >&2
+        echo "Run 'lsblk' to find the target disk (e.g. /dev/sda, /dev/nvme0n1)." >&2
+        exit 1
+        ;;
+esac
+# Check required tools
+for tool in parted mkfs.vfat mkfs.ext4 unsquashfs grub-install update-grub; do
+    if ! command -v "$tool" >/dev/null 2>&1; then
+        echo "ERROR: required tool not found: $tool" >&2
+        exit 1
+    fi
+done
 
 SQUASHFS="/run/live/medium/live/filesystem.squashfs"
 if [ ! -f "$SQUASHFS" ]; then

iso/overlay/usr/local/bin/bee-john-gpu-stress

@@ -7,6 +7,8 @@ EXCLUDE=""
 FORMAT=""
 JOHN_DIR="/usr/local/lib/bee/john/run"
 JOHN_BIN="${JOHN_DIR}/john"
+export OCL_ICD_VENDORS="/etc/OpenCL/vendors"
+export LD_LIBRARY_PATH="/usr/lib:/usr/local/lib${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}"
 
 usage() {
     echo "usage: $0 [--seconds N] [--devices 0,1] [--exclude 2,3] [--format name]" >&2
@@ -23,6 +25,95 @@ contains_csv() {
     echo ",${haystack}," | grep -q ",${needle},"
 }
 
+show_opencl_diagnostics() {
+    echo "-- OpenCL ICD vendors --" >&2
+    if [ -d /etc/OpenCL/vendors ]; then
+        ls -l /etc/OpenCL/vendors >&2 || true
+        for icd in /etc/OpenCL/vendors/*.icd; do
+            [ -f "${icd}" ] || continue
+            echo "  file: ${icd}" >&2
+            sed 's/^/    /' "${icd}" >&2 || true
+        done
+    else
+        echo "  /etc/OpenCL/vendors is missing" >&2
+    fi
+    echo "-- NVIDIA device nodes --" >&2
+    ls -l /dev/nvidia* >&2 || true
+    echo "-- ldconfig OpenCL/NVIDIA --" >&2
+    ldconfig -p 2>/dev/null | grep 'libOpenCL\|libcuda\|libnvidia-opencl' >&2 || true
+    if command -v clinfo >/dev/null 2>&1; then
+        echo "-- clinfo -l --" >&2
+        clinfo -l >&2 || true
+    fi
+    echo "-- john --list=opencl-devices --" >&2
+    ./john --list=opencl-devices >&2 || true
+}
+
+refresh_nvidia_runtime() {
+    if [ "$(id -u)" != "0" ]; then
+        return 1
+    fi
+    if command -v bee-nvidia-load >/dev/null 2>&1; then
+        bee-nvidia-load >/dev/null 2>&1 || true
+    fi
+    ldconfig >/dev/null 2>&1 || true
+    return 0
+}
+
+ensure_nvidia_uvm() {
+    if lsmod 2>/dev/null | grep -q '^nvidia_uvm '; then
+        return 0
+    fi
+    if [ "$(id -u)" != "0" ]; then
+        return 1
+    fi
+
+    ko="/usr/local/lib/nvidia/nvidia-uvm.ko"
+    [ -f "${ko}" ] || return 1
+
+    if ! insmod "${ko}" >/dev/null 2>&1; then
+        return 1
+    fi
+
+    uvm_major=$(grep -m1 ' nvidia-uvm$' /proc/devices | awk '{print $1}')
+    if [ -n "${uvm_major}" ]; then
+        mknod -m 666 /dev/nvidia-uvm c "${uvm_major}" 0 2>/dev/null || true
+        mknod -m 666 /dev/nvidia-uvm-tools c "${uvm_major}" 1 2>/dev/null || true
+    fi
+    return 0
+}
+
+ensure_opencl_ready() {
+    out=$(./john --list=opencl-devices 2>&1 || true)
+    if echo "${out}" | grep -q "Device #"; then
+        return 0
+    fi
+
+    if refresh_nvidia_runtime; then
+        out=$(./john --list=opencl-devices 2>&1 || true)
+        if echo "${out}" | grep -q "Device #"; then
+            return 0
+        fi
+    fi
+
+    if ensure_nvidia_uvm; then
+        out=$(./john --list=opencl-devices 2>&1 || true)
+        if echo "${out}" | grep -q "Device #"; then
+            return 0
+        fi
+    fi
+
+    echo "OpenCL devices are not available for John." >&2
+    if ! lsmod 2>/dev/null | grep -q '^nvidia_uvm '; then
+        echo "nvidia_uvm is not loaded." >&2
+    fi
+    if [ ! -e /dev/nvidia-uvm ]; then
+        echo "/dev/nvidia-uvm is missing." >&2
+    fi
+    show_opencl_diagnostics
+    return 1
+}
+
 while [ "$#" -gt 0 ]; do
     case "$1" in
         --seconds|-t) [ "$#" -ge 2 ] || usage; SECONDS="$2"; shift 2 ;;
@@ -76,6 +167,8 @@ echo "john_devices=${JOHN_DEVICES}"
 
 cd "${JOHN_DIR}"
 
+ensure_opencl_ready || exit 1
+
 choose_format() {
     if [ -n "${FORMAT}" ]; then
         echo "${FORMAT}"

iso/overlay/usr/local/bin/bee-log-run

@@ -17,7 +17,7 @@ mkdir -p "$(dirname "$log_file")"
 serial_sink() {
     local tty="$1"
     if [ -w "$tty" ]; then
-        cat > "$tty"
+        cat > "$tty" 2>/dev/null || true
     else
         cat > /dev/null
     fi

iso/overlay/usr/local/bin/bee-network.sh

@@ -6,25 +6,66 @@ LOG_PREFIX="bee-network"
 
 log() { echo "[$LOG_PREFIX] $*"; }
 
-# find physical interfaces: exclude lo and virtual (docker/virbr/veth/tun/tap)
-interfaces=$(ip -o link show \
-    | awk -F': ' '{print $2}' \
-    | grep -v '^lo$' \
-    | grep -vE '^(docker|virbr|veth|tun|tap|br-|bond|dummy)' \
-    | sort)
+list_interfaces() {
+    ip -o link show \
+        | awk -F': ' '{print $2}' \
+        | grep -v '^lo$' \
+        | grep -vE '^(docker|virbr|veth|tun|tap|br-|bond|dummy)' \
+        | sort
+}
 
-if [ -z "$interfaces" ]; then
+# Give udev a short chance to expose late NICs before the first scan.
+if command -v udevadm >/dev/null 2>&1; then
+    udevadm settle --timeout=5 >/dev/null 2>&1 || log "WARN: udevadm settle timed out"
+fi
+
+started_ifaces=""
+started_count=0
+scan_pass=1
+
+# Some server NICs appear a bit later after module/firmware init. Do a small
+# bounded rescan window without turning network bring-up into a boot blocker.
+while [ "$scan_pass" -le 3 ]; do
+    interfaces=$(list_interfaces)
+
+    if [ -n "$interfaces" ]; then
+        for iface in $interfaces; do
+            case " $started_ifaces " in
+                *" $iface "*) continue ;;
+            esac
+
+            log "bringing up $iface"
+            if ! ip link set "$iface" up; then
+                log "WARN: could not bring up $iface"
+                continue
+            fi
+
+            carrier=$(cat "/sys/class/net/$iface/carrier" 2>/dev/null || true)
+            if [ "$carrier" = "1" ]; then
+                log "carrier detected on $iface"
+            else
+                log "carrier not detected yet on $iface"
+            fi
+
+            # DHCP in background — non-blocking, keep dhclient verbose output in the service log.
+            dhclient -4 -v -nw "$iface" &
+            log "DHCP started for $iface (pid $!)"
+
+            started_ifaces="$started_ifaces $iface"
+            started_count=$((started_count + 1))
+        done
+    fi
+
+    if [ "$scan_pass" -ge 3 ]; then
+        break
+    fi
+    scan_pass=$((scan_pass + 1))
+    sleep 2
+done
+
+if [ "$started_count" -eq 0 ]; then
     log "no physical interfaces found"
     exit 0
 fi
 
-for iface in $interfaces; do
-    log "bringing up $iface"
-    ip link set "$iface" up || { log "WARN: could not bring up $iface"; continue; }
-
-    # DHCP in background — non-blocking, keep dhclient verbose output in the service log.
-    dhclient -4 -v -nw "$iface" &
-    log "DHCP started for $iface (pid $!)"
-done
-
-log "done"
+log "done (interfaces started: $started_count)"

iso/overlay/usr/local/bin/bee-nvidia-load

@@ -59,11 +59,24 @@ load_module() {
     return 1
 }
 
+load_host_module() {
+    mod="$1"
+    if modprobe "$mod" >/dev/null 2>&1; then
+        log "host module loaded: $mod"
+        return 0
+    fi
+    return 1
+}
+
 case "$nvidia_mode" in
     normal|full)
         if ! load_module nvidia; then
             exit 1
         fi
+        # nvidia-modeset on some server kernels needs ACPI video helper symbols
+        # exported by the generic "video" module. Best-effort only; compute paths
+        # remain functional even if display-related modules stay absent.
+        load_host_module video || true
         load_module nvidia-modeset || true
         load_module nvidia-uvm || true
         ;;