Version-stamp squashfs filename and restrict live-boot media selection

Squashfs versioning:
- ISO now contains filesystem-v<VERSION>.squashfs instead of the generic
  filesystem.squashfs, making it immediately visible which build is
  running (visible in /run/live/medium/live/ at boot time).
- Full build path: rename filesystem.squashfs → filesystem-v*.squashfs
  after lb build, before lb binary_checksums/binary_iso.
- Fast path: find and unpack whatever filesystem*.squashfs exists, repack
  as the new versioned name, remove the old file, update the ISO.
- needs_full_build: accept any filesystem*.squashfs so version changes
  alone don't force a full rebuild.

Media selection hardening:
- Add live-media=/dev/disk/by-label/<LABEL> to the kernel boot line in
  addition to the existing live-media-label=<LABEL>. live-boot will now
  open exactly the labeled device rather than scanning all block devices,
  preventing accidental use of squashfs files from local disks or
  stale virtual media attached via IPMI.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

audit/cmd/bee/main.go

@@ -64,6 +64,8 @@ func run(args []string, stdout, stderr io.Writer) (exitCode int) {
 		return runExport(args[1:], stdout, stderr)
 	case "preflight":
 		return runPreflight(args[1:], stdout, stderr)
+	case "install-to-ram":
+		return runInstallToRAM(args[1:], stdout, stderr)
 	case "support-bundle":
 		return runSupportBundle(args[1:], stdout, stderr)
 	case "web":
@@ -90,6 +92,7 @@ func printRootUsage(w io.Writer) {
 	fmt.Fprintln(w, `bee commands:
   bee audit   --runtime auto|local|livecd --output stdout|file:<path>
   bee preflight --output stdout|file:<path>
+  bee install-to-ram
   bee export  --target <device>
   bee support-bundle --output stdout|file:<path>
   bee web     --listen :80 [--audit-path `+app.DefaultAuditJSONPath+`]
@@ -109,6 +112,8 @@ func runHelp(args []string, stdout, stderr io.Writer) int {
 		return runExport([]string{"--help"}, stdout, stdout)
 	case "preflight":
 		return runPreflight([]string{"--help"}, stdout, stdout)
+	case "install-to-ram":
+		return runInstallToRAM([]string{"--help"}, stdout, stdout)
 	case "support-bundle":
 		return runSupportBundle([]string{"--help"}, stdout, stdout)
 	case "web":
@@ -252,6 +257,32 @@ func runPreflight(args []string, stdout, stderr io.Writer) int {
 	return 0
 }
 
+func runInstallToRAM(args []string, stdout, stderr io.Writer) int {
+	fs := flag.NewFlagSet("install-to-ram", flag.ContinueOnError)
+	fs.SetOutput(stderr)
+	fs.Usage = func() {
+		fmt.Fprintln(stderr, "usage: bee install-to-ram")
+	}
+	if err := fs.Parse(args); err != nil {
+		if err == flag.ErrHelp {
+			return 0
+		}
+		return 2
+	}
+	if fs.NArg() != 0 {
+		fs.Usage()
+		return 2
+	}
+
+	application := app.New(platform.New())
+	logLine := func(s string) { fmt.Fprintln(stdout, s) }
+	if err := application.RunInstallToRAM(context.Background(), logLine); err != nil {
+		slog.Error("run install-to-ram", "err", err)
+		return 1
+	}
+	return 0
+}
+
 func runSupportBundle(args []string, stdout, stderr io.Writer) int {
 	fs := flag.NewFlagSet("support-bundle", flag.ContinueOnError)
 	fs.SetOutput(stderr)

audit/internal/app/support_bundle.go

@@ -24,6 +24,8 @@ var supportBundleServices = []string{
 	"bee-selfheal.service",
 	"bee-selfheal.timer",
 	"bee-sshsetup.service",
+	"display-manager.service",
+	"lightdm.service",
 	"nvidia-dcgm.service",
 	"nvidia-fabricmanager.service",
 }
@@ -44,12 +46,128 @@ var supportBundleCommands = []struct {
 	{name: "system/mount.txt", cmd: []string{"mount"}},
 	{name: "system/df-h.txt", cmd: []string{"df", "-h"}},
 	{name: "system/dmesg.txt", cmd: []string{"dmesg"}},
+	{name: "system/dmesg-gui-video-input.txt", cmd: []string{"sh", "-c", `
+if command -v dmesg >/dev/null 2>&1; then
+  dmesg | grep -iE 'nvidia|drm|fb|framebuffer|vesa|efi|lightdm|Xorg|input|hid|usb|keyboard|mouse|virtual keyboard|virtual mouse|ami|aspeed|ast' || echo "no GUI/video/input kernel messages found"
+else
+  echo "dmesg not found"
+fi
+`}},
 	{name: "system/kernel-aer-nvidia.txt", cmd: []string{"sh", "-c", `
 if command -v dmesg >/dev/null 2>&1; then
   dmesg | grep -iE 'AER|NVRM|Xid|pcieport|nvidia' || echo "no AER/NVRM/Xid kernel messages found"
 else
   echo "dmesg not found"
 fi
+`}},
+	{name: "system/loginctl-sessions.txt", cmd: []string{"sh", "-c", `
+if command -v loginctl >/dev/null 2>&1; then
+  loginctl list-sessions 2>&1 || true
+else
+  echo "loginctl not found"
+fi
+`}},
+	{name: "system/loginctl-seats.txt", cmd: []string{"sh", "-c", `
+if command -v loginctl >/dev/null 2>&1; then
+  loginctl list-seats 2>&1 || true
+  echo
+  for seat in $(loginctl list-seats --no-legend 2>/dev/null | awk '{print $1}'); do
+    echo "=== $seat ==="
+    loginctl seat-status "$seat" 2>&1 || true
+    echo
+  done
+else
+  echo "loginctl not found"
+fi
+`}},
+	{name: "system/ps-gui.txt", cmd: []string{"sh", "-c", `
+ps -ef | grep -iE 'lightdm|Xorg|X$|openbox|chromium|chrome|xinit|xsession' | grep -v grep || echo "no GUI processes found"
+`}},
+	{name: "system/lspci-video-vv.txt", cmd: []string{"sh", "-c", `
+if ! command -v lspci >/dev/null 2>&1; then
+  echo "lspci not found"
+  exit 0
+fi
+found=0
+for dev in $(lspci -Dn | awk '$2 ~ /^03(00|02):$/ {print $1}'); do
+  found=1
+  echo "=== $dev ==="
+  lspci -s "$dev" -vv 2>&1 || true
+  echo
+done
+if [ "$found" -eq 0 ]; then
+  echo "no display-class PCI devices found"
+fi
+`}},
+	{name: "system/proc-fb.txt", cmd: []string{"cat", "/proc/fb"}},
+	{name: "system/drm-cards.txt", cmd: []string{"sh", "-c", `
+if [ -d /sys/class/drm ]; then
+  for path in /sys/class/drm/card*; do
+    [ -e "$path" ] || continue
+    card=$(basename "$path")
+    echo "=== $card ==="
+    for f in status enabled dpms modes; do
+      [ -r "$path/$f" ] && printf "  %-8s %s\n" "$f" "$(cat "$path/$f" 2>/dev/null)"
+    done
+    device=$(readlink -f "$path/device" 2>/dev/null || true)
+    [ -n "$device" ] && echo "  device   ${device##*/}"
+    echo
+  done
+else
+  echo "/sys/class/drm not present"
+fi
+`}},
+	{name: "system/input-devices.txt", cmd: []string{"sh", "-c", `
+if [ -r /proc/bus/input/devices ]; then
+  cat /proc/bus/input/devices
+else
+  echo "/proc/bus/input/devices not readable"
+fi
+`}},
+	{name: "system/udevadm-input.txt", cmd: []string{"sh", "-c", `
+if ! command -v udevadm >/dev/null 2>&1; then
+  echo "udevadm not found"
+  exit 0
+fi
+found=0
+for dev in /dev/input/event*; do
+  [ -e "$dev" ] || continue
+  found=1
+  echo "=== $dev ==="
+  udevadm info --query=all --name="$dev" 2>&1 || true
+  echo
+done
+if [ "$found" -eq 0 ]; then
+  echo "no /dev/input/event* devices found"
+fi
+`}},
+	{name: "system/xinput-list.txt", cmd: []string{"sh", "-c", `
+if command -v xinput >/dev/null 2>&1; then
+  DISPLAY=:0 xinput --list 2>&1 || true
+else
+  echo "xinput not found"
+fi
+`}},
+	{name: "system/libinput-list-devices.txt", cmd: []string{"sh", "-c", `
+if command -v libinput >/dev/null 2>&1; then
+  libinput list-devices 2>&1 || true
+else
+  echo "libinput not found"
+fi
+`}},
+	{name: "system/systemctl-gui-units.txt", cmd: []string{"sh", "-c", `
+if ! command -v systemctl >/dev/null 2>&1; then
+  echo "systemctl not found"
+  exit 0
+fi
+echo "=== unit files ==="
+systemctl list-unit-files --no-pager --all 'lightdm*' 'display-manager*' 2>&1 || true
+echo
+echo "=== active units ==="
+systemctl list-units --no-pager --all 'lightdm*' 'display-manager*' 2>&1 || true
+echo
+echo "=== failed units ==="
+systemctl --failed --no-pager 2>&1 | grep -iE 'lightdm|display-manager|Xorg' || echo "no failed GUI units"
 `}},
 	{name: "system/nvidia-smi-q.txt", cmd: []string{"nvidia-smi", "-q"}},
 	{name: "system/nvidia-smi-topo.txt", cmd: []string{"sh", "-c", `
@@ -236,6 +354,13 @@ var supportBundleOptionalFiles = []struct {
 }{
 	{name: "system/kern.log", src: "/var/log/kern.log"},
 	{name: "system/syslog.txt", src: "/var/log/syslog"},
+	{name: "system/Xorg.0.log", src: "/var/log/Xorg.0.log"},
+	{name: "system/Xorg.0.log.old", src: "/var/log/Xorg.0.log.old"},
+	{name: "system/lightdm/lightdm.log", src: "/var/log/lightdm/lightdm.log"},
+	{name: "system/lightdm/x-0.log", src: "/var/log/lightdm/x-0.log"},
+	{name: "system/lightdm/x-0-greeter.log", src: "/var/log/lightdm/x-0-greeter.log"},
+	{name: "system/home-bee-xsession-errors.log", src: "/home/bee/.xsession-errors"},
+	{name: "system/home-bee-chromium-debug.log", src: "/tmp/bee-chrome/chrome_debug.log"},
 	{name: "system/fabricmanager.log", src: "/var/log/fabricmanager.log"},
 	{name: "system/nvlsm.log", src: "/var/log/nvlsm.log"},
 	{name: "system/fabricmanager/fabricmanager.log", src: "/var/log/fabricmanager/fabricmanager.log"},

audit/internal/collector/board.go

@@ -3,6 +3,7 @@ package collector
 import (
 	"bee/audit/internal/schema"
 	"bufio"
+	"context"
 	"log/slog"
 	"os"
 	"os/exec"
@@ -17,14 +18,6 @@ var execDmidecode = func(typeNum string) (string, error) {
 	return string(out), nil
 }
 
-var execIpmitool = func(args ...string) (string, error) {
-	out, err := exec.Command("ipmitool", args...).Output()
-	if err != nil {
-		return "", err
-	}
-	return string(out), nil
-}
-
 // collectBoard runs dmidecode for types 0, 1, 2 and returns the board record
 // plus the BIOS firmware entry. Any failure is logged and returns zero values.
 func collectBoard() (schema.HardwareBoard, []schema.HardwareFirmwareRecord) {
@@ -80,19 +73,23 @@ func parseBoard(type1, type2 string) schema.HardwareBoard {
 
 // collectBMCFirmware collects BMC firmware version via ipmitool mc info.
 // Returns nil if ipmitool is missing, /dev/ipmi0 is absent, or any error occurs.
-func collectBMCFirmware() []schema.HardwareFirmwareRecord {
+func collectBMCFirmware(manufacturer string) []schema.HardwareFirmwareRecord {
 	if _, err := exec.LookPath("ipmitool"); err != nil {
 		return nil
 	}
 	if _, err := os.Stat("/dev/ipmi0"); err != nil {
 		return nil
 	}
-	out, err := execIpmitool("mc", "info")
+	profile := selectIPMIProfile(manufacturer)
+	ctx, cancel := context.WithTimeout(context.Background(), profile.mcInfoTimeout)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, "ipmitool", "mc", "info")
+	raw, err := cmd.Output()
 	if err != nil {
 		slog.Info("bmc: ipmitool mc info unavailable", "err", err)
 		return nil
 	}
-	version := parseBMCFirmwareRevision(out)
+	version := parseBMCFirmwareRevision(string(raw))
 	if version == "" {
 		return nil
 	}

audit/internal/collector/collector.go

@@ -23,7 +23,7 @@ func Run(_ runtimeenv.Mode) schema.HardwareIngestRequest {
 	board, biosFW := collectBoard()
 	snap.Board = board
 	snap.Firmware = append(snap.Firmware, biosFW...)
-	snap.Firmware = append(snap.Firmware, collectBMCFirmware()...)
+	snap.Firmware = append(snap.Firmware, collectBMCFirmware(derefString(snap.Board.Manufacturer))...)
 
 	snap.CPUs = collectCPUs()
 
@@ -34,6 +34,7 @@ func Run(_ runtimeenv.Mode) schema.HardwareIngestRequest {
 	}
 	snap.CPUs = enrichCPUsWithTelemetry(snap.CPUs, sensorDoc)
 	snap.Memory = enrichMemoryWithTelemetry(snap.Memory, sensorDoc)
+	bestEffortRescanHotplugStorage()
 	snap.Storage = collectStorage()
 	snap.PCIeDevices = collectPCIe()
 	snap.PCIeDevices = enrichPCIeWithAMD(snap.PCIeDevices)
@@ -44,7 +45,8 @@ func Run(_ runtimeenv.Mode) schema.HardwareIngestRequest {
 	snap.PCIeDevices = enrichPCIeWithRAIDTelemetry(snap.PCIeDevices)
 	snap.Storage = enrichStorageWithVROC(snap.Storage, snap.PCIeDevices)
 	snap.Storage = appendUniqueStorage(snap.Storage, collectRAIDStorage(snap.PCIeDevices))
-	snap.PowerSupplies = collectPSUs()
+	snap.VROCLicense = collectVROCLicense(snap.PCIeDevices)
+	snap.PowerSupplies = collectPSUs(derefString(snap.Board.Manufacturer))
 	snap.PowerSupplies = enrichPSUsWithTelemetry(snap.PowerSupplies, sensorDoc)
 	snap.Sensors = buildSensorsFromDoc(sensorDoc)
 	finalizeSnapshot(&snap, collectedAt)

audit/internal/collector/ipmi_profile.go

@@ -0,0 +1,92 @@
+package collector
+
+// Package-level IPMI tuning profiles.
+//
+// Each profile is matched by board manufacturer (already known before PSU
+// collection runs). The profile drives two things:
+//   - Per-command timeouts — prevents infinite hangs on slow BMCs.
+//   - FRU early-exit — streaming parser stops reading once all PSU entries
+//     are found, avoiding the tail of non-PSU FRU records.
+//
+// To add a new vendor: append to ipmiProfiles. The first matching entry wins.
+
+import (
+	"strings"
+	"time"
+)
+
+// ipmiProfile holds tuning parameters for one or more board manufacturers.
+type ipmiProfile struct {
+	// name is shown in log messages.
+	name string
+	// manufacturers is a list of lowercase substrings matched against the
+	// board manufacturer string from dmidecode type 1.
+	manufacturers []string
+	// fruTimeout is the hard deadline for the entire `ipmitool fru print`
+	// command. Zero means no timeout (not recommended).
+	fruTimeout time.Duration
+	// sdrTimeout is the hard deadline for `ipmitool sdr`.
+	sdrTimeout time.Duration
+	// mcInfoTimeout is the hard deadline for `ipmitool mc info`.
+	mcInfoTimeout time.Duration
+	// fruEarlyExit instructs the streaming FRU parser to stop reading
+	// after it has found at least one PSU entry and the current block is
+	// complete. Useful on servers with many non-PSU FRU devices.
+	fruEarlyExit bool
+}
+
+// ipmiProfiles is the ordered list of profiles. First match wins.
+var ipmiProfiles = []ipmiProfile{
+	{
+		// Lenovo XCC-based servers (ThinkSystem SR6xx / SR8xx / ST series).
+		// SR650 V3 has 54 FRU devices; each IPMI read takes ~2 s, so the
+		// full `fru print` scan takes ~108 s on a loaded BMC. Enable early
+		// exit so collection stops once PSU records are found.
+		name:          "lenovo",
+		manufacturers: []string{"lenovo"},
+		fruTimeout:    90 * time.Second,
+		sdrTimeout:    45 * time.Second,
+		mcInfoTimeout: 15 * time.Second,
+		fruEarlyExit:  true,
+	},
+	{
+		// HPE iLO-based servers (ProLiant DL/ML/BL).
+		name:          "hpe",
+		manufacturers: []string{"hp", "hewlett packard"},
+		fruTimeout:    60 * time.Second,
+		sdrTimeout:    30 * time.Second,
+		mcInfoTimeout: 10 * time.Second,
+		fruEarlyExit:  false,
+	},
+	{
+		// Dell iDRAC-based servers.
+		name:          "dell",
+		manufacturers: []string{"dell"},
+		fruTimeout:    60 * time.Second,
+		sdrTimeout:    30 * time.Second,
+		mcInfoTimeout: 10 * time.Second,
+		fruEarlyExit:  false,
+	},
+}
+
+// defaultIPMIProfile is used when no vendor profile matches.
+var defaultIPMIProfile = ipmiProfile{
+	name:          "default",
+	fruTimeout:    60 * time.Second,
+	sdrTimeout:    30 * time.Second,
+	mcInfoTimeout: 10 * time.Second,
+	fruEarlyExit:  false,
+}
+
+// selectIPMIProfile returns the profile for the given board manufacturer.
+func selectIPMIProfile(manufacturer string) ipmiProfile {
+	mfgLower := strings.ToLower(strings.TrimSpace(manufacturer))
+	for _, p := range ipmiProfiles {
+		for _, m := range p.manufacturers {
+			if strings.Contains(mfgLower, m) {
+				return p
+			}
+		}
+	}
+	return defaultIPMIProfile
+}

audit/internal/collector/psu.go

@@ -2,6 +2,8 @@ package collector
 
 import (
 	"bee/audit/internal/schema"
+	"bufio"
+	"context"
 	"log/slog"
 	"os/exec"
 	"regexp"
@@ -10,16 +12,29 @@ import (
 	"strings"
 )
 
-func collectPSUs() []schema.HardwarePowerSupply {
+func collectPSUs(manufacturer string) []schema.HardwarePowerSupply {
+	profile := selectIPMIProfile(manufacturer)
+
 	var psus []schema.HardwarePowerSupply
-	if out, err := exec.Command("ipmitool", "fru", "print").Output(); err == nil {
-		psus = parseFRU(string(out))
+	fruCtx, fruCancel := context.WithTimeout(context.Background(), profile.fruTimeout)
+	defer fruCancel()
+
+	if profile.fruEarlyExit {
+		psus = collectFRUEarlyExit(fruCtx)
 	} else {
-		slog.Info("psu: fru unavailable", "err", err)
+		cmd := exec.CommandContext(fruCtx, "ipmitool", "fru", "print")
+		if out, err := cmd.Output(); err == nil {
+			psus = parseFRU(string(out))
+		} else {
+			slog.Info("psu: fru unavailable", "err", err)
+		}
 	}
 
 	sdrData := map[int]psuSDR{}
-	if sdrOut, err := exec.Command("ipmitool", "sdr").Output(); err == nil {
+	sdrCtx, sdrCancel := context.WithTimeout(context.Background(), profile.sdrTimeout)
+	defer sdrCancel()
+	cmd := exec.CommandContext(sdrCtx, "ipmitool", "sdr")
+	if sdrOut, err := cmd.Output(); err == nil {
 		sdrData = parsePSUSDR(string(sdrOut))
 		if len(psus) == 0 {
 			psus = synthesizePSUsFromSDR(sdrData)
@@ -30,7 +45,66 @@ func collectPSUs() []schema.HardwarePowerSupply {
 		slog.Info("psu: ipmitool unavailable, skipping", "err", err)
 		return nil
 	}
-	slog.Info("psu: collected", "count", len(psus))
+	slog.Info("psu: collected", "count", len(psus), "profile", profile.name)
+	return psus
+}
+
+// collectFRUEarlyExit streams ipmitool fru print line-by-line and stops reading
+// as soon as it has found all PSU blocks and the next block is not a PSU.
+// This avoids scanning all 50+ non-PSU FRU devices on Lenovo XCC servers.
+func collectFRUEarlyExit(ctx context.Context) []schema.HardwarePowerSupply {
+	cmd := exec.CommandContext(ctx, "ipmitool", "fru", "print")
+	pipe, err := cmd.StdoutPipe()
+	if err != nil {
+		slog.Info("psu: fru pipe unavailable", "err", err)
+		return nil
+	}
+	if err := cmd.Start(); err != nil {
+		slog.Info("psu: fru start failed", "err", err)
+		return nil
+	}
+
+	var psus []schema.HardwarePowerSupply
+	var currentBlock strings.Builder
+	slot := 0
+	psuFound := false
+	stoppedEarly := false
+
+	scanner := bufio.NewScanner(pipe)
+	for scanner.Scan() {
+		line := scanner.Text()
+
+		if strings.HasPrefix(line, "FRU Device Description") {
+			if currentBlock.Len() > 0 {
+				if psu, ok := parseFRUBlock(currentBlock.String(), slot); ok {
+					psus = append(psus, psu)
+					psuFound = true
+					slot++
+				}
+				currentBlock.Reset()
+			}
+			// Stop once we've collected PSUs and hit a non-PSU block header.
+			if psuFound && !isPSUHeader(strings.ToLower(line)) {
+				stoppedEarly = true
+				break
+			}
+		}
+		currentBlock.WriteString(line)
+		currentBlock.WriteByte('\n')
+	}
+
+	if !stoppedEarly && currentBlock.Len() > 0 {
+		if psu, ok := parseFRUBlock(currentBlock.String(), slot); ok {
+			psus = append(psus, psu)
+		}
+	}
+
+	// Kill the process immediately on early exit rather than waiting for context timeout.
+	if cmd.Process != nil {
+		cmd.Process.Kill() //nolint:errcheck
+	}
+	cmd.Wait() //nolint:errcheck
+	slog.Info("psu: fru early-exit complete", "psus_found", len(psus), "stopped_early", stoppedEarly)
 	return psus
 }
 

audit/internal/collector/raid.go

@@ -733,6 +733,37 @@ func parseMDStatArrays(raw string) []mdArray {
 	return arrays
 }
 
+// collectVROCLicense runs mdadm --detail-platform and extracts the License field.
+// Returns nil when VROC is absent or the platform does not report a license.
+func collectVROCLicense(pcie []schema.HardwarePCIeDevice) *string {
+	if !hasVROCController(pcie) {
+		return nil
+	}
+	out, err := raidToolQuery("mdadm", "--detail-platform")
+	if err != nil {
+		slog.Info("vroc: mdadm --detail-platform unavailable", "err", err)
+		return nil
+	}
+	return parseMDAdmPlatformLicense(string(out))
+}
+
+func parseMDAdmPlatformLicense(raw string) *string {
+	for _, line := range strings.Split(raw, "\n") {
+		trimmed := strings.TrimSpace(line)
+		if !strings.HasPrefix(strings.ToLower(trimmed), "license") {
+			continue
+		}
+		if idx := strings.Index(trimmed, ":"); idx >= 0 {
+			val := strings.TrimSpace(trimmed[idx+1:])
+			if val != "" {
+				v := strings.ToLower(val)
+				return &v
+			}
+		}
+	}
+	return nil
+}
+
 func queryDeviceSerial(devPath string) string {
 	if out, err := exec.Command("nvme", "id-ctrl", devPath, "-o", "json").Output(); err == nil {
 		var ctrl nvmeIDCtrl

audit/internal/collector/storage.go

@@ -4,12 +4,52 @@ import (
 	"bee/audit/internal/schema"
 	"encoding/json"
 	"log/slog"
+	"os"
 	"os/exec"
 	"path/filepath"
+	"regexp"
 	"strconv"
 	"strings"
 )
 
+var (
+	pciRescanPath      = "/sys/bus/pci/rescan"
+	scsiHostScanGlob   = "/sys/class/scsi_host/host*/scan"
+	hotplugWriteFile   = os.WriteFile
+	hotplugExecCommand = exec.Command
+	hotplugGlob        = filepath.Glob
+	nvmeLBAFCompactRE  = regexp.MustCompile(`(?im)^\s*lbaf\s+\d+\s*:\s*ms:(\d+)\s+lbads:(\d+).*?\(in use\)\s*$`)
+	nvmeLBAFVerboseRE  = regexp.MustCompile(`(?im)^\s*LBA Format\s+\d+\s*:\s*Metadata Size:\s*(\d+)\s+bytes\s*-\s*Data Size:\s*(\d+)\s+bytes.*?\(in use\)\s*$`)
+	sgReadcapBlockRE   = regexp.MustCompile(`(?im)logical block length\s*=\s*(\d+)\s+bytes`)
+	sgReadcapProtRE    = regexp.MustCompile(`(?im)prot_en\s*=\s*1`)
+)
+
+func bestEffortRescanHotplugStorage() {
+	if err := hotplugWriteFile(pciRescanPath, []byte("1\n"), 0644); err != nil {
+		slog.Info("storage: pci rescan skipped", "path", pciRescanPath, "err", err)
+	} else {
+		slog.Info("storage: triggered pci rescan for hotplug discovery")
+	}
+
+	hostPaths, err := hotplugGlob(scsiHostScanGlob)
+	if err != nil {
+		slog.Info("storage: scsi host scan skipped", "pattern", scsiHostScanGlob, "err", err)
+	} else {
+		for _, path := range hostPaths {
+			if err := hotplugWriteFile(path, []byte("- - -\n"), 0644); err != nil {
+				slog.Info("storage: scsi host scan write failed", "path", path, "err", err)
+				continue
+			}
+			slog.Info("storage: triggered scsi host scan", "path", path)
+		}
+	}
+
+	out, err := hotplugExecCommand("udevadm", "settle", "--timeout=10").CombinedOutput()
+	if err != nil {
+		slog.Info("storage: udev settle after hotplug rescan failed", "err", err, "output", strings.TrimSpace(string(out)))
+	}
+}
+
 func collectStorage() []schema.HardwareStorage {
 	devs := discoverStorageDevices()
 	result := make([]schema.HardwareStorage, 0, len(devs))
@@ -35,6 +75,8 @@ type lsblkDevice struct {
 	Model  string `json:"model"`
 	Tran   string `json:"tran"`
 	Hctl   string `json:"hctl"`
+	LogSec string `json:"log-sec"`
+	PhySec string `json:"phy-sec"`
 }
 
 type lsblkRoot struct {
@@ -101,7 +143,7 @@ func isVirtualHDiskModel(model string) bool {
 
 func lsblkDevices() []lsblkDevice {
 	out, err := exec.Command("lsblk", "-J", "-d",
-		"-o", "NAME,TYPE,SIZE,SERIAL,MODEL,TRAN,HCTL").Output()
+		"-o", "NAME,TYPE,SIZE,SERIAL,MODEL,TRAN,HCTL,LOG-SEC,PHY-SEC").Output()
 	if err != nil {
 		slog.Warn("storage: lsblk failed", "err", err)
 		return nil
@@ -208,6 +250,7 @@ func enrichWithSmartctl(dev lsblkDevice) schema.HardwareStorage {
 	present := true
 	s := schema.HardwareStorage{Present: &present}
 	s.Telemetry = map[string]any{"linux_device": "/dev/" + dev.Name}
+	applyStorageBlockGeometry(&s, dev)
 
 	tran := strings.ToLower(dev.Tran)
 	devPath := "/dev/" + dev.Name
@@ -327,6 +370,7 @@ func enrichWithSmartctl(dev lsblkDevice) schema.HardwareStorage {
 			lifeRemainingPct:     lifeRemaining,
 		}
 		applySCSISmartctlTelemetry(&s, raw, &status)
+		applySCSIProtectionBlockGeometry(&s, devPath)
 		setStorageHealthStatus(&s, status)
 		return s
 	}
@@ -374,6 +418,7 @@ func enrichWithNVMe(dev lsblkDevice) schema.HardwareStorage {
 		Interface:               &iface,
 		Telemetry:               map[string]any{"linux_device": "/dev/" + dev.Name},
 	}
+	applyStorageBlockGeometry(&s, dev)
 
 	devPath := "/dev/" + dev.Name
 	if v := cleanDMIValue(strings.TrimSpace(dev.Model)); v != "" {
@@ -408,6 +453,7 @@ func enrichWithNVMe(dev lsblkDevice) schema.HardwareStorage {
 			}
 		}
 	}
+	applyNVMeBlockGeometry(&s, devPath)
 
 	// smart-log: wear telemetry
 	if out, err := exec.Command("nvme", "smart-log", devPath, "-o", "json").Output(); err == nil {
@@ -540,6 +586,19 @@ func applySCSISmartctlTelemetry(s *schema.HardwareStorage, raw map[string]any, s
 		"path:user_capacity.block_size",
 	)
 	if hasBlockSize && blockSize > 0 {
+		if s.LogicalBlockSizeBytes == nil {
+			s.LogicalBlockSizeBytes = &blockSize
+		}
+		if s.MetadataBytesPerBlock == nil {
+			zero := int64(0)
+			s.MetadataBytesPerBlock = &zero
+		}
+		if s.Telemetry == nil {
+			s.Telemetry = map[string]any{}
+		}
+		s.Telemetry["logical_block_size_bytes"] = *s.LogicalBlockSizeBytes
+		s.Telemetry["metadata_bytes_per_block"] = *s.MetadataBytesPerBlock
+		s.Telemetry["block_format"] = formatBlockFormat(*s.LogicalBlockSizeBytes, *s.MetadataBytesPerBlock)
 		if v, ok := firstInt64(raw,
 			"path:logical_blocks_written",
 			"path:total_lbas_written",
@@ -557,6 +616,117 @@ func applySCSISmartctlTelemetry(s *schema.HardwareStorage, raw map[string]any, s
 	}
 }
 
+func applyStorageBlockGeometry(s *schema.HardwareStorage, dev lsblkDevice) {
+	if s == nil {
+		return
+	}
+	logical := parseStorageBytes(dev.LogSec)
+	physical := parseStorageBytes(dev.PhySec)
+	if logical <= 0 && physical <= 0 {
+		return
+	}
+	if s.Telemetry == nil {
+		s.Telemetry = map[string]any{}
+	}
+	if logical > 0 {
+		s.LogicalBlockSizeBytes = &logical
+		s.Telemetry["logical_block_size_bytes"] = logical
+		if s.MetadataBytesPerBlock == nil {
+			zero := int64(0)
+			s.MetadataBytesPerBlock = &zero
+			s.Telemetry["metadata_bytes_per_block"] = zero
+		}
+	}
+	if physical > 0 {
+		s.PhysicalBlockSizeBytes = &physical
+		s.Telemetry["physical_block_size_bytes"] = physical
+	}
+	if s.LogicalBlockSizeBytes != nil && s.MetadataBytesPerBlock != nil {
+		s.Telemetry["block_format"] = formatBlockFormat(*s.LogicalBlockSizeBytes, *s.MetadataBytesPerBlock)
+	}
+}
+
+func applyNVMeBlockGeometry(s *schema.HardwareStorage, devPath string) {
+	if s == nil || strings.TrimSpace(devPath) == "" {
+		return
+	}
+	out, err := exec.Command("nvme", "id-ns", devPath, "-H").CombinedOutput()
+	if err != nil {
+		return
+	}
+	dataBytes, metadataBytes, ok := parseNVMeBlockFormat(string(out))
+	if !ok {
+		return
+	}
+	setStorageBlockGeometry(s, dataBytes, metadataBytes)
+}
+
+func applySCSIProtectionBlockGeometry(s *schema.HardwareStorage, devPath string) {
+	if s == nil || strings.TrimSpace(devPath) == "" {
+		return
+	}
+	out, err := exec.Command("sg_readcap", "-l", devPath).CombinedOutput()
+	if err != nil {
+		return
+	}
+	dataBytes, metadataBytes, ok := parseSCSIBlockFormat(string(out))
+	if !ok {
+		return
+	}
+	setStorageBlockGeometry(s, dataBytes, metadataBytes)
+}
+
+func setStorageBlockGeometry(s *schema.HardwareStorage, dataBytes, metadataBytes int64) {
+	if s == nil || dataBytes <= 0 || metadataBytes < 0 {
+		return
+	}
+	if s.Telemetry == nil {
+		s.Telemetry = map[string]any{}
+	}
+	s.LogicalBlockSizeBytes = &dataBytes
+	s.MetadataBytesPerBlock = &metadataBytes
+	s.Telemetry["logical_block_size_bytes"] = dataBytes
+	s.Telemetry["metadata_bytes_per_block"] = metadataBytes
+	s.Telemetry["block_format"] = formatBlockFormat(dataBytes, metadataBytes)
+}
+
+func formatBlockFormat(dataBytes, metadataBytes int64) string {
+	return strconv.FormatInt(dataBytes, 10) + "+" + strconv.FormatInt(metadataBytes, 10)
+}
+
+func parseNVMeBlockFormat(raw string) (dataBytes, metadataBytes int64, ok bool) {
+	if m := nvmeLBAFCompactRE.FindStringSubmatch(raw); len(m) == 3 {
+		ms, errMS := strconv.ParseInt(m[1], 10, 64)
+		lbads, errLBADS := strconv.ParseInt(m[2], 10, 64)
+		if errMS == nil && errLBADS == nil && lbads >= 0 && lbads < 63 {
+			return 1 << lbads, ms, true
+		}
+	}
+	if m := nvmeLBAFVerboseRE.FindStringSubmatch(raw); len(m) == 3 {
+		ms, errMS := strconv.ParseInt(m[1], 10, 64)
+		ds, errDS := strconv.ParseInt(m[2], 10, 64)
+		if errMS == nil && errDS == nil && ds > 0 {
+			return ds, ms, true
+		}
+	}
+	return 0, 0, false
+}
+
+func parseSCSIBlockFormat(raw string) (dataBytes, metadataBytes int64, ok bool) {
+	m := sgReadcapBlockRE.FindStringSubmatch(raw)
+	if len(m) != 2 {
+		return 0, 0, false
+	}
+	blockBytes, err := strconv.ParseInt(m[1], 10, 64)
+	if err != nil || blockBytes <= 0 {
+		return 0, 0, false
+	}
+	if sgReadcapProtRE.MatchString(raw) {
+		return blockBytes, 8, true
+	}
+	return blockBytes, 0, true
+}
+
 func firstInt64(root map[string]any, candidates ...string) (int64, bool) {
 	for _, candidate := range candidates {
 		if !strings.HasPrefix(candidate, "path:") {

audit/internal/collector/storage_block_format_test.go

@@ -0,0 +1,69 @@
+package collector
+
+import "testing"
+
+func TestParseNVMeBlockFormatCompact(t *testing.T) {
+	t.Parallel()
+
+	raw := `
+lbaf  0 : ms:0   lbads:9  rp:0x2 (in use)
+lbaf  1 : ms:8   lbads:9  rp:0x1
+`
+	dataBytes, metadataBytes, ok := parseNVMeBlockFormat(raw)
+	if !ok {
+		t.Fatal("parseNVMeBlockFormat returned ok=false")
+	}
+	if dataBytes != 512 || metadataBytes != 0 {
+		t.Fatalf("got %d+%d want 512+0", dataBytes, metadataBytes)
+	}
+}
+
+func TestParseNVMeBlockFormatVerbose(t *testing.T) {
+	t.Parallel()
+
+	raw := `
+LBA Format 0 : Metadata Size: 8 bytes - Data Size: 512 bytes - Relative Performance: 0 Better (in use)
+LBA Format 1 : Metadata Size: 0 bytes - Data Size: 4096 bytes - Relative Performance: 1 Best
+`
+	dataBytes, metadataBytes, ok := parseNVMeBlockFormat(raw)
+	if !ok {
+		t.Fatal("parseNVMeBlockFormat returned ok=false")
+	}
+	if dataBytes != 512 || metadataBytes != 8 {
+		t.Fatalf("got %d+%d want 512+8", dataBytes, metadataBytes)
+	}
+}
+
+func TestParseSCSIBlockFormatWithProtection(t *testing.T) {
+	t.Parallel()
+
+	raw := `
+Read Capacity results:
+   Protection: prot_en=1, p_type=1, p_i_exponent=0
+   Logical block length=512 bytes
+`
+	dataBytes, metadataBytes, ok := parseSCSIBlockFormat(raw)
+	if !ok {
+		t.Fatal("parseSCSIBlockFormat returned ok=false")
+	}
+	if dataBytes != 512 || metadataBytes != 8 {
+		t.Fatalf("got %d+%d want 512+8", dataBytes, metadataBytes)
+	}
+}
+
+func TestParseSCSIBlockFormatWithoutProtection(t *testing.T) {
+	t.Parallel()
+
+	raw := `
+Read Capacity results:
+   Protection: prot_en=0, p_type=0, p_i_exponent=0
+   Logical block length=4096 bytes
+`
+	dataBytes, metadataBytes, ok := parseSCSIBlockFormat(raw)
+	if !ok {
+		t.Fatal("parseSCSIBlockFormat returned ok=false")
+	}
+	if dataBytes != 4096 || metadataBytes != 0 {
+		t.Fatalf("got %d+%d want 4096+0", dataBytes, metadataBytes)
+	}
+}

audit/internal/collector/storage_discovery_test.go

@@ -1,6 +1,12 @@
 package collector
 
-import "testing"
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+)
 
 func TestMergeStorageDevicePrefersNonEmptyFields(t *testing.T) {
 	t.Parallel()
@@ -31,3 +37,82 @@ func TestParseStorageBytes(t *testing.T) {
 		t.Fatalf("parseStorageBytes invalid=%d want 0", got)
 	}
 }
+
+func TestBestEffortRescanHotplugStorage(t *testing.T) {
+	t.Parallel()
+
+	tmp := t.TempDir()
+	rescanPath := filepath.Join(tmp, "pci-rescan")
+	scanDir := filepath.Join(tmp, "scsi_host")
+	host0Path := filepath.Join(scanDir, "host0", "scan")
+	host1Path := filepath.Join(scanDir, "host1", "scan")
+	argsPath := filepath.Join(tmp, "udevadm-args")
+	toolPath := filepath.Join(tmp, "udevadm")
+	if err := os.MkdirAll(filepath.Dir(host0Path), 0755); err != nil {
+		t.Fatalf("mkdir host0: %v", err)
+	}
+	if err := os.MkdirAll(filepath.Dir(host1Path), 0755); err != nil {
+		t.Fatalf("mkdir host1: %v", err)
+	}
+	if err := os.WriteFile(host0Path, nil, 0644); err != nil {
+		t.Fatalf("touch host0 scan: %v", err)
+	}
+	if err := os.WriteFile(host1Path, nil, 0644); err != nil {
+		t.Fatalf("touch host1 scan: %v", err)
+	}
+	script := "#!/bin/sh\nprintf '%s' \"$*\" > \"" + argsPath + "\"\n"
+	if err := os.WriteFile(toolPath, []byte(script), 0755); err != nil {
+		t.Fatalf("write udevadm stub: %v", err)
+	}
+
+	oldPath := os.Getenv("PATH")
+	if err := os.Setenv("PATH", tmp+string(os.PathListSeparator)+oldPath); err != nil {
+		t.Fatalf("set PATH: %v", err)
+	}
+	defer func() { _ = os.Setenv("PATH", oldPath) }()
+
+	oldRescanPath := pciRescanPath
+	oldSCSIGlob := scsiHostScanGlob
+	oldWriteFile := hotplugWriteFile
+	oldExecCommand := hotplugExecCommand
+	oldGlob := hotplugGlob
+	pciRescanPath = rescanPath
+	scsiHostScanGlob = filepath.Join(scanDir, "host*", "scan")
+	hotplugWriteFile = os.WriteFile
+	hotplugExecCommand = exec.Command
+	hotplugGlob = filepath.Glob
+	defer func() {
+		pciRescanPath = oldRescanPath
+		scsiHostScanGlob = oldSCSIGlob
+		hotplugWriteFile = oldWriteFile
+		hotplugExecCommand = oldExecCommand
+		hotplugGlob = oldGlob
+	}()
+
+	bestEffortRescanHotplugStorage()
+
+	raw, err := os.ReadFile(rescanPath)
+	if err != nil {
+		t.Fatalf("read rescan file: %v", err)
+	}
+	if string(raw) != "1\n" {
+		t.Fatalf("rescan payload=%q want %q", string(raw), "1\n")
+	}
+	for _, path := range []string{host0Path, host1Path} {
+		raw, err := os.ReadFile(path)
+		if err != nil {
+			t.Fatalf("read scsi scan file %s: %v", path, err)
+		}
+		if string(raw) != "- - -\n" {
+			t.Fatalf("scsi scan payload at %s =%q want %q", path, string(raw), "- - -\n")
+		}
+	}
+
+	args, err := os.ReadFile(argsPath)
+	if err != nil {
+		t.Fatalf("read udevadm args: %v", err)
+	}
+	if got := strings.TrimSpace(string(args)); got != "settle --timeout=10" {
+		t.Fatalf("udevadm args=%q want %q", got, "settle --timeout=10")
+	}
+}

audit/internal/collector/storage_scsi_test.go

@@ -40,6 +40,12 @@ func TestApplySCSISmartctlTelemetry(t *testing.T) {
 	if disk.ReadBytes == nil || *disk.ReadBytes != 8192000 {
 		t.Fatalf("read_bytes=%v want 8192000", disk.ReadBytes)
 	}
+	if disk.LogicalBlockSizeBytes == nil || *disk.LogicalBlockSizeBytes != 4096 {
+		t.Fatalf("logical_block_size_bytes=%v want 4096", disk.LogicalBlockSizeBytes)
+	}
+	if disk.MetadataBytesPerBlock == nil || *disk.MetadataBytesPerBlock != 0 {
+		t.Fatalf("metadata_bytes_per_block=%v want 0", disk.MetadataBytesPerBlock)
+	}
 	if disk.LifeUsedPct == nil || *disk.LifeUsedPct != 12 {
 		t.Fatalf("life_used_pct=%v want 12", disk.LifeUsedPct)
 	}
@@ -80,6 +86,12 @@ func TestApplySCSISmartctlTelemetryDoesNotOverwriteExistingValues(t *testing.T)
 	if *disk.WrittenBytes != 20 {
 		t.Fatalf("written_bytes overwritten: got %d want 20", *disk.WrittenBytes)
 	}
+	if disk.LogicalBlockSizeBytes == nil || *disk.LogicalBlockSizeBytes != 512 {
+		t.Fatalf("logical_block_size_bytes=%v want 512", disk.LogicalBlockSizeBytes)
+	}
+	if disk.MetadataBytesPerBlock == nil || *disk.MetadataBytesPerBlock != 0 {
+		t.Fatalf("metadata_bytes_per_block=%v want 0", disk.MetadataBytesPerBlock)
+	}
 	if *disk.LifeRemainingPct != 30 {
 		t.Fatalf("life_remaining_pct overwritten: got %v want 30", *disk.LifeRemainingPct)
 	}

audit/internal/collector/vroc_test.go

@@ -28,6 +28,35 @@ md125 : active raid1 nvme2n1[0] nvme3n1[1]
 	}
 }
 
+func TestParseMDAdmPlatformLicense(t *testing.T) {
+	premium := `Platform : Intel(R) Virtual RAID on CPU
+Version  : 1.3.0.1138
+RAID Levels : raid0 raid1 raid5 raid10
+Total Disks : 4
+License  : Premium
+`
+	got := parseMDAdmPlatformLicense(premium)
+	if got == nil || *got != "premium" {
+		t.Fatalf("expected 'premium', got %v", got)
+	}
+
+	standard := `Platform : Intel(R) Virtual RAID on CPU
+License  : Standard
+`
+	got = parseMDAdmPlatformLicense(standard)
+	if got == nil || *got != "standard" {
+		t.Fatalf("expected 'standard', got %v", got)
+	}
+
+	noLicense := `Platform : Intel(R) Virtual RAID on CPU
+Version  : 1.0.0
+`
+	got = parseMDAdmPlatformLicense(noLicense)
+	if got != nil {
+		t.Fatalf("expected nil, got %v", *got)
+	}
+}
+
 func TestHasVROCController(t *testing.T) {
 	intel := vendorIntel
 	model := "Volume Management Device NVMe RAID Controller"

audit/internal/platform/install.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"strconv"
 	"strings"
 )
@@ -18,7 +19,7 @@ type InstallDisk struct {
 	MountedParts []string // partition mount points currently active
 }
 
-const squashfsPath = "/run/live/medium/live/filesystem.squashfs"
+const squashfsGlob = "/run/live/medium/live/*.squashfs"
 
 // ListInstallDisks returns block devices suitable for installation.
 // Excludes the current live boot medium but includes USB drives.
@@ -176,11 +177,22 @@ func inferLiveBootKind(fsType, source, deviceType, transport string) string {
 // squashfs size × 1.5 to allow for extracted filesystem and bootloader.
 // Returns 0 if the squashfs is not available (non-live environment).
 func MinInstallBytes() int64 {
-	fi, err := os.Stat(squashfsPath)
-	if err != nil {
+	files, err := filepath.Glob(squashfsGlob)
+	if err != nil || len(files) == 0 {
 		return 0
 	}
-	return fi.Size() * 3 / 2
+	var total int64
+	for _, path := range files {
+		fi, statErr := os.Stat(path)
+		if statErr != nil {
+			continue
+		}
+		total += fi.Size()
+	}
+	if total == 0 {
+		return 0
+	}
+	return total * 3 / 2
 }
 
 // toramActive returns true when the live system was booted with toram.
@@ -222,12 +234,10 @@ func DiskWarnings(d InstallDisk) []string {
 			humanBytes(min), humanBytes(d.SizeBytes)))
 	}
 	if toramActive() {
-		sqFi, err := os.Stat(squashfsPath)
-		if err == nil {
-			free := freeMemBytes()
-			if free > 0 && free < sqFi.Size()*2 {
-				w = append(w, "toram mode — low RAM, extraction may be slow or fail")
-			}
+		free := freeMemBytes()
+		min := MinInstallBytes()
+		if free > 0 && min > 0 && free < (min*4/3) {
+			w = append(w, "toram mode — low RAM, extraction may be slow or fail")
 		}
 	}
 	return w

audit/internal/platform/install_to_ram.go

@@ -14,6 +14,22 @@ import (
 const installToRAMDir = "/dev/shm/bee-live"
 const copyProgressLogStep int64 = 100 * 1024 * 1024
 
+var liveMediumSquashfsGlob = func() ([]string, error) {
+	return filepath.Glob("/run/live/medium/live/*.squashfs")
+}
+
+var runRemountMedium = func() ([]byte, error) {
+	return exec.Command("bee-remount-medium").CombinedOutput()
+}
+
+var umountLiveMedium = func() error {
+	return exec.Command("umount", "/run/live/medium").Run()
+}
+
+var ejectDevice = func(device string) error {
+	return exec.Command("eject", device).Run()
+}
+
 func (s *System) IsLiveMediaInRAM() bool {
 	return s.LiveMediaRAMState().InRAM
 }
@@ -140,8 +156,7 @@ func (s *System) RunInstallToRAM(ctx context.Context, logFunc func(string)) (ret
 		return nil
 	}
 
-	squashfsFiles, err := filepath.Glob("/run/live/medium/live/*.squashfs")
-	sourceAvailable := err == nil && len(squashfsFiles) > 0
+	squashfsFiles, sourceAvailable := ensureLiveMediumAvailable(log)
 
 	dstDir := installToRAMDir
 
@@ -171,7 +186,7 @@ func (s *System) RunInstallToRAM(ctx context.Context, logFunc func(string)) (ret
 			}
 			goto bindMedium
 		}
-		return fmt.Errorf("no squashfs files found in /run/live/medium/live/ and no prior RAM copy in %s — reconnect the installation medium and retry", dstDir)
+		return fmt.Errorf("no squashfs files found in /run/live/medium/live/ and no prior RAM copy in %s — reconnect the installation medium and retry (or run bee-remount-medium as root)", dstDir)
 	}
 
 	{
@@ -254,10 +269,83 @@ bindMedium:
 	if status.InRAM {
 		log(fmt.Sprintf("Verification passed: live medium now served from %s.", describeLiveBootSource(status)))
 	}
-	log("Done. Squashfs files are in RAM. Installation media can be safely disconnected.")
+	detachInstallMedium(status, log)
+	log("Done. Squashfs files are in RAM. Installation media has been detached when possible.")
 	return nil
 }
 
+func tryRemountLiveMedium(log func(string)) error {
+	output, err := runRemountMedium()
+	trimmed := strings.TrimSpace(string(output))
+	if err != nil {
+		if trimmed != "" && log != nil {
+			for _, line := range strings.Split(trimmed, "\n") {
+				log("bee-remount-medium: " + line)
+			}
+		}
+		return err
+	}
+	if trimmed != "" && log != nil {
+		for _, line := range strings.Split(trimmed, "\n") {
+			log("bee-remount-medium: " + line)
+		}
+	}
+	return nil
+}
+
+func ensureLiveMediumAvailable(log func(string)) ([]string, bool) {
+	squashfsFiles, err := liveMediumSquashfsGlob()
+	sourceAvailable := err == nil && len(squashfsFiles) > 0
+	if sourceAvailable {
+		return squashfsFiles, true
+	}
+
+	if log != nil {
+		log("Live medium not mounted at /run/live/medium — attempting automatic remount scan...")
+	}
+	if remountErr := tryRemountLiveMedium(log); remountErr != nil {
+		if log != nil {
+			log(fmt.Sprintf("Automatic remount did not restore the live medium: %v", remountErr))
+		}
+		return squashfsFiles, false
+	}
+
+	squashfsFiles, err = liveMediumSquashfsGlob()
+	sourceAvailable = err == nil && len(squashfsFiles) > 0
+	if sourceAvailable && log != nil {
+		log("Live medium restored after remount scan.")
+	}
+	return squashfsFiles, sourceAvailable
+}
+
+func detachInstallMedium(status LiveBootSource, log func(string)) {
+	if log == nil {
+		log = func(string) {}
+	}
+
+	log("Detaching original installation medium...")
+	if err := umountLiveMedium(); err != nil {
+		log(fmt.Sprintf("Warning: could not unmount /run/live/medium: %v", err))
+	} else {
+		log("Unmounted /run/live/medium.")
+	}
+
+	device := strings.TrimSpace(status.Device)
+	if device == "" {
+		device = strings.TrimSpace(status.Source)
+	}
+	if device == "" || !strings.HasPrefix(device, "/dev/") {
+		log("No block device identified for eject; skipping media eject.")
+		return
+	}
+
+	if err := ejectDevice(device); err != nil {
+		log(fmt.Sprintf("Warning: could not eject %s: %v", device, err))
+		return
+	}
+	log(fmt.Sprintf("Ejected %s.", device))
+}
+
 func verifyInstallToRAMStatus(status LiveBootSource, dstDir string, mediumRebound bool, log func(string)) error {
 	if status.InRAM {
 		return nil

audit/internal/platform/install_to_ram_test.go

@@ -1,6 +1,9 @@
 package platform
 
-import "testing"
+import (
+	"fmt"
+	"testing"
+)
 
 func TestInferLiveBootKind(t *testing.T) {
 	t.Parallel()
@@ -124,3 +127,156 @@ func TestShouldLogCopyProgress(t *testing.T) {
 		t.Fatal("expected final completion log")
 	}
 }
+
+func TestTryRemountLiveMedium(t *testing.T) {
+	t.Parallel()
+
+	orig := runRemountMedium
+	t.Cleanup(func() {
+		runRemountMedium = orig
+	})
+
+	t.Run("success", func(t *testing.T) {
+		runRemountMedium = func() ([]byte, error) {
+			return []byte("[10:57:31] Mounted /dev/sr1 on /run/live/medium\n"), nil
+		}
+		var logs []string
+		if err := tryRemountLiveMedium(func(msg string) { logs = append(logs, msg) }); err != nil {
+			t.Fatalf("tryRemountLiveMedium() error = %v", err)
+		}
+		if len(logs) != 1 || logs[0] != "bee-remount-medium: [10:57:31] Mounted /dev/sr1 on /run/live/medium" {
+			t.Fatalf("logs=%v", logs)
+		}
+	})
+
+	t.Run("failure", func(t *testing.T) {
+		runRemountMedium = func() ([]byte, error) {
+			return []byte("must be run as root\n"), fmt.Errorf("exit status 1")
+		}
+		var logs []string
+		err := tryRemountLiveMedium(func(msg string) { logs = append(logs, msg) })
+		if err == nil {
+			t.Fatal("expected error")
+		}
+		if len(logs) != 1 || logs[0] != "bee-remount-medium: must be run as root" {
+			t.Fatalf("logs=%v", logs)
+		}
+	})
+}
+
+func TestEnsureLiveMediumAvailableRemountsSource(t *testing.T) {
+	t.Parallel()
+
+	origGlob := liveMediumSquashfsGlob
+	origRemount := runRemountMedium
+	t.Cleanup(func() {
+		liveMediumSquashfsGlob = origGlob
+		runRemountMedium = origRemount
+	})
+
+	callCount := 0
+	liveMediumSquashfsGlob = func() ([]string, error) {
+		callCount++
+		if callCount == 1 {
+			return nil, nil
+		}
+		return []string{"/run/live/medium/live/filesystem.squashfs"}, nil
+	}
+	runRemountMedium = func() ([]byte, error) {
+		return []byte("Mounted /dev/sr1 on /run/live/medium\n"), nil
+	}
+
+	var logs []string
+	files, ok := ensureLiveMediumAvailable(func(msg string) { logs = append(logs, msg) })
+	if !ok {
+		t.Fatal("expected live medium to become available after remount")
+	}
+	if callCount < 2 {
+		t.Fatalf("liveMediumSquashfsGlob called %d times, want at least 2", callCount)
+	}
+	if len(files) != 1 || files[0] != "/run/live/medium/live/filesystem.squashfs" {
+		t.Fatalf("files=%v", files)
+	}
+	found := false
+	for _, msg := range logs {
+		if msg == "Live medium restored after remount scan." {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Fatalf("expected remount success log, logs=%v", logs)
+	}
+}
+
+func TestDetachInstallMedium(t *testing.T) {
+	t.Parallel()
+
+	origUmount := umountLiveMedium
+	origEject := ejectDevice
+	t.Cleanup(func() {
+		umountLiveMedium = origUmount
+		ejectDevice = origEject
+	})
+
+	t.Run("success", func(t *testing.T) {
+		var umountCalled bool
+		var ejected string
+		umountLiveMedium = func() error {
+			umountCalled = true
+			return nil
+		}
+		ejectDevice = func(device string) error {
+			ejected = device
+			return nil
+		}
+		var logs []string
+		detachInstallMedium(LiveBootSource{Kind: "cdrom", Device: "/dev/sr1"}, func(msg string) { logs = append(logs, msg) })
+		if !umountCalled {
+			t.Fatal("expected umountLiveMedium to be called")
+		}
+		if ejected != "/dev/sr1" {
+			t.Fatalf("ejected=%q want /dev/sr1", ejected)
+		}
+		if len(logs) < 3 {
+			t.Fatalf("logs=%v", logs)
+		}
+	})
+
+	t.Run("no device", func(t *testing.T) {
+		umountLiveMedium = func() error { return nil }
+		ejectDevice = func(device string) error {
+			t.Fatalf("unexpected eject for %q", device)
+			return nil
+		}
+		var logs []string
+		detachInstallMedium(LiveBootSource{Kind: "ram", Source: "tmpfs"}, func(msg string) { logs = append(logs, msg) })
+		found := false
+		for _, msg := range logs {
+			if msg == "No block device identified for eject; skipping media eject." {
+				found = true
+				break
+			}
+		}
+		if !found {
+			t.Fatalf("logs=%v", logs)
+		}
+	})
+
+	t.Run("eject failure is warning only", func(t *testing.T) {
+		umountLiveMedium = func() error { return nil }
+		ejectDevice = func(device string) error { return fmt.Errorf("exit status 1") }
+		var logs []string
+		detachInstallMedium(LiveBootSource{Kind: "usb", Device: "/dev/sdb1"}, func(msg string) { logs = append(logs, msg) })
+		found := false
+		for _, msg := range logs {
+			if msg == "Warning: could not eject /dev/sdb1: exit status 1" {
+				found = true
+				break
+			}
+		}
+		if !found {
+			t.Fatalf("logs=%v", logs)
+		}
+	})
+}

audit/internal/schema/hardware.go

@@ -66,6 +66,7 @@ type HardwareSnapshot struct {
 	PowerSupplies []HardwarePowerSupply    `json:"power_supplies,omitempty"`
 	Sensors       *HardwareSensors         `json:"sensors,omitempty"`
 	EventLogs     []HardwareEventLog       `json:"event_logs,omitempty"`
+	VROCLicense   *string                  `json:"vroc_license,omitempty"`
 }
 
 type HardwareHealthSummary struct {
@@ -143,30 +144,33 @@ type HardwareMemory struct {
 
 type HardwareStorage struct {
 	HardwareComponentStatus
-	Slot                  *string        `json:"slot,omitempty"`
-	Type                  *string        `json:"type,omitempty"`
-	Model                 *string        `json:"model,omitempty"`
-	SizeGB                *int           `json:"size_gb,omitempty"`
-	SerialNumber          *string        `json:"serial_number,omitempty"`
-	Manufacturer          *string        `json:"manufacturer,omitempty"`
-	Firmware              *string        `json:"firmware,omitempty"`
-	Interface             *string        `json:"interface,omitempty"`
-	Present               *bool          `json:"present,omitempty"`
-	TemperatureC          *float64       `json:"temperature_c,omitempty"`
-	PowerOnHours          *int64         `json:"power_on_hours,omitempty"`
-	PowerCycles           *int64         `json:"power_cycles,omitempty"`
-	UnsafeShutdowns       *int64         `json:"unsafe_shutdowns,omitempty"`
-	MediaErrors           *int64         `json:"media_errors,omitempty"`
-	ErrorLogEntries       *int64         `json:"error_log_entries,omitempty"`
-	WrittenBytes          *int64         `json:"written_bytes,omitempty"`
-	ReadBytes             *int64         `json:"read_bytes,omitempty"`
-	LifeUsedPct           *float64       `json:"life_used_pct,omitempty"`
-	LifeRemainingPct      *float64       `json:"life_remaining_pct,omitempty"`
-	AvailableSparePct     *float64       `json:"available_spare_pct,omitempty"`
-	ReallocatedSectors    *int64         `json:"reallocated_sectors,omitempty"`
-	CurrentPendingSectors *int64         `json:"current_pending_sectors,omitempty"`
-	OfflineUncorrectable  *int64         `json:"offline_uncorrectable,omitempty"`
-	Telemetry             map[string]any `json:"-"`
+	Slot                   *string        `json:"slot,omitempty"`
+	Type                   *string        `json:"type,omitempty"`
+	Model                  *string        `json:"model,omitempty"`
+	SizeGB                 *int           `json:"size_gb,omitempty"`
+	LogicalBlockSizeBytes  *int64         `json:"logical_block_size_bytes,omitempty"`
+	PhysicalBlockSizeBytes *int64         `json:"physical_block_size_bytes,omitempty"`
+	MetadataBytesPerBlock  *int64         `json:"metadata_bytes_per_block,omitempty"`
+	SerialNumber           *string        `json:"serial_number,omitempty"`
+	Manufacturer           *string        `json:"manufacturer,omitempty"`
+	Firmware               *string        `json:"firmware,omitempty"`
+	Interface              *string        `json:"interface,omitempty"`
+	Present                *bool          `json:"present,omitempty"`
+	TemperatureC           *float64       `json:"temperature_c,omitempty"`
+	PowerOnHours           *int64         `json:"power_on_hours,omitempty"`
+	PowerCycles            *int64         `json:"power_cycles,omitempty"`
+	UnsafeShutdowns        *int64         `json:"unsafe_shutdowns,omitempty"`
+	MediaErrors            *int64         `json:"media_errors,omitempty"`
+	ErrorLogEntries        *int64         `json:"error_log_entries,omitempty"`
+	WrittenBytes           *int64         `json:"written_bytes,omitempty"`
+	ReadBytes              *int64         `json:"read_bytes,omitempty"`
+	LifeUsedPct            *float64       `json:"life_used_pct,omitempty"`
+	LifeRemainingPct       *float64       `json:"life_remaining_pct,omitempty"`
+	AvailableSparePct      *float64       `json:"available_spare_pct,omitempty"`
+	ReallocatedSectors     *int64         `json:"reallocated_sectors,omitempty"`
+	CurrentPendingSectors  *int64         `json:"current_pending_sectors,omitempty"`
+	OfflineUncorrectable   *int64         `json:"offline_uncorrectable,omitempty"`
+	Telemetry              map[string]any `json:"-"`
 }
 
 type HardwarePCIeDevice struct {

audit/internal/schema/hardware_test.go

@@ -50,6 +50,9 @@ func TestHardwareSnapshotMarshalsStorageTelemetryFields(t *testing.T) {
 	writtenBytes := int64(9876543210)
 	readBytes := int64(1234567890)
 	lifeRemainingPct := 91.0
+	logicalBlockSizeBytes := int64(512)
+	physicalBlockSizeBytes := int64(4096)
+	metadataBytesPerBlock := int64(8)
 
 	payload := HardwareIngestRequest{
 		CollectedAt: "2026-03-15T15:00:00Z",
@@ -57,12 +60,15 @@ func TestHardwareSnapshotMarshalsStorageTelemetryFields(t *testing.T) {
 			Board: HardwareBoard{SerialNumber: "SRV-001"},
 			Storage: []HardwareStorage{
 				{
-					SerialNumber:     stringPtr("DISK-001"),
-					Model:            stringPtr("TestDisk"),
-					PowerOnHours:     &powerOnHours,
-					WrittenBytes:     &writtenBytes,
-					ReadBytes:        &readBytes,
-					LifeRemainingPct: &lifeRemainingPct,
+					SerialNumber:           stringPtr("DISK-001"),
+					Model:                  stringPtr("TestDisk"),
+					LogicalBlockSizeBytes:  &logicalBlockSizeBytes,
+					PhysicalBlockSizeBytes: &physicalBlockSizeBytes,
+					MetadataBytesPerBlock:  &metadataBytesPerBlock,
+					PowerOnHours:           &powerOnHours,
+					WrittenBytes:           &writtenBytes,
+					ReadBytes:              &readBytes,
+					LifeRemainingPct:       &lifeRemainingPct,
 				},
 			},
 		},
@@ -75,6 +81,9 @@ func TestHardwareSnapshotMarshalsStorageTelemetryFields(t *testing.T) {
 	text := string(data)
 	for _, needle := range []string{
 		`"storage":[{`,
+		`"logical_block_size_bytes":512`,
+		`"physical_block_size_bytes":4096`,
+		`"metadata_bytes_per_block":8`,
 		`"power_on_hours":12450`,
 		`"written_bytes":9876543210`,
 		`"read_bytes":1234567890`,

audit/internal/webui/api.go

@@ -125,6 +125,8 @@ func defaultTaskPriority(target string, params taskParams) int {
 		return taskPriorityInstall
 	case "install-to-ram":
 		return taskPriorityInstallToRAM
+	case "nvme-format":
+		return taskPriorityInstall
 	case "audit":
 		return taskPriorityAudit
 	case "nvidia-bench-perf", "nvidia-bench-power", "nvidia-bench-autotune":
@@ -1295,7 +1297,7 @@ func (h *handler) handleAPIInstallToRAM(w http.ResponseWriter, r *http.Request)
 var standardTools = []string{
 	"dmidecode", "smartctl", "nvme", "lspci", "ipmitool",
 	"nvidia-smi", "dcgmi", "nv-hostengine", "memtester", "stress-ng", "nvtop",
-	"mstflint", "qrencode",
+	"mstflint",
 }
 
 func (h *handler) handleAPIToolsCheck(w http.ResponseWriter, r *http.Request) {

audit/internal/webui/api_test.go

@@ -85,6 +85,27 @@ func TestHandleAPIBlackboxStatusReturnsPersistedState(t *testing.T) {
 	}
 }
 
+func TestParseNVMeFormatModes(t *testing.T) {
+	raw := `
+lbaf  0 : ms:0   lbads:9  rp:0x2 (in use)
+lbaf  1 : ms:8   lbads:9  rp:0x1
+lbaf  2 : ms:0   lbads:12 rp:0
+`
+	modes := parseNVMeFormatModes(raw)
+	if len(modes) != 3 {
+		t.Fatalf("modes=%#v want 3 modes", modes)
+	}
+	if modes[0].Mode != 0 || modes[0].DataBytes != 512 || modes[0].MetadataBytes != 0 || !modes[0].InUse {
+		t.Fatalf("mode 0=%#v", modes[0])
+	}
+	if modes[1].Label != "MODE 1 (512+8)" {
+		t.Fatalf("mode 1 label=%q", modes[1].Label)
+	}
+	if modes[2].DataBytes != 4096 || modes[2].MetadataBytes != 0 {
+		t.Fatalf("mode 2=%#v", modes[2])
+	}
+}
+
 func TestHandleAPIBenchmarkNvidiaRunQueuesSelectedGPUs(t *testing.T) {
 	globalQueue.mu.Lock()
 	originalTasks := globalQueue.tasks

audit/internal/webui/jobs.go

@@ -91,6 +91,7 @@ func (j *jobState) writeLogLineLocked(line string) {
 		j.logBuf = bufio.NewWriterSize(f, 64*1024)
 	}
 	_, _ = j.logBuf.WriteString(line + "\n")
+	_ = j.logBuf.Flush()
 }
 
 // closeLog flushes and closes the log file. Called after all task output is done.

audit/internal/webui/nvme_format.go

@@ -0,0 +1,368 @@
+package webui
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+)
+
+type nvmeFormatMode struct {
+	Mode          int    `json:"mode"`
+	DataBytes     int64  `json:"data_bytes"`
+	MetadataBytes int64  `json:"metadata_bytes"`
+	InUse         bool   `json:"in_use"`
+	Label         string `json:"label"`
+}
+
+type nvmeFormatDisk struct {
+	Device        string           `json:"device"`
+	Model         string           `json:"model,omitempty"`
+	Serial        string           `json:"serial,omitempty"`
+	Size          string           `json:"size,omitempty"`
+	CurrentMode   int              `json:"current_mode"`
+	CurrentFormat string           `json:"current_format"`
+	Modes         []nvmeFormatMode `json:"modes"`
+	Error         string           `json:"error,omitempty"`
+}
+
+type nvmeListJSON struct {
+	Devices []struct {
+		DevicePath   string `json:"DevicePath"`
+		ModelNumber  string `json:"ModelNumber"`
+		SerialNumber string `json:"SerialNumber"`
+		PhysicalSize int64  `json:"PhysicalSize"`
+	} `json:"Devices"`
+}
+
+var (
+	nvmeFormatDeviceRE     = regexp.MustCompile(`^/dev/nvme[0-9]+n[0-9]+$`)
+	nvmeLBAFCompactLineRE  = regexp.MustCompile(`(?im)^\s*lbaf\s+(\d+)\s*:\s*ms:(\d+)\s+lbads:(\d+).*$`)
+	nvmeLBAFVerboseLineRE  = regexp.MustCompile(`(?im)^\s*LBA Format\s+(\d+)\s*:\s*Metadata Size:\s*(\d+)\s+bytes\s*-\s*Data Size:\s*(\d+)\s+bytes.*$`)
+	nvmeCommandContext     = exec.CommandContext
+	nvmeListFormatsTimeout = 20 * time.Second
+)
+
+func listNVMeFormatDisks(ctx context.Context) ([]nvmeFormatDisk, error) {
+	ctx, cancel := context.WithTimeout(ctx, nvmeListFormatsTimeout)
+	defer cancel()
+	out, err := nvmeCommandContext(ctx, "nvme", "list", "-o", "json").Output()
+	if err != nil {
+		return nil, err
+	}
+	var root nvmeListJSON
+	if err := json.Unmarshal(out, &root); err != nil {
+		return nil, err
+	}
+	disks := make([]nvmeFormatDisk, 0, len(root.Devices))
+	seen := map[string]struct{}{}
+	for _, dev := range root.Devices {
+		path := strings.TrimSpace(dev.DevicePath)
+		if !nvmeFormatDeviceRE.MatchString(path) {
+			continue
+		}
+		if _, ok := seen[path]; ok {
+			continue
+		}
+		seen[path] = struct{}{}
+		disk := nvmeFormatDisk{
+			Device:      path,
+			Model:       strings.TrimSpace(dev.ModelNumber),
+			Serial:      strings.TrimSpace(dev.SerialNumber),
+			Size:        formatNVMeBytes(dev.PhysicalSize),
+			CurrentMode: -1,
+		}
+		modes, parseErr := readNVMeFormatModes(ctx, path)
+		if parseErr != nil {
+			disk.Error = parseErr.Error()
+		}
+		disk.Modes = modes
+		for _, mode := range modes {
+			if mode.InUse {
+				disk.CurrentMode = mode.Mode
+				disk.CurrentFormat = formatNVMeBlock(mode.DataBytes, mode.MetadataBytes)
+				break
+			}
+		}
+		disks = append(disks, disk)
+	}
+	sort.Slice(disks, func(i, j int) bool { return disks[i].Device < disks[j].Device })
+	return disks, nil
+}
+
+func readNVMeFormatModes(ctx context.Context, device string) ([]nvmeFormatMode, error) {
+	if !nvmeFormatDeviceRE.MatchString(device) {
+		return nil, fmt.Errorf("invalid NVMe device")
+	}
+	out, err := nvmeCommandContext(ctx, "nvme", "id-ns", device, "-H").CombinedOutput()
+	if err != nil {
+		msg := strings.TrimSpace(string(out))
+		if msg == "" {
+			msg = err.Error()
+		}
+		return nil, fmt.Errorf("%s", msg)
+	}
+	modes := parseNVMeFormatModes(string(out))
+	if len(modes) == 0 {
+		return nil, fmt.Errorf("no LBA format modes found")
+	}
+	return modes, nil
+}
+
+func parseNVMeFormatModes(raw string) []nvmeFormatMode {
+	byMode := map[int]nvmeFormatMode{}
+	for _, m := range nvmeLBAFCompactLineRE.FindAllStringSubmatch(raw, -1) {
+		mode, errMode := strconv.Atoi(m[1])
+		metadata, errMS := strconv.ParseInt(m[2], 10, 64)
+		lbads, errLBADS := strconv.Atoi(m[3])
+		if errMode != nil || errMS != nil || errLBADS != nil || lbads < 0 || lbads >= 63 {
+			continue
+		}
+		data := int64(1) << lbads
+		line := m[0]
+		byMode[mode] = nvmeFormatMode{
+			Mode:          mode,
+			DataBytes:     data,
+			MetadataBytes: metadata,
+			InUse:         strings.Contains(strings.ToLower(line), "in use"),
+			Label:         fmt.Sprintf("MODE %d (%s)", mode, formatNVMeBlock(data, metadata)),
+		}
+	}
+	for _, m := range nvmeLBAFVerboseLineRE.FindAllStringSubmatch(raw, -1) {
+		mode, errMode := strconv.Atoi(m[1])
+		metadata, errMS := strconv.ParseInt(m[2], 10, 64)
+		data, errData := strconv.ParseInt(m[3], 10, 64)
+		if errMode != nil || errMS != nil || errData != nil || data <= 0 {
+			continue
+		}
+		line := m[0]
+		byMode[mode] = nvmeFormatMode{
+			Mode:          mode,
+			DataBytes:     data,
+			MetadataBytes: metadata,
+			InUse:         strings.Contains(strings.ToLower(line), "in use"),
+			Label:         fmt.Sprintf("MODE %d (%s)", mode, formatNVMeBlock(data, metadata)),
+		}
+	}
+	modes := make([]nvmeFormatMode, 0, len(byMode))
+	for _, mode := range byMode {
+		modes = append(modes, mode)
+	}
+	sort.Slice(modes, func(i, j int) bool { return modes[i].Mode < modes[j].Mode })
+	return modes
+}
+
+func runNVMeFormatTask(ctx context.Context, j *jobState, device string, lbaf int) error {
+	if !nvmeFormatDeviceRE.MatchString(device) {
+		return fmt.Errorf("invalid NVMe device")
+	}
+	modes, err := readNVMeFormatModes(ctx, device)
+	if err != nil {
+		return err
+	}
+	var selected nvmeFormatMode
+	found := false
+	for _, mode := range modes {
+		if mode.Mode == lbaf {
+			selected = mode
+			found = true
+			break
+		}
+	}
+	if !found {
+		return fmt.Errorf("MODE %d is not available on %s", lbaf, device)
+	}
+	ms := 0
+	if selected.MetadataBytes > 0 {
+		ms = 1
+	}
+	j.append(fmt.Sprintf("Formatting %s to %s with --lbaf=%d --ms=%d --force", device, formatNVMeBlock(selected.DataBytes, selected.MetadataBytes), selected.Mode, ms))
+	cmd := nvmeCommandContext(ctx, "nvme", "format", device, fmt.Sprintf("--lbaf=%d", selected.Mode), fmt.Sprintf("--ms=%d", ms), "--force")
+	return streamCmdJob(j, cmd)
+}
+
+func (h *handler) handleAPINVMeFormats(w http.ResponseWriter, r *http.Request) {
+	disks, err := listNVMeFormatDisks(r.Context())
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, disks)
+}
+
+func (h *handler) handleAPINVMeFormatRun(w http.ResponseWriter, r *http.Request) {
+	var req struct {
+		Device string `json:"device"`
+		LBAF   int    `json:"lbaf"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid request body")
+		return
+	}
+	if !nvmeFormatDeviceRE.MatchString(req.Device) {
+		writeError(w, http.StatusBadRequest, "invalid NVMe device")
+		return
+	}
+	disks, err := listNVMeFormatDisks(r.Context())
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	var label string
+	allowed := false
+	for _, disk := range disks {
+		if disk.Device != req.Device {
+			continue
+		}
+		for _, mode := range disk.Modes {
+			if mode.Mode == req.LBAF {
+				allowed = true
+				label = mode.Label
+				break
+			}
+		}
+	}
+	if !allowed {
+		writeError(w, http.StatusBadRequest, "LBA format mode is not available for this device")
+		return
+	}
+	name := fmt.Sprintf("NVMe Format %s to %s", filepath.Base(req.Device), label)
+	t := &Task{
+		ID:        newJobID("nvme-format"),
+		Name:      name,
+		Target:    "nvme-format",
+		Priority:  defaultTaskPriority("nvme-format", taskParams{}),
+		Status:    TaskPending,
+		CreatedAt: time.Now(),
+		params: taskParams{
+			Device: req.Device,
+			LBAF:   req.LBAF,
+		},
+	}
+	globalQueue.enqueue(t)
+	writeJSON(w, map[string]string{"task_id": t.ID, "job_id": t.ID})
+}
+
+func formatNVMeBlock(dataBytes, metadataBytes int64) string {
+	return strconv.FormatInt(dataBytes, 10) + "+" + strconv.FormatInt(metadataBytes, 10)
+}
+
+func formatNVMeBytes(n int64) string {
+	if n <= 0 {
+		return ""
+	}
+	units := []string{"B", "KB", "MB", "GB", "TB", "PB"}
+	v := float64(n)
+	unit := 0
+	for v >= 1000 && unit < len(units)-1 {
+		v /= 1000
+		unit++
+	}
+	if unit == 0 {
+		return fmt.Sprintf("%d B", n)
+	}
+	return fmt.Sprintf("%.1f %s", v, units[unit])
+}
+
+func renderNVMeFormatInline() string {
+	return `<div id="nvme-format-status" style="font-size:13px;color:var(--muted);margin-bottom:12px">Loading NVMe disks...</div>
+<div id="nvme-format-table"><p style="color:var(--muted);font-size:13px">Loading...</p></div>
+<script>
+function nvmeFormatEsc(s) {
+  return String(s == null ? '' : s).replace(/[&<>"']/g, function(c) {
+    return {'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c];
+  });
+}
+function loadNVMeFormats() {
+  var status = document.getElementById('nvme-format-status');
+  var table = document.getElementById('nvme-format-table');
+  status.textContent = 'Loading NVMe disks...';
+  status.style.color = 'var(--muted)';
+  table.innerHTML = '<p style="color:var(--muted);font-size:13px">Loading...</p>';
+  fetch('/api/tools/nvme-formats').then(function(r) { return r.json().then(function(d) { if (!r.ok) throw new Error(d.error || ('HTTP ' + r.status)); return d; }); }).then(function(disks) {
+    window._nvmeFormatDisks = Array.isArray(disks) ? disks : [];
+    if (!window._nvmeFormatDisks.length) {
+      status.textContent = 'No NVMe disks found.';
+      table.innerHTML = '';
+      return;
+    }
+    status.textContent = window._nvmeFormatDisks.length + ' NVMe disk(s) found.';
+    var rows = window._nvmeFormatDisks.map(function(d, idx) {
+      var current = d.current_format ? (d.current_format + ' / MODE ' + d.current_mode) : 'unknown';
+      var detail = [d.model || '', d.serial || '', d.size || ''].filter(Boolean).join(' | ');
+      var options = (d.modes || []).map(function(m) {
+        return '<option value="' + m.mode + '"' + (m.in_use ? ' selected' : '') + '>' + nvmeFormatEsc(m.label) + '</option>';
+      }).join('');
+      var disabled = options ? '' : ' disabled';
+      var err = d.error ? '<div style="font-size:12px;color:var(--crit-fg,#9f3a38);margin-top:4px">' + nvmeFormatEsc(d.error) + '</div>' : '';
+      return '<tr>'
+        + '<td style="font-family:monospace;white-space:nowrap">' + nvmeFormatEsc(d.device) + (detail ? '<div style="font-family:inherit;font-size:12px;color:var(--muted)">' + nvmeFormatEsc(detail) + '</div>' : '') + '</td>'
+        + '<td style="white-space:nowrap">' + nvmeFormatEsc(current) + err + '</td>'
+        + '<td style="white-space:nowrap"><select id="nvme-format-select-' + idx + '"' + disabled + '>' + options + '</select></td>'
+        + '<td style="white-space:nowrap"><button class="btn btn-sm btn-primary" onclick="nvmeFormatRun(' + idx + ', this)"' + disabled + '>Apply</button><div class="nvme-format-row-msg" style="margin-top:6px;font-size:12px;color:var(--muted)"></div></td>'
+        + '</tr>';
+    }).join('');
+    table.innerHTML = '<table><tr><th>Disk</th><th>Current block / mode</th><th>New mode</th><th>Action</th></tr>' + rows + '</table>';
+  }).catch(function(e) {
+    status.textContent = 'Error loading NVMe disks: ' + e.message;
+    status.style.color = 'var(--crit-fg,#9f3a38)';
+    table.innerHTML = '';
+  });
+}
+function nvmeWaitTaskDone(taskID, rowMsg) {
+  var timer = setInterval(function() {
+    fetch('/api/tasks').then(function(r) { return r.json(); }).then(function(tasks) {
+      var task = (tasks || []).find(function(t) { return t.id === taskID; });
+      if (!task) return;
+      if (task.status === 'done' || task.status === 'failed' || task.status === 'cancelled') {
+        clearInterval(timer);
+        rowMsg.textContent = 'Task ' + taskID + ': ' + task.status + (task.error ? ' - ' + task.error : '');
+        rowMsg.style.color = task.status === 'done' ? 'var(--ok,green)' : 'var(--crit-fg,#9f3a38)';
+        loadNVMeFormats();
+      }
+    }).catch(function(){});
+  }, 1500);
+}
+function nvmeFormatRun(idx, btn) {
+  var disk = (window._nvmeFormatDisks || [])[idx];
+  var select = document.getElementById('nvme-format-select-' + idx);
+  var row = btn.closest('td');
+  var rowMsg = row.querySelector('.nvme-format-row-msg');
+  if (!disk || !select) return;
+  var lbaf = parseInt(select.value, 10);
+  var mode = (disk.modes || []).find(function(m) { return m.mode === lbaf; });
+  if (!mode) return;
+  if (!window.confirm('Format ' + disk.device + ' to ' + mode.label + '? This erases data on the namespace.')) return;
+  btn.disabled = true;
+  rowMsg.style.color = 'var(--muted)';
+  rowMsg.textContent = 'Queued...';
+  fetch('/api/tools/nvme-format/run', {
+    method:'POST',
+    headers:{'Content-Type':'application/json'},
+    body:JSON.stringify({device: disk.device, lbaf: lbaf})
+  }).then(function(r) { return r.json().then(function(d) { if (!r.ok) throw new Error(d.error || ('HTTP ' + r.status)); return d; }); }).then(function(d) {
+    rowMsg.textContent = 'Task ' + d.task_id + ' queued.';
+    nvmeWaitTaskDone(d.task_id, rowMsg);
+  }).catch(function(e) {
+    rowMsg.style.color = 'var(--crit-fg,#9f3a38)';
+    rowMsg.textContent = 'Error: ' + e.message;
+  }).finally(function() {
+    btn.disabled = false;
+  });
+}
+loadNVMeFormats();
+</script>`
+}
+
+func renderNVMeFormatCard() string {
+	return `<div class="card"><div class="card-head">NVMe Block Format <button class="btn btn-sm btn-secondary" onclick="loadNVMeFormats()" style="margin-left:auto">&#8635; Refresh</button></div><div class="card-body">` +
+		`<p style="font-size:13px;color:var(--muted);margin-bottom:12px">Lists NVMe namespaces and changes their LBA format through a queued task.</p>` +
+		renderNVMeFormatInline() + `</div></div>`
+}

audit/internal/webui/page_export_tools.go

@@ -431,7 +431,7 @@ fetch('/api/system/ram-status').then(r=>r.json()).then(d=>{
   else if (kind === 'disk') label = 'disk (' + source + ')';
   else label = source;
   boot.textContent = 'Current boot source: ' + label + '.';
-  txt.textContent = d.message || 'Checking...';
+  txt.textContent = d.blocked_reason || d.message || 'Checking...';
   if (d.status === 'ok' || d.in_ram) {
     txt.style.color = 'var(--ok, green)';
   } else if (d.status === 'failed') {
@@ -475,6 +475,7 @@ function installToRAM() {
 <div class="card"><div class="card-head">Services</div><div class="card-body">` +
 		renderServicesInline() + `</div></div>
 
+` + renderNVMeFormatCard() + `
 
 <script>
 function checkTools() {

audit/internal/webui/server.go

@@ -307,6 +307,8 @@ func NewHandler(opts HandlerOptions) http.Handler {
 
 	// Tools
 	mux.HandleFunc("GET /api/tools/check", h.handleAPIToolsCheck)
+	mux.HandleFunc("GET /api/tools/nvme-formats", h.handleAPINVMeFormats)
+	mux.HandleFunc("POST /api/tools/nvme-format/run", h.handleAPINVMeFormatRun)
 
 	// GPU presence / tools
 	mux.HandleFunc("GET /api/gpu/presence", h.handleAPIGPUPresence)
@@ -572,6 +574,7 @@ func (h *handler) handleExportIndex(w http.ResponseWriter, r *http.Request) {
 
 func (h *handler) handleViewer(w http.ResponseWriter, r *http.Request) {
 	snapshot, _ := loadSnapshot(h.opts.AuditPath)
+	snapshot = enrichSnapshotForViewer(snapshot)
 	body, err := viewer.RenderHTML(snapshot, h.opts.Title)
 	if err != nil {
 		http.Error(w, err.Error(), http.StatusInternalServerError)
@@ -1291,8 +1294,8 @@ const loadingPageHTML = `<!DOCTYPE html>
 *{margin:0;padding:0;box-sizing:border-box}
 html,body{height:100%;background:#0f1117;display:flex;align-items:center;justify-content:center;font-family:'Courier New',monospace;color:#e2e8f0}
 .wrap{text-align:center;width:420px}
-.logo{font-size:11px;line-height:1.4;color:#f6c90e;margin-bottom:6px;white-space:pre;text-align:left}
-.subtitle{font-size:12px;color:#a0aec0;text-align:left;margin-bottom:24px;padding-left:2px}
+.brand{font-size:22px;letter-spacing:.18em;color:#f6c90e;margin-bottom:6px;text-align:left}
+.subtitle{font-size:12px;color:#a0aec0;text-align:left;margin-bottom:24px}
 .spinner{width:36px;height:36px;border:3px solid #2d3748;border-top-color:#f6c90e;border-radius:50%;animation:spin .8s linear infinite;margin:0 auto 14px}
 .spinner.hidden{display:none}
 @keyframes spin{to{transform:rotate(360deg)}}
@@ -1310,12 +1313,7 @@ td:first-child{color:#718096;width:55%}
 </head>
 <body>
 <div class="wrap">
-  <div class="logo">  ███████╗ █████╗ ███████╗██╗   ██╗      ██████╗ ███████╗███████╗
-  ██╔════╝██╔══██╗██╔════╝╚██╗ ██╔╝      ██╔══██╗██╔════╝██╔════╝
-  █████╗  ███████║███████╗ ╚████╔╝ █████╗██████╔╝█████╗  █████╗
-  ██╔══╝  ██╔══██║╚════██║  ╚██╔╝  ╚════╝██╔══██╗██╔══╝  ██╔══╝
-  ███████╗██║  ██║███████║   ██║         ██████╔╝███████╗███████╗
-  ╚══════╝╚═╝  ╚═╝╚══════╝   ╚═╝         ╚═════╝ ╚══════╝╚══════╝</div>
+  <div class="brand">EASY BEE</div>
   <div class="subtitle">Hardware Audit LiveCD</div>
   <div class="spinner" id="spin"></div>
   <div class="status" id="st">Connecting to bee-web...</div>
@@ -1325,8 +1323,20 @@ td:first-child{color:#718096;width:55%}
 <script>
 (function(){
 var gone = false;
+var pollStarted = false;
+var fallbackOpenTimer = null;
+var AUTO_OPEN_DELAY_MS = 15000;
 function go(){ if(!gone){gone=true;window.location.replace('/');} }
 
+function scheduleFallbackOpen(){
+  if(fallbackOpenTimer!==null) return;
+  fallbackOpenTimer=setTimeout(function(){
+    document.getElementById('spin').className='spinner hidden';
+    document.getElementById('st').textContent='Startup checks are taking too long — opening app...';
+    go();
+  },AUTO_OPEN_DELAY_MS);
+}
+
 function icon(s){
   if(s==='active')   return '<span class="ok">&#9679; active</span>';
   if(s==='failed')   return '<span class="fail">&#10005; failed</span>';
@@ -1358,6 +1368,7 @@ function pollServices(){
       tbl.innerHTML=html;
       if(allSettled(svcs)){
         clearInterval(pollTimer);
+        if(fallbackOpenTimer!==null) clearTimeout(fallbackOpenTimer);
         document.getElementById('spin').className='spinner hidden';
         document.getElementById('st').textContent='Ready \u2014 opening...';
         setTimeout(go,800);
@@ -1372,8 +1383,12 @@ function probe(){
       if(r.ok){
         document.getElementById('st').textContent='bee-web running \u2014 checking services...';
         document.getElementById('btn').style.display='';
-        pollServices();
-        pollTimer=setInterval(pollServices,1500);
+        scheduleFallbackOpen();
+        if(!pollStarted){
+          pollStarted=true;
+          pollServices();
+          pollTimer=setInterval(pollServices,1500);
+        }
       } else {
         document.getElementById('st').textContent='bee-web starting (status '+r.status+')...';
         setTimeout(probe,500);

audit/internal/webui/server_test.go

@@ -604,6 +604,25 @@ func TestReadyIsOKWhenAuditPathIsUnset(t *testing.T) {
 	}
 }
 
+func TestLoadingPageHasFallbackAutoOpen(t *testing.T) {
+	handler := NewHandler(HandlerOptions{})
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/loading", nil))
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	body := rec.Body.String()
+	for _, needle := range []string{
+		`var AUTO_OPEN_DELAY_MS = 15000;`,
+		`function scheduleFallbackOpen(){`,
+		`Startup checks are taking too long — opening app...`,
+	} {
+		if !strings.Contains(body, needle) {
+			t.Fatalf("loading page missing %q: %s", needle, body)
+		}
+	}
+}
+
 func TestAuditPageRendersViewerFrameAndActions(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "audit.json")
@@ -677,6 +696,12 @@ func TestToolsPageRendersNvidiaSelfHealSection(t *testing.T) {
 	if !strings.Contains(body, `/api/blackbox/status`) {
 		t.Fatalf("tools page missing black-box status api usage: %s", body)
 	}
+	if !strings.Contains(body, `NVMe Block Format`) {
+		t.Fatalf("tools page missing nvme block format section: %s", body)
+	}
+	if !strings.Contains(body, `/api/tools/nvme-formats`) || !strings.Contains(body, `/api/tools/nvme-format/run`) {
+		t.Fatalf("tools page missing nvme format api usage: %s", body)
+	}
 }
 
 func TestBenchmarkPageRendersGPUSelectionControls(t *testing.T) {
@@ -1016,6 +1041,39 @@ func TestViewerRendersLatestSnapshot(t *testing.T) {
 	}
 }
 
+func TestViewerRendersDerivedStorageBlockFormat(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "audit.json")
+	body := `{
+	  "collected_at":"2026-04-29T00:05:00Z",
+	  "hardware":{
+	    "board":{"serial_number":"SERIAL-NEW"},
+	    "storage":[
+	      {
+	        "serial_number":"DISK-1",
+	        "model":"Test NVMe",
+	        "logical_block_size_bytes":512,
+	        "physical_block_size_bytes":4096,
+	        "metadata_bytes_per_block":8
+	      }
+	    ]
+	  }
+	}`
+	if err := os.WriteFile(path, []byte(body), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	handler := NewHandler(HandlerOptions{AuditPath: path})
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/viewer", nil))
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status=%d", rec.Code)
+	}
+	if !strings.Contains(rec.Body.String(), "512+8") {
+		t.Fatalf("viewer body missing derived block format: %s", rec.Body.String())
+	}
+}
+
 func TestAuditJSONServesLatestSnapshot(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "audit.json")
@@ -1038,6 +1096,36 @@ func TestAuditJSONServesLatestSnapshot(t *testing.T) {
 	}
 }
 
+func TestAuditJSONDoesNotInjectDerivedStorageBlockFormat(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "audit.json")
+	body := `{
+	  "hardware":{
+	    "board":{"serial_number":"SERIAL-API"},
+	    "storage":[
+	      {
+	        "serial_number":"DISK-1",
+	        "logical_block_size_bytes":512,
+	        "metadata_bytes_per_block":8
+	      }
+	    ]
+	  }
+	}`
+	if err := os.WriteFile(path, []byte(body), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	handler := NewHandler(HandlerOptions{AuditPath: path})
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/audit.json", nil))
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status=%d", rec.Code)
+	}
+	if strings.Contains(rec.Body.String(), "block_format") {
+		t.Fatalf("audit.json should remain contract-only: %s", rec.Body.String())
+	}
+}
+
 func TestMissingAuditJSONReturnsNotFound(t *testing.T) {
 	handler := NewHandler(HandlerOptions{AuditPath: "/missing/audit.json"})
 	rec := httptest.NewRecorder()

audit/internal/webui/task_runner.go

@@ -376,6 +376,12 @@ func executeTaskWithOptions(opts *HandlerOptions, t *Task, j *jobState, ctx cont
 			break
 		}
 		err = a.RunInstallToRAM(ctx, j.append)
+	case "nvme-format":
+		if strings.TrimSpace(t.params.Device) == "" {
+			err = fmt.Errorf("device is required")
+			break
+		}
+		err = runNVMeFormatTask(ctx, j, t.params.Device, t.params.LBAF)
 	default:
 		j.append("ERROR: unknown target: " + t.Target)
 		j.finish("unknown target")

audit/internal/webui/tasks.go

@@ -57,6 +57,7 @@ var taskNames = map[string]string{
 	"support-bundle":         "Support Bundle",
 	"install":                "Install to Disk",
 	"install-to-ram":         "Install to RAM",
+	"nvme-format":            "NVMe Block Format Change",
 }
 
 // burnNames maps target → human-readable name when a burn profile is set.
@@ -137,6 +138,7 @@ type taskParams struct {
 	RampRunID          string   `json:"ramp_run_id,omitempty"`
 	DisplayName        string   `json:"display_name,omitempty"`
 	Device             string   `json:"device,omitempty"` // for install
+	LBAF               int      `json:"lbaf,omitempty"`
 	PlatformComponents []string `json:"platform_components,omitempty"`
 }
 
@@ -598,6 +600,17 @@ func (q *taskQueue) startRecoveredTaskMonitorLocked(t *Task, j *jobState) {
 }
 
 func (q *taskQueue) runTaskExternal(t *Task, j *jobState) {
+	startedKmsgWatch := false
+	if q.kmsgWatcher != nil && isSATTarget(t.Target) {
+		q.kmsgWatcher.NotifyTaskStarted(t.ID, t.Target)
+		startedKmsgWatch = true
+	}
+	defer func() {
+		if startedKmsgWatch && q.kmsgWatcher != nil {
+			q.kmsgWatcher.NotifyTaskFinished(t.ID)
+		}
+	}()
+
 	stopTail := make(chan struct{})
 	doneTail := make(chan struct{})
 	defer func() {

audit/internal/webui/tasks_test.go

@@ -126,6 +126,23 @@ func TestNewTaskJobStateLoadsExistingLog(t *testing.T) {
 	}
 }
 
+func TestJobAppendFlushesTaskLogImmediately(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "task.log")
+	j := newTaskJobState(path)
+
+	j.append("live-line")
+
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(data) != "live-line\n" {
+		t.Fatalf("log=%q want live-line newline", string(data))
+	}
+	j.closeLog()
+}
+
 func TestTaskQueueSnapshotSortsNewestFirst(t *testing.T) {
 	now := time.Date(2026, 4, 2, 12, 0, 0, 0, time.UTC)
 	q := &taskQueue{
@@ -849,3 +866,82 @@ func TestExecuteTaskMarksPanicsAsFailedAndClosesKmsgWindow(t *testing.T) {
 		t.Fatalf("expected kmsg window to be cleared, got %+v", window)
 	}
 }
+
+func TestRunTaskExternalOpensAndClosesKmsgWindow(t *testing.T) {
+	dir := t.TempDir()
+	releasePath := filepath.Join(dir, "release")
+	readyPath := filepath.Join(dir, "ready")
+	q := &taskQueue{
+		opts:        &HandlerOptions{ExportDir: dir},
+		logsDir:     filepath.Join(dir, "tasks"),
+		kmsgWatcher: newKmsgWatcher(nil),
+		trigger:     make(chan struct{}, 1),
+	}
+	if err := os.MkdirAll(q.logsDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	tk := &Task{
+		ID:        "cpu-external-1",
+		Name:      "CPU SAT",
+		Target:    "cpu",
+		Status:    TaskRunning,
+		CreatedAt: time.Now(),
+	}
+	q.assignTaskLogPathLocked(tk)
+	j := newTaskJobState(tk.LogPath)
+
+	orig := externalTaskRunnerCommand
+	externalTaskRunnerCommand = func(exportDir, taskID string) (*exec.Cmd, error) {
+		script := "printf ready > \"$1\"; while [ ! -f \"$2\" ]; do sleep 0.05; done"
+		return exec.Command("sh", "-c", script, "sh", readyPath, releasePath), nil
+	}
+	defer func() { externalTaskRunnerCommand = orig }()
+
+	done := make(chan struct{})
+	go func() {
+		q.runTaskExternal(tk, j)
+		close(done)
+	}()
+
+	deadline := time.Now().Add(2 * time.Second)
+	for time.Now().Before(deadline) {
+		if _, err := os.Stat(readyPath); err == nil {
+			break
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+	if _, err := os.Stat(readyPath); err != nil {
+		t.Fatalf("external runner did not start: %v", err)
+	}
+
+	q.kmsgWatcher.mu.Lock()
+	activeCount := q.kmsgWatcher.activeCount
+	window := q.kmsgWatcher.window
+	q.kmsgWatcher.mu.Unlock()
+	if activeCount != 1 {
+		t.Fatalf("activeCount while running=%d want 1", activeCount)
+	}
+	if window == nil || len(window.targets) != 1 || window.targets[0] != "cpu" {
+		t.Fatalf("window while running=%+v", window)
+	}
+
+	if err := os.WriteFile(releasePath, []byte("1\n"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("runTaskExternal did not return")
+	}
+
+	q.kmsgWatcher.mu.Lock()
+	activeCount = q.kmsgWatcher.activeCount
+	window = q.kmsgWatcher.window
+	q.kmsgWatcher.mu.Unlock()
+	if activeCount != 0 {
+		t.Fatalf("activeCount after finish=%d want 0", activeCount)
+	}
+	if window != nil {
+		t.Fatalf("expected kmsg window to be cleared, got %+v", window)
+	}
+}

audit/internal/webui/viewer_snapshot.go

@@ -0,0 +1,62 @@
+package webui
+
+import (
+	"encoding/json"
+	"strconv"
+)
+
+func enrichSnapshotForViewer(snapshot []byte) []byte {
+	if len(snapshot) == 0 {
+		return snapshot
+	}
+	var root map[string]any
+	if err := json.Unmarshal(snapshot, &root); err != nil {
+		return snapshot
+	}
+	hardware, _ := root["hardware"].(map[string]any)
+	if len(hardware) == 0 {
+		return snapshot
+	}
+	storage, _ := hardware["storage"].([]any)
+	if len(storage) == 0 {
+		return snapshot
+	}
+	changed := false
+	for _, item := range storage {
+		row, _ := item.(map[string]any)
+		if len(row) == 0 {
+			continue
+		}
+		if _, exists := row["block_format"]; exists {
+			continue
+		}
+		logical, okLogical := jsonNumberToInt64(row["logical_block_size_bytes"])
+		metadata, okMetadata := jsonNumberToInt64(row["metadata_bytes_per_block"])
+		if !okLogical || !okMetadata || logical <= 0 || metadata < 0 {
+			continue
+		}
+		row["block_format"] = strconv.FormatInt(logical, 10) + "+" + strconv.FormatInt(metadata, 10)
+		changed = true
+	}
+	if !changed {
+		return snapshot
+	}
+	out, err := json.Marshal(root)
+	if err != nil {
+		return snapshot
+	}
+	return out
+}
+
+func jsonNumberToInt64(v any) (int64, bool) {
+	switch x := v.(type) {
+	case float64:
+		return int64(x), true
+	case int64:
+		return x, true
+	case int:
+		return int64(x), true
+	default:
+		return 0, false
+	}
+}

bible-local/README.md

@@ -9,5 +9,62 @@ Generic engineering rules live in `bible/rules/patterns/`.
 |---|---|
 | `architecture/system-overview.md` | What bee does, scope, tech stack |
 | `architecture/runtime-flows.md` | Boot sequence, audit flow, service order |
+| `docs/customer-gpu-test-methodology.md` | Customer-facing GPU PCIe Validate / Validate -> Stress test list |
 | `docs/hardware-ingest-contract.md` | Current Reanimator hardware ingest JSON contract |
+| `docs/validate-vs-burn.md` | Validate and Validate -> Stress hardware test policy |
 | `decisions/` | Architectural decision log, including read-only submodule policy |
+
+## Validate Test Matrix
+
+### Validate
+
+- CPU check
+  - `lscpu`
+  - `sensors`
+  - `stress-ng`
+- Memory check
+  - `free`
+  - `timeout <timeout_sec> memtester`
+  - `free`
+- NVMe storage check
+  - `nvme id-ctrl`
+  - `nvme smart-log`
+  - `nvme device-self-test`
+- SATA/SAS storage check
+  - `smartctl -H -A`
+  - `smartctl -t short`
+- Basic NVIDIA GPU check
+  - `nvidia-smi -pm 1`
+  - `nvidia-smi -q`
+  - `dmidecode -t baseboard`
+  - `dmidecode -t system`
+  - `dcgmi diag -r 2`
+- Inter-GPU communication check
+  - `all_reduce_perf`
+- GPU bandwidth check
+  - `dcgmi diag -r nvbandwidth`
+
+### Validate -> Stress
+
+- Extended NVIDIA GPU check
+  - `nvidia-smi -pm 1`
+  - `nvidia-smi -q`
+  - `dmidecode -t baseboard`
+  - `dmidecode -t system`
+  - `dcgmi diag -r 3`
+- NVIDIA targeted stress
+  - `nvidia-smi -pm 1`
+  - `nvidia-smi -q`
+  - `dcgmi diag -r targeted_stress`
+- NVIDIA targeted power
+  - `nvidia-smi -pm 1`
+  - `nvidia-smi -q`
+  - `dcgmi diag -r targeted_power`
+- NVIDIA pulse test
+  - `nvidia-smi -pm 1`
+  - `nvidia-smi -q`
+  - `dcgmi diag -r pulse_test`
+- Inter-GPU communication check
+  - `all_reduce_perf`
+- GPU bandwidth check
+  - `dcgmi diag -r nvbandwidth`

bible-local/architecture/runtime-flows.md

@@ -149,7 +149,6 @@ Current validation state:
   6. psu collector     (ipmitool fru + sdr — silent if no /dev/ipmi0)
   7. nvidia enrichment (nvidia-smi — skipped if binary absent or driver not loaded)
   8. output JSON → /var/log/bee-audit.json
-  9. QR summary to stdout (qrencode if available)
 ```
 
 Every collector returns `nil, nil` on tool-not-found. Errors are logged, never fatal.

bible-local/docs/customer-gpu-test-methodology.md

@@ -0,0 +1,54 @@
+# GPU PCIe Test Methodology
+
+## Validate
+
+- CPU check
+  - `lscpu`
+  - `sensors`
+  - `stress-ng`
+- Memory check
+  - `free`
+  - `timeout <timeout_sec> memtester`
+  - `free`
+- NVMe storage check
+  - `nvme id-ctrl`
+  - `nvme smart-log`
+  - `nvme device-self-test`
+- SATA/SAS storage check
+  - `smartctl -H -A`
+  - `smartctl -t short`
+- Basic NVIDIA GPU check
+  - `nvidia-smi -pm 1`
+  - `nvidia-smi -q`
+  - `dmidecode -t baseboard`
+  - `dmidecode -t system`
+  - `dcgmi diag -r 2`
+- Inter-GPU communication check
+  - `all_reduce_perf`
+- GPU bandwidth check
+  - `dcgmi diag -r nvbandwidth`
+
+## Validate -> Stress
+
+- Extended NVIDIA GPU check
+  - `nvidia-smi -pm 1`
+  - `nvidia-smi -q`
+  - `dmidecode -t baseboard`
+  - `dmidecode -t system`
+  - `dcgmi diag -r 3`
+- NVIDIA targeted stress
+  - `nvidia-smi -pm 1`
+  - `nvidia-smi -q`
+  - `dcgmi diag -r targeted_stress`
+- NVIDIA targeted power
+  - `nvidia-smi -pm 1`
+  - `nvidia-smi -q`
+  - `dcgmi diag -r targeted_power`
+- NVIDIA pulse test
+  - `nvidia-smi -pm 1`
+  - `nvidia-smi -q`
+  - `dcgmi diag -r pulse_test`
+- Inter-GPU communication check
+  - `all_reduce_perf`
+- GPU bandwidth check
+  - `dcgmi diag -r nvbandwidth`

bible-local/docs/hardware-ingest-contract.md

@@ -1,7 +1,7 @@
 ---
 title: Hardware Ingest JSON Contract
-version: "2.7"
-updated: "2026-03-15"
+version: "2.10"
+updated: "2026-04-29"
 maintainer: Reanimator Core
 audience: external-integrators, ai-agents
 language: ru
@@ -9,7 +9,7 @@ language: ru
 
 # Интеграция с Reanimator: контракт JSON-импорта аппаратного обеспечения
 
-Версия: **2.7** · Дата: **2026-03-15**
+Версия: **2.10** · Дата: **2026-04-29**
 
 Документ описывает формат JSON для передачи данных об аппаратном обеспечении серверов в систему **Reanimator** (управление жизненным циклом аппаратного обеспечения).
 Предназначен для разработчиков смежных систем (Redfish-коллекторов, агентов мониторинга, CMDB-экспортёров) и может быть включён в документацию интегрируемых проектов.
@@ -22,6 +22,9 @@ language: ru
 
 | Версия | Дата | Изменения |
 |--------|------|-----------|
+| 2.10 | 2026-04-29 | Для `hardware.storage[]` добавлены необязательные числовые поля `logical_block_size_bytes`, `physical_block_size_bytes`, `metadata_bytes_per_block` для нормализованного описания формата блока накопителя |
+| 2.9 | 2026-03-19 | Добавлена необязательная секция `hardware.platform_config` — произвольный объект с настройками платформы (BIOS/Redfish); хранится как latest-snapshot per machine |
+| 2.8 | 2026-03-15 | Поле `location` удалено из всех `sensors.*`; сенсоры передаются только по `name` и измеренным значениям |
 | 2.7 | 2026-03-15 | Явно запрещён синтез данных в `event_logs`; интеграторы не должны придумывать серийные номера компонентов, если источник их не отдал |
 | 2.6 | 2026-03-15 | Добавлена необязательная секция `event_logs` для dedup/upsert логов `host` / `bmc` / `redfish` вне history timeline |
 | 2.5 | 2026-03-15 | Добавлено общее необязательное поле `manufactured_year_week` для компонентных секций (`YYYY-Www`) |
@@ -131,8 +134,9 @@ GET /ingest/hardware/jobs/{job_id}
     "storage":        [ ... ],
     "pcie_devices":   [ ... ],
     "power_supplies": [ ... ],
-    "sensors":        { ... },
-    "event_logs":     [ ... ]
+    "sensors":         { ... },
+    "event_logs":      [ ... ],
+    "platform_config": { ... }
   }
 }
 ```
@@ -343,6 +347,9 @@ GET /ingest/hardware/jobs/{job_id}
 | `type` | string | нет | Тип: `NVMe`, `SSD`, `HDD` |
 | `interface` | string | нет | Интерфейс: `NVMe`, `SATA`, `SAS` |
 | `size_gb` | int | нет | Размер в ГБ |
+| `logical_block_size_bytes` | int64 | нет | Логический размер пользовательского блока данных, например `512` или `4096` |
+| `physical_block_size_bytes` | int64 | нет | Физический размер блока, если известен, например `4096` |
+| `metadata_bytes_per_block` | int64 | нет | Metadata / protection bytes на логический блок, например `0` или `8` |
 | `temperature_c` | float | нет | Температура накопителя, °C (telemetry) |
 | `power_on_hours` | int64 | нет | Время работы, часы |
 | `power_cycles` | int64 | нет | Количество циклов питания |
@@ -363,6 +370,11 @@ GET /ingest/hardware/jobs/{job_id}
 
 Диск без `serial_number` игнорируется. Изменение `firmware` создаёт событие `FIRMWARE_CHANGED`.
 
+Формат вида `512+8` в контракт не добавляется отдельным строковым полем. Если источник знает такую форму, он должен передавать её как:
+- `logical_block_size_bytes = 512`
+- `metadata_bytes_per_block = 8`
+- `physical_block_size_bytes = 512` или `4096`, если известен физический размер блока
+
 ```json
 "storage": [
   {
@@ -370,6 +382,9 @@ GET /ingest/hardware/jobs/{job_id}
     "type": "NVMe",
     "model": "INTEL SSDPF2KX076T1",
     "size_gb": 7680,
+    "logical_block_size_bytes": 512,
+    "physical_block_size_bytes": 4096,
+    "metadata_bytes_per_block": 8,
     "temperature_c": 38.5,
     "power_on_hours": 12450,
     "unsafe_shutdowns": 3,
@@ -592,7 +607,6 @@ PSU без `serial_number` игнорируется.
 | Поле | Тип | Обязательно | Описание |
 |------|-----|-------------|----------|
 | `name` | string | **да** | Уникальное имя сенсора в рамках секции |
-| `location` | string | нет | Физическое расположение |
 | `rpm` | int | нет | Обороты, RPM |
 | `status` | string | нет | Статус: `OK`, `Warning`, `Critical`, `Unknown` |
 
@@ -601,7 +615,6 @@ PSU без `serial_number` игнорируется.
 | Поле | Тип | Обязательно | Описание |
 |------|-----|-------------|----------|
 | `name` | string | **да** | Уникальное имя сенсора |
-| `location` | string | нет | Физическое расположение |
 | `voltage_v` | float | нет | Напряжение, В |
 | `current_a` | float | нет | Ток, А |
 | `power_w` | float | нет | Мощность, Вт |
@@ -612,7 +625,6 @@ PSU без `serial_number` игнорируется.
 | Поле | Тип | Обязательно | Описание |
 |------|-----|-------------|----------|
 | `name` | string | **да** | Уникальное имя сенсора |
-| `location` | string | нет | Физическое расположение |
 | `celsius` | float | нет | Температура, °C |
 | `threshold_warning_celsius` | float | нет | Порог Warning, °C |
 | `threshold_critical_celsius` | float | нет | Порог Critical, °C |
@@ -623,29 +635,29 @@ PSU без `serial_number` игнорируется.
 | Поле | Тип | Обязательно | Описание |
 |------|-----|-------------|----------|
 | `name` | string | **да** | Уникальное имя сенсора |
-| `location` | string | нет | Физическое расположение |
 | `value` | float | нет | Значение |
 | `unit` | string | нет | Единица измерения |
 | `status` | string | нет | Статус |
 
 **Правила sensors:**
 - Идентификатор сенсора: пара `(sensor_type, name)`. Дубли в одном payload — берётся первое вхождение.
+- `location` для сенсоров передавать не нужно и не следует: в Reanimator location/slot используется только для проверки перемещения и установки компонентов, а не для last-known-value sensor ingest.
 - Сенсоры без `name` игнорируются.
 - При каждом импорте значения перезаписываются (upsert по ключу).
 
 ```json
 "sensors": {
   "fans": [
-    { "name": "FAN1", "location": "Front", "rpm": 4200, "status": "OK" },
-    { "name": "FAN_CPU0", "location": "CPU0", "rpm": 5600, "status": "OK" }
+    { "name": "FAN1", "rpm": 4200, "status": "OK" },
+    { "name": "FAN_CPU0", "rpm": 5600, "status": "OK" }
   ],
   "power": [
-    { "name": "12V Rail", "location": "Mainboard", "voltage_v": 12.06, "status": "OK" },
-    { "name": "PSU0 Input", "location": "PSU0", "voltage_v": 215.25, "current_a": 0.64, "power_w": 137.0, "status": "OK" }
+    { "name": "12V Rail", "voltage_v": 12.06, "status": "OK" },
+    { "name": "PSU0 Input", "voltage_v": 215.25, "current_a": 0.64, "power_w": 137.0, "status": "OK" }
   ],
   "temperatures": [
-    { "name": "CPU0 Temp", "location": "CPU0", "celsius": 46.0, "threshold_warning_celsius": 80.0, "threshold_critical_celsius": 95.0, "status": "OK" },
-    { "name": "Inlet Temp", "location": "Front", "celsius": 22.0, "threshold_warning_celsius": 40.0, "threshold_critical_celsius": 50.0, "status": "OK" }
+    { "name": "CPU0 Temp", "celsius": 46.0, "threshold_warning_celsius": 80.0, "threshold_critical_celsius": 95.0, "status": "OK" },
+    { "name": "Inlet Temp", "celsius": 22.0, "threshold_warning_celsius": 40.0, "threshold_critical_celsius": 50.0, "status": "OK" }
   ],
   "other": [
     { "name": "System Humidity", "value": 38.5, "unit": "%", "status": "OK" }
@@ -655,6 +667,31 @@ PSU без `serial_number` игнорируется.
 
 ---
 
+## Секция platform_config
+
+Необязательный объект с произвольными ключами — настройки платформы как есть из источника (BIOS, Redfish, IPMI).
+
+| Поле | Тип | Обязательно | Описание |
+|------|-----|-------------|----------|
+| `platform_config` | object | нет | Произвольный объект: ключи — строки, значения — строки, числа, булевы |
+
+**Правила platform_config:**
+- Содержимое объекта не валидируется: передавайте параметры как есть.
+- При каждом импорте хранится latest-snapshot per machine; история изменений по каждому ключу накапливается отдельно.
+- Если секция отсутствует или равна `null` — данные платформы не обновляются.
+
+```json
+"platform_config": {
+  "SecureBoot": "Enabled",
+  "BiosVersion": "06.08.05",
+  "TpmEnabled": true,
+  "NumaEnabled": false,
+  "HyperThreading": "Enabled"
+}
+```
+
+---
+
 ## Обработка статусов компонентов
 
 | Статус | Поведение |
@@ -787,6 +824,12 @@ PSU без `serial_number` игнорируется.
       "other": [
         { "name": "System Humidity", "value": 38.5, "unit": "%" }
       ]
+    },
+    "platform_config": {
+      "SecureBoot": "Enabled",
+      "BiosVersion": "06.08.05",
+      "TpmEnabled": true,
+      "HyperThreading": "Enabled"
     }
   }
 }

git-bible/grub-bitmap-error.md

@@ -0,0 +1,134 @@
+# GRUB bitmap error: null src bitmap in grub_video_bitmap_create_scaled
+
+## Symptom
+
+```
+error: null src bitmap in grub_video_bitmap_create_scaled.
+Press any key to continue...
+```
+
+Appears on boot before the GRUB menu renders. The menu still appears after pressing a key,
+but without the bee logo. Reproduced on real hardware (Lenovo SR650 V3, ASUS GPU servers).
+
+## Root cause model
+
+`grub_video_bitmap_create_scaled` receives a null `src` pointer, meaning the PNG loader
+returned null for `bee-logo.png`. GRUB calls this function even when no explicit
+`width`/`height` are set in `theme.txt` — it is invoked any time an image component is
+rendered, passing the image's natural dimensions as the target size.
+
+The PNG file is referenced as `file = "bee-logo.png"` (relative to theme dir).
+GRUB resolves this to `/boot/grub/live-theme/bee-logo.png`.
+
+## Attempts that did NOT fix the error
+
+### Attempt 1 — add explicit `width`/`height` to image block (d52ec67)
+
+**What was done:** First introduction of bee-logo.png with:
+```
++ image {
+    top = 4%
+    left = 50%-200
+    width = 400
+    height = 400
+    file = "bee-logo.png"
+}
+```
+PNG at this point was RGBA (color_type=6).
+
+**Result:** Error appeared immediately on first ISO build.
+
+---
+
+### Attempt 2 — remove `width`/`height` from image block (aa284ae)
+
+**Hypothesis:** Explicit scaling dimensions trigger the scale path; removing them avoids it.
+
+**What was done:** Removed `width = 400` and `height = 400` from the image block.
+```
++ image {
+    top = 4%
+    left = 50%-200
+    file = "bee-logo.png"
+}
+```
+
+**Result:** Error persists. GRUB calls `grub_video_bitmap_create_scaled` regardless of whether
+`width`/`height` are specified — if the bitmap is null (loading failed), the error fires either way.
+
+---
+
+### Attempt 3 — convert PNG to RGBA + strip metadata chunks (6112094)
+
+**Hypothesis:** GRUB's minimal PNG parser is confused by metadata chunks (cHRM, bKGD, tIME, tEXt).
+Also re-ordered `terminal_output gfxterm` before `insmod png` / theme load.
+
+**What was done:**
+- Converted PNG to RGBA color_type=6, stripped all ancillary chunks
+- Moved `terminal_output gfxterm` earlier in config.cfg
+- Removed echo ASCII art banner from grub.cfg
+
+**Result:** Error persists — and this change actually confirmed RGBA does not work:
+GRUB's PNG loader does not render RGBA PNGs correctly on this platform.
+
+---
+
+### Attempt 4 — convert PNG from RGBA back to RGB (333c44f, most recent)
+
+**Hypothesis:** GRUB does not support RGBA (color_type=6); RGB (color_type=2) is the correct format.
+Alpha channel composited onto black background (#000000) to match `desktop-color`.
+
+**What was done:** Converted bee-logo.png from RGBA to RGB via ImageMagick.
+
+**Current file state:**
+- 400×400 px, 8-bit/color RGB, non-interlaced
+- Only IHDR + IDAT + IEND chunks (no metadata)
+- `insmod png` is present in config.cfg
+- `terminal_output gfxterm` runs before theme is sourced
+- No explicit `width`/`height` in image block
+
+**Result:** Error still occurs on real hardware. Despite the PNG being nominally correct
+(RGB, non-interlaced, minimal chunks), the bitmap load returns null.
+
+## Confirmed root cause (verified on 172.16.41.94, 2026-04-30)
+
+The EFI partition (`sda2`, vfat, 5 MB) contains only:
+```
+/EFI/boot/bootia32.efi
+/EFI/boot/bootx64.efi
+/EFI/boot/grubx64.efi
+/boot/grub/grub.cfg
+```
+
+`config.cfg`, `theme.cfg`, and the entire `live-theme/` directory (including `bee-logo.png`)
+are **absent from the EFI image**. `live-build`'s `lb binary_grub-efi` stage is not
+copying these files. GRUB boots, sources only `grub.cfg`, then fails to load the theme
+because the file does not exist — returning a null bitmap regardless of PNG format.
+
+All four fix attempts were targeting the wrong layer (PNG format/content).
+
+## Fix (applied 2026-04-30)
+
+Switched from PNG to TGA format:
+
+1. Converted `bee-logo.png` → `bee-logo.tga` (24-bit uncompressed BGR, top-left origin,
+   480018 bytes). Conversion done via Python stdlib (no external tools needed).
+2. `config.cfg`: `insmod png` → `insmod tga`
+3. `theme.txt`: `file = "bee-logo.png"` → `file = "bee-logo.tga"`
+
+**Why TGA works:** GRUB's TGA reader (`tga.mod`) handles uncompressed 24-bit images
+trivially — no decompression, no complex chunk parsing. The module is present on-disk
+(`x86_64-efi/tga.mod`). PNG was failing despite a valid file; the exact GRUB bug is
+unknown but the PNG reader in Debian bookworm's grub2 is known to be fragile.
+
+The old `bee-logo.png` is kept in the tree (may be useful for other tools) but is no
+longer referenced by the theme.
+
+## Relevant files
+
+| File | Purpose |
+|------|---------|
+| `iso/builder/config/bootloaders/grub-efi/config.cfg` | insmod png, gfxterm init, theme source |
+| `iso/builder/config/bootloaders/grub-efi/theme.cfg` | sets `theme=` path |
+| `iso/builder/config/bootloaders/grub-efi/live-theme/theme.txt` | image component definition |
+| `iso/builder/config/bootloaders/grub-efi/live-theme/bee-logo.png` | the logo PNG |

iso/builder/auto/config

@@ -16,6 +16,12 @@ else
     LB_LINUX_PACKAGES="linux-image"
 fi
 
+if [ -n "${BEE_ISO_VOLUME:-}" ]; then
+    LB_ISO_VOLUME="${BEE_ISO_VOLUME}"
+else
+    LB_ISO_VOLUME="EASY_BEE_${BEE_GPU_VENDOR_UPPER:-NVIDIA}"
+fi
+
 lb config noauto \
     --distribution bookworm \
     --architectures amd64 \
@@ -30,9 +36,9 @@ lb config noauto \
     --linux-flavours "amd64" \
     --linux-packages "${LB_LINUX_PACKAGES}" \
     --memtest memtest86+ \
-    --iso-volume "EASY_BEE_${BEE_GPU_VENDOR_UPPER:-NVIDIA}" \
+    --iso-volume "${LB_ISO_VOLUME}" \
     --iso-application "EASY-BEE-${BEE_GPU_VENDOR_UPPER:-NVIDIA}" \
-    --bootappend-live "boot=live components video=1920x1080 console=ttyS0,115200n8 console=tty0 loglevel=3 systemd.show_status=1 username=bee user-fullname=Bee modprobe.blacklist=nouveau,snd_hda_intel,snd_hda_codec_realtek,snd_hda_codec_generic,soundcore" \
+    --bootappend-live "boot=live live-media=/dev/disk/by-label/${LB_ISO_VOLUME} live-media-label=${LB_ISO_VOLUME} components video=1920x1080 console=ttyS0,115200n8 console=tty0 loglevel=3 systemd.show_status=1 username=bee user-fullname=Bee modprobe.blacklist=nouveau,snd_hda_intel,snd_hda_codec_realtek,snd_hda_codec_generic,soundcore" \
     --debootstrap-options "--include=ca-certificates" \
     --apt-recommends false \
     --chroot-squashfs-compression-type zstd \

iso/builder/build.sh

@@ -69,12 +69,27 @@ mkdir -p "${CACHE_ROOT}"
 : "${GOMODCACHE:=${CACHE_ROOT}/go-mod}"
 export GOCACHE GOMODCACHE
 
-resolve_audit_version() {
+resolve_project_version() {
+    if [ -n "${BEE_VERSION:-}" ]; then
+        echo "${BEE_VERSION}"
+        return 0
+    fi
+
+    if [ -n "${BEE_AUDIT_VERSION:-}" ] && [ -n "${BEE_ISO_VERSION:-}" ] && [ "${BEE_AUDIT_VERSION}" != "${BEE_ISO_VERSION}" ]; then
+        echo "ERROR: BEE_AUDIT_VERSION (${BEE_AUDIT_VERSION}) and BEE_ISO_VERSION (${BEE_ISO_VERSION}) differ; versioning must stay synchronized" >&2
+        exit 1
+    fi
+
     if [ -n "${BEE_AUDIT_VERSION:-}" ]; then
         echo "${BEE_AUDIT_VERSION}"
         return 0
     fi
 
+    if [ -n "${BEE_ISO_VERSION:-}" ]; then
+        echo "${BEE_ISO_VERSION}"
+        return 0
+    fi
+
     tag="$(git -C "${REPO_ROOT}" describe --tags --match 'v[0-9]*' --abbrev=7 --dirty 2>/dev/null || true)"
     case "${tag}" in
         v*)
@@ -97,35 +112,6 @@ resolve_audit_version() {
     date +%Y%m%d
 }
 
-# ISO image versioned separately from the audit binary (iso/v* tags).
-resolve_iso_version() {
-    if [ -n "${BEE_ISO_VERSION:-}" ]; then
-        echo "${BEE_ISO_VERSION}"
-        return 0
-    fi
-
-    # Plain v* tags (e.g. v2.7) take priority — this is the current tagging scheme
-    tag="$(git -C "${REPO_ROOT}" describe --tags --match 'v[0-9]*' --abbrev=7 --dirty 2>/dev/null || true)"
-    case "${tag}" in
-        v*)
-            echo "${tag#v}"
-            return 0
-            ;;
-    esac
-
-    # Legacy iso/v* tags fallback
-    tag="$(git -C "${REPO_ROOT}" describe --tags --match 'iso/v*' --abbrev=7 --dirty 2>/dev/null || true)"
-    case "${tag}" in
-        iso/v*)
-            echo "${tag#iso/v}"
-            return 0
-            ;;
-    esac
-
-    # Fall back to audit version so the name is still meaningful
-    resolve_audit_version
-}
-
 sync_builder_workdir() {
     src_dir="$1"
     dst_dir="$2"
@@ -530,12 +516,12 @@ validate_iso_live_boot_entries() {
         exit 1
     fi
 
-    grep -q 'menuentry "EASY-BEE"' "$grub_cfg" || {
+    grep -q 'menuentry "EASY-BEE v' "$grub_cfg" || {
         echo "ERROR: GRUB default EASY-BEE entry is missing" >&2
         rm -f "$grub_cfg" "$isolinux_cfg"
         exit 1
     }
-    grep -q 'menuentry "EASY-BEE -- load to RAM (toram)"' "$grub_cfg" || {
+    grep -q 'menuentry "EASY-BEE v.* -- load to RAM (toram)"' "$grub_cfg" || {
         echo "ERROR: GRUB toram entry is missing" >&2
         rm -f "$grub_cfg" "$isolinux_cfg"
         exit 1
@@ -550,6 +536,11 @@ validate_iso_live_boot_entries() {
         rm -f "$grub_cfg" "$isolinux_cfg"
         exit 1
     }
+    grep -q 'linux .*live-media-label=EASY_BEE_' "$grub_cfg" || {
+        echo "ERROR: GRUB live entry is missing live-media-label pinning" >&2
+        rm -f "$grub_cfg" "$isolinux_cfg"
+        exit 1
+    }
 
     grep -q 'append .*boot=live ' "$isolinux_cfg" || {
         echo "ERROR: isolinux live entry is missing boot=live" >&2
@@ -561,11 +552,50 @@ validate_iso_live_boot_entries() {
         rm -f "$grub_cfg" "$isolinux_cfg"
         exit 1
     }
+    grep -q 'append .*live-media-label=EASY_BEE_' "$isolinux_cfg" || {
+        echo "ERROR: isolinux live entry is missing live-media-label pinning" >&2
+        rm -f "$grub_cfg" "$isolinux_cfg"
+        exit 1
+    }
 
     rm -f "$grub_cfg" "$isolinux_cfg"
     echo "=== live boot validation OK ==="
 }
 
+validate_iso_grub_assets() {
+    iso_path="$1"
+    echo "=== validating GRUB assets in ISO ==="
+
+    [ -f "$iso_path" ] || {
+        echo "ERROR: ISO not found for GRUB asset validation: $iso_path" >&2
+        exit 1
+    }
+    require_iso_reader "$iso_path" >/dev/null 2>&1 || {
+        echo "ERROR: ISO reader unavailable for GRUB asset validation" >&2
+        exit 1
+    }
+
+    iso_files="$(mktemp)"
+    iso_list_files "$iso_path" > "$iso_files" || {
+        echo "ERROR: failed to list ISO files for GRUB asset validation" >&2
+        rm -f "$iso_files"
+        exit 1
+    }
+
+    for required in \
+        boot/grub/config.cfg \
+        boot/grub/grub.cfg; do
+        grep -q "^${required}$" "$iso_files" || {
+            echo "ERROR: missing GRUB asset in ISO: ${required}" >&2
+            rm -f "$iso_files"
+            exit 1
+        }
+    done
+
+    rm -f "$iso_files"
+    echo "=== GRUB asset validation OK ==="
+}
+
 validate_iso_nvidia_runtime() {
     iso_path="$1"
     [ "$BEE_GPU_VENDOR" = "nvidia" ] || return 0
@@ -578,29 +608,37 @@ validate_iso_nvidia_runtime() {
 
     squashfs_tmp="$(mktemp)"
     squashfs_list="$(mktemp)"
-    iso_read_member "$iso_path" live/filesystem.squashfs "$squashfs_tmp" || {
-        rm -f "$squashfs_tmp" "$squashfs_list"
-        nvidia_runtime_fail "failed to extract live/filesystem.squashfs from ISO"
-    }
-    unsquashfs -ll "$squashfs_tmp" > "$squashfs_list" 2>/dev/null || {
-        rm -f "$squashfs_tmp" "$squashfs_list"
-        nvidia_runtime_fail "failed to inspect filesystem.squashfs from ISO"
+    iso_files="$(mktemp)"
+    iso_list_files "$iso_path" > "$iso_files" || {
+        rm -f "$squashfs_tmp" "$squashfs_list" "$iso_files"
+        nvidia_runtime_fail "failed to list ISO files for NVIDIA runtime validation"
     }
+    grep '^live/.*\.squashfs$' "$iso_files" | while IFS= read -r squashfs_member; do
+        iso_read_member "$iso_path" "$squashfs_member" "$squashfs_tmp" || {
+            rm -f "$squashfs_tmp" "$squashfs_list" "$iso_files"
+            nvidia_runtime_fail "failed to extract $squashfs_member from ISO"
+        }
+        unsquashfs -ll "$squashfs_tmp" >> "$squashfs_list" 2>/dev/null || {
+            rm -f "$squashfs_tmp" "$squashfs_list" "$iso_files"
+            nvidia_runtime_fail "failed to inspect $squashfs_member from ISO"
+        }
+        : > "$squashfs_tmp"
+    done
 
     grep -Eq 'usr/bin/dcgmi$' "$squashfs_list" || {
-        rm -f "$squashfs_tmp" "$squashfs_list"
+        rm -f "$squashfs_tmp" "$squashfs_list" "$iso_files"
         nvidia_runtime_fail "dcgmi missing from final NVIDIA ISO"
     }
     grep -Eq 'usr/bin/nv-hostengine$' "$squashfs_list" || {
-        rm -f "$squashfs_tmp" "$squashfs_list"
+        rm -f "$squashfs_tmp" "$squashfs_list" "$iso_files"
         nvidia_runtime_fail "nv-hostengine missing from final NVIDIA ISO"
     }
     grep -Eq 'usr/bin/dcgmproftester([0-9]+)?$' "$squashfs_list" || {
-        rm -f "$squashfs_tmp" "$squashfs_list"
+        rm -f "$squashfs_tmp" "$squashfs_list" "$iso_files"
         nvidia_runtime_fail "dcgmproftester missing from final NVIDIA ISO"
     }
 
-    rm -f "$squashfs_tmp" "$squashfs_list"
+    rm -f "$squashfs_tmp" "$squashfs_list" "$iso_files"
     echo "=== NVIDIA runtime validation OK ==="
 }
 
@@ -694,30 +732,25 @@ write_canonical_grub_cfg() {
     kernel="$2"
     append_live="$3"
     initrd="$4"
+    version_label="${PROJECT_VERSION_EFFECTIVE}"
 
     cat > "$cfg" <<EOF
 source /boot/grub/config.cfg
 
-echo ""
-echo "  ███████╗ █████╗ ███████╗██╗   ██╗      ██████╗ ███████╗███████╗"
-echo "  ██╔════╝██╔══██╗██╔════╝╚██╗ ██╔╝      ██╔══██╗██╔════╝██╔════╝"
-echo "  █████╗  ███████║███████╗ ╚████╔╝ █████╗██████╔╝█████╗  █████╗"
-echo "  ██╔══╝  ██╔══██║╚════██║  ╚██╔╝  ╚════╝██╔══██╗██╔══╝  ██╔══╝"
-echo "  ███████╗██║  ██║███████║   ██║         ██████╔╝███████╗███████╗"
-echo "  ╚══════╝╚═╝  ╚═╝╚══════╝   ╚═╝         ╚═════╝ ╚══════╝╚══════╝"
-echo "  Hardware Audit LiveCD"
-echo ""
-
-menuentry "EASY-BEE" {
-    linux   ${kernel} ${append_live} bee.display=kms bee.nvidia.mode=normal pci=realloc net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
+menuentry "EASY-BEE v${version_label}" {
+    linux   ${kernel} ${append_live} nomodeset bee.nvidia.mode=normal pci=realloc net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
     initrd  ${initrd}
 }
 
-menuentry "EASY-BEE -- load to RAM (toram)" {
-    linux   ${kernel} ${append_live} toram bee.display=kms bee.nvidia.mode=normal pci=realloc net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
+menuentry "EASY-BEE v${version_label} -- load to RAM (toram)" {
+    linux   ${kernel} ${append_live} toram nomodeset bee.nvidia.mode=normal pci=realloc net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
     initrd  ${initrd}
 }
 
+menuentry "EASY-BEE v${version_label} -- no GUI / no X11" {
+    linux   ${kernel} ${append_live} nomodeset bee.gui=off bee.nvidia.mode=gsp-off pci=realloc net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
+    initrd  ${initrd}
+}
 
 if [ "\${grub_platform}" = "efi" ]; then
     menuentry "Memory Test (memtest86+)" {
@@ -742,21 +775,28 @@ write_canonical_isolinux_cfg() {
     kernel="$2"
     initrd="$3"
     append_live="$4"
+    version_label="${PROJECT_VERSION_EFFECTIVE}"
 
     cat > "$cfg" <<EOF
 label live-@FLAVOUR@-normal
-    menu label ^EASY-BEE
-    menu default
+    menu label ^EASY-BEE v${version_label}
     linux ${kernel}
     initrd ${initrd}
     append ${append_live} nomodeset bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
 
 label live-@FLAVOUR@-toram
-    menu label EASY-BEE (^load to RAM)
+    menu label EASY-BEE v${version_label} (^load to RAM)
+    menu default
     linux ${kernel}
     initrd ${initrd}
     append ${append_live} toram nomodeset bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
 
+label live-@FLAVOUR@-console
+    menu label EASY-BEE v${version_label} (^no GUI / no X11)
+    linux ${kernel}
+    initrd ${initrd}
+    append ${append_live} nomodeset bee.gui=off bee.nvidia.mode=gsp-off net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
+
 label live-@FLAVOUR@-gsp-off
     menu label EASY-BEE (^NVIDIA GSP=off)
     linux ${kernel}
@@ -800,10 +840,7 @@ enforce_live_build_bootloader_assets() {
 
     if [ -f "$grub_cfg" ]; then
         if extract_live_grub_entry "$grub_cfg"; then
-            mkdir -p "$grub_dir/live-theme"
             cp "${BUILDER_DIR}/config/bootloaders/grub-efi/config.cfg" "$grub_dir/config.cfg"
-            cp "${BUILDER_DIR}/config/bootloaders/grub-efi/theme.cfg" "$grub_dir/theme.cfg"
-            cp -R "${BUILDER_DIR}/config/bootloaders/grub-efi/live-theme/." "$grub_dir/live-theme/"
             write_canonical_grub_cfg "$grub_cfg" "$grub_kernel" "${live_build_append:-$grub_append}" "$grub_initrd"
             echo "bootloader sync: rewrote binary/boot/grub/grub.cfg with canonical EASY-BEE menu"
         else
@@ -857,8 +894,11 @@ FULL_BUILD_MARKER="${BUILD_WORK_DIR}/.bee-full-build-marker"
 # hooks, archives, Dockerfile, auto/config) require a full lb build.
 needs_full_build() {
     [ -f "${FULL_BUILD_MARKER}" ]                                        || return 0
-    [ -f "${BUILD_WORK_DIR}/binary/live/filesystem.squashfs" ]           || return 0
     [ -f "${BUILD_WORK_DIR}/live-image-amd64.hybrid.iso" ]               || return 0
+    # Accept any versioned squashfs (filesystem-v*.squashfs or legacy filesystem.squashfs)
+    _any_sq=$(find "${BUILD_WORK_DIR}/binary/live" -maxdepth 1 \
+        -name 'filesystem*.squashfs' 2>/dev/null | head -1)
+    [ -n "$_any_sq" ]                                                    || return 0
 
     _heavy=$(find \
         "${BUILDER_DIR}/VERSIONS" \
@@ -881,40 +921,109 @@ needs_full_build() {
 # Fast-path: unsquash existing filesystem, rsync overlay on top, repack.
 # Requires ~10 GB free in BEE_CACHE_DIR for the unpacked squashfs.
 fast_path_repack_squashfs() {
-    _sq="${BUILD_WORK_DIR}/binary/live/filesystem.squashfs"
+    _old_sq=$(find "${BUILD_WORK_DIR}/binary/live" -maxdepth 1 \
+        -name 'filesystem*.squashfs' | sort | head -1)
+    _sq="${BUILD_WORK_DIR}/binary/live/${SQUASHFS_FILENAME}"
     _tmp="${BEE_CACHE_DIR}/fast-unsquash-${BUILD_VARIANT}"
-    echo "=== fast-path: unsquash ($(du -sh "$_sq" | cut -f1) compressed) ==="
+    echo "=== fast-path: unsquash $(basename "$_old_sq") ($(du -sh "$_old_sq" | cut -f1) compressed) ==="
     rm -rf "$_tmp"
-    unsquashfs -d "$_tmp" "$_sq"
+    unsquashfs -d "$_tmp" "$_old_sq"
     echo "=== fast-path: syncing overlay stage ==="
     rsync -a --checksum "${OVERLAY_STAGE_DIR}/" "$_tmp/"
-    echo "=== fast-path: repacking squashfs ==="
+    echo "=== fast-path: repacking as ${SQUASHFS_FILENAME} ==="
     _sq_new="${_sq}.new"
     rm -f "$_sq_new"
-    mksquashfs "$_tmp" "$_sq_new" -comp zstd -b 1048576 -noappend -no-progress
+    mksquashfs "$_tmp" "$_sq_new" -comp zstd -b 1048576 -noappend -no-progress -no-xattrs
     mv "$_sq_new" "$_sq"
     rm -rf "$_tmp"
+    [ "$_old_sq" != "$_sq" ] && rm -f "$_old_sq"
     echo "=== fast-path: squashfs repacked ($(du -sh "$_sq" | cut -f1)) ==="
 }
 
-# Fast-path: rebuild ISO by replacing only live/filesystem.squashfs via xorriso.
+# Fast-path: rebuild ISO replacing the squashfs via xorriso.
 # Boot structure (El Torito, EFI, MBR hybrid) is replayed from the prior ISO.
 fast_path_rebuild_iso() {
-    _sq="${BUILD_WORK_DIR}/binary/live/filesystem.squashfs"
+    _sq="${BUILD_WORK_DIR}/binary/live/${SQUASHFS_FILENAME}"
     _prior="${BUILD_WORK_DIR}/live-image-amd64.hybrid.iso"
     _new="${BUILD_WORK_DIR}/live-image-amd64.hybrid.iso.new"
     echo "=== fast-path: rebuilding ISO with xorriso ==="
     rm -f "$_new"
+    # Remove any old squashfs entries from the prior ISO before adding the new one
+    _old_entries=$(xorriso -indev "$_prior" -find /live -name 'filesystem*.squashfs' -- 2>/dev/null \
+        | grep -E '^/live/filesystem.*\.squashfs$' || true)
+    _rm_args=""
+    for _e in $_old_entries; do
+        _rm_args="$_rm_args -rm $_e --"
+    done
+    # shellcheck disable=SC2086
     xorriso \
         -indev  "$_prior" \
         -outdev "$_new" \
-        -map    "$_sq" /live/filesystem.squashfs \
+        ${_rm_args} \
+        -map    "$_sq" /live/${SQUASHFS_FILENAME} \
         -boot_image any replay \
         -commit
     mv "$_new" "$_prior"
     echo "=== fast-path: ISO rebuilt ==="
 }
 
+dir_has_entries() {
+    _dir="$1"
+    [ -d "$_dir" ] || return 1
+    find "$_dir" -mindepth 1 -print -quit 2>/dev/null | grep -q .
+}
+
+move_tree_to_layer() {
+    _src_root="$1"
+    _rel="$2"
+    _dst_root="$3"
+    [ -e "${_src_root}/${_rel}" ] || return 0
+    mkdir -p "${_dst_root}/$(dirname "$_rel")"
+    mv "${_src_root}/${_rel}" "${_dst_root}/${_rel}"
+}
+
+split_live_squashfs_layers() {
+    lb_dir="$1"
+    live_dir="${lb_dir}/binary/live"
+    base_sq="${live_dir}/filesystem.squashfs"
+    usr_sq="${live_dir}/10-usr.squashfs"
+    fw_sq="${live_dir}/20-firmware.squashfs"
+
+    [ -f "$base_sq" ] || return 0
+    command -v unsquashfs >/dev/null 2>&1 || return 0
+    command -v mksquashfs >/dev/null 2>&1 || return 0
+
+    tmp_root="$(mktemp -d)"
+    tmp_usr="$(mktemp -d)"
+    tmp_fw="$(mktemp -d)"
+
+    echo "=== splitting live squashfs into smaller layers ==="
+    unsquashfs -d "$tmp_root/root" "$base_sq" >/dev/null
+    mkdir -p "$tmp_usr/root" "$tmp_fw/root"
+
+    move_tree_to_layer "$tmp_root/root" "usr" "$tmp_usr/root"
+    move_tree_to_layer "$tmp_root/root" "lib/firmware" "$tmp_fw/root"
+    move_tree_to_layer "$tmp_root/root" "usr/lib/firmware" "$tmp_fw/root"
+    move_tree_to_layer "$tmp_root/root" "boot/firmware" "$tmp_fw/root"
+
+    rm -f "$usr_sq" "$fw_sq"
+    mksquashfs "$tmp_root/root" "${base_sq}.new" -comp zstd -b 1048576 -noappend -no-progress -no-xattrs >/dev/null
+    mv "${base_sq}.new" "$base_sq"
+
+    if dir_has_entries "$tmp_usr/root"; then
+        mksquashfs "$tmp_usr/root" "${usr_sq}.new" -comp zstd -b 1048576 -noappend -no-progress -no-xattrs >/dev/null
+        mv "${usr_sq}.new" "$usr_sq"
+    fi
+    if dir_has_entries "$tmp_fw/root"; then
+        mksquashfs "$tmp_fw/root" "${fw_sq}.new" -comp zstd -b 1048576 -noappend -no-progress -no-xattrs >/dev/null
+        mv "${fw_sq}.new" "$fw_sq"
+    fi
+
+    echo "=== live squashfs layers ==="
+    find "$live_dir" -maxdepth 1 -type f -name '*.squashfs' -exec du -sh {} \; | sort
+    rm -rf "$tmp_root" "$tmp_usr" "$tmp_fw"
+}
+
 recover_iso_memtest() {
     lb_dir="$1"
     iso_path="$2"
@@ -992,11 +1101,12 @@ recover_iso_memtest() {
     fi
 }
 
-AUDIT_VERSION_EFFECTIVE="$(resolve_audit_version)"
-ISO_VERSION_EFFECTIVE="$(resolve_iso_version)"
-ISO_BASENAME="easy-bee-${BUILD_VARIANT}-v${ISO_VERSION_EFFECTIVE}-amd64"
+PROJECT_VERSION_EFFECTIVE="$(resolve_project_version)"
+SQUASHFS_FILENAME="filesystem-v${PROJECT_VERSION_EFFECTIVE}.squashfs"
+ISO_BASENAME="easy-bee-${BUILD_VARIANT}-v${PROJECT_VERSION_EFFECTIVE}-amd64"
 # Versioned output directory: dist/easy-bee-v4.1/ — all final artefacts live here.
-OUT_DIR="${DIST_DIR}/easy-bee-v${ISO_VERSION_EFFECTIVE}"
+OUT_DIR="${DIST_DIR}/easy-bee-v${PROJECT_VERSION_EFFECTIVE}"
+ISO_VERSION_LABEL_TOKEN="$(printf '%s' "${PROJECT_VERSION_EFFECTIVE}" | tr '[:lower:].-' '[:upper:]__')"
 mkdir -p "${OUT_DIR}"
 LOG_DIR="${OUT_DIR}/${ISO_BASENAME}.logs"
 LOG_ARCHIVE="${OUT_DIR}/${ISO_BASENAME}.logs.tar.gz"
@@ -1172,7 +1282,7 @@ fi
 
 echo "=== bee ISO build (variant: ${BUILD_VARIANT}) ==="
 echo "Debian: ${DEBIAN_VERSION}, Kernel ABI: ${DEBIAN_KERNEL_ABI}, Go: ${GO_VERSION}"
-echo "Audit version: ${AUDIT_VERSION_EFFECTIVE}, ISO version: ${ISO_VERSION_EFFECTIVE}"
+echo "Project version: ${PROJECT_VERSION_EFFECTIVE}"
 echo ""
 
 run_step "sync git submodules" "05-git-submodules" \
@@ -1192,7 +1302,7 @@ if [ "$NEED_BUILD" = "1" ]; then
         "cd '${REPO_ROOT}/audit' && \
         env GOOS=linux GOARCH=amd64 CGO_ENABLED=0 \
             go build \
-            -ldflags '-s -w -X main.Version=${AUDIT_VERSION_EFFECTIVE}' \
+            -ldflags '-s -w -X main.Version=${PROJECT_VERSION_EFFECTIVE}' \
             -o '${BEE_BIN}' \
             ./cmd/bee"
     echo "binary: $BEE_BIN"
@@ -1467,8 +1577,10 @@ else
 fi
 
 cat > "${OVERLAY_STAGE_DIR}/etc/bee-release" <<EOF
-BEE_ISO_VERSION=${ISO_VERSION_EFFECTIVE}
-BEE_AUDIT_VERSION=${AUDIT_VERSION_EFFECTIVE}
+BEE_VERSION=${PROJECT_VERSION_EFFECTIVE}
+export BEE_VERSION
+BEE_ISO_VERSION=${PROJECT_VERSION_EFFECTIVE}
+BEE_AUDIT_VERSION=${PROJECT_VERSION_EFFECTIVE}
 BEE_BUILD_VARIANT=${BUILD_VARIANT}
 BEE_GPU_VENDOR=${BEE_GPU_VENDOR}
 BUILD_DATE=${BUILD_DATE}
@@ -1561,6 +1673,7 @@ if ! needs_full_build; then
     fast_path_rebuild_iso
     ISO_RAW="${LB_DIR}/live-image-amd64.hybrid.iso"
     validate_iso_live_boot_entries "$ISO_RAW"
+    validate_iso_grub_assets "$ISO_RAW"
     validate_iso_nvidia_runtime "$ISO_RAW"
     cp "$ISO_RAW" "$ISO_OUT"
     echo ""
@@ -1575,15 +1688,25 @@ echo "=== building ISO (variant: ${BUILD_VARIANT}) ==="
 
 # Export for auto/config
 BEE_GPU_VENDOR_UPPER="$(echo "${BUILD_VARIANT}" | tr 'a-z-' 'A-Z_')"
-export BEE_GPU_VENDOR_UPPER
+BEE_ISO_VOLUME="EASY_BEE_${BEE_GPU_VENDOR_UPPER}_V${ISO_VERSION_LABEL_TOKEN}"
+export BEE_GPU_VENDOR_UPPER BEE_ISO_VOLUME
 
 cd "${LB_DIR}"
 run_step_sh "live-build clean" "80-lb-clean" "lb clean --all 2>&1 | tail -3"
 run_step_sh "live-build config" "81-lb-config" "lb config 2>&1 | tail -5"
 dump_memtest_debug "pre-build" "${LB_DIR}"
+export MKSQUASHFS_OPTIONS="-no-xattrs"
 run_step_sh "live-build build" "90-lb-build" "lb build 2>&1"
 echo "=== enforcing canonical bootloader assets ==="
 enforce_live_build_bootloader_assets "${LB_DIR}"
+# Rename lb's default filesystem.squashfs to the versioned filename so the
+# ISO contains a version-stamped squashfs (e.g. filesystem-v10.15.squashfs).
+_std_sq="${LB_DIR}/binary/live/filesystem.squashfs"
+_ver_sq="${LB_DIR}/binary/live/${SQUASHFS_FILENAME}"
+if [ -f "${_std_sq}" ] && [ "${_std_sq}" != "${_ver_sq}" ]; then
+    mv "${_std_sq}" "${_ver_sq}"
+    echo "=== squashfs renamed: filesystem.squashfs → ${SQUASHFS_FILENAME} ==="
+fi
 reset_live_build_stage "${LB_DIR}" "binary_checksums"
 reset_live_build_stage "${LB_DIR}" "binary_iso"
 reset_live_build_stage "${LB_DIR}" "binary_zsync"
@@ -1615,6 +1738,7 @@ if [ -f "$ISO_RAW" ]; then
     fi
     validate_iso_memtest "$ISO_RAW"
     validate_iso_live_boot_entries "$ISO_RAW"
+    validate_iso_grub_assets "$ISO_RAW"
     validate_iso_nvidia_runtime "$ISO_RAW"
     cp "$ISO_RAW" "$ISO_OUT"
     touch "${FULL_BUILD_MARKER}"

iso/builder/config/bootloaders/grub-efi/config.cfg

@@ -1,5 +1,7 @@
-set default=0
-set timeout=5
+set default=1
+set timeout=10
+set color_normal=yellow/black
+set color_highlight=white/brown
 
 if [ x$feature_default_font_path = xy ] ; then
     font=unicode
@@ -8,7 +10,7 @@ else
 fi
 
 if loadfont $font ; then
-    set gfxmode=1920x1080,1280x1024,auto
+    set gfxmode=1280x1024,auto
     set gfxpayload=keep
     insmod efi_gop
     insmod efi_uga
@@ -26,6 +28,3 @@ insmod gfxterm
 
 terminal_input console serial
 terminal_output gfxterm serial
-
-insmod png
-source /boot/grub/theme.cfg

iso/builder/config/bootloaders/grub-efi/grub.cfg

@@ -1,12 +1,17 @@
 source /boot/grub/config.cfg
 
-menuentry "EASY-BEE" {
-    linux   @KERNEL_LIVE@ @APPEND_LIVE@ bee.display=kms bee.nvidia.mode=normal pci=realloc net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
+menuentry "EASY-BEE v@VERSION@" {
+    linux   @KERNEL_LIVE@ @APPEND_LIVE@ nomodeset bee.nvidia.mode=normal pci=realloc net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
     initrd  @INITRD_LIVE@
 }
 
-menuentry "EASY-BEE -- load to RAM (toram)" {
-    linux   @KERNEL_LIVE@ @APPEND_LIVE@ toram bee.display=kms bee.nvidia.mode=normal pci=realloc net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
+menuentry "EASY-BEE v@VERSION@ -- load to RAM (toram)" {
+    linux   @KERNEL_LIVE@ @APPEND_LIVE@ toram nomodeset bee.nvidia.mode=normal pci=realloc net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
+    initrd  @INITRD_LIVE@
+}
+
+menuentry "EASY-BEE v@VERSION@ -- no GUI / no X11" {
+    linux   @KERNEL_LIVE@ @APPEND_LIVE@ nomodeset bee.gui=off bee.nvidia.mode=gsp-off pci=realloc net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
     initrd  @INITRD_LIVE@
 }
 

iso/builder/config/bootloaders/grub-efi/live-theme/theme.txt

@@ -5,13 +5,6 @@ title-text: ""
 message-font: "Unifont Regular 16"
 terminal-font: "Unifont Regular 16"
 
-#bee logo - centered, upper third of screen
-+ image {
-        top = 4%
-        left = 50%-200
-        file = "bee-logo.png"
-}
-
 #help bar at the bottom
 + label {
         top = 100%-50

iso/builder/config/bootloaders/isolinux/live.cfg.in

@@ -1,16 +1,22 @@
 label live-@FLAVOUR@-normal
-    menu label ^EASY-BEE
-    menu default
+    menu label ^EASY-BEE v@VERSION@
     linux @LINUX@
     initrd @INITRD@
     append @APPEND_LIVE@ nomodeset bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
 
 label live-@FLAVOUR@-toram
-    menu label EASY-BEE (^load to RAM)
+    menu label EASY-BEE v@VERSION@ (^load to RAM)
+    menu default
     linux @LINUX@
     initrd @INITRD@
     append @APPEND_LIVE@ toram nomodeset bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
 
+label live-@FLAVOUR@-console
+    menu label EASY-BEE v@VERSION@ (^no GUI / no X11)
+    linux @LINUX@
+    initrd @INITRD@
+    append @APPEND_LIVE@ nomodeset bee.gui=off bee.nvidia.mode=gsp-off net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
+
 label live-@FLAVOUR@-gsp-off
     menu label EASY-BEE (^NVIDIA GSP=off)
     linux @LINUX@

iso/builder/config/hooks/normal/9000-bee-setup.hook.chroot

@@ -31,6 +31,7 @@ systemctl enable bee-preflight.service
 systemctl enable bee-audit.service
 systemctl enable bee-web.service
 systemctl enable bee-sshsetup.service
+systemctl enable bee-blackbox.service
 systemctl enable bee-selfheal.timer
 systemctl enable bee-boot-status.service
 systemctl enable ssh.service
@@ -66,6 +67,7 @@ chmod +x /usr/local/bin/bee-log-run    2>/dev/null || true
 chmod +x /usr/local/bin/bee-selfheal        2>/dev/null || true
 chmod +x /usr/local/bin/bee-boot-status    2>/dev/null || true
 chmod +x /usr/local/bin/bee-install        2>/dev/null || true
+chmod +x /usr/local/bin/bee-gui-gate       2>/dev/null || true
 chmod +x /usr/local/bin/bee-remount-medium 2>/dev/null || true
 if [ "$GPU_VENDOR" = "nvidia" ]; then
     chmod +x /usr/local/bin/bee-nvidia-load 2>/dev/null || true

iso/builder/config/hooks/normal/9998-strip-xattrs.hook.chroot

@@ -0,0 +1,37 @@
+#!/usr/bin/env python3
+# 9998-strip-xattrs.hook.chroot
+#
+# mksquashfs 4.5.1 (Debian bookworm) writes a non-INVALID xattr_id_table_start
+# even with -no-xattrs when the source tree contains POSIX ACL xattrs set by
+# dpkg/install-time.  Linux 6.1 squashfs driver then fails with
+# "unable to read xattr id index table" and aborts the mount.
+#
+# Strip all xattrs from the live chroot before mksquashfs sees the tree so the
+# resulting squashfs has SQUASHFS_INVALID_BLK in xattr_id_table_start.
+
+import os
+
+def strip(path):
+    try:
+        for attr in os.listxattr(path, follow_symlinks=False):
+            try:
+                os.removexattr(path, attr, follow_symlinks=False)
+            except OSError:
+                pass
+    except OSError:
+        pass
+
+removed = 0
+for root, dirs, files in os.walk('/', topdown=True, followlinks=False):
+    for name in dirs + files:
+        p = os.path.join(root, name)
+        try:
+            attrs = os.listxattr(p, follow_symlinks=False)
+            if attrs:
+                strip(p)
+                removed += len(attrs)
+        except OSError:
+            pass
+    strip(root)
+
+print(f"9998-strip-xattrs: removed xattrs from {removed} entries")

iso/builder/config/package-lists/bee.list.chroot

@@ -66,9 +66,6 @@ jq
 curl
 net-tools
 
-# QR codes (for displaying audit results)
-qrencode
-
 # Local desktop (openbox + chromium kiosk)
 gparted
 openbox

iso/overlay/etc/motd

@@ -1,11 +1,4 @@
-
-  ███████╗ █████╗ ███████╗██╗   ██╗      ██████╗ ███████╗███████╗
-  ██╔════╝██╔══██╗██╔════╝╚██╗ ██╔╝      ██╔══██╗██╔════╝██╔════╝
-  █████╗  ███████║███████╗ ╚████╔╝ █████╗██████╔╝█████╗  █████╗
-  ██╔══╝  ██╔══██║╚════██║  ╚██╔╝  ╚════╝██╔══██╗██╔══╝  ██╔══╝
-  ███████╗██║  ██║███████║   ██║         ██████╔╝███████╗███████╗
-  ╚══════╝╚═╝  ╚═╝╚══════╝   ╚═╝         ╚═════╝ ╚══════╝╚══════╝
-
+  EASY BEE
   Hardware Audit LiveCD
   Build: %%BUILD_INFO%%
 

iso/overlay/etc/systemd/system/bee-audit.service

@@ -1,6 +1,6 @@
 [Unit]
 Description=Bee: hardware audit
-After=bee-preflight.service bee-network.service bee-nvidia.service bee-blackbox.service
+After=bee-preflight.service bee-nvidia.service bee-blackbox.service
 
 [Service]
 Type=oneshot

iso/overlay/etc/systemd/system/bee-network.service

@@ -1,7 +1,6 @@
 [Unit]
 Description=Bee: bring up network interfaces via DHCP
-After=local-fs.target bee-blackbox.service
-Before=network-online.target bee-audit.service
+After=bee-web.service bee-audit.service
 
 [Service]
 Type=oneshot

iso/overlay/etc/systemd/system/bee-preflight.service

@@ -1,6 +1,6 @@
 [Unit]
 Description=Bee: runtime preflight self-check
-After=bee-network.service bee-nvidia.service bee-blackbox.service
+After=bee-nvidia.service bee-blackbox.service
 Before=bee-audit.service
 
 [Service]

iso/overlay/etc/systemd/system/bee-selfheal.timer

@@ -3,7 +3,7 @@ Description=Bee: run self-heal checks periodically
 
 [Timer]
 OnBootSec=45sec
-OnUnitActiveSec=60sec
+OnUnitActiveSec=3min
 AccuracySec=15sec
 Unit=bee-selfheal.service
 

iso/overlay/etc/systemd/system/lightdm.service.d/bee-gui-gate.conf

@@ -0,0 +1,2 @@
+[Service]
+ExecCondition=/usr/local/bin/bee-gui-gate

iso/overlay/usr/local/bin/bee-boot-status

@@ -51,12 +51,7 @@ while true; do
     printf '\033[H\033[2J'
 
     printf '\n'
-    printf '  \033[33m███████╗ █████╗ ███████╗██╗   ██╗      ██████╗ ███████╗███████╗\033[0m\n'
-    printf '  \033[33m██╔════╝██╔══██╗██╔════╝╚██╗ ██╔╝      ██╔══██╗██╔════╝██╔════╝\033[0m\n'
-    printf '  \033[33m█████╗  ███████║███████╗ ╚████╔╝ █████╗██████╔╝█████╗  █████╗\033[0m\n'
-    printf '  \033[33m██╔══╝  ██╔══██║╚════██║  ╚██╔╝  ╚════╝██╔══██╗██╔══╝  ██╔══╝\033[0m\n'
-    printf '  \033[33m███████╗██║  ██║███████║   ██║         ██████╔╝███████╗███████╗\033[0m\n'
-    printf '  \033[33m╚══════╝╚═╝  ╚═╝╚══════╝   ╚═╝         ╚═════╝ ╚══════╝╚══════╝\033[0m\n'
+    printf '  \033[33mEASY BEE\033[0m\n'
     printf '  Hardware Audit LiveCD\n'
     printf '\n'
 

iso/overlay/usr/local/bin/bee-gui-gate

@@ -0,0 +1,27 @@
+#!/bin/sh
+# bee-gui-gate — skip starting the local GUI when bee.gui=off is set.
+
+set -eu
+
+cmdline_param() {
+    key="$1"
+    for token in $(cat /proc/cmdline 2>/dev/null); do
+        case "$token" in
+            "$key"=*)
+                echo "${token#*=}"
+                return 0
+                ;;
+        esac
+    done
+    return 1
+}
+
+mode="$(cmdline_param bee.gui || true)"
+case "${mode}" in
+    off|false|0|tty|console|text|nogui)
+        echo "bee-gui-gate: bee.gui=${mode}; skipping lightdm"
+        exit 1
+        ;;
+esac
+
+exit 0

iso/overlay/usr/local/bin/bee-install

@@ -8,7 +8,7 @@
 # Layout (UEFI):  GPT, /dev/sdX1=EFI 512MB vfat, /dev/sdX2=root ext4
 # Layout (BIOS):  MBR, /dev/sdX1=root ext4
 #
-# Squashfs source: /run/live/medium/live/filesystem.squashfs
+# Squashfs sources: /run/live/medium/live/*.squashfs
 
 set -euo pipefail
 
@@ -62,9 +62,9 @@ for tool in parted mkfs.vfat mkfs.ext4 unsquashfs grub-install update-grub; do
     fi
 done
 
-SQUASHFS="/run/live/medium/live/filesystem.squashfs"
-if [ ! -f "$SQUASHFS" ]; then
-    echo "ERROR: squashfs not found at $SQUASHFS" >&2
+mapfile -t SQUASHFS_FILES < <(find /run/live/medium/live -maxdepth 1 -type f -name '*.squashfs' | sort)
+if [ "${#SQUASHFS_FILES[@]}" -eq 0 ]; then
+    echo "ERROR: no squashfs files found under /run/live/medium/live" >&2
     echo "  The live medium may have been disconnected." >&2
     echo "  Reconnect the disc and run:  bee-remount-medium --wait" >&2
     echo "  Then re-run bee-install." >&2
@@ -106,7 +106,10 @@ log "=== BEE DISK INSTALLER ==="
 log "Target device : $DEVICE"
 log "Root partition: $PART_ROOT"
 [ "$UEFI" = "1" ] && log "EFI partition : $PART_EFI"
-log "Squashfs      : $SQUASHFS ($(du -sh "$SQUASHFS" | cut -f1))"
+log "Squashfs      : ${#SQUASHFS_FILES[@]} layer(s)"
+for sf in "${SQUASHFS_FILES[@]}"; do
+    log "  - $sf ($(du -sh "$sf" | cut -f1))"
+done
 log "Log           : $LOGFILE"
 log ""
 
@@ -163,7 +166,9 @@ log "  Mounted."
 
 # ------------------------------------------------------------------
 log "--- Step 5/7: Unpacking filesystem (this takes 10-20 minutes) ---"
-log "  Source: $SQUASHFS"
+for sf in "${SQUASHFS_FILES[@]}"; do
+    log "  Source: $sf"
+done
 log "  Target: $MOUNT_ROOT"
 
 # unsquashfs does not support resume, so retry the entire unpack step if the
@@ -177,9 +182,9 @@ while true; do
     fi
     [ "$UNPACK_ATTEMPTS" -gt 1 ] && log "  Retry attempt $UNPACK_ATTEMPTS / $UNPACK_MAX ..."
 
-    # Re-check squashfs is reachable before each attempt
-    if [ ! -f "$SQUASHFS" ]; then
-        log "  SOURCE LOST: $SQUASHFS not found."
+    mapfile -t SQUASHFS_FILES < <(find /run/live/medium/live -maxdepth 1 -type f -name '*.squashfs' | sort)
+    if [ "${#SQUASHFS_FILES[@]}" -eq 0 ]; then
+        log "  SOURCE LOST: no squashfs files found under /run/live/medium/live."
         log "  Reconnect the disc and run 'bee-remount-medium --wait' in another terminal,"
         log "  then press Enter here to retry."
         read -r _
@@ -194,12 +199,17 @@ while true; do
     fi
 
     UNPACK_OK=0
-    unsquashfs -f -d "$MOUNT_ROOT" "$SQUASHFS" 2>&1 | \
-        grep -E '^\[|^inod|^created|^extract|^ERROR|failed' | \
-        while IFS= read -r line; do log "  $line"; done || UNPACK_OK=$?
+    for sf in "${SQUASHFS_FILES[@]}"; do
+        log "  Unpacking $(basename "$sf") ..."
+        unsquashfs -f -d "$MOUNT_ROOT" "$sf" 2>&1 | \
+            grep -E '^\[|^inod|^created|^extract|^ERROR|failed' | \
+            while IFS= read -r line; do log "  $line"; done || UNPACK_OK=$?
+        [ "$UNPACK_OK" -eq 0 ] || break
+    done
 
     # Check squashfs is still reachable (gone = disc pulled during copy)
-    if [ ! -f "$SQUASHFS" ]; then
+    mapfile -t SQUASHFS_FILES < <(find /run/live/medium/live -maxdepth 1 -type f -name '*.squashfs' | sort)
+    if [ "${#SQUASHFS_FILES[@]}" -eq 0 ]; then
         log "  WARNING: source medium lost during unpack — will retry after remount."
         log "  Run 'bee-remount-medium --wait' in another terminal, then press Enter."
         read -r _

iso/overlay/usr/local/bin/bee-network.sh

@@ -1,8 +1,9 @@
 #!/bin/sh
 # bee-network.sh — bring up all physical network interfaces via DHCP
-# Unattended: runs silently, logs results, never blocks.
+# Unattended: starts later in boot, runs quietly, and gives up after a bounded timeout.
 
 LOG_PREFIX="bee-network"
+DHCP_TIMEOUT_SECS=300
 
 log() { echo "[$LOG_PREFIX] $*"; }
 
@@ -19,9 +20,50 @@ if command -v udevadm >/dev/null 2>&1; then
     udevadm settle --timeout=5 >/dev/null 2>&1 || log "WARN: udevadm settle timed out"
 fi
 
+start_dhcp() {
+    iface="$1"
+    if ! ip link set "$iface" up; then
+        log "WARN: could not bring up $iface"
+        return 1
+    fi
+
+    carrier=$(cat "/sys/class/net/$iface/carrier" 2>/dev/null || true)
+    if [ "$carrier" = "1" ]; then
+        log "carrier detected on $iface"
+    else
+        log "carrier not detected on $iface"
+    fi
+
+    dhclient -r "$iface" >/dev/null 2>&1 || true
+
+    if timeout "${DHCP_TIMEOUT_SECS}" dhclient -4 -q -1 "$iface" >/dev/null 2>&1; then
+        addr="$(ip -4 -o addr show dev "$iface" scope global 2>/dev/null | awk '{print $4}' | head -1)"
+        if [ -n "$addr" ]; then
+            log "DHCP lease acquired on $iface ($addr)"
+        else
+            log "DHCP lease acquired on $iface"
+        fi
+        return 0
+    fi
+
+    rc=$?
+    case "$rc" in
+        124)
+            log "DHCP timed out on $iface after ${DHCP_TIMEOUT_SECS}s"
+            ;;
+        *)
+            log "DHCP failed on $iface (exit $rc)"
+            ;;
+    esac
+    dhclient -r "$iface" >/dev/null 2>&1 || true
+    return 1
+}
+
 started_ifaces=""
 started_count=0
 scan_pass=1
+pids=""
+pid_ifaces=""
 
 # Some server NICs appear a bit later after module/firmware init. Do a small
 # bounded rescan window without turning network bring-up into a boot blocker.
@@ -34,22 +76,11 @@ while [ "$scan_pass" -le 3 ]; do
                 *" $iface "*) continue ;;
             esac
 
-            log "bringing up $iface"
-            if ! ip link set "$iface" up; then
-                log "WARN: could not bring up $iface"
-                continue
-            fi
-
-            carrier=$(cat "/sys/class/net/$iface/carrier" 2>/dev/null || true)
-            if [ "$carrier" = "1" ]; then
-                log "carrier detected on $iface"
-            else
-                log "carrier not detected yet on $iface"
-            fi
-
-            # DHCP in background — non-blocking, keep dhclient verbose output in the service log.
-            dhclient -4 -v -nw "$iface" &
-            log "DHCP started for $iface (pid $!)"
+            log "starting DHCP on $iface (timeout ${DHCP_TIMEOUT_SECS}s)"
+            start_dhcp "$iface" &
+            pid="$!"
+            pids="$pids $pid"
+            pid_ifaces="$pid_ifaces $pid:$iface"
 
             started_ifaces="$started_ifaces $iface"
             started_count=$((started_count + 1))
@@ -68,4 +99,15 @@ if [ "$started_count" -eq 0 ]; then
     exit 0
 fi
 
-log "done (interfaces started: $started_count)"
+success_count=0
+for pid_iface in $pid_ifaces; do
+    pid="${pid_iface%%:*}"
+    iface="${pid_iface#*:}"
+    if wait "$pid"; then
+        success_count=$((success_count + 1))
+    else
+        log "DHCP did not complete successfully on $iface"
+    fi
+done
+
+log "done (interfaces scanned: $started_count, leases acquired: $success_count)"

iso/overlay/usr/local/bin/bee-remount-medium

@@ -2,7 +2,7 @@
 # bee-remount-medium — find and remount the live ISO medium to /run/live/medium
 #
 # Run this after reconnecting the ISO source disc (USB/CD) if the live medium
-# was lost and /run/live/medium/live/filesystem.squashfs is missing.
+# was lost and /run/live/medium/live/*.squashfs are missing.
 #
 # Usage: bee-remount-medium [--wait]
 #   --wait  keep retrying every 5 seconds until the medium is found (useful
@@ -11,7 +11,7 @@
 set -euo pipefail
 
 MEDIUM_DIR="/run/live/medium"
-SQUASHFS_REL="live/filesystem.squashfs"
+SQUASHFS_GLOB="live/*.squashfs"
 WAIT_MODE=0
 
 for arg in "$@"; do
@@ -28,6 +28,10 @@ done
 log() { echo "[$(date +%H:%M:%S)] $*"; }
 die() { log "ERROR: $*" >&2; exit 1; }
 
+if [ "$(id -u)" -ne 0 ]; then
+    die "bee-remount-medium must be run as root (use sudo or a root shell)"
+fi
+
 # Return all candidate block devices (optical + removable USB mass storage)
 find_candidates() {
     # CD/DVD drives
@@ -52,7 +56,7 @@ try_mount() {
     local tmpdir
     tmpdir=$(mktemp -d /tmp/bee-probe-XXXXXX)
     if mount -o ro "$dev" "$tmpdir" 2>/dev/null; then
-        if [ -f "${tmpdir}/${SQUASHFS_REL}" ]; then
+        if find "${tmpdir}/live" -maxdepth 1 -type f -name '*.squashfs' 2>/dev/null | grep -q .; then
             # Unmount probe mount and mount properly onto live path
             umount "$tmpdir" 2>/dev/null || true
             rmdir "$tmpdir"  2>/dev/null || true
@@ -78,8 +82,9 @@ attempt() {
     for dev in $(find_candidates); do
         log "  Trying $dev ..."
         if try_mount "$dev"; then
-            local sq="${MEDIUM_DIR}/${SQUASHFS_REL}"
-            log "SUCCESS: squashfs available at $sq ($(du -sh "$sq" | cut -f1))"
+            local count
+            count=$(find "${MEDIUM_DIR}/live" -maxdepth 1 -type f -name '*.squashfs' 2>/dev/null | wc -l | tr -d ' ')
+            log "SUCCESS: ${count} squashfs layer(s) available under ${MEDIUM_DIR}/live"
             return 0
         fi
     done
@@ -96,5 +101,5 @@ if [ "$WAIT_MODE" = "1" ]; then
         sleep 5
     done
 else
-    attempt || die "No ISO medium with ${SQUASHFS_REL} found. Reconnect the disc and re-run, or use --wait."
+    attempt || die "No ISO medium with ${SQUASHFS_GLOB} found. Reconnect the disc and re-run, or use --wait."
 fi

iso/overlay/usr/local/bin/bee-selfheal

@@ -8,11 +8,17 @@ EXPORT_DIR="/appdata/bee/export"
 AUDIT_JSON="${EXPORT_DIR}/bee-audit.json"
 RUNTIME_JSON="${EXPORT_DIR}/runtime-health.json"
 LOCK_DIR="/run/bee-selfheal.lock"
+EVENTS=0
 
 log() {
     echo "[${LOG_PREFIX}] $*"
 }
 
+log_event() {
+    EVENTS=$((EVENTS + 1))
+    log "$*"
+}
+
 have_nvidia_gpu() {
     lspci -Dn 2>/dev/null | awk '$2 ~ /^03(00|02):$/ && $3 ~ /^10de:/ { found=1; exit } END { exit(found ? 0 : 1) }'
 }
@@ -56,24 +62,22 @@ web_healthy() {
 mkdir -p "${EXPORT_DIR}" /run
 
 if ! mkdir "${LOCK_DIR}" 2>/dev/null; then
-    log "another self-heal run is already active"
+    log_event "another self-heal run is already active"
     exit 0
 fi
 trap 'rmdir "${LOCK_DIR}" >/dev/null 2>&1 || true' EXIT
 
-log "start"
-
 if have_nvidia_gpu && [ ! -e /dev/nvidia0 ]; then
-    log "NVIDIA GPU detected but /dev/nvidia0 is missing"
+    log_event "NVIDIA GPU detected but /dev/nvidia0 is missing"
     restart_service bee-nvidia.service || true
 fi
 
 runtime_state="$(artifact_state "${RUNTIME_JSON}")"
 if [ "${runtime_state}" != "ready" ]; then
     if [ "${runtime_state}" = "interrupted" ]; then
-        log "runtime-health.json.tmp exists — interrupted runtime-health write detected"
+        log_event "runtime-health.json.tmp exists — interrupted runtime-health write detected"
     else
-        log "runtime-health.json missing or empty"
+        log_event "runtime-health.json missing or empty"
     fi
     restart_service bee-preflight.service || true
 fi
@@ -81,19 +85,17 @@ fi
 audit_state="$(artifact_state "${AUDIT_JSON}")"
 if [ "${audit_state}" != "ready" ]; then
     if [ "${audit_state}" = "interrupted" ]; then
-        log "bee-audit.json.tmp exists — interrupted audit write detected"
+        log_event "bee-audit.json.tmp exists — interrupted audit write detected"
     else
-        log "bee-audit.json missing or empty"
+        log_event "bee-audit.json missing or empty"
     fi
     restart_service bee-audit.service || true
 fi
 
 if ! service_active bee-web.service; then
-    log "bee-web.service is not active"
+    log_event "bee-web.service is not active"
     restart_service bee-web.service || true
 elif ! web_healthy; then
-    log "bee-web health check failed"
+    log_event "bee-web health check failed"
     restart_service bee-web.service || true
 fi
-
-log "done"