From 955b47a3357e0b3938ccc3896a6b30d1c2b7266b Mon Sep 17 00:00:00 2001
From: "Hoseok(Jose) LEE" <F1304@dpwah.com>
Date: Tue, 23 Jun 2026 15:51:34 +0900
Subject: [PATCH] Release v1.11.16 - MemoryMax 128M + BSP-baking integration
 guide
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- web-configurator.service: MemoryMax 48M -> 128M (support-bundle+UI 동시 사용 시
  OOM-kill 위험 제거; 장비 RAM 3.4GB 대비 3.7%, 누수 방지 캡 유지)
- BSP 통합 가이드 정비: 네트워크-적용 하드닝본을 /usr/bin/dpworld-network-apply.sh
  원본 교체(BSP 베이킹)하는 것을 1차 방식으로 명시. .service.d override 드롭인은
  라이브 후적용(over-the-top) fallback으로 정리
- 최신 UI(v1.11.15: 사이드바 System/Firmware 그룹 + monitor 아이콘) 동기화
- 배포물 flat 레이아웃(루트=배포물), 내부 참조/산출물 정리
---
 .gitattributes                                |    6 +
 .gitignore                                    |   72 +
 BSP-INTEGRATION.md                            |  202 ++
 CHANGELOG.md                                  |   42 +
 DELIVERABLE-MANIFEST.txt                      |   82 +
 README.md                                     |  165 +
 RELEASE-NOTES.md                              |  101 +
 VERSION                                       |    1 +
 deploy/dpworld-ap-apply.service               |   10 +
 deploy/dpworld-ap-apply.sh                    |   89 +
 deploy/dpworld-ap-seed.service                |   12 +
 deploy/dpworld-hostapd-ap0.service            |   10 +
 deploy/dpworld-net-recover.service            |   11 +
 deploy/dpworld-network-apply-hardened.sh      |  365 ++
 deploy/dpworld-network-apply-ondemand.conf    |    7 +
 .../20-hardened.conf                          |    7 +
 .../20-hardened.conf                          |    6 +
 deploy/dpworld-udhcpd-ap0.service             |   12 +
 deploy/nginx.conf                             |   25 +
 deploy/web-configurator.service               |   50 +
 docs/DEPLOY.md                                |  203 ++
 docs/README.md                                |   22 +
 docs/architecture.md                          |  424 +++
 docs/architecture/v1.5.4.2-system-overview.md |  850 +++++
 docs/config-spec/config-contract-proposal.md  |  131 +
 .../proposed/config_device.v2.proposed.json   |  118 +
 .../proposed/config_protocol.v2.proposed.json |  124 +
 docs/dpworldapp_compatibility.md              |  243 ++
 .../device_schema_v2.json                     |  285 ++
 .../device_schema_v3.json                     |  174 +
 .../migration_examples.md                     |  679 ++++
 .../protocol_schema_v2.json                   |  222 ++
 .../protocol_schema_v3.json                   |  172 +
 docs/firmware-boot-hardening.md               |  133 +
 docs/firmware-ota-guide.md                    |  131 +
 docs/network-apply-engine-guide.md            | 1403 ++++++++
 docs/wifi-ap-guide.md                         |  132 +
 scripts/deploy.ps1                            |  434 +++
 src/config_validator.py                       |  845 +++++
 src/db_manager.py                             |  443 +++
 src/dpworldapp_enums.py                       |   90 +
 src/dpworldapp_telemetry.py                   |  196 ++
 src/enum_normalizer.py                        |  171 +
 src/firmware/__init__.py                      |    1 +
 src/firmware/config_safety.py                 |  216 ++
 src/firmware/fw_client.py                     |  124 +
 src/firmware/fw_controller.py                 |  602 ++++
 src/firmware/fw_routes.py                     |  135 +
 src/firmware/protocol.py                      |   64 +
 src/firmware/staging.py                       |   61 +
 src/kernel_log.py                             |  285 ++
 src/log_manager.py                            |  691 ++++
 src/migrations.py                             |  208 ++
 src/network/__init__.py                       |    0
 src/network/ap_engine.py                      |  151 +
 src/network/ap_model.py                       |   55 +
 src/network/ap_renderer.py                    |   36 +
 src/network/ap_routes.py                      |   54 +
 src/network/ap_validator.py                   |   71 +
 src/network/apply_engine.py                   |  723 ++++
 src/network/journal.py                        |  159 +
 src/network/net_routes.py                     |  151 +
 src/network/netmodel.py                       |  140 +
 src/network/renderer.py                       |  105 +
 src/network/snapshot.py                       |  128 +
 src/network/validator.py                      |  141 +
 src/network/verifier.py                       |  177 +
 src/network/watchdog.py                       |  336 ++
 src/server.py                                 | 1291 +++++++
 src/static/css/style.css                      | 3033 +++++++++++++++++
 src/static/fonts/Inter-Bold.woff2             |  Bin 0 -> 24356 bytes
 src/static/fonts/Inter-Light.woff2            |  Bin 0 -> 23916 bytes
 src/static/fonts/Inter-Medium.woff2           |  Bin 0 -> 24272 bytes
 src/static/fonts/Inter-Regular.woff2          |  Bin 0 -> 23664 bytes
 src/static/fonts/Inter-SemiBold.woff2         |  Bin 0 -> 24452 bytes
 src/static/fonts/JetBrainsMono-Medium.woff2   |  Bin 0 -> 21832 bytes
 src/static/fonts/JetBrainsMono-Regular.woff2  |  Bin 0 -> 21168 bytes
 src/static/img/dp-world-logo.svg              |  214 ++
 src/static/index.html                         |  229 ++
 src/static/js/api.js                          |  258 ++
 src/static/js/app.js                          |  904 +++++
 src/static/js/apply-flow.js                   |  307 ++
 src/static/js/components/crud-table.js        |   70 +
 src/static/js/components/ip-input.js          |  101 +
 src/static/js/components/port-input.js        |   36 +
 src/static/js/confirm-modal.js                |  112 +
 src/static/js/constants.js                    |   97 +
 src/static/js/country-codes.js                |  264 ++
 src/static/js/dirty-tracker.js                |   41 +
 src/static/js/firmware-logic.js               |  147 +
 src/static/js/icons.js                        |  135 +
 src/static/js/nav-guard.js                    |  166 +
 src/static/js/page-dirty.js                   |   91 +
 src/static/js/pages/can-bus.js                |  134 +
 src/static/js/pages/can.js                    |   92 +
 src/static/js/pages/ethernet.js               |  158 +
 src/static/js/pages/firmware.js               |  931 +++++
 src/static/js/pages/general-settings.js       |  355 ++
 src/static/js/pages/home.js                   | 1901 +++++++++++
 src/static/js/pages/io.js                     |  156 +
 src/static/js/pages/log.js                    |  747 ++++
 src/static/js/pages/modbus.js                 |  253 ++
 src/static/js/pages/net-apply.js              |  329 ++
 src/static/js/pages/network.js                |  207 ++
 src/static/js/pages/opcua.js                  |  164 +
 src/static/js/pages/register.js               |  480 +++
 src/static/js/pages/sensor-io.js              |  199 ++
 src/static/js/pages/server-setting.js         |  174 +
 src/static/js/pages/ssid.js                   |  458 +++
 src/static/js/pages/wifi-ap.js                |  214 ++
 src/static/js/pages/wifi.js                   |  495 +++
 src/static/js/pending.js                      |  391 +++
 src/static/js/state.js                        |  830 +++++
 src/static/js/toast.js                        |   96 +
 src/static/js/utils.js                        |   20 +
 src/static/js/validator.js                    |  156 +
 src/static/js/view-mode.js                    |   59 +
 src/support_bundle.py                         |  104 +
 src/system_status.py                          | 1166 +++++++
 119 files changed, 31479 insertions(+)
 create mode 100644 .gitattributes
 create mode 100644 .gitignore
 create mode 100644 BSP-INTEGRATION.md
 create mode 100644 CHANGELOG.md
 create mode 100644 DELIVERABLE-MANIFEST.txt
 create mode 100644 README.md
 create mode 100644 RELEASE-NOTES.md
 create mode 100644 VERSION
 create mode 100644 deploy/dpworld-ap-apply.service
 create mode 100644 deploy/dpworld-ap-apply.sh
 create mode 100644 deploy/dpworld-ap-seed.service
 create mode 100644 deploy/dpworld-hostapd-ap0.service
 create mode 100644 deploy/dpworld-net-recover.service
 create mode 100644 deploy/dpworld-network-apply-hardened.sh
 create mode 100644 deploy/dpworld-network-apply-ondemand.conf
 create mode 100644 deploy/dpworld-network-apply.service.d/20-hardened.conf
 create mode 100644 deploy/dpworld-network-seed.service.d/20-hardened.conf
 create mode 100644 deploy/dpworld-udhcpd-ap0.service
 create mode 100644 deploy/nginx.conf
 create mode 100644 deploy/web-configurator.service
 create mode 100644 docs/DEPLOY.md
 create mode 100644 docs/README.md
 create mode 100644 docs/architecture.md
 create mode 100644 docs/architecture/v1.5.4.2-system-overview.md
 create mode 100644 docs/config-spec/config-contract-proposal.md
 create mode 100644 docs/config-spec/proposed/config_device.v2.proposed.json
 create mode 100644 docs/config-spec/proposed/config_protocol.v2.proposed.json
 create mode 100644 docs/dpworldapp_compatibility.md
 create mode 100644 docs/dpworldapp_schema_handoff/device_schema_v2.json
 create mode 100644 docs/dpworldapp_schema_handoff/device_schema_v3.json
 create mode 100644 docs/dpworldapp_schema_handoff/migration_examples.md
 create mode 100644 docs/dpworldapp_schema_handoff/protocol_schema_v2.json
 create mode 100644 docs/dpworldapp_schema_handoff/protocol_schema_v3.json
 create mode 100644 docs/firmware-boot-hardening.md
 create mode 100644 docs/firmware-ota-guide.md
 create mode 100644 docs/network-apply-engine-guide.md
 create mode 100644 docs/wifi-ap-guide.md
 create mode 100644 scripts/deploy.ps1
 create mode 100644 src/config_validator.py
 create mode 100644 src/db_manager.py
 create mode 100644 src/dpworldapp_enums.py
 create mode 100644 src/dpworldapp_telemetry.py
 create mode 100644 src/enum_normalizer.py
 create mode 100644 src/firmware/__init__.py
 create mode 100644 src/firmware/config_safety.py
 create mode 100644 src/firmware/fw_client.py
 create mode 100644 src/firmware/fw_controller.py
 create mode 100644 src/firmware/fw_routes.py
 create mode 100644 src/firmware/protocol.py
 create mode 100644 src/firmware/staging.py
 create mode 100644 src/kernel_log.py
 create mode 100644 src/log_manager.py
 create mode 100644 src/migrations.py
 create mode 100644 src/network/__init__.py
 create mode 100644 src/network/ap_engine.py
 create mode 100644 src/network/ap_model.py
 create mode 100644 src/network/ap_renderer.py
 create mode 100644 src/network/ap_routes.py
 create mode 100644 src/network/ap_validator.py
 create mode 100644 src/network/apply_engine.py
 create mode 100644 src/network/journal.py
 create mode 100644 src/network/net_routes.py
 create mode 100644 src/network/netmodel.py
 create mode 100644 src/network/renderer.py
 create mode 100644 src/network/snapshot.py
 create mode 100644 src/network/validator.py
 create mode 100644 src/network/verifier.py
 create mode 100644 src/network/watchdog.py
 create mode 100644 src/server.py
 create mode 100644 src/static/css/style.css
 create mode 100644 src/static/fonts/Inter-Bold.woff2
 create mode 100644 src/static/fonts/Inter-Light.woff2
 create mode 100644 src/static/fonts/Inter-Medium.woff2
 create mode 100644 src/static/fonts/Inter-Regular.woff2
 create mode 100644 src/static/fonts/Inter-SemiBold.woff2
 create mode 100644 src/static/fonts/JetBrainsMono-Medium.woff2
 create mode 100644 src/static/fonts/JetBrainsMono-Regular.woff2
 create mode 100644 src/static/img/dp-world-logo.svg
 create mode 100644 src/static/index.html
 create mode 100644 src/static/js/api.js
 create mode 100644 src/static/js/app.js
 create mode 100644 src/static/js/apply-flow.js
 create mode 100644 src/static/js/components/crud-table.js
 create mode 100644 src/static/js/components/ip-input.js
 create mode 100644 src/static/js/components/port-input.js
 create mode 100644 src/static/js/confirm-modal.js
 create mode 100644 src/static/js/constants.js
 create mode 100644 src/static/js/country-codes.js
 create mode 100644 src/static/js/dirty-tracker.js
 create mode 100644 src/static/js/firmware-logic.js
 create mode 100644 src/static/js/icons.js
 create mode 100644 src/static/js/nav-guard.js
 create mode 100644 src/static/js/page-dirty.js
 create mode 100644 src/static/js/pages/can-bus.js
 create mode 100644 src/static/js/pages/can.js
 create mode 100644 src/static/js/pages/ethernet.js
 create mode 100644 src/static/js/pages/firmware.js
 create mode 100644 src/static/js/pages/general-settings.js
 create mode 100644 src/static/js/pages/home.js
 create mode 100644 src/static/js/pages/io.js
 create mode 100644 src/static/js/pages/log.js
 create mode 100644 src/static/js/pages/modbus.js
 create mode 100644 src/static/js/pages/net-apply.js
 create mode 100644 src/static/js/pages/network.js
 create mode 100644 src/static/js/pages/opcua.js
 create mode 100644 src/static/js/pages/register.js
 create mode 100644 src/static/js/pages/sensor-io.js
 create mode 100644 src/static/js/pages/server-setting.js
 create mode 100644 src/static/js/pages/ssid.js
 create mode 100644 src/static/js/pages/wifi-ap.js
 create mode 100644 src/static/js/pages/wifi.js
 create mode 100644 src/static/js/pending.js
 create mode 100644 src/static/js/state.js
 create mode 100644 src/static/js/toast.js
 create mode 100644 src/static/js/utils.js
 create mode 100644 src/static/js/validator.js
 create mode 100644 src/static/js/view-mode.js
 create mode 100644 src/support_bundle.py
 create mode 100644 src/system_status.py

diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..fe63390
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,6 @@
+*.service text eol=lf
+# v1.7.1: deploy/ 셸 스크립트 + systemd drop-in conf — 장비에서 실행되므로 LF 강제
+deploy/*.sh text eol=lf
+deploy/**/*.conf text eol=lf
+# v1.6.0: golden fixtures 는 장비 바이트 그대로 보존 — 어떤 EOL 변환도 금지 (byte-exact 테스트)
+tests/fixtures/network_golden/** -text
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..28f8026
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,72 @@
+# Dependencies
+node_modules/
+
+# Python bytecode and test/cache output
+__pycache__/
+*.py[cod]
+*$py.class
+.pytest_cache/
+.coverage
+.coverage.*
+htmlcov/
+.tox/
+.mypy_cache/
+.ruff_cache/
+.pyre/
+
+# Virtual environments
+.venv/
+venv/
+env/
+
+# Local runtime data
+dev_data.db*
+*.db
+*.db-*
+*.sqlite
+*.sqlite-*
+*.sqlite3
+*.sqlite3-*
+/db/
+/logs/
+*.log
+*.log.*
+network_journal.jsonl
+
+# Runtime/download workspaces
+/config_backups/
+/fw_staging/
+/fw_upload/
+/network/
+log-download-*/
+kernel-bundle-*/
+dpw_fw_*.zip
+
+# Downloaded/generated bundles and firmware images
+support-bundle_*.zip
+logs_*.tar.gz
+kernel-logs_*.tar.gz
+forensic_*.tar.gz
+webcfg-deploy-*.tar
+*.zip
+*.tar
+*.tar.gz
+*.tgz
+*.gz
+*.bin
+*.img
+
+# Internal-only push runbook (not for the partner repo)
+PARTNER-PUSH.md
+
+# Local environment and editor files
+.env
+.env.*
+!.env.example
+.DS_Store
+Thumbs.db
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
diff --git a/BSP-INTEGRATION.md b/BSP-INTEGRATION.md
new file mode 100644
index 0000000..c09d319
--- /dev/null
+++ b/BSP-INTEGRATION.md
@@ -0,0 +1,202 @@
+# BSP 통합 가이드 — Web Configurator v1.11.16
+
+디바이스 이미지(Yocto/OE 등)에 포함하기 위한 **커밋 히스토리 없는 클린 스냅샷**입니다.
+런타임 앱·systemd 유닛·샘플·문서와 optional nginx sample 설정만 들어 있고, 개발/내부 자료와 VCS 이력은 없습니다.
+
+---
+
+## 1. 런타임 구조
+- **Python 3 애플리케이션, stdlib 전용** — pip·virtualenv·외부 패키지 없음.
+- 실행 진입점: `python3 /opt/web-configurator/src/server.py`
+- 리슨 포트: **9090** (유닛의 `Environment=PORT=` 로 변경 가능)
+- 앱은 기본적으로 `:9090`에서 직접 서비스됩니다. nginx `:80` reverse proxy는 optional이며, `deploy/nginx.conf`는 BSP가 필요할 때 쓰는 sample 설정입니다.
+- 영속 상태 — **패키지에 없음**(런타임/다른 컴포넌트가 생성):
+  - DB:   `/home/root/db/dynamic_data.db`   (`DB_PATH`)
+  - 로그: `/opt/log/dpworldapp`             (`LOG_DIR`)
+
+> **nginx optional**: `scripts/deploy.ps1`는 nginx 설정을 설치하거나 수정하지 않습니다. BSP에서 `deploy/nginx.conf`를 사용할 때만 이미지 레이아웃에 맞게 설치하고, Python 앱 단독 프록시라면 `proxy_pass`를 `http://127.0.0.1:9090/` 로 맞추세요.
+
+---
+
+## 2. 설치 경로 (`do_install`)
+| 소스 (이 패키지) | 디바이스 설치 위치 |
+|---|---|
+| `src/`                              | `/opt/web-configurator/src/` |
+| `deploy/web-configurator.service`   | `${systemd_system_unitdir}/` |
+| `deploy/dpworld-*.service`          | `${systemd_system_unitdir}/`  (제품이 사용하는 유닛만) |
+| `deploy/*.service.d/`               | `${systemd_system_unitdir}/<unit>.service.d/` |
+| `deploy/dpworld-*.sh`               | 각 유닛의 `ExecStart=` 가 가리키는 경로 |
+| `deploy/dpworld-network-apply-ondemand.conf` | 해당 유닛이 참조하는 경로 |
+| `deploy/nginx.conf`                 | Optional nginx sample site config. BSP/firmware가 nginx를 별도로 소유하면 생략 가능 |
+
+권장 전체 기능 설치 목록:
+- 항상 설치: `src/`, `deploy/web-configurator.service`
+- 네트워크 apply 사용 시 (**권장 = 직접 교체**): `deploy/dpworld-network-apply-hardened.sh` 의 내용을 **`/usr/bin/dpworld-network-apply.sh` 원본 이름으로 설치**(펌웨어 base 스크립트 교체)하고 `deploy/dpworld-network-apply-ondemand.conf` 를 함께 설치. firmware-native base 유닛(`dpworld-network-apply.service`/`dpworld-network-seed.service`)이 그 경로를 호출하므로 자동 적용됨. **이 방식에서는 `.service.d` 드롭인을 설치하지 않습니다** (드롭인은 라이브 후적용 fallback 전용 — §7, `docs/firmware-boot-hardening.md`)
+- Wi-Fi AP 사용 시: `deploy/dpworld-ap-apply.service`, `deploy/dpworld-ap-seed.service`, `deploy/dpworld-hostapd-ap0.service`, `deploy/dpworld-udhcpd-ap0.service`, `deploy/dpworld-ap-apply.sh`를 함께 설치
+- 복구 유닛 사용 시: `deploy/dpworld-net-recover.service` 설치
+- `*.sh`는 `0755` 실행 권한으로 `/usr/bin/`에 설치
+쓰기 가능 런타임 디렉토리 생성 (recipe `do_install` / tmpfiles.d / 유닛의 `ExecStartPre` 중 택1):
+```
+/opt/web-configurator  /opt/log/dpworldapp  /opt/fw_staging  /opt/fw_upload
+/opt/config_backups    /home/root/db        /home/root/network
+```
+
+---
+
+## 3. 런타임 의존성 (`RDEPENDS`)
+**stdlib 전용** — 앱이 import하는 python3 표준 모듈만 이미지에 포함하면 됩니다. (외부 패키지 없음)
+OE의 모듈형 python3 기준 예시:
+```
+python3-core python3-sqlite3 python3-json python3-netserver python3-netclient
+python3-compression python3-crypt python3-logging python3-datetime python3-threading
+python3-shell python3-io python3-mime python3-stringold python3-ctypes
+```
+실제 import: `sqlite3, http(.server), socketserver, socket, urllib, json, gzip, tarfile,
+zipfile, hashlib, subprocess, shlex, logging, datetime, ipaddress, mimetypes, struct,
+tempfile, shutil, re, io, os, sys, time, copy, traceback` — 사용하는 OE python3 분할 패키지에 맞춰 확인하세요.
+
+추가로 유닛이 런타임에 쓰는 시스템 패키지: nginx reverse proxy를 이미지에서 제공할 때만 `nginx`.
+네트워크/AP 유닛 사용 시 `wpa-supplicant`, `hostapd`, `udhcpd`/`busybox`, `iproute2` 등.
+
+---
+
+## 4. systemd
+```
+SYSTEMD_SERVICE:${PN} = "web-configurator.service"
+SYSTEMD_AUTO_ENABLE   = "enable"
+```
+제품에서 필요한 `dpworld-*` 유닛(network-apply, Wi-Fi AP, recovery)을 추가하세요. 전체 기능 이미지에서는 보통 다음처럼 함께 등록합니다:
+```
+SYSTEMD_SERVICE:${PN} = "web-configurator.service \
+                         dpworld-ap-seed.service \
+                         dpworld-hostapd-ap0.service \
+                         dpworld-udhcpd-ap0.service"
+```
+`dpworld-ap-apply.service`와 `dpworld-net-recover.service`는 웹 설정기/watchdog이 on-demand로 `systemctl start` 하므로 `[Install]` 없이 설치만 하면 됩니다. `dpworld-network-apply.service`/`dpworld-network-seed.service`는 firmware-native base 유닛이며 `/usr/bin/dpworld-network-apply.sh` 를 호출합니다 — 본 패키지는 **그 base 스크립트를 하드닝본으로 교체**합니다(권장, §7). (펌웨어 원본을 교체할 수 없는 라이브 디바이스에서는 `.service.d` override 드롭인이 fallback.)
+
+---
+
+## 5. 샘플 레시피 — `web-configurator_1.11.16.bb`
+```bitbake
+SUMMARY  = "DP World Smart Solutions — Web Configurator"
+LICENSE  = "CLOSED"
+
+# 방법 A — 내부 git 서버의 태그 릴리스를 fetch (배포물이 repo 루트에 평탄 배치됨):
+SRC_URI  = "git://<internal-host>/<path>/NewWebConfigurator.git;branch=<branch>;protocol=ssh"
+SRCREV   = "<v1.11.16 의 sha 또는 tag>"
+S        = "${WORKDIR}/git"
+# 방법 B — git archive 로 만든 스냅샷 tarball 사용:
+#   (git -C <repo> archive v1.11.16 | gzip > web-configurator-v1.11.16.tar.gz)
+#   SRC_URI = "file://web-configurator-v1.11.16.tar.gz"
+#   S       = "${WORKDIR}"
+
+inherit systemd
+
+RDEPENDS:${PN} += "python3-core python3-sqlite3 python3-json python3-netserver \
+                   python3-netclient python3-compression python3-crypt python3-logging \
+                   python3-datetime python3-threading python3-shell python3-io \
+                   python3-mime"
+
+# Optional: add nginx only if this recipe installs/enables the nginx reverse proxy.
+# RDEPENDS:${PN} += "nginx"
+
+SYSTEMD_SERVICE:${PN} = "web-configurator.service"
+SYSTEMD_AUTO_ENABLE   = "enable"
+
+do_install() {
+    # 애플리케이션
+    install -d ${D}/opt/web-configurator
+    cp -r ${S}/src ${D}/opt/web-configurator/
+
+    # systemd 유닛
+    install -d ${D}${systemd_system_unitdir}
+    install -m 0644 ${S}/deploy/web-configurator.service ${D}${systemd_system_unitdir}/
+    install -m 0644 ${S}/deploy/dpworld-ap-apply.service ${D}${systemd_system_unitdir}/
+    install -m 0644 ${S}/deploy/dpworld-ap-seed.service ${D}${systemd_system_unitdir}/
+    install -m 0644 ${S}/deploy/dpworld-hostapd-ap0.service ${D}${systemd_system_unitdir}/
+    install -m 0644 ${S}/deploy/dpworld-udhcpd-ap0.service ${D}${systemd_system_unitdir}/
+    install -m 0644 ${S}/deploy/dpworld-net-recover.service ${D}${systemd_system_unitdir}/
+
+    # 유닛 ExecStart 대상 스크립트
+    install -d ${D}${bindir}
+    install -m 0755 ${S}/deploy/dpworld-ap-apply.sh ${D}${bindir}/dpworld-ap-apply.sh
+
+    # 네트워크-적용 하드닝 (권장 = 직접 교체):
+    #   펌웨어 base 스크립트 /usr/bin/dpworld-network-apply.sh 를 하드닝본으로 교체한다.
+    #   firmware-native 한 dpworld-network-apply.service / dpworld-network-seed.service 가
+    #   이 경로를 호출하므로 apply·--boot 모두 자동으로 하드닝 동작을 탄다. 드롭인은 설치하지 않는다.
+    #   (파일 소유권은 BSP에서 조정 — firmware recipe의 base 파일을 이 패키지가 덮어쓰도록
+    #    bbappend 또는 recipe 우선순위로 정리. 자세히 docs/firmware-boot-hardening.md)
+    install -m 0755 ${S}/deploy/dpworld-network-apply-hardened.sh \
+        ${D}${bindir}/dpworld-network-apply.sh
+    install -m 0644 ${S}/deploy/dpworld-network-apply-ondemand.conf \
+        ${D}${systemd_system_unitdir}/dpworld-network-apply-ondemand.conf
+
+    # Fallback (라이브 후적용 전용 — 베이킹 시 설치하지 않음):
+    #   펌웨어 원본을 교체할 수 없는 경우에만, 하드닝본을 원래 -hardened 이름으로 설치하고
+    #   deploy/dpworld-network-{apply,seed}.service.d/20-hardened.conf 드롭인 2개로
+    #   base 유닛의 ExecStart 를 override 한다.
+
+    # Optional nginx site config.
+    # scripts/deploy.ps1 does not use this file. Skip this block if firmware/BSP
+    # owns nginx, or if the device will access the app directly on :9090.
+    if [ -f ${S}/deploy/nginx.conf ]; then
+        install -d ${D}${sysconfdir}/nginx
+        install -m 0644 ${S}/deploy/nginx.conf ${D}${sysconfdir}/nginx/web-configurator.conf
+    fi
+
+    # 쓰기 가능 런타임 디렉토리
+    install -d ${D}/opt/log/dpworldapp ${D}/opt/fw_staging ${D}/opt/fw_upload \
+               ${D}/opt/config_backups ${D}/home/root/db ${D}/home/root/network
+}
+
+FILES:${PN} += "/opt/web-configurator /opt/log ${systemd_system_unitdir} \
+                /opt/fw_staging /opt/fw_upload /opt/config_backups \
+                /home/root/db /home/root/network ${bindir}/dpworld-*.sh \
+                ${sysconfdir}/nginx"
+```
+
+---
+
+## 6. 부팅 후 동작 확인 (smoke test)
+```sh
+systemctl status web-configurator        # active (running)
+curl -fsS http://127.0.0.1:9090/ | head  # 앱 응답
+curl -fsS http://127.0.0.1/ | head       # optional: nginx 경유 사용 시
+```
+
+---
+
+## 7. firmware-native 전제 + 네트워크-적용 하드닝 통합
+
+### firmware가 제공하는 것 (이 패키지에 **미포함**)
+- **base 네트워크-적용 유닛** — `dpworld-network-apply.service`, `dpworld-network-seed.service`. 이 유닛들은 `/usr/bin/dpworld-network-apply.sh` 를 호출합니다(no-arg / `--boot`).
+- **dpworldapp**(텔레메트리 바이너리), (전환기의 레거시 `app-runner`) — firmware-native.
+- **nginx** — 제품 이미지가 `:80` reverse proxy를 제공할 때만. 앱을 `:9090`으로 직접 접근하면 불필요.
+
+### 네트워크-적용 하드닝본 통합 — ① 직접 교체(권장) vs ② override(fallback)
+펌웨어 base `/usr/bin/dpworld-network-apply.sh` 에는 WiFi country 변경 시 `modprobe -r wlan`
+라이브 재로드 경로가 있어 QCA6490에서 PMU 워치독 재부팅 루프를 유발한 이력이 있습니다.
+`deploy/dpworld-network-apply-hardened.sh` 가 이를 제거한 **완전 대체본**입니다.
+
+| | ① 직접 교체 (BSP 베이킹, **권장**) | ② override (라이브 후적용, fallback) |
+|---|---|---|
+| 대상 | 펌웨어 이미지를 빌드하는 협력사 | 이미 구워진 디바이스(우리 `deploy.ps1`) |
+| 방법 | 하드닝본 내용을 **`/usr/bin/dpworld-network-apply.sh` 원본 이름**으로 설치(원본 교체) | 하드닝본을 `…-hardened.sh` 로 두고 `.service.d/20-hardened.conf` 드롭인 2개로 ExecStart 교체 |
+| 드롭인 | **설치 안 함** | 설치함 |
+| 효과 | base 유닛이 그대로 하드닝 스크립트를 실행 | base 유닛의 ExecStart가 하드닝본으로 바뀜 |
+
+절차 상세: `docs/firmware-boot-hardening.md` "펌웨어 베이킹 (BSP) — 원본 교체 방법".
+
+### 이 패키지가 소유·제공하는 스크립트 (모두 포함됨)
+| 스크립트 | 설치 위치(권장 ①) | 호출 주체 |
+|---|---|---|
+| `deploy/dpworld-ap-apply.sh` | `/usr/bin/dpworld-ap-apply.sh` | `dpworld-ap-apply.service`, `dpworld-ap-seed.service` |
+| `deploy/dpworld-network-apply-hardened.sh` | `/usr/bin/dpworld-network-apply.sh` (원본 교체) | firmware-native `dpworld-network-apply.service` / `dpworld-network-seed.service` |
+
+> fallback(②) 사용 시에는 `…-hardened.sh` 이름으로 설치하고 `.service.d` 드롭인 2개(`deploy/dpworld-network-apply.service.d/`, `deploy/dpworld-network-seed.service.d/`)를 함께 둡니다.
+
+### 웹 설정기 앱이 런타임에 호출하는 유닛
+`server.py` 는 다음을 `systemctl start` 로 호출합니다:
+`dpworld-network-apply.service`(firmware base 유닛 — 교체된 하드닝 스크립트 실행), `dpworld-ap-apply.service`, `dpworld-hostapd-ap0.service`, `dpworld-udhcpd-ap0.service`, `dpworld-net-recover.service`.
+→ base 네트워크-적용 **유닛**(firmware-native)을 제외하면 모두 본 패키지에 포함됩니다.
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..fff824b
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,42 @@
+# Changelog — Web Configurator
+
+파트너 전달용 변경 이력입니다. **v1.11.16부터** 이 형식으로 관리합니다.
+
+---
+
+## [v1.11.16] — 2026-06-23
+### Changed
+- `web-configurator.service` 의 `MemoryMax` 를 **48M → 128M** 로 상향. support-bundle(진단 zip, 메모리 빌드)
+  + UI 동시 사용 시 실측 피크 ~40-50MB로 OOM-kill 위험이 있어 여유를 확보 (장비 RAM 3.4GB 대비 3.7%,
+  누수 방지 캡은 유지). 정적자산 최대 93KB·펌웨어 업로드는 디스크 스트리밍이라 메모리 영향 없음.
+
+### Docs
+- BSP 통합 가이드 정비 — 네트워크-적용 하드닝본을 **`/usr/bin/dpworld-network-apply.sh` 원본 교체
+  (BSP 베이킹)** 하는 것을 1차 방식으로 명시. `.service.d` override 드롭인은 라이브 후적용 fallback으로 정리.
+  (`RELEASE-NOTES.md` §3, `BSP-INTEGRATION.md` §7, `docs/firmware-boot-hardening.md`)
+- 배포물을 repo 루트(flat) 구조로 정리.
+
+> 앱 코드·UI는 v1.11.15와 동일 (기능 무변경). 본 릴리스는 배포 단위의 메모리 정책 + 통합 가이드 정비입니다.
+
+---
+
+## [v1.11.15] — 2026-06-23
+### Changed
+- 사이드바 네비게이션 정비: **System** 그룹(Dashboard + Log)과 **Firmware** 그룹 분리, System 그룹에 monitor 아이콘 적용. (v1.11.14–v1.11.15)
+- (v1.11.12–v1.11.13: 대시보드 visual-calm 시도 후 되돌림 — 최종 외형 변화 없음)
+
+---
+
+## [v1.11.11] — 2026-06-23
+### Changed
+- config 쓰기 경로를 디바이스 config-reader 계약에 정렬: RS485 parity `no→none`, 2/4-byte order 공백형
+  (`little swap`/`big swap`), register `idt` `float`(`float64` 제거), protocol 목록에서 CAN 제거
+  (`can_input` 토글로 대체), 채널 `ai2`/`ai3`/`di2`/`di3` 지원.
+
+### Added
+- 기존 디바이스 DB의 옛 표기를 새 계약 표기로 **부팅 시 1회 자동 변환** (멱등 마이그레이션, 변경 전 자동 백업).
+
+---
+
+## [v1.11.10] — 2026-06-20
+- 전체 코드리뷰 반영 — 입력 검증/정규화 강화 다수.
diff --git a/DELIVERABLE-MANIFEST.txt b/DELIVERABLE-MANIFEST.txt
new file mode 100644
index 0000000..d3f42e3
--- /dev/null
+++ b/DELIVERABLE-MANIFEST.txt
@@ -0,0 +1,82 @@
+DP World Smart Solutions — Web Configurator
+파트너 전달물 — v1.11.16
+BSP 이미지 포함용 클린 스냅샷. 커밋 히스토리 없음, 내부 전용 자료 없음.
+일자: 2026-06-23
+
+================================================================================
+이 패키지는 무엇인가
+================================================================================
+디바이스용 Python 3 웹 설정기(stdlib 전용 — pip 없음)와, 디바이스에서 구동하기 위한
+systemd 유닛입니다. nginx 설정은 optional sample입니다. 태그 릴리스를 평탄 스냅샷(`git archive`)으로 추출해
+커밋 히스토리와 개발/내부 문서가 포함돼 있지 않습니다.
+
+먼저 읽을 문서:
+  RELEASE-NOTES.md     이번 버전 변경/주의/배포방법 (한글)
+  BSP-INTEGRATION.md   설치 경로 + 샘플 bitbake recipe + RDEPENDS (한글)
+
+================================================================================
+구성
+================================================================================
+src/                         애플리케이션 (Python 3, stdlib 전용)
+  server.py                  진입점 — HTTP 서버 (기본 PORT 9090)
+  config_validator.py        config 쓰기 경로 검증/정규화
+  dpworldapp_enums.py        디바이스 config-reader 계약 enum 집합
+  enum_normalizer.py         입력 별칭 정규화
+  migrations.py              부팅 시 1회 DB 마이그레이션 (schema_meta 게이트, 멱등)
+  db_manager.py              SQLite(board_config) 접근
+  network/  firmware/        network-apply / 펌웨어 OTA 서브시스템
+  static/                    웹 UI (HTML/CSS/JS)
+deploy/                      디바이스 통합 산출물
+  web-configurator.service   메인 systemd 유닛 (python3 src/server.py, :9090)
+  nginx.conf                 optional reverse proxy sample (:80 → 앱)
+  dpworld-network-*.service.d / dpworld-network-apply-hardened.sh / *.conf
+  dpworld-ap-*.service / dpworld-ap-apply.sh / dpworld-hostapd-ap0 / dpworld-udhcpd-ap0
+  dpworld-net-recover.service
+docs/                        architecture, DEPLOY, 가이드,
+                             dpworldapp_schema_handoff/(데이터 계약+스키마), config-spec/
+scripts/deploy.ps1           (참고) PC→디바이스 라이브 배포 도구 — BSP 베이킹에는 불필요
+README.md  CHANGELOG.md  VERSION  RELEASE-NOTES.md  BSP-INTEGRATION.md  DELIVERABLE-MANIFEST.txt
+
+================================================================================
+설치 위치 (디바이스)   — 샘플 recipe는 BSP-INTEGRATION.md 참조
+================================================================================
+src/                              → /opt/web-configurator/src/
+deploy/web-configurator.service   → systemd 유닛 디렉토리
+deploy/dpworld-*.service + *.d/   → systemd 유닛 디렉토리 (제품이 사용하는 것만)
+deploy/dpworld-*.sh / *.conf      → 각 유닛 ExecStart 가 가리키는 경로
+deploy/nginx.conf                 → optional nginx 사이트 설정 디렉토리 (제품에서 사용할 때만)
+enable:  web-configurator.service (+ 필요한 dpworld-* 유닛)
+
+================================================================================
+런타임 요건
+================================================================================
+인터프리터 : python3 (stdlib 전용 — pip 패키지 없음)
+리슨        : PORT 9090 (유닛 env로 변경 가능)
+DB          : /home/root/db/dynamic_data.db        (env DB_PATH)
+로그        : /opt/log/dpworldapp                  (env LOG_DIR)
+쓰기 경로   : /opt/web-configurator  /opt/log/dpworldapp  /opt/fw_staging
+              /opt/fw_upload  /opt/config_backups  /home/root/db  /home/root/network
+메모리 상한 : MemoryMax=128M (유닛에 설정됨; v1.11.16에서 48M→128M 상향)
+
+nginx optional: deploy/nginx.conf 는 :80 reverse proxy가 필요한 BSP용 sample입니다.
+scripts/deploy.ps1은 nginx를 설치/수정하지 않으며, 앱을 :9090으로 직접 접근하면 없어도 됩니다.
+sample을 사용할 경우 proxy_pass 를 앱 포트(:9090)로 맞추세요.
+
+================================================================================
+전제 (디바이스 firmware 제공 — 이 패키지에 미포함)
+================================================================================
+base 네트워크-적용 유닛은 firmware-native 입니다 (이 패키지에 없음):
+  dpworld-network-apply.service / dpworld-network-seed.service
+  (둘 다 /usr/bin/dpworld-network-apply.sh 를 호출함)
+→ 권장(BSP 베이킹): 본 패키지의 동봉 하드닝본(dpworld-network-apply-hardened.sh) 내용을
+  /usr/bin/dpworld-network-apply.sh 원본 이름으로 직접 교체 설치 (§7 ①). base 유닛이 그 경로를
+  호출하므로 자동 적용. 펌웨어 원본 교체 불가한 라이브 디바이스는 .service.d/ override 드롭인 fallback (§7 ②).
+dpworldapp(텔레메트리 바이너리)는 firmware-native. nginx는 제품 이미지가 :80 프록시를 제공할 때만 필요.
+포함된 .sh: dpworld-ap-apply.sh, dpworld-network-apply-hardened.sh  (자세히 BSP-INTEGRATION.md §7 + docs/firmware-boot-hardening.md)
+
+================================================================================
+미포함 (내부 전용)
+================================================================================
+개발 커밋 히스토리, 내부 분석/설계 노트, 개발/감사 스크립트, VCS·에디터 설정,
+테스트 스위트, 샘플 import config, 프런트 테스트 도구(package.json). 패키지에는
+런타임 앱·디바이스 통합 유닛·파트너용 문서만 포함됩니다.
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..2127ad9
--- /dev/null
+++ b/README.md
@@ -0,0 +1,165 @@
+# IoT Web Configurator
+
+> **파트너 전달 안내 (한글)** — 먼저 이 순서로 보세요:
+> [`RELEASE-NOTES.md`](RELEASE-NOTES.md) (이번 버전·변경·주의·배포) →
+> [`BSP-INTEGRATION.md`](BSP-INTEGRATION.md) (설치 경로·샘플 recipe·의존성) →
+> [`DELIVERABLE-MANIFEST.txt`](DELIVERABLE-MANIFEST.txt) (패키지 구성).
+
+IoT 디바이스 설정을 위한 웹 인터페이스를 제공하는 경량 Python stdlib HTTP 서버입니다.
+원래 Java Spring Boot 애플리케이션이었으나, 순수 Python(stdlib만 사용)으로 재작성되어
+메모리 사용량이 ~436 MB에서 10–30 MB로 줄었습니다. 모든 설정은 디바이스 내
+SQLite 데이터베이스(`board_config` 테이블)에 저장됩니다.
+
+---
+
+## 저장소 구조
+
+| 경로 | 설명 |
+|---|---|
+| `src/` | 애플리케이션 소스 — 서버, DB 매니저, 유효성 검사기, 로그 매니저, 네트워크 적용 엔진(`src/network/`), 펌웨어 OTA(`src/firmware/`), Wi-Fi AP(`src/network/ap_*`), 프론트엔드 SPA(`src/static/js/pages/` 하위 ~18개 페이지 모듈) |
+| `docs/` | 설계 문서, 사양서, 운영 가이드 (`docs/DEPLOY.md` 참조) |
+| `scripts/` | 라이브 배포 도구 (`deploy.ps1`) |
+| `CHANGELOG.md` | 버전 변경 이력 |
+
+---
+
+## 로컬 실행
+
+```bash
+# From the repo root
+python src/server.py
+```
+
+서버는 기본적으로 `0.0.0.0:8080`에 바인딩됩니다 (로컬 개발용). 환경 변수로 재정의할 수 있습니다:
+
+| 변수 | 기본값 | 설명 |
+|---|---|---|
+| `HOST` | `0.0.0.0` | 바인딩 주소 |
+| `PORT` | `8080` | 수신 포트 |
+| `DB_PATH` | `/home/root/db/dynamic_data.db` | SQLite 데이터베이스 경로 |
+| `LOG_DIR` | `/opt/log/dpworldapp` | 로그 파일 디렉터리 |
+
+> **포트 안내:** `8080`은 로컬 개발 환경에서만 사용하는 기본값입니다. 디바이스에서는
+> systemd 유닛(`deploy/web-configurator.service`)이 `PORT=9090`으로 설정하므로,
+> 배포된 configurator는 **9090** 포트에서 수신합니다 — [docs/DEPLOY.md](docs/DEPLOY.md) §7 참조.
+
+예시:
+
+```bash
+PORT=8888 DB_PATH=./dev_data.db python src/server.py
+```
+
+---
+
+## 배포
+
+디바이스 배포는 `scripts/deploy.ps1` (PowerShell, Windows 개발 호스트)을 사용합니다.
+전체 절차는 **[docs/DEPLOY.md](docs/DEPLOY.md)** 를 참조하세요. 다음 내용을 다룹니다:
+
+- 버전 정책(`vMAJOR.MINOR.PATCH`) 및 릴리즈 절차
+- 사전 요건 및 사용 방법
+- 스크립트 동작 순서 (아카이브 → 전송 → 백업 → 교체 → 버전 스탬프 → 재시작 → 검증)
+- 배포 검증 및 디바이스에서 `DEPLOYED_VERSION` 확인
+- 롤백 (`-Rollback` 플래그)
+- 디바이스 아키텍처 (포트, 경로, 서비스 이름)
+- 문제 해결
+
+빠른 참조:
+
+```powershell
+.\scripts\deploy.ps1 192.168.55.56          # deploy a tagged release
+.\scripts\deploy.ps1 192.168.55.56 -Rollback  # restore last backup
+```
+
+`deploy.ps1`은 nginx를 설치하거나 수정하지 않습니다. `deploy/nginx.conf`는
+`:80` 리버스 프록시를 통해 앱을 노출하는 제품을 위한 선택적 BSP 샘플일 뿐이며,
+디바이스는 `:9090`으로 앱에 직접 접근할 수도 있습니다.
+
+---
+
+## API 엔드포인트
+
+### 디바이스 설정
+
+| 메서드 | 경로 | 설명 |
+|---|---|---|
+| `GET` | `/setting/get-device` | 디바이스 설정 읽기 (비어있으면 204 반환) |
+| `POST` | `/setting/device` | 디바이스 설정 저장 |
+| `GET` | `/setting/get-protocol` | 프로토콜 설정 읽기 (비어있으면 204 반환) |
+| `POST` | `/setting/protocol` | 프로토콜 설정 저장 |
+| `GET` | `/api/mac` | WiFi MAC 주소 읽기 |
+
+### 로그 관리
+
+| 메서드 | 경로 | 설명 |
+|---|---|---|
+| `GET` | `/setting/log-files` | 로그 파일 목록 조회 (크기, 수정 일시, 유형) |
+| `GET` | `/setting/log-stats` | 로그 디렉터리 통계 |
+| `POST` | `/setting/log-download` | 선택한 파일을 tar.gz로 다운로드 |
+| `POST` | `/setting/log-compress` | 비활성 로그 파일 수동 압축 |
+| `POST` | `/setting/log-delete` | 선택한 로그 파일 삭제 |
+| `GET`  | `/setting/kernel-bundle` | 커널 로그 번들 `.tar.gz` 다운로드 (journalctl 텍스트 내보내기 + `/opt/log` 커널 로그 + 부팅 이력 + pstore) — v1.1.0에서 추가 |
+
+### 대시보드 / 모니터링
+
+| 메서드 | 경로 | 설명 |
+|---|---|---|
+| `GET` | `/api/health` | 서버 상태 (가동 시간, DB 백엔드) |
+| `GET` | `/api/system-status` | 홈 대시보드 페이로드 — 최상위 키: `core_app`, `communication`, `network`, `system` (v1.0.x~); `hardware_modules` GNSS + WiFi 펌웨어 (v1.2.0에서 추가); `dpworldapp_status` 7단계 시작 추적기 + 5-상태 결과 + 런타임 설정 필드 6개 (v1.3.0에서 추가) |
+| `GET` | `/api/support-bundle` | 진단 zip (상태 + 마스킹된 설정 + 최근 로그 + OS 진단) |
+| `POST` | `/api/action/test-connections` | 설정된 서버 엔드포인트 TCP 프로브 |
+| `POST` | `/api/action/restart-dpworldapp` | systemctl을 통해 dpworldapp 재시작 |
+
+### 네트워크 적용 엔진 (v1.6.0+)
+
+30초 watchdog를 사용하여 OS 상의 네트워크 설정을 적용/검증/롤백합니다.
+전체 내용: **[docs/network-apply-engine-guide.md](docs/network-apply-engine-guide.md)**.
+
+| 메서드 | 경로 | 설명 |
+|---|---|---|
+| `GET`  | `/api/network/state` | 라이브 인터페이스 + drift + watchdog + 최종 적용 + `country_pending` |
+| `GET`  | `/api/network/drift` | 전역 미적용 변경 수 (경량) |
+| `GET`  | `/api/network/apply/status?id=<apply_id>` | 진행 중인 적용 폴링 (confirm TTL도 이 요청으로 갱신) |
+| `GET`  | `/api/network/journal?limit=<n>` | 적용 저널 tail |
+| `GET`  | `/api/network/config` | 유효한 `net_config` 읽기 (watchdog 킬스위치) |
+| `POST` | `/api/network/apply` | 네트워크 필드 적용 (또는 `dry_run`) — 비동기, `apply_id` 반환 |
+| `POST` | `/api/network/apply/confirm` | TTL 내에 eth1 단절성 적용 확인 |
+| `POST` | `/api/network/rollback` | 이전 적용 스냅샷으로 롤백 |
+| `POST` | `/api/network/config` | `net_config` watchdog 키 쓰기 |
+
+### Wi-Fi AP
+
+현장 프로비저닝을 위한 Soft-AP(`ap0`) 관리. 전체 내용:
+**docs/wifi-ap-guide.md**.
+
+| 메서드 | 경로 | 설명 |
+|---|---|---|
+| `GET`  | `/api/network/ap/status` | AP 런타임 상태 |
+| `POST` | `/api/network/ap/config` | `ap_config` 쓰기 |
+| `POST` | `/api/network/ap/apply` | AP 설정 적용 (ap0 시작/중지) |
+
+### 펌웨어 OTA
+
+dpworldapp 펌웨어 채널을 통한 업로드 → 사전 검증 → 플래시 → 복원 확인 흐름.
+전체 내용: **docs/firmware-ota-guide.md**.
+
+| 메서드 | 경로 | 설명 |
+|---|---|---|
+| `GET`  | `/api/firmware/status` | 현재 OTA 상태 스냅샷 |
+| `POST` | `/api/firmware/preflight` | 업로드 전 사전 검증 |
+| `POST` | `/api/firmware/upload` | 펌웨어 ZIP 업로드 |
+| `POST` | `/api/firmware/flash` | 플래시 실행 |
+| `POST` | `/api/firmware/restore-check` | 플래시 후 복원 검증 |
+
+> 서브시스템 내부 구조 (상태 머신, byte-exact 렌더링, 부팅 강화)는
+> [docs/architecture.md](docs/architecture.md) 및 위에 링크된 서브시스템별 가이드에 문서화되어 있습니다.
+
+---
+
+## 기술 스택
+
+- Python 3.10 (stdlib만 사용 — 외부 의존성 없음)
+- SQLite3 (기본 설정 저장소)
+- 멀티스레드 HTTP 서버 (`ThreadingMixIn`)
+- Vanilla ES-module SPA 프론트엔드 (빌드 단계 없음) — **Two Faces** 사용자/고급 보기 전환 기능을 포함한 ~18개 페이지 모듈 (`src/static/js/view-mode.js`)
+- 주요 서브시스템: 네트워크 적용 엔진, Wi-Fi AP, 펌웨어 OTA (API 섹션 및 서브시스템별 가이드 참조)
diff --git a/RELEASE-NOTES.md b/RELEASE-NOTES.md
new file mode 100644
index 0000000..03ed95c
--- /dev/null
+++ b/RELEASE-NOTES.md
@@ -0,0 +1,101 @@
+# 릴리스 노트 — Web Configurator **v1.11.16**
+
+- **배포일**: 2026-06-23
+- **대상**: 디바이스 BSP 이미지 포함용 (DP World Smart Solutions · IoT 디바이스)
+- **패키지**: 내부 git 태그 `v1.11.16` (커밋 히스토리가 없는 **클린 스냅샷**)
+- **이전 버전**: v1.11.15
+
+---
+
+## 1. 한눈에 보기
+이번 릴리스는 **배포 패키지 정비 릴리스**입니다. 앱 기능·디바이스 계약·UI는 v1.11.15와 동일하며,
+다음 두 가지를 정비했습니다.
+
+1. **MemoryMax 상향** (`48M → 128M`) — 운영 중 OOM-kill 위험 제거.
+2. **BSP 통합 가이드 정비** — 네트워크-적용 하드닝 스크립트의 권장 통합 방식을
+   **"펌웨어 원본 스크립트 직접 교체(BSP 베이킹)"** 를 1차 방식으로 재구성.
+
+- Python 3 **표준 라이브러리(stdlib)만** 사용 — 외부 pip 패키지 없음
+- systemd 유닛 포함, nginx 설정은 optional sample → **이미지에 바로 포함 가능**
+- 기존 디바이스 DB는 **부팅 시 자동 변환**(1회, 멱등) — 수동 작업 불필요
+
+---
+
+## 2. 주요 변경 (v1.11.15 → v1.11.16)
+
+| 항목 | 변경 |
+|---|---|
+| **MemoryMax** | `web-configurator.service` 의 `MemoryMax` 를 **48M → 128M** 로 상향. 48M는 support-bundle(진단 zip, 메모리 빌드)과 UI 동시 사용 시 실측 피크 ~40-50MB로 OOM-kill 위험이 있었음. 128M = 실피크 ~2.5x 여유 + 누수 방지 캡 유지 (장비 RAM 3.4GB 대비 3.7%). |
+| **BSP 통합 방식 1차 = 직접 교체** | 네트워크-적용 하드닝본을 **`/usr/bin/dpworld-network-apply.sh` 원본 이름으로 교체 설치**하는 것을 BSP 베이킹의 기본 방식으로 명시. `.service.d` override 드롭인은 **라이브 디바이스 후적용(over-the-top) fallback** 으로 강등. (자세히 `BSP-INTEGRATION.md` §7 + `docs/firmware-boot-hardening.md`) |
+| 패키지 구성 정리 | 배포물을 repo 루트(flat)로 정리, 내부 전용 참조/링크 정돈. 런타임 코드 변경 없음. |
+
+> 앱 코드 자체는 **v1.11.15와 동일**합니다 (UI/기능 무변경). 본 릴리스는 배포 단위의
+> 메모리 정책 + 통합 가이드 정비입니다.
+
+---
+
+## 3. 네트워크-적용 하드닝 — 통합 방식 (중요)
+
+디바이스 펌웨어는 다음 base 구성을 제공합니다(firmware-native):
+- `dpworld-network-apply.service` / `dpworld-network-seed.service` (유닛)
+- `/usr/bin/dpworld-network-apply.sh` (base 스크립트)
+
+이 base 스크립트에는 WiFi 국가 코드 변경 시 `modprobe -r wlan` 으로 모듈을 라이브 재로드하는
+경로가 있어, QCA6490(cnss_pci)에서 **PMU 워치독 재부팅 루프**를 유발한 이력이 있습니다.
+본 패키지의 `dpworld-network-apply-hardened.sh` 가 이 문제를 제거한 **완전 대체본**입니다.
+
+**① 권장 — BSP 베이킹(직접 교체):** 펌웨어 이미지를 빌드하는 협력사는
+`deploy/dpworld-network-apply-hardened.sh` 의 내용을 **`/usr/bin/dpworld-network-apply.sh`
+원본 이름으로 설치**(펌웨어 원본 교체)하면 됩니다. base 서비스/시드 유닛이 이미 그 경로를
+호출하므로 apply·`--boot` 모두 자동으로 하드닝 동작을 탑니다. **드롭인은 베이킹하지 않습니다.**
+
+**② Fallback — 라이브 후적용(override):** 이미 구워진 디바이스에 펌웨어 교체 없이 얹을 때만,
+하드닝본을 별도 파일로 두고 `dpworld-network-apply.service.d/` + `dpworld-network-seed.service.d/`
+드롭인으로 ExecStart를 교체합니다. (우리 개발용 `scripts/deploy.ps1` 가 이 방식을 사용)
+
+→ 단계별 절차는 `docs/firmware-boot-hardening.md` "펌웨어 베이킹 (BSP) — 원본 교체 방법" 참조.
+
+---
+
+## 4. 호환성 · 주의사항
+- **디바이스 적용 시점**: dpworldapp 재시작 시 새 계약값으로 config가 재적용됩니다.
+- **nginx optional**: `deploy/nginx.conf`는 BSP에서 `:80` reverse proxy를 제공할 때 쓰는 sample입니다. `scripts/deploy.ps1`는 nginx를 설치/수정하지 않으며, 디바이스가 앱을 `:9090`으로 직접 접근하면 없어도 됩니다. sample을 쓸 경우 `proxy_pass`를 앱 포트 `:9090`으로 맞추세요.
+- **런타임 의존성**: python3 stdlib만 필요 (RDEPENDS 목록은 `BSP-INTEGRATION.md` 참조). 외부 패키지 없음.
+- **dpworldapp**(텔레메트리 바이너리)는 firmware-native.
+
+---
+
+## 5. 배포 방법 (BSP)
+1. **패키지 입수**: 내부 git 태그 `v1.11.16` (또는 동봉 스냅샷)
+2. **레시피 작성**: `BSP-INTEGRATION.md`의 샘플 bitbake recipe + 설치 경로표 사용
+   - `src/` → `/opt/web-configurator/src/`
+   - `deploy/*.service` → systemd 유닛 디렉토리
+   - `deploy/dpworld-network-apply-hardened.sh` → **`/usr/bin/dpworld-network-apply.sh`** (펌웨어 원본 교체, §3 ①)
+   - `deploy/nginx.conf` → optional nginx sample site config
+   - `web-configurator.service` enable
+3. **검증**: 이미지 부팅 후 `systemctl status web-configurator` + `curl http://127.0.0.1:9090/`
+
+---
+
+## 6. 품질/검증
+- v1.11.16 변경은 **앱 로직 무변경** — systemd 서비스 메모리 캡(MemoryMax) + 문서/주석/버전 문자열뿐입니다.
+  기능 동등 기준선 **v1.11.15**는 내부 테스트 스위트(Python + 프런트 `.mjs`)로 검증되었습니다.
+- 테스트 스위트는 내부 저장소에서 관리되며 **본 배포물에는 포함되지 않습니다**.
+- 패키지는 **커밋 히스토리 없음**(`git archive` 스냅샷) + 내부 분석/개발 자료 제외 (`DELIVERABLE-MANIFEST.txt` 참조).
+
+---
+
+## 7. 롤백
+- BSP recipe의 버전 핀(태그/SRCREV)을 **v1.11.15**로 되돌리면 이전 버전 배포.
+- 마이그레이션은 **멱등 + 변경 전 자동 백업**(config_safety)으로 보호됩니다.
+
+---
+
+## 버전 이력 (요약)
+| 버전 | 일자 | 요약 |
+|---|---|---|
+| **v1.11.16** | 2026-06-23 | MemoryMax 48M→128M + BSP 베이킹(직접 교체) 가이드 1차 정비 (앱 기능 무변경) |
+| v1.11.15 | 2026-06-23 | 사이드바 System 그룹 monitor 아이콘 정리 |
+| v1.11.14 | 2026-06-23 | 사이드바 부모 그룹(System=Dashboard+Log / Firmware) 재편 |
+| v1.11.11 | 2026-06-23 | config 쓰기 경로를 디바이스 config-reader 계약에 정렬 + 자동 마이그레이션 |
+| v1.11.10 | 2026-06-20 | 전체 코드리뷰 fix (37건) |
diff --git a/VERSION b/VERSION
new file mode 100644
index 0000000..8f253a3
--- /dev/null
+++ b/VERSION
@@ -0,0 +1 @@
+v1.11.16
diff --git a/deploy/dpworld-ap-apply.service b/deploy/dpworld-ap-apply.service
new file mode 100644
index 0000000..08f65f3
--- /dev/null
+++ b/deploy/dpworld-ap-apply.service
@@ -0,0 +1,10 @@
+# enable 하지 않음 — web-configurator 엔진이 on-demand로 start (no [Install])
+[Unit]
+Description=Apply DPWorld WiFi AP configuration (on-demand)
+After=local-fs.target
+RequiresMountsFor=/home/root /opt
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/dpworld-ap-apply.sh
+TimeoutStartSec=90
diff --git a/deploy/dpworld-ap-apply.sh b/deploy/dpworld-ap-apply.sh
new file mode 100644
index 0000000..6e233d3
--- /dev/null
+++ b/deploy/dpworld-ap-apply.sh
@@ -0,0 +1,89 @@
+#!/bin/sh
+# dpworld-ap-apply.sh — WiFi AP bring-up/down (spec §8). STA(wlan0) 무접촉, ap0 전용.
+# 호출: --boot(seed) | (무인자, on-demand). ap-enabled 마커로 enable/disable 판정.
+set -u
+AP_DIR="/home/root/network/ap"
+HOSTAPD_CONF="${AP_DIR}/hostapd-ap0.conf"
+UDHCPD_CONF="${AP_DIR}/udhcpd-ap0.conf"
+ENABLED_MARK="${AP_DIR}/ap-enabled"
+STATE_DIR="/opt/dpworld-network"
+LOG="${STATE_DIR}/ap_apply.log"
+WLAN_MAC_FILE="/sys/class/net/wlan0/address"
+
+log() { echo "[$(date '+%F %T' 2>/dev/null) up=$(cut -d' ' -f1 /proc/uptime 2>/dev/null)] $*" >&2
+        [ -d "$STATE_DIR" ] && echo "$*" >> "$LOG" 2>/dev/null || true; }
+run() { "$@"; rc=$?; [ "$rc" -ne 0 ] && log "  cmd rc=$rc: $*"; return "$rc"; }
+
+ap_mac() {  # wlan0 MAC의 첫 옥텟에 local-admin bit(0x02) 세팅 → 별도 MAC
+    base=$(cat "$WLAN_MAC_FILE" 2>/dev/null); [ -n "$base" ] || { echo ""; return; }
+    o1=$(echo "$base" | cut -d: -f1); rest=$(echo "$base" | cut -d: -f2-)
+    [ -n "$o1" ] || { echo ""; return; }     # 드라이버 리로드 중 빈 옥텟 → 산술오류 방지
+    new=$(printf '%02x' $(( 0x$o1 | 0x02 )))
+    echo "${new}:${rest}"
+}
+
+# §8.1 ap0 방화벽 — 전용 chain(cleanup=flush+delete로 잔재/중복 원천 차단).
+# INPUT(장치 자체): v1.11.7 — ap0 클라이언트에 장치 서비스 전부 개방(SSH 22 포함). WPA2 PSK가 접근 게이트.
+#   (이전 default-deny[9090/67/icmp만 허용, 8989·8990·SSH 차단]에서 전환 — 현장 관리 접근성 우선, 비번 강화 전제.)
+# FORWARD(경유): ip_forward=1일 때 AP 클라이언트가 PLC(eth1)·업링크로 라우팅하는 것을 전면 차단(provisioning 격리) — 유지.
+#   ★ INPUT은 열되 FORWARD 격리는 유지 → AP 클라이언트는 장치 자체엔 접근 가능하나 내부망/PLC로는 경유 불가.
+AP_IN_CHAIN="DPWORLD_AP_IN"
+AP_FWD_CHAIN="DPWORLD_AP_FWD"
+
+fw_clear() {  # unhook(점프 전부 drain) → flush → delete chain. 멱등 + 중복 점프(비정상/크래시 잔재)까지 제거.
+    while iptables -D INPUT -i ap0 -j "$AP_IN_CHAIN" 2>/dev/null; do :; done
+    while iptables -D FORWARD -i ap0 -j "$AP_FWD_CHAIN" 2>/dev/null; do :; done
+    while iptables -D FORWARD -o ap0 -j "$AP_FWD_CHAIN" 2>/dev/null; do :; done
+    iptables -F "$AP_IN_CHAIN" 2>/dev/null
+    iptables -F "$AP_FWD_CHAIN" 2>/dev/null
+    iptables -X "$AP_IN_CHAIN" 2>/dev/null
+    iptables -X "$AP_FWD_CHAIN" 2>/dev/null
+}
+fw_apply() {  # 전용 chain 재생성 + INPUT/FORWARD에서 ap0 트래픽을 chain으로 점프. ap0 한정 → STA/eth 무영향.
+    fw_clear
+    # INPUT(장치 자체): ap0 클라이언트에 전체 개방(SSH 포함) — WPA2 PSK가 접근 게이트(v1.11.7).
+    run iptables -N "$AP_IN_CHAIN" || { fw_clear; return 1; }
+    run iptables -A "$AP_IN_CHAIN" -j ACCEPT || { fw_clear; return 1; }
+    run iptables -A INPUT -i ap0 -j "$AP_IN_CHAIN" || { fw_clear; return 1; }
+    # FORWARD(경유): PLC(eth1)/업링크 라우팅 전면 차단 — provisioning 격리 유지(INPUT 개방과 독립).
+    run iptables -N "$AP_FWD_CHAIN" || { fw_clear; return 1; }
+    run iptables -A "$AP_FWD_CHAIN" -j DROP || { fw_clear; return 1; }
+    run iptables -A FORWARD -i ap0 -j "$AP_FWD_CHAIN" || { fw_clear; return 1; }
+    run iptables -A FORWARD -o ap0 -j "$AP_FWD_CHAIN" || { fw_clear; return 1; }
+}
+
+ap_down() {  # 멱등 정리 (stop은 미기동 시 routine 실패 → run 미사용, ap_up과 일치)
+    systemctl stop dpworld-udhcpd-ap0.service 2>/dev/null
+    systemctl stop dpworld-hostapd-ap0.service 2>/dev/null
+    fw_clear
+    ip addr flush dev ap0 2>/dev/null
+    iw dev ap0 del 2>/dev/null
+    log "AP down (cleaned)"
+}
+
+ap_up() {
+    [ -f "$HOSTAPD_CONF" ] || { log "no hostapd conf — skip"; return 0; }
+    # RECONCILE: 기존 데몬/방화벽 정리, vif는 재사용(없을 때만 add)
+    systemctl stop dpworld-udhcpd-ap0.service 2>/dev/null
+    systemctl stop dpworld-hostapd-ap0.service 2>/dev/null
+    fw_clear
+    iw dev ap0 info >/dev/null 2>&1 || run iw dev wlan0 interface add ap0 type __ap || return 1
+    mac=$(ap_mac); [ -n "$mac" ] && run ip link set ap0 address "$mac"
+    ap_ip=$(sed -n 's/^opt router \([0-9.]*\).*/\1/p' "$UDHCPD_CONF" 2>/dev/null)
+    if [ -n "$ap_ip" ]; then run ip addr replace "${ap_ip}/24" dev ap0 || return 1   # replace=멱등
+    else log "no udhcpd conf/router — fail closed"; return 1; fi
+    run ip link set ap0 up || return 1
+    if ! fw_apply; then
+        log "AP firewall setup failed"
+        ap_down
+        return 1
+    fi
+    touch /run/udhcpd-ap0.leases 2>/dev/null
+    run systemctl restart dpworld-hostapd-ap0.service || return 1
+    run systemctl restart dpworld-udhcpd-ap0.service || return 1
+    log "AP up (ssid rendered, ap0 up)"
+}
+
+mkdir -p "$STATE_DIR" 2>/dev/null || true
+if [ -f "$ENABLED_MARK" ]; then ap_up; rc=$?; else ap_down; rc=$?; fi
+exit "$rc"
diff --git a/deploy/dpworld-ap-seed.service b/deploy/dpworld-ap-seed.service
new file mode 100644
index 0000000..e8f11a2
--- /dev/null
+++ b/deploy/dpworld-ap-seed.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=Bring up DPWorld WiFi AP at boot (reconcile)
+After=local-fs.target wpa_supplicant@wlan0.service
+RequiresMountsFor=/home/root /opt
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/dpworld-ap-apply.sh --boot
+TimeoutStartSec=120
+
+[Install]
+WantedBy=multi-user.target
diff --git a/deploy/dpworld-hostapd-ap0.service b/deploy/dpworld-hostapd-ap0.service
new file mode 100644
index 0000000..848d96f
--- /dev/null
+++ b/deploy/dpworld-hostapd-ap0.service
@@ -0,0 +1,10 @@
+[Unit]
+Description=DPWorld hostapd on ap0
+StartLimitIntervalSec=60
+StartLimitBurst=5
+
+[Service]
+Type=simple
+ExecStart=/usr/sbin/hostapd /home/root/network/ap/hostapd-ap0.conf -P /run/hostapd-ap0.pid
+Restart=on-failure
+RestartSec=3
diff --git a/deploy/dpworld-net-recover.service b/deploy/dpworld-net-recover.service
new file mode 100644
index 0000000..8c92c21
--- /dev/null
+++ b/deploy/dpworld-net-recover.service
@@ -0,0 +1,11 @@
+# deploy/dpworld-net-recover.service
+# v1.6.0 (spec §7): apply.sh 의 wlan 모듈 완전 다운 사각지대 복구.
+# 웹/watchdog 이 systemctl start 로만 호출 — web-configurator 샌드박스의
+# ProtectKernelModules=yes 를 유지하기 위해 modprobe 를 이 유닛에 위임.
+# modprobe -r(제거) 는 의도적으로 미포함 — 과거 ExecStopPost=modprobe -r 사고 재발 방지.
+[Unit]
+Description=DP World network recovery (wlan module + wpa restart)
+
+[Service]
+Type=oneshot
+ExecStart=/bin/sh -c 'modprobe wlan_cnss_core_pcie; modprobe wlan; systemctl try-restart wpa_supplicant@wlan0.service'
diff --git a/deploy/dpworld-network-apply-hardened.sh b/deploy/dpworld-network-apply-hardened.sh
new file mode 100644
index 0000000..32b7c8c
--- /dev/null
+++ b/deploy/dpworld-network-apply-hardened.sh
@@ -0,0 +1,365 @@
+#!/bin/sh
+# dpworld-network-apply.sh — firmware-safe network apply script
+# ---------------------------------------------------------------------------
+# 목적:
+#   dpworldapp 또는 WebConfigurator가 /home/root/network/에 생성한 네트워크
+#   렌더 파일을 systemd-networkd, wpa_supplicant, WiFi country 설정에
+#   동기화한다.
+#
+# 배포 위치:
+#   firmware image: /usr/bin/dpworld-network-apply.sh
+#   file mode:      root:root, 0755, LF, POSIX /bin/sh
+#
+# 호출:
+#   dpworld-network-apply.sh
+#       on-demand 적용. /run 동기화 후 networkctl reload/reconfigure,
+#       WPA 변경 시 wpa_cli reconfigure를 수행한다.
+#
+#   dpworld-network-apply.sh --boot
+#       부팅 seed. /home/root/network가 비어 있으면
+#       /etc/dpworld/network-defaults를 복사하고, /run/systemd/network를
+#       먼저 동기화한다. networkd가 이미 active인 boot-order race에서는
+#       live address reconcile까지 수행한다.
+#
+#   dpworld-network-apply.sh --country-now
+#       호환 인자. 이 빌드 제안본에서는 live module unload를 하지 않는다.
+#       country는 modprobe.d에 기록하고 reboot-required marker로 처리한다.
+#
+# 안전 정책:
+#   - 실행 가능한 modprobe -r 경로를 두지 않는다. QCA6490/cnss_pci에서
+#     module unload가 hang과 watchdog reset으로 이어진 이력이 있기 때문이다.
+#   - country 변경은 reboot-deferred가 기본이다.
+#   - reboot-required 판단은 wpa_cli get country가 아니라
+#     /sys/module/wlan/parameters/country_code 또는 iw reg get 기준으로 한다.
+#   - set -e를 쓰지 않는다. 실패한 외부 명령은 로그에 남기고 가능한 후속
+#     처리를 계속한다.
+#   - 기존 렌더 파일이 있으면 /etc/dpworld/network-defaults로 덮어쓰지 않는다.
+#
+# 상태 파일:
+#   /opt/dpworld-network/apply.log         적용 로그. 512KB 초과 시 apply.log.1로 자체 rotate
+#   /opt/dpworld-network/applied/          마지막 적용 기준선
+#   /opt/dpworld-network/reboot-required   country 재부팅 필요 marker
+#   /run/dpworld-network/apply.lock        중복 실행 방지 lock
+#   /run/dpworld-network/country-now       호환 marker
+#
+# 한계:
+#   eth1 IP 변경 후 confirm/rollback 같은 세션 보존 로직은 이 셸 스크립트가
+#   담당하지 않는다. WebConfigurator apply engine이 있으면 그쪽에서 처리한다.
+#   standalone으로 eth1 주소를 바꿀 때는 콘솔 또는 대체 접속 경로를 확보한다.
+#
+# POSIX /bin/sh (BusyBox ash). bashism 금지.
+set -u
+
+# ─────────────────────────────── 인자 ────────────────────────────────
+MODE_BOOT=0
+COUNTRY_NOW=0
+for a in "$@"; do
+    case "$a" in
+        --boot)        MODE_BOOT=1 ;;
+        --country-now) COUNTRY_NOW=1 ;;
+    esac
+done
+MODE_NAME=$([ "$MODE_BOOT" -eq 1 ] && echo boot || echo ondemand)
+
+# ─────────────────────────────── 경로 ────────────────────────────────
+NETWORK_DIR="/home/root/network"
+DEFAULT_DIR="/etc/dpworld/network-defaults"
+RUNTIME_DIR="/run/systemd/network"
+MODPROBE_CONF="/etc/modprobe.d/10-wlan.conf"
+
+STATE_DIR="/opt/dpworld-network"            # 영속(/opt, After=local-fs.target 보장) — shadow/로그/마커
+SHADOW_DIR="${STATE_DIR}/applied"
+LOG_FILE="${STATE_DIR}/apply.log"
+REBOOT_MARK="${STATE_DIR}/reboot-required"
+
+RUN_STATE_DIR="/run/dpworld-network"        # tmpfs — 락/일회성 마커
+LOCK_DIR="${RUN_STATE_DIR}/apply.lock"
+LOCK_PID="${LOCK_DIR}/pid"
+COUNTRY_NOW_MARK="${RUN_STATE_DIR}/country-now"   # 엔진 호환: 있으면 country-now
+
+NET_RENDERS="10-wlan0.network 10-eth0.network 10-eth1.network"
+WPA_RENDER="${NETWORK_DIR}/wpa_supplicant-wlan0.conf"
+COUNTRY_RENDER="${NETWORK_DIR}/wifi-country-code"
+PERSIST_JSON="${NETWORK_DIR}/network_config.json"
+ROOTFS_MIN_KB=20480
+LOG_MAX_BYTES=524288
+
+# 엔진 마커가 있으면 country-now 로 승격 (공존 호환)
+[ -f "$COUNTRY_NOW_MARK" ] && COUNTRY_NOW=1
+
+# ──────────────────────────── 로깅 / 실행 ─────────────────────────────
+log() {
+    up=$(cut -d' ' -f1 /proc/uptime 2>/dev/null || echo '?')   # RTC 불신뢰 → uptime 병기
+    line="[$(date '+%Y-%m-%d %H:%M:%S' 2>/dev/null) up=${up}s ${MODE_NAME}] $*"
+    echo "$line" >&2
+    if [ -d "$STATE_DIR" ]; then
+        if [ -f "$LOG_FILE" ] && [ "$(wc -c < "$LOG_FILE" 2>/dev/null || echo 0)" -gt "$LOG_MAX_BYTES" ]; then
+            mv -f "$LOG_FILE" "${LOG_FILE}.1" 2>/dev/null || true
+        fi
+        echo "$line" >> "$LOG_FILE" 2>/dev/null || true
+    fi
+}
+run() {   # 외부 명령 + rc 로깅. 절대 스크립트를 중단시키지 않음.
+    "$@"; rc=$?
+    [ "$rc" -ne 0 ] && log "  cmd rc=${rc}: $*"
+    return "$rc"
+}
+
+seed_defaults_if_empty() {
+    if ! run mkdir -p "$NETWORK_DIR"; then
+        log "  defaults: cannot create ${NETWORK_DIR} - skip"
+        return 0
+    fi
+
+    if find "$NETWORK_DIR" -mindepth 1 -maxdepth 1 2>/dev/null | read -r _; then
+        return 0
+    fi
+
+    if [ ! -d "$DEFAULT_DIR" ]; then
+        log "  defaults: ${NETWORK_DIR} empty but ${DEFAULT_DIR} missing - skip"
+        return 0
+    fi
+
+    if run cp -a "${DEFAULT_DIR}/." "$NETWORK_DIR/"; then
+        log "  defaults: seeded ${NETWORK_DIR} from ${DEFAULT_DIR}"
+    else
+        log "  defaults: failed to seed ${NETWORK_DIR} from ${DEFAULT_DIR}"
+    fi
+}
+
+# ──────────────────────────── 헬퍼 ───────────────────────────────────
+runtime_target() {
+    case "$1" in
+        10-wlan0.network) echo "${RUNTIME_DIR}/05-dpworld-wlan0.network" ;;
+        10-eth0.network)  echo "${RUNTIME_DIR}/05-dpworld-eth0.network" ;;
+        10-eth1.network)  echo "${RUNTIME_DIR}/05-dpworld-eth1.network" ;;
+    esac
+}
+iface_of() {
+    case "$1" in
+        10-wlan0.network) echo wlan0 ;;
+        10-eth0.network)  echo eth0 ;;
+        10-eth1.network)  echo eth1 ;;
+    esac
+}
+render_addr() {  # 렌더 파일의 static Address (없으면 빈값=DHCP)
+    sed -n 's#^[[:space:]]*Address[[:space:]]*=[[:space:]]*\([0-9][0-9.]*\)/.*#\1#p' "$1" 2>/dev/null | head -n1
+}
+live_addr() {
+    ip -4 -o addr show dev "$1" 2>/dev/null | awk '{split($4,a,"/"); print a[1]}' | head -n1
+}
+desired_country() {
+    cc=""
+    [ -r "$COUNTRY_RENDER" ] && cc=$(tr -d ' \r\n\t' < "$COUNTRY_RENDER" 2>/dev/null | tr 'a-z' 'A-Z')
+    if [ -z "$cc" ] && [ -r "$PERSIST_JSON" ]; then
+        cc=$(sed -n 's/.*"country_code"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$PERSIST_JSON" 2>/dev/null \
+             | head -n1 | tr -d ' \r\n\t' | tr 'a-z' 'A-Z')
+    fi
+    echo "$cc"
+}
+valid_cc() { case "$1" in [A-Z][A-Z]) return 0 ;; *) return 1 ;; esac; }
+modprobe_country() {
+    [ -r "$MODPROBE_CONF" ] || return 0
+    sed -n 's/^[[:space:]]*options[[:space:]]\+wlan[[:space:]]\+country_code=\([A-Za-z]\{2\}\).*$/\1/p' \
+        "$MODPROBE_CONF" 2>/dev/null | head -n1 | tr 'a-z' 'A-Z'
+}
+live_country() {  # 라디오 실효 country (ground truth). 모듈 로드 파라미터 우선, iw reg 폴백.
+    # ※ wpa_cli get country 는 wpa conf 렌더값일 뿐 라디오 실효값이 아님 → 사용 금지(거짓 양성: 오류②).
+    c=""
+    [ -r /sys/module/wlan/parameters/country_code ] && \
+        c=$(tr -d ' \r\n\t' < /sys/module/wlan/parameters/country_code 2>/dev/null | tr 'a-z' 'A-Z')
+    if { [ -z "$c" ] || [ "$c" = "00" ] || [ "$c" = "(NULL)" ]; } && command -v iw >/dev/null 2>&1; then
+        c=$(iw reg get 2>/dev/null | sed -n 's/^country \([A-Z][A-Z]\):.*/\1/p' | grep -v '^00$' | head -n1)
+    fi
+    echo "$c"
+}
+
+note_country_now_deferred() {
+    log "  country-now requested, but live module unload is disabled on this hardware; reboot-required 유지"
+    rm -f "$COUNTRY_NOW_MARK" 2>/dev/null || true
+}
+
+# ──────────────────────── 락 (mkdir 원자 + PID stale 회수) ─────────────
+acquire_lock() {
+    i=0
+    while [ "$i" -lt 12 ]; do
+        if mkdir "$LOCK_DIR" 2>/dev/null; then
+            echo "$$" > "$LOCK_PID" 2>/dev/null || true
+            return 0
+        fi
+        holder=$(cat "$LOCK_PID" 2>/dev/null || echo "")
+        if [ -n "$holder" ] && ! kill -0 "$holder" 2>/dev/null; then
+            log "stale lock (pid ${holder} dead) — 회수"
+            rm -f "$LOCK_PID" 2>/dev/null; rmdir "$LOCK_DIR" 2>/dev/null
+            continue                         # 즉시 재시도 (i 증가 없음)
+        fi
+        i=$((i+1)); sleep 1
+    done
+    return 1
+}
+
+mkdir -p "$RUN_STATE_DIR" 2>/dev/null || true
+if ! acquire_lock; then
+    log "다른 apply 실행 중 — 락 획득 실패. 멱등하므로 종료(0)."
+    exit 0
+fi
+cleanup() { rm -rf "$LOCK_DIR" 2>/dev/null || true; }
+trap cleanup EXIT INT TERM
+
+mkdir -p "$SHADOW_DIR" 2>/dev/null || true
+log "START (boot=${MODE_BOOT} country_now=${COUNTRY_NOW})"
+
+seed_defaults_if_empty
+
+# ──────── 1) /run 채우기 (양 모드) — tmpfs 는 부팅마다 비므로 항상 동기화 ────────
+NETWORKD_DIRTY=0
+CHANGED_IFACES=""
+install -d "$RUNTIME_DIR" 2>/dev/null || true
+
+for stale in 10-wlan0.network 10-eth0.network 10-eth1.network; do   # 펌웨어식 잔여 이름 제거
+    [ -e "${RUNTIME_DIR}/${stale}" ] && { run rm -f "${RUNTIME_DIR}/${stale}"; NETWORKD_DIRTY=1; }
+done
+
+for r in $NET_RENDERS; do
+    src="${NETWORK_DIR}/${r}"; tgt=$(runtime_target "$r"); ifc=$(iface_of "$r")
+    if [ -f "$src" ]; then
+        if [ ! -f "$tgt" ] || ! cmp -s "$src" "$tgt"; then
+            if run install -m 0644 "$src" "$tgt"; then
+                NETWORKD_DIRTY=1; CHANGED_IFACES="${CHANGED_IFACES} ${ifc}"
+                log "  runtime updated: ${tgt}"
+            fi
+        fi
+    elif [ -e "$tgt" ]; then
+        run rm -f "$tgt"; NETWORKD_DIRTY=1; CHANGED_IFACES="${CHANGED_IFACES} ${ifc}"
+        log "  runtime removed (source gone): ${tgt}"
+    fi
+done
+
+# ──────── 2) wpa 변경 감지 (shadow 기준 — /run 사본이 없는 유일 파일) P1 ────────
+WPA_CHANGED=0
+if [ -f "$WPA_RENDER" ]; then
+    if [ ! -f "${SHADOW_DIR}/wpa_supplicant-wlan0.conf" ] || \
+       ! cmp -s "$WPA_RENDER" "${SHADOW_DIR}/wpa_supplicant-wlan0.conf"; then
+        WPA_CHANGED=1
+        log "  wpa render changed (SSID/PW/security/country header)"
+    fi
+fi
+
+# ──────── 3) country: modprobe.d 동기화 + 라디오 실효 기준 reboot 판정 (P2 / 오류①② 修) ────────
+# 오류①: wlan 모듈은 부팅 초기(modules-load)에 로드되고 seed 는 그 뒤에 modprobe.d 를 갱신 →
+#         country 변경이 그 부팅엔 반영 안 됨(라디오는 옛값). 다음 부팅에야 적용.
+# 오류②: 적용 검증을 wpa conf 값(wpa_cli)으로 하면 거짓 양성 → 반드시 라디오 실효값(live_country)으로.
+DC=$(desired_country)
+if [ -n "$DC" ] && valid_cc "$DC"; then
+    CUR=$(modprobe_country)
+    # (a) modprobe.d 를 목표로 동기화 (다를 때만). 런타임 modprobe -r 없음(deferred).
+    if [ "$DC" != "$CUR" ]; then
+        rootfs_free=$(df -k / 2>/dev/null | awk 'END{print $4}'); rootfs_free=${rootfs_free:-0}
+        if [ "$rootfs_free" -lt "$ROOTFS_MIN_KB" ]; then
+            log "  country: rootfs 여유 ${rootfs_free}KB < ${ROOTFS_MIN_KB}KB — modprobe.d 쓰기 보류 (P6)"
+        elif printf 'options wlan country_code=%s\n' "$DC" > "${MODPROBE_CONF}.tmp.$$" 2>/dev/null \
+             && mv -f "${MODPROBE_CONF}.tmp.$$" "$MODPROBE_CONF" 2>/dev/null; then
+            log "  country: modprobe.d ${CUR:-none} -> ${DC}"
+        else
+            rm -f "${MODPROBE_CONF}.tmp.$$" 2>/dev/null || true
+            log "  country: modprobe.d 쓰기 실패 (disk?) — 변경 보류"
+        fi
+    fi
+    # (b) reboot-required 판정은 "라디오 실효 country" 기준 (모듈이 실제 무엇으로 떠있나).
+    #     modprobe.d 가 목표와 같아도 라디오가 다르면(=아직 그 값으로 모듈이 안 올라옴) 재부팅 필요.
+    LC=$(live_country)
+    if [ -n "$LC" ] && [ "$LC" = "$DC" ]; then
+        [ -f "$REBOOT_MARK" ] && { rm -f "$REBOOT_MARK" 2>/dev/null; log "  country: 라디오 실효=${LC} == 목표 — reboot-required 해제"; }
+    else
+        : > "$REBOOT_MARK" 2>/dev/null || true
+        log "  country: 라디오 실효=${LC:-unknown} != 목표 ${DC} → 재부팅 필요 (reboot-required)"
+        if [ "$MODE_BOOT" -eq 0 ] && [ "$COUNTRY_NOW" -eq 1 ]; then
+            note_country_now_deferred
+        fi
+    fi
+elif [ -n "$DC" ]; then
+    log "  country: 잘못된 코드 '${DC}' 무시"
+fi
+
+# ──────── 4) 라이브 적용 + 라이브-vs-의도 reconcile (P3 + L1) ────────
+# on-demand: 항상 수행.
+# boot: 정상 순서면 networkd 미기동 → 자연 적용에 맡기고 생략. 단 boot-ordering race 로
+#       networkd 가 이미 active 면(우리 /run 설치 전에 링크 구성) 라이브가 옛 값으로 굳으므로 reconcile.
+DO_LIVE=0
+if [ "$MODE_BOOT" -eq 0 ]; then
+    DO_LIVE=1
+elif systemctl is-active --quiet systemd-networkd.service 2>/dev/null; then
+    DO_LIVE=1
+    log "  boot race 감지: networkd 가 이미 active → 라이브 reconcile 수행"
+fi
+
+if [ "$DO_LIVE" -eq 1 ]; then
+    # L1: 라이브-vs-렌더 정합성 — /run 이 렌더와 같아도 "라이브 주소 != 렌더 주소"면 reconfigure
+    # 강제. 펌웨어 reconcile_live_networkd_state 복원 (이게 빠져서 cold-boot race 후 옛 IP 가
+    # 그대로 남았음). /run-vs-렌더 비교만으로는 못 잡는 케이스를 닫는다.
+    RECON=""
+    for r in $NET_RENDERS; do
+        src="${NETWORK_DIR}/${r}"; ifc=$(iface_of "$r")
+        [ -f "$src" ] || continue
+        want=$(render_addr "$src"); [ -n "$want" ] || continue     # DHCP — 비교 생략
+        have=$(live_addr "$ifc")
+        if [ "$want" != "$have" ]; then
+            RECON="${RECON} ${ifc}"
+            log "  reconcile: ${ifc} live=${have:-none} != desired=${want} → reconfigure"
+        fi
+    done
+
+    # reconfigure 대상 = /run 변경 iface ∪ 라이브 불일치 iface
+    TARGETS=$(printf '%s\n' $CHANGED_IFACES $RECON | grep -v '^$' | sort -u)
+    if [ -n "$TARGETS" ]; then
+        if systemctl is-active --quiet systemd-networkd.service 2>/dev/null; then
+            run networkctl reload                                   # P3
+            for ifc in $TARGETS; do
+                if command -v ip >/dev/null 2>&1 && ! ip link show dev "$ifc" >/dev/null 2>&1; then
+                    log "  ${ifc} 미존재 — reconfigure 생략"; continue
+                fi
+                run networkctl reconfigure "$ifc"
+            done
+        else
+            log "  systemd-networkd 비활성 — reload/reconfigure 생략"
+        fi
+    fi
+
+    if [ "$WPA_CHANGED" -eq 1 ]; then                               # P1
+        if command -v wpa_cli >/dev/null 2>&1 && wpa_cli -i wlan0 ping >/dev/null 2>&1; then
+            run wpa_cli -i wlan0 reconfigure
+        else
+            run systemctl try-restart wpa_supplicant@wlan0.service
+        fi
+    fi
+
+    # ── 4.5) 검증 요약 (관측만 — 롤백 안 함). 재테스트 판정용. ──
+    if [ -n "$TARGETS" ] || [ "$WPA_CHANGED" -eq 1 ]; then
+        sleep 2                                                     # 주소 settle
+        for r in $NET_RENDERS; do
+            src="${NETWORK_DIR}/${r}"; ifc=$(iface_of "$r")
+            [ -f "$src" ] || continue
+            want=$(render_addr "$src")
+            [ -n "$want" ] || { log "  verify ${ifc}: DHCP/no-addr"; continue; }
+            have=$(live_addr "$ifc")
+            if [ "$want" = "$have" ]; then
+                log "  verify ${ifc}: OK (${have})"
+            else
+                log "  verify ${ifc}: MISMATCH want=${want} live=${have:-none}"
+            fi
+        done
+        if [ "$WPA_CHANGED" -eq 1 ]; then
+            st=$(wpa_cli -i wlan0 status 2>/dev/null | sed -n 's/^wpa_state=//p')
+            ss=$(wpa_cli -i wlan0 status 2>/dev/null | sed -n 's/^ssid=//p')
+            log "  verify wlan0: wpa_state=${st:-?} ssid=${ss:-?}"
+        fi
+    fi
+fi
+
+# ──────── 5) shadow 갱신 (적용 기준선) ────────
+for f in $NET_RENDERS wpa_supplicant-wlan0.conf wifi-country-code network_config.json; do
+    [ -f "${NETWORK_DIR}/${f}" ] && cp -f "${NETWORK_DIR}/${f}" "${SHADOW_DIR}/${f}" 2>/dev/null || true
+done
+
+log "DONE (networkd_dirty=${NETWORKD_DIRTY} wpa_changed=${WPA_CHANGED}$([ -f "$REBOOT_MARK" ] && echo ' reboot_required=1'))"
+exit 0
diff --git a/deploy/dpworld-network-apply-ondemand.conf b/deploy/dpworld-network-apply-ondemand.conf
new file mode 100644
index 0000000..ea16b4f
--- /dev/null
+++ b/deploy/dpworld-network-apply-ondemand.conf
@@ -0,0 +1,7 @@
+# v1.6.0: dpworld-network-apply.service 는 펌웨어 소유 oneshot 으로 Requires=dpworld-network-seed.service
+# 를 걸어, 재부팅 후 web-configurator 가 systemctl start 로 온디맨드 호출하면 seed(boot-only
+# oneshot)가 inactive → "Dependency failed" rc=1 (.56 실측, 수락 #6 C-2). seed 는 부팅 순서
+# 보장용일 뿐 apply.sh 자체는 자족적이므로 런타임 Requires 를 비워 온디맨드 호출을 가능케 한다.
+# (After= 는 부팅 순서용으로 유지 — 부팅 이후엔 무해.)
+[Unit]
+Requires=
diff --git a/deploy/dpworld-network-apply.service.d/20-hardened.conf b/deploy/dpworld-network-apply.service.d/20-hardened.conf
new file mode 100644
index 0000000..e27db65
--- /dev/null
+++ b/deploy/dpworld-network-apply.service.d/20-hardened.conf
@@ -0,0 +1,7 @@
+# Hardened apply.sh override (2026-06-15) — 펌웨어 /usr/bin/dpworld-network-apply.sh 무수정,
+# ExecStart 만 하드닝본으로 교체. country reboot-deferred(모듈 리로드 hang 방지),
+# /run 동기화 우선, wpa/networkctl 재구성. TimeoutStartSec 확대(country-now 여유).
+[Service]
+ExecStart=
+ExecStart=/usr/bin/dpworld-network-apply-hardened.sh
+TimeoutStartSec=180
diff --git a/deploy/dpworld-network-seed.service.d/20-hardened.conf b/deploy/dpworld-network-seed.service.d/20-hardened.conf
new file mode 100644
index 0000000..d3e941d
--- /dev/null
+++ b/deploy/dpworld-network-seed.service.d/20-hardened.conf
@@ -0,0 +1,6 @@
+# Hardened seed override (2026-06-15) — 부팅 시 하드닝본 --boot 실행.
+# /run 렌더 복사를 최우선 수행, 모듈 리로드 안 함(hang 방지) → IP 가 부팅 시 정상 반영.
+[Service]
+ExecStart=
+ExecStart=/usr/bin/dpworld-network-apply-hardened.sh --boot
+TimeoutStartSec=120
diff --git a/deploy/dpworld-udhcpd-ap0.service b/deploy/dpworld-udhcpd-ap0.service
new file mode 100644
index 0000000..ae40d9c
--- /dev/null
+++ b/deploy/dpworld-udhcpd-ap0.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=DPWorld udhcpd on ap0
+After=dpworld-hostapd-ap0.service
+StartLimitIntervalSec=60
+StartLimitBurst=5
+
+[Service]
+Type=simple
+ExecStartPre=/bin/sh -c 'touch /run/udhcpd-ap0.leases'
+ExecStart=/usr/sbin/udhcpd -f -S /home/root/network/ap/udhcpd-ap0.conf
+Restart=on-failure
+RestartSec=3
diff --git a/deploy/nginx.conf b/deploy/nginx.conf
new file mode 100644
index 0000000..f766403
--- /dev/null
+++ b/deploy/nginx.conf
@@ -0,0 +1,25 @@
+server {
+    listen 80;
+    server_name _;
+
+    # Static files
+    location / {
+        root /opt/web-configurator/static;
+        try_files $uri $uri/ /index.html;
+        expires 1h;
+        add_header Cache-Control "public, must-revalidate";
+    }
+
+    location /configuration/ {
+        proxy_pass http://127.0.0.1:8080/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 30s;
+    }
+
+    location = /configuration {
+        return 301 /configuration/;
+    }
+}
diff --git a/deploy/web-configurator.service b/deploy/web-configurator.service
new file mode 100644
index 0000000..893c7af
--- /dev/null
+++ b/deploy/web-configurator.service
@@ -0,0 +1,50 @@
+# v1.3.1: synced to device .56 reality (then at /home/root/NEW_Web_Configurator).
+# v1.11.1: app install dir moved to /opt/web-configurator (FHS /opt). The
+# server from /opt/web-configurator/src on port 9090.
+# v1.11.16: MemoryMax 48M→128M. 48M was tight — support-bundle(io.BytesIO)+UI 동시
+# 사용 시 실측 피크 ~40-50MB로 OOM-kill 위험. 128M = 실피크 ~2.5x 여유 + 누수 방지
+# 캡 유지(장비 RAM 3.4GB 대비 3.7%). 정적자산 최대 93KB·업로드는 디스크 스트리밍.
+[Unit]
+Description=IoT Web Configurator
+# v1.6.0 C3: wpa_supplicant@wlan0 이후 기동 — watchdog 첫 틱에 /var/run/wpa_supplicant
+# 제어 소켓이 보이도록 (부팅 순서 race → wpa 쿼리 실패 → production wpa flap 방지)
+After=network.target wpa_supplicant@wlan0.service
+Wants=network.target wpa_supplicant@wlan0.service
+StartLimitIntervalSec=60
+StartLimitBurst=5
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/python3 /opt/web-configurator/src/server.py
+WorkingDirectory=/opt/web-configurator/src
+Restart=always
+RestartSec=5
+Environment=DB_PATH=/home/root/db/dynamic_data.db
+Environment=LOG_DIR=/opt/log/dpworldapp
+Environment=PORT=9090
+MemoryMax=128M
+StandardOutput=journal
+StandardError=journal
+# v1.4.0: security hardening — minimum-cost OS-level sandboxing
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=read-only
+# v1.6.0: PrivateTmp yes→no (.56 strace 실측). wpa_cli 는 응답 수신용 클라이언트 소켓을
+# /tmp/wpa_ctrl_<pid> 에 bind 하는데(컴파일 고정), PrivateTmp 사설 tmpfs 는 호스트의
+# wpa_supplicant 에게 보이지 않아 회신 불가 → 영구 무응답. 공유 /tmp 로 전환하고
+# ReadWritePaths 에 /tmp 명시 (ProtectSystem=strict 는 /tmp 도 RO 로 만들므로 필요 —
+# v1.4.6.6 log-download 의 /tmp staging 도 이 라인으로 유지). 보안 트레이드오프:
+# /tmp symlink 공격면 일부 복원 — 폐쇄 LAN 단일 운영자 장비라 수용 (CHANGELOG 기록).
+PrivateTmp=no
+PrivateDevices=yes
+ReadWritePaths=/home/root/db /opt/log/dpworldapp /opt/web-configurator /opt/fw_staging /opt/fw_upload -/opt/config_backups -/home/root/network /tmp
+# /var/run 은 /run 의 symlink — namespace 는 실경로 기준이므로 둘 다 지정 (.56 실측)
+ReadWritePaths=-/var/run/wpa_supplicant -/run/wpa_supplicant
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+
+[Install]
+WantedBy=multi-user.target
diff --git a/docs/DEPLOY.md b/docs/DEPLOY.md
new file mode 100644
index 0000000..924da99
--- /dev/null
+++ b/docs/DEPLOY.md
@@ -0,0 +1,203 @@
+# 배포 및 버전 관리 운영 절차서
+
+이 문서는 NEW Web Configurator의 버전 관리 정책, 릴리즈 절차, 배포 워크플로우, 검증, 롤백, 디바이스 아키텍처, 트러블슈팅을 다룹니다. 신규 버전을 디바이스에서 실행하는 방법에 대한 단일 참조 문서입니다.
+
+---
+
+## 1. 개요
+
+NEW Web Configurator는 여러 현장의 IoT 디바이스에 배포되는 Python stdlib HTTP 서버입니다. 배포는 `scripts/deploy.ps1` — PowerShell 스크립트를 사용합니다. 이 스크립트는 커밋된 `src/` 트리를 아카이브로 묶어 SSH로 전송하고, 디바이스 상의 기존 트리를 백업 및 교체한 뒤, 배포된 버전을 기록하고 systemd 서비스를 재시작합니다. 모든 프로덕션 배포는 반드시 `vMAJOR.MINOR.PATCH` 릴리즈 태그와 연결되어야 하므로, 어떤 디바이스에서든 실행 중인 정확한 버전을 언제나 식별할 수 있습니다.
+
+---
+
+## 2. 버전 관리 정책
+
+### 2.1 버전 체계
+
+세 부분으로 구성된 시맨틱 버전 관리: **`vMAJOR.MINOR.PATCH`**.
+
+| 구분 | 올려야 하는 경우 |
+|---|---|
+| **MAJOR** | 하위 호환이 깨지는 변경 — 예: 기존 디바이스를 망가뜨리는 `board_config` 스키마 변경, 또는 API 삭제/이름 변경. |
+| **MINOR** | 새로운 하위 호환 기능 추가 — 예: 새 설정 페이지, 랜딩 대시보드, WiFi 국가 코드 드롭다운. |
+| **PATCH** | 신규 기능 없는 버그 수정 또는 소규모 수정 — 예: `db_manager` 재시도 수정, 표시 버그 수정. |
+
+### 2.2 단일 진실 소스(Single Source of Truth)
+
+`src/static/js/constants.js`의 `APP_VERSION`이 애플리케이션 버전의 단일 진실 소스입니다. 사이드바에 표시되며, 릴리즈 시점에 git 태그와 반드시 일치해야 합니다.
+
+---
+
+## 3. 릴리즈 절차
+
+새 릴리즈를 만들려면:
+
+1. **버전 올림 결정** — 변경 내용이 MAJOR, MINOR, PATCH 중 어느 것에 해당하는지 결정합니다(§2.1 표 참조).
+2. **`APP_VERSION` 업데이트** — `src/static/js/constants.js`에서 `APP_VERSION`을 새 버전 문자열로 설정합니다(예: `'v1.0.1'`).
+3. **`CHANGELOG.md` 항목 추가** — `CHANGELOG.md` 상단에 `## [vX.Y.Z] — YYYY-MM-DD` 형식으로 변경 내용을 기술하는 섹션을 추가합니다.
+4. **커밋** — `constants.js`와 `CHANGELOG.md`를 함께 커밋합니다.
+5. **태그** — annotated 태그를 생성합니다:
+   ```
+   git tag -a vX.Y.Z -m "Release vX.Y.Z — <one-line summary>"
+   ```
+
+태그는 릴리즈 시점에만 생성합니다. 개발 중간에 태그를 붙이지 마십시오. 태그는 배포되는 커밋을 정확히 표시합니다.
+
+---
+
+## 4. 배포
+
+### 4.1 사전 요구사항
+
+- 다음이 갖춰진 **Windows 개발 호스트**:
+  - OpenSSH `ssh` 및 `scp` (Windows 10/11 기본 포함 또는 Git for Windows).
+  - `PATH`에 등록된 `git`.
+  - `root@<device>`에 인증된 SSH 키.
+- **클린(clean)** 상태의 로컬 워킹 트리 (`git status`에 변경 사항 없음).
+- **`vX.Y.Z` 태그에 위치한 HEAD** (플래그 처리된 개발 빌드에는 `-AllowUntagged` 사용).
+
+### 4.2 사용법
+
+```powershell
+.\scripts\deploy.ps1 <device-ip>
+.\scripts\deploy.ps1 <device-ip> -AllowUntagged
+.\scripts\deploy.ps1 <device-ip> -Rollback
+```
+
+예시:
+
+```powershell
+.\scripts\deploy.ps1 192.168.55.56
+.\scripts\deploy.ps1 192.168.55.56 -AllowUntagged
+```
+
+### 4.3 배포 흐름 (스크립트 동작 상세)
+
+1. **사전 점검(Pre-flight)** — SSH 도달 가능 여부 확인(`ssh … echo ok`), 로컬 워킹 트리가 클린 상태인지 확인, HEAD가 버전 태그에 위치하는지 확인(버전 태그가 아니면 중단, `-AllowUntagged`가 전달된 경우 제외).
+2. **클린 아카이브 빌드** — `git archive --output=<temp>.tar HEAD src`를 실행하여 `src/` 하위의 커밋된 파일만 캡처 — `__pycache__`, `*.bak.*`, 미추적 파일은 제외.
+3. **전송** — `scp`로 임시 tar 파일을 디바이스로 복사하고, 디바이스에서 스테이징 디렉터리에 압축 해제.
+4. **백업** — 현재 디바이스의 `src/`를 `backups/src-<timestamp>/`로 복사하고, 최근 3개 백업만 유지하도록 정리.
+5. **systemd 유닛 및 헬퍼 스크립트 설치** (멱등성 보장 — 해시 비교 후 변경된 경우에만 재복사; src 교체 이전에 수행하므로 실패 시 기존 src가 활성 상태를 유지). 모든 유닛은 영구 경로 `/lib/systemd/system/`에 설치됩니다(`/etc/systemd/system/` 오버레이는 tmpfs라 재부팅 시 초기화됩니다). 설치 항목:
+   - `web-configurator.service` (메인 유닛; 첫 배포 시 `systemctl enable`도 수행).
+   - `dpworld-net-recover.service` — 네트워크 적용 엔진이 사용하는 `modprobe` 전용 복구 유닛.
+   - `dpworld-network-apply.service.d/10-ondemand.conf` — 펌웨어 적용 유닛의 부팅 전용 `Requires`를 온디맨드로 재정의하는 드롭인.
+   - **펌웨어 부팅 하드닝(v1.7.1+)**: 하드닝된 부팅 스크립트 `deploy/dpworld-network-apply-hardened.sh` → `/usr/bin/`으로 복사, 그리고 두 개의 드롭인(`dpworld-network-apply.service.d/20-hardened.conf` 및 `dpworld-network-seed.service.d/20-hardened.conf`)이 펌웨어 seed/apply 유닛을 하드닝된 스크립트로 연결(라이브 `modprobe -r` 없음 — 국가 코드는 재부팅 시 적용됨). 펌웨어 원본 `/usr/bin/dpworld-network-apply.sh`는 수정하지 않습니다. [firmware-boot-hardening.md](firmware-boot-hardening.md) 참조.
+   - **Wi-Fi AP 유닛**: `deploy/dpworld-ap-apply.sh` → `/usr/bin/`으로 복사, 그리고 네 개의 유닛(`dpworld-ap-seed`, `dpworld-ap-apply`, `dpworld-hostapd-ap0`, `dpworld-udhcpd-ap0`). `dpworld-ap-seed.service`만 enable하며, 나머지는 apply 스크립트에서 온디맨드로 시작됩니다.
+   - 엔진/OTA 디렉터리도 사전 생성합니다(`/opt/fw_staging`, `/opt/fw_upload`, `/opt/config_backups`, `/home/root/network`, `/opt/config_backups/network`).
+6. **교체(Swap)** — 디바이스의 `src/`를 새로 압축 해제된 트리로 교체(`rm -rf src && mv <staging>/src src`); 스테이징 tar와 디렉터리를 삭제.
+7. **버전 기록** — `DEPLOYED_VERSION`을 기록하고 `deploy-history.log`에 한 줄을 추가합니다(§5 참조).
+8. **재시작** — `systemctl restart web-configurator`를 실행합니다.
+9. **검증** — 최대 약 15초 동안 폴링: `systemctl is-active web-configurator`가 `active`인지, `:9090`으로 HTTP 요청 시 200이 반환되는지 확인합니다. 성공 또는 실패를 보고합니다. 재시작/검증이 실패하면 스크립트가 4단계에서 생성한 `backups/src-<timestamp>/`로 자동 롤백합니다.
+
+> **참고:** HEAD가 정확히 `vX.Y.Z` 태그에 있지 않으면 배포가 거부됩니다. 미태그 커밋을 플래그 처리된 개발 빌드로 배포하려면 `-AllowUntagged`를 전달하십시오(버전은 `vX.Y.Z-dev+<short-sha>`로 기록됩니다).
+
+이 스크립트는 nginx, Java app-runner, SQLite 데이터베이스, dpworldapp 바이너리를 **절대 건드리지 않습니다**. 단, 5단계에 나열된 systemd 유닛과 헬퍼 스크립트를 설치/갱신하며(멱등성 보장, 해시가 다를 경우에만), 펌웨어 소유의 `/usr/bin/dpworld-network-apply.sh`는 수정하지 않습니다 — 하드닝은 원본을 수정하지 않고 드롭인을 통해 적용됩니다.
+
+---
+
+## 5. 배포 검증
+
+배포 성공 후, 디바이스에서 실행 중인 내용을 확인합니다:
+
+```bash
+ssh root@<ip> cat /opt/web-configurator/DEPLOYED_VERSION
+```
+
+이 파일은 매 배포 시 덮어쓰이며, 다음 내용을 포함합니다:
+
+```
+version=v1.0.0
+tag=v1.0.0
+commit=<full-sha>
+deployed_at=<ISO-8601 timestamp>
+deployed_by=<user>@<host>
+```
+
+배포 이력을 확인하려면:
+
+```bash
+ssh root@<ip> cat /opt/web-configurator/deploy-history.log
+```
+
+각 줄의 형식: `<timestamp>  <version>  <commit-short>  <deployed_by>`.
+
+---
+
+## 6. 롤백
+
+디바이스의 가장 최근 백업으로 복원하려면:
+
+```powershell
+.\scripts\deploy.ps1 <ip> -Rollback
+```
+
+이 명령은 가장 최근의 `backups/src-*` 스냅샷을 `src/`에 복원하고, 서비스를 재시작하여 정상 여부를 검증한 뒤, 롤백이 발생했음을 기록하도록 `DEPLOYED_VERSION`을 다시 기록합니다(복원된 백업 타임스탬프 포함). 백업 스냅샷은 롤백 후에도 삭제되지 않습니다.
+
+---
+
+## 7. 디바이스 아키텍처
+
+| 항목 | 값 |
+|---|---|
+| 앱 디렉터리 | `/opt/web-configurator/` |
+| systemd 서비스 | `web-configurator.service`가 `src/server.py` 실행 |
+| Python 설정 서버 포트 | **9090** |
+| Nginx (리버스 프록시) | 포트 **80** |
+| Java app-runner | 포트 **8080** |
+| 디바이스 — 프로덕션(메인) | `192.168.55.56` (유선 `eth1`) |
+| 디바이스 — 개발/검증(보조) | `192.168.55.54` |
+| Python 런타임 | Python 3.10 |
+| SSH 사용자 | `root` |
+
+디바이스 주요 경로:
+
+| 경로 | 용도 |
+|---|---|
+| `/opt/web-configurator/src/` | 실행 중인 애플리케이션 소스 |
+| `/opt/web-configurator/backups/` | 디바이스 내 백업 스냅샷(최근 3개) |
+| `/opt/web-configurator/DEPLOYED_VERSION` | 현재 버전 기록 파일 |
+| `/opt/web-configurator/deploy-history.log` | 배포별 감사 로그 |
+| `/home/root/db/dynamic_data.db` | SQLite 설정 데이터베이스(`board_config` 테이블) |
+| `/opt/log/dpworldapp/` | 애플리케이션 로그 디렉터리 |
+
+---
+
+## 8. 트러블슈팅
+
+### SSH 접속 불가
+
+**증상:** `Cannot reach <ip> over SSH.`
+
+**조치:**
+- 디바이스 전원이 켜져 있고 네트워크에 연결되어 있는지 확인합니다: `ping <ip>`.
+- SSH 키가 `root@<ip>:~/.ssh/authorized_keys`에 등록되어 있는지 확인합니다.
+- 수동으로 테스트합니다: `ssh -o StrictHostKeyChecking=no root@<ip> echo ok`.
+
+### 배포 거부 — HEAD에 태그 없음
+
+**증상:** `HEAD is not at a version tag. Tag a release, or pass -AllowUntagged for a dev build.`
+
+**조치:** 커밋에 태그를 붙이거나(`git tag -a vX.Y.Z -m "..."`) 다시 실행하거나, `-AllowUntagged`를 전달하여 플래그 처리된 개발 빌드를 배포합니다. 프로덕션 배포에 `-AllowUntagged`를 절대 사용하지 마십시오.
+
+### 배포 거부 — 더티(dirty) 워킹 트리
+
+**증상:** `Local working tree is not clean.`
+
+**조치:** 배포 전에 모든 로컬 변경 사항을 커밋하거나 stash합니다. `git status`로 미처리 항목을 확인하십시오.
+
+### 배포 후 서비스 비정상
+
+**증상:** 스크립트가 `Verification failed: web-configurator not healthy on <ip> after restart`를 보고합니다.
+
+**조치:**
+```bash
+ssh root@<ip> journalctl -u web-configurator -n 50 --no-pager
+```
+Python import 오류, 파일 누락, 포트 충돌 등을 확인합니다. 새 버전에 문제가 있으면 즉시 롤백합니다:
+```powershell
+.\scripts\deploy.ps1 <ip> -Rollback
+```
+
+### 롤백 방법
+
+§6을 참조합니다. 롤백 자체가 실패한 경우(백업 없음), 알려진 정상 상태의 `.tar` 파일에서 수동 복원하거나 이전 릴리즈 태그를 다시 배포합니다.
diff --git a/docs/README.md b/docs/README.md
new file mode 100644
index 0000000..027788a
--- /dev/null
+++ b/docs/README.md
@@ -0,0 +1,22 @@
+# 문서 인덱스
+
+이 디렉터리는 파트너 전달용으로 정리되었습니다. 현재 Web Configurator 제품,
+배포 흐름, `dpworldapp`과의 설정 계약을 설명하는 문서들이 포함되어 있습니다.
+
+## 시작 안내
+
+| 문서 | 설명 |
+|---|---|
+| [DEPLOY.md](DEPLOY.md) | 디바이스 배포 및 롤백 운영 가이드. |
+| [architecture.md](architecture.md) | 고수준 아키텍처 및 런타임 모델. |
+| [architecture/v1.5.4.2-system-overview.md](architecture/v1.5.4.2-system-overview.md) | 현행 Python Web Configurator 상세 시스템 개요. |
+
+## 설정 계약
+
+| 문서 | 설명 |
+|---|---|
+| [dpworldapp_compatibility.md](dpworldapp_compatibility.md) | 공유 SQLite `board_config`에 대한 호환성 안내. |
+| [config-spec/config-contract-proposal.md](config-spec/config-contract-proposal.md) | Web Configurator와 `dpworldapp`을 위한 정규화된 설정 계약 제안. |
+| [config-spec/proposed/config_device.v2.proposed.json](config-spec/proposed/config_device.v2.proposed.json) | 제안된 디바이스 설정 JSON 예시. |
+| [config-spec/proposed/config_protocol.v2.proposed.json](config-spec/proposed/config_protocol.v2.proposed.json) | 제안된 프로토콜 설정 JSON 예시. |
+| [dpworldapp_schema_handoff/](dpworldapp_schema_handoff/) | `dpworldapp` 논의용 후보 v2/v3 스키마 및 마이그레이션 예시. |
diff --git a/docs/architecture.md b/docs/architecture.md
new file mode 100644
index 0000000..d94852c
--- /dev/null
+++ b/docs/architecture.md
@@ -0,0 +1,424 @@
+# NEW Web Configurator — Architecture Document
+
+> **Version 3.0 | 2026-06-20** — reflects app **v1.11.10** (Network Apply Engine + Wi-Fi AP + Firmware OTA)
+> Supersedes: v2.2 (2026-05-28), v2.1 (2026-05-26), v2.0 (2026-05-22), v1.1 (2026-02-19), v1.0 (2026-02-12)
+
+---
+
+## 1. Overview
+
+The **NEW Web Configurator** is a browser-based configuration tool for the
+Telechips TCC8030 IoT device. It is a **Python-stdlib HTTP server** plus a
+**vanilla ES-module SPA** (no build step), and it replaced a heavier legacy
+Java/Spring configurator (~436 MB → ~15–30 MB resident).
+
+It reads and writes the device's `board_config` SQLite store. That store is
+also used by two other programs on the device — the legacy Java app and the
+`dpworldapp` data-processing binary — which makes **storage ownership** a
+central concern of this document (see §6).
+
+---
+
+## 2. System Context
+
+Three independent programs run on the device and **all touch the same SQLite
+DB**:
+
+```mermaid
+graph LR
+    Operator["운영자<br/>(브라우저)"]
+    Operator -->|":9090 직접"| WebCfg
+    Operator -->|":80 → nginx"| JavaApp
+
+    subgraph Device["IoT Device — TCC8030 (192.168.55.x)"]
+        WebCfg["Python Web Configurator<br/>systemd: web-configurator.service<br/>:9090"]
+        JavaApp["레거시 Java app-runner<br/>:8080 (nginx :80 프록시)"]
+        dpworld["dpworldapp<br/>CAN/Modbus/OPC-UA 데이터 처리"]
+        DB[("SQLite<br/>~/db/dynamic_data.db")]
+        WebCfg -->|R/W| DB
+        JavaApp -->|R/W| DB
+        dpworld -->|R/W| DB
+    end
+```
+
+- **Python Web Configurator** — this project. systemd-managed service on port
+  **9090**, reached directly (no reverse proxy in front of it).
+- **Legacy Java app-runner** — a separate, still-running legacy app on 8080,
+  fronted by nginx on :80. Not part of this project, but it **shares
+  `board_config`** — see §6.
+- **dpworldapp** — the core data-processing binary. Reads config from
+  `board_config`, writes events to `event_history`.
+
+> The original design docs assumed "nginx :80 → Python :8080". The actual
+> device deployment is the layout above (Python direct on :9090, systemd-
+> managed). See [`DEPLOY.md`](DEPLOY.md) for the deployment runbook.
+
+> 위 3개 프로그램 외에 사용자의 **별도 프로젝트 Super_Relay**도 같은
+> `board_config`에 일부 키(`security_config`·`transport_config`)를 기록한다
+> — 소유권 상세는 §6.2.
+
+---
+
+## 3. Component Architecture
+
+```mermaid
+graph TB
+    subgraph Frontend["프론트엔드 — Vanilla ES-module SPA (빌드 없음)"]
+        AppJS["app.js — 라우팅·초기화·Save/Import/Export"]
+        ApiJS["api.js — REST 클라이언트"]
+        StateJS["state.js — 상태관리, flat↔nested 변환"]
+        ViewMode["view-mode.js — Two Faces (User/Advanced 토글)"]
+        Pages["pages/ — ~18 페이지<br/>(home·wifi·wifi-ap·ethernet·io·<br/>can·modbus·opcua·register·log·<br/>firmware·net-apply·…)"]
+        Shared["validator·utils·toast·constants·<br/>country-codes·components/"]
+        AppJS --> Pages --> ApiJS
+        AppJS --> ViewMode
+        Pages --> StateJS
+        Pages --> Shared
+    end
+
+    subgraph Backend["백엔드 — Python stdlib"]
+        Server["server.py — HTTP 라우팅·CORS·정적파일·진입점"]
+        DBMgr["db_manager.py — 3-tier SQLite 접근 레이어"]
+        Validator["config_validator.py — 서버측 검증·정규화"]
+        LogMgr["log_manager.py — 로그 관리·자동압축 데몬"]
+        KernelLog["kernel_log.py — 커널 로그 번들 (.tar.gz)"]
+        Status["system_status.py — Home 대시보드 상태 집계"]
+        Bundle["support_bundle.py — 진단 zip 생성"]
+        NetPkg["network/ — Network Apply Engine + Wi-Fi AP"]
+        FwPkg["firmware/ — Firmware OTA (TCP 8990)"]
+        Server --> DBMgr
+        Server --> Validator
+        Server --> LogMgr
+        Server --> KernelLog
+        Server --> Status
+        Server --> Bundle
+        Server --> NetPkg
+        Server --> FwPkg
+    end
+
+    ApiJS -->|HTTP REST| Server
+```
+
+### 3.1 Backend modules (`src/*.py`)
+
+| 모듈 | 책임 |
+|------|------|
+| `server.py` | stdlib `ThreadedHTTPServer` + `ConfigHandler`. 모든 GET/POST 라우팅, 정적파일 서빙, 앱 진입점(`main()`) |
+| `db_manager.py` | 3-tier 설정 저장 레이어 — `board_config` 읽기/쓰기는 전부 이곳을 거침 |
+| `config_validator.py` | device/protocol config 검증·정규화 (`None` 제거, 비활성 프로토콜 매핑 처리) |
+| `log_manager.py` | dpworldapp 앱 로그(`/opt/log/dpworldapp`) 목록·다운로드 아카이브·수동/자동 압축·정리·통계, 그리고 5분 자동압축 데몬 |
+| `kernel_log.py` | **(v1.1.0)** 커널 로그 번들 빌더 — systemd 저널을 `journalctl`로 텍스트 export + `/opt/log` 평문 커널 로그(`kernel-follow.log`/`wifi-focus.log`/`boot-history`/`pstore`) 사본 + 매니페스트 → `.tar.gz` 한 파일. journald 디렉터리(`/opt/log/journal/`)는 읽기 전용 (텍스트 export 방식). 시작 시 `sweep_stale_temp_dirs()`로 잔여 임시디렉터리 정리 |
+| `system_status.py` | Home 대시보드용 디바이스 헬스 스냅샷 집계. v1.0.x 기본(core_app·communication·network·system) + **(v1.2.0)** `hardware_modules` (GNSS FW + WiFi FW, `/lib/firmware/amss.bin`의 `QC_IMAGE_VERSION_STRING` 토큰 + dpworldapp 로그의 `[GNSS FW VER : ...]`) + **(v1.2.1)** chunk-boundary 안전 line-iter 스캐너로 교체 (FWVE 16KB tail 누락 버그 fix) + **(v1.3.0)** `dpworldapp_status` (7개 startup phase tracker + 5개 result 상태 [healthy/starting/hung/failed/unknown] + 6개 runtime config 필드 `equipment`·`protocol+endpoint`·`can_input/type/speed`·`speed_data`·`odo_speed.source`·`odo_dir.source`). 모든 신규 필드는 module-level cache + `threading.Lock`로 lazy-load (서비스 재시작 전까지 영구 캐시) |
+| `support_bundle.py` | 진단 zip 생성 (상태 + 마스킹된 config + 최신 로그 + OS 진단) — "빠른 스냅샷" 용도. 전체 커널 저널이 필요하면 `kernel_log.py`의 별도 번들 사용 |
+| `config_validator.py` | device/protocol config 검증·정규화 (`None` 제거, 비활성 프로토콜 매핑 처리) — dpworldapp 가 기대하는 JSON 형식 보장 |
+| `enum_normalizer.py` | enum 값의 case-only 입력 정규화(`"ON"→"on"`). 의미 추측은 의도적 제외 |
+| `dpworldapp_enums.py` | device/protocol enum 허용집합 — 배포 바이너리 검증 계약과 일치. validator 가 reject 판정에 사용 |
+| `dpworldapp_telemetry.py` | **(v1.5.5)** dpworldapp telemetry 스트림(TCP **8989**) 파서 — connect→헤더 frame parse→disconnect 의 stateless query 로 정적 정보(firmware version/MAC/IP) 수집 |
+| `migrations.py` | 기동 시 1회 실행 마이그레이션 — `schema_meta` 테이블로 게이트(`board_config` 경합 회피). CanSpeed Integer 정합 등 |
+
+### 3.1.1 `src/network/` — Network Apply Engine + Wi-Fi AP (v1.6.0~)
+
+웹에서 입력한 네트워크 22항목을 **dpworldapp 파일 계약과 byte-exact 로 렌더**해 즉시 적용·검증·롤백하고, 상시 watchdog 로 자가복구한다. Wi-Fi AP(소프트 AP, ap0) 서브시스템도 같은 패키지에 있다.
+
+| 모듈 | 책임 |
+|------|------|
+| `apply_engine.py` | apply 상태머신(STAGING→APPLYING→VERIFYING→CONFIRM_WAIT→COMMITTED). 단일 in-flight, DB-first 쓰기, confirm TTL(90s) 타이머, 크래시 복구, country split-apply(비country 즉시 / country deferred) |
+| `netmodel.py` | 22항목 집합 — DB `device_config` ↔ intent ↔ persist JSON 매핑 + dpworldapp 네트워크-필드 비교 정합 의미론 |
+| `renderer.py` | intent → dpworldapp byte-호환 파일 렌더(캡처 golden 과 1바이트도 안 틀리게) |
+| `validator.py` | §5.2 hard rule — SSID/PSK 바이트 길이·security·IPv4 등 dpworldapp 파서 한계 위반 차단 |
+| `snapshot.py` | apply 전 백업 + manifest 해시 검증 + 롤백 복원(last-known-good) |
+| `verifier.py` | 사후 검증(존재→carrier→주소·라우트→wpa_state→gateway ping). carrier 없음 = "config staged" WARN |
+| `watchdog.py` | 상시 감시·자가복구(30s 틱, 히스테리시스·cooldown·시간당 한도). 적용본(`network_config.json`) 기준 |
+| `journal.py` | JSONL 네트워크 이벤트 저널(5MB×3 로테이션, psk/password 마스킹) + forensic 번들 |
+| `net_routes.py` | `/api/network/*` 라우트 글루(서버 독립적·dict in/out) |
+| `ap_engine.py` | **Wi-Fi AP** apply 오케스트레이션 — hostapd/udhcpd conf 렌더 + `dpworld-ap-apply.service` 트리거 + 상태 persist. SCC(STA 채널 추종)·marker kill-switch |
+| `ap_model.py` | `ap_config` DB 키 ↔ 정규화 intent (별도 board_config 키, `device_config` 무관) |
+| `ap_renderer.py` | intent → `hostapd-ap0.conf` / `udhcpd-ap0.conf` 렌더(WPA2-PSK) |
+| `ap_validator.py` | AP 필드 hard rule(SSID/PSK/채널/country) |
+| `ap_routes.py` | `/api/network/ap/*` 라우트 글루. status 응답에서 `ap_passphrase` 제거(미인증 API) |
+
+> 상세는 §5 API 표(Network Apply) 및 Wi-Fi AP는 [`wifi-ap-guide.md`](wifi-ap-guide.md) 참조.
+
+### 3.1.2 `src/firmware/` — Firmware OTA (v1.5.0 Phase 4a~)
+
+dpworldapp 의 FW-MMI 채널(TCP **8990**)로 펌웨어 컴포넌트를 staging→flash 하는 OTA 서브시스템. 플래시 전 config 백업, 재부팅 후 복원 검사까지 오케스트레이션한다.
+
+| 모듈 | 책임 |
+|------|------|
+| `fw_controller.py` | 상태머신·8단계 phase stepper(upload·verify·preflight·backup·flash·commit·reboot·config) + 컴포넌트별 진행률. `FirmwareController` 단일 인스턴스, thread-safe |
+| `staging.py` | 업로드 ZIP 추출·컴포넌트 식별(.rom/.img/.ext4/.dtb)·sha256·free-space 확인 |
+| `protocol.py` | dpworldapp FW-MMI 와이어 프로토콜(3바이트 signature + 8바이트 LE size + payload, ACK `SUCCESS`/`FW_FAIL`) |
+| `fw_client.py` | TCP 8990 wire client — 컴포넌트 전송 + ACK 분류 + 진행 콜백 |
+| `config_safety.py` | 플래시 전 `device_config`/`protocol_config` 백업, 재부팅 후 factory-default reseed 감지 → 원자적 복원(단일 BEGIN IMMEDIATE 트랜잭션) |
+| `fw_routes.py` | `/api/firmware/*` 라우트 글루 — 스트리밍 ZIP 업로드(디스크 `/opt` 버퍼, tmpfs 금지) |
+
+> 상세는 [`firmware-ota-guide.md`](firmware-ota-guide.md) 참조.
+
+### 3.2 Frontend (`src/static/js/`)
+
+- **Core**: `app.js`(라우팅·초기화·저장), `api.js`(fetch 래퍼), `state.js`(상태·flat↔nested 변환), `view-mode.js`(**Two Faces** — User 기본 / Advanced 토글, body 클래스로 `.user-only`/`.advanced-only` 구동)
+- **Shared**: `validator.js`, `utils.js`(`escapeHtml`), `toast.js`, `constants.js`(기본값 + `APP_VERSION`), `country-codes.js`(WiFi 국가코드)
+- **`components/`**: `crud-table.js`, `ip-input.js`
+- **`pages/`** (~18개): `home`(Dashboard), `wifi`, `wifi-ap`, `ssid`, `ethernet`, `network`/`server-setting`, `general-settings`, `io`/`sensor-io`, `can`/`can-bus`, `modbus`, `opcua`, `register`, `log`, `firmware`(OTA), `net-apply`(Apply & Status — **Advanced 전용**)
+- **Two Faces (v1.8.0)**: 기본 **User** 보기(운영자용 간소 동선)와 **Advanced** 보기(네트워크 Apply & Status 등 고급 기능)를 토글한다. `net-apply` 같은 Advanced 전용 페이지는 User 모드에서 nav 숨김 + 라우트 가드로 이중 차단
+
+---
+
+## 4. Data Flow
+
+### 4.1 설정 조회 / 저장
+
+```mermaid
+sequenceDiagram
+    participant B as Browser
+    participant P as Python Web Configurator
+    participant D as SQLite DB
+
+    B->>P: GET /setting/get-device
+    P->>D: SELECT device_config, log_config
+    P-->>B: 200 — 두 키를 병합한 단일 JSON
+
+    B->>P: POST /setting/device {JSON}
+    P->>P: 검증 · None 제거 · 로그설정 분리
+    P->>D: device_config 저장 (로그설정 제외)
+    P->>D: log_config 저장 (로그설정 4개)
+    P-->>B: 200 success
+```
+
+> **로그 설정 분리(v1.0.2)**: 클라이언트는 변함없이 하나의 device config를
+> 주고받지만, `server.py`가 저장 시 로그 자동압축/정리 설정 4개를 `log_config`
+> 키로 떼어내고, 조회 시 다시 합쳐서 내려준다. 이유는 §6.3.
+
+### 4.2 로그 자동압축 데몬
+
+`main()`이 백그라운드 데몬 스레드를 띄운다. 5분마다:
+1. `log_config`에서 `log_auto_compress` / `log_auto_cleanup` 확인
+2. 켜져 있으면 — 비활성(active 아님) 로그를 `<로그명>.<mtime>.tar.gz`로 압축,
+   오래된 압축 아카이브를 임계치까지 정리
+
+---
+
+## 5. API Contract
+
+기존 Java 앱과 호환되는 `/setting/*` 엔드포인트 + 신규 `/api/*` 엔드포인트.
+
+| Method | Path | 핸들러 | 용도 |
+|--------|------|--------|------|
+| `GET` | `/setting/get-device` | `_handle_get_device` | device + log config 조회(병합) |
+| `GET` | `/setting/get-protocol` | `_handle_get_protocol` | protocol config 조회 |
+| `GET` | `/setting/log-files` | `_handle_get_log_files` | 로그 파일 목록 |
+| `GET` | `/setting/log-stats` | `_handle_get_log_stats` | 로그 디스크 사용량 통계 |
+| `GET` | `/setting/kernel-bundle` | `_handle_get_kernel_bundle` | **(v1.1.0)** 커널 로그 번들 `.tar.gz` 즉석 생성·스트리밍 (journalctl 텍스트 export + 평문 커널 로그 + boot-history + pstore + manifest) |
+| `GET` | `/api/health` | `_handle_health` | 서버 헬스(uptime·DB 백엔드) |
+| `GET` | `/api/mac` | `_handle_get_mac` | WiFi MAC (장비 식별) |
+| `GET` | `/api/system-status` | `_handle_system_status` | Home 대시보드 종합 상태. 응답: `core_app`·`communication`·`network`·`system` (v1.0.x) + `hardware_modules` (v1.2.0, GNSS FW + WiFi FW) + `dpworldapp_status` (v1.3.0, 7 phases + result + runtime config). 모두 top-level key, 후방 호환 |
+| `GET` | `/api/support-bundle` | `_handle_support_bundle` | 진단 zip 다운로드 |
+| `POST` | `/setting/device` | `_handle_post_device` | device config 저장(로그설정 분리) |
+| `POST` | `/setting/protocol` | `_handle_post_protocol` | protocol config 저장 |
+| `POST` | `/setting/log-download` | `_handle_post_log_download` | 선택 로그 tar.gz 다운로드 |
+| `POST` | `/setting/log-compress` | `_handle_post_log_compress` | 수동 압축 |
+| `POST` | `/setting/log-delete` | `_handle_post_log_delete` | 선택 로그 삭제 |
+| `POST` | `/api/action/test-connections` | `_handle_test_connections` | 설정된 서버 TCP 연결 테스트 |
+| `POST` | `/api/action/restart-dpworldapp` | `_handle_restart_dpworldapp` | dpworldapp 재시작 |
+
+#### Firmware OTA (v1.5.0 Phase 4a) — 상세 [`firmware-ota-guide.md`](firmware-ota-guide.md)
+
+| Method | Path | 용도 |
+|--------|------|------|
+| `GET`  | `/api/firmware/status` | OTA 상태 스냅샷(phase stepper + 컴포넌트 진행률 + slot) |
+| `POST` | `/api/firmware/preflight` | 플래시 전 게이트 체크리스트(staging·여유공간·FW 포트·DB·slot) |
+| `POST` | `/api/firmware/upload` | 펌웨어 ZIP 스트리밍 업로드 → staging(`/opt` 버퍼) |
+| `POST` | `/api/firmware/flash` | staged 컴포넌트 플래시 시작(백그라운드 워커) |
+| `POST` | `/api/firmware/restore-check` | 재부팅 후 config reseed 감지 → 복원 + dpworldapp 재시작 |
+
+#### Network Apply (v1.6.0) — 상세 per-subsystem 가이드
+
+| Method | Path | 용도 |
+|--------|------|------|
+| `GET`  | `/api/network/state` | 현재 적용 상태머신 스냅샷 |
+| `GET`  | `/api/network/drift` | DB ↔ `network_config.json` 22항목 미적용 drift 카운트(경량) |
+| `GET`  | `/api/network/apply/status` (`?id=`) | 특정 apply 진행 상태 |
+| `GET`  | `/api/network/journal` (`?limit=`) | 네트워크 이벤트 저널 tail |
+| `GET`  | `/api/network/config` | watchdog 등 효과적 `net_config` 조회 |
+| `POST` | `/api/network/apply` | 22항목 적용 시작(즉시 적용 + confirm 대기) |
+| `POST` | `/api/network/apply/confirm` | 적용 확정(미확정 시 TTL 만료 → 자동 롤백) |
+| `POST` | `/api/network/rollback` | last-known-good 롤백 |
+| `POST` | `/api/network/config` | watchdog kill-switch 등 `net_config` 쓰기 |
+
+#### Wi-Fi AP (v1.11.x) — 상세 [`wifi-ap-guide.md`](wifi-ap-guide.md)
+
+| Method | Path | 용도 |
+|--------|------|------|
+| `GET`  | `/api/network/ap/status` | AP 라이브 상태(`ap_passphrase` 제거됨) |
+| `POST` | `/api/network/ap/config` | `ap_config` 저장(필드 화이트리스트 merge) |
+| `POST` | `/api/network/ap/apply` | AP bring-up/down 적용(또는 `dry_run`) |
+
+> 네트워크/AP 서브시스템 import 실패 시(예: Windows dev box) 해당 라우트는 503 으로 fail-soft.
+
+`OPTIONS`는 CORS preflight(204). 알 수 없는 `/api/`·`/setting/` 경로는 404(SPA 폴백 마스킹 방지, v1.5.0). 그 외 GET은 SPA 정적파일 폴백.
+
+---
+
+## 6. Database — `board_config` 소유권 ⭐
+
+`~/db/dynamic_data.db`는 **세 프로그램이 공유**한다. 이 절은 **무엇이 누구
+소유인지** 명확히 한다 — 잘못 건드리면 다른 앱의 데이터가 깨진다.
+
+### 6.1 테이블
+
+```sql
+CREATE TABLE board_config (key TEXT PRIMARY KEY NOT NULL, value TEXT NOT NULL);
+CREATE TABLE event_history (id INTEGER PRIMARY KEY AUTOINCREMENT, data TEXT NOT NULL);
+```
+
+- `board_config` — Key-Value 설정 저장소. Python 이 쓰는 키는 **5개**
+  (`db_manager.ALLOWED_KEYS`), 그 외 다른 프로그램 소유 키도 같은 테이블에 공존
+- `event_history` — 이벤트 큐. **dpworldapp이 WRITE**, Web Configurator는 건드리지 않음
+
+### 6.2 `board_config` 키별 소유권 — 우리 / Java / dpworldapp
+
+| key | 쓰기 주체 | 소유 구분 |
+|-----|----------|----------|
+| `device_config` | **Python Web Configurator** + **레거시 Java 앱** | ⚠️ **공유(경합)** |
+| `protocol_config` | **Python Web Configurator** + **레거시 Java 앱** | ⚠️ **공유 계약** |
+| `log_config` | **Python Web Configurator** | 🟦 우리 (**v1.0.2 신설**) |
+| `net_config` | **Python Web Configurator** | 🟦 우리 (**v1.6.0** — watchdog 등 Network Apply 설정) |
+| `ap_config` | **Python Web Configurator** | 🟦 우리 (**v1.11.x** — Wi-Fi AP 설정) |
+| `security_config` | **Super_Relay 프로젝트** | 🟧 타 프로젝트 |
+| `transport_config` | **Super_Relay 프로젝트** | 🟧 타 프로젝트 |
+
+- 🟦 **우리(Python Web Configurator)가 쓰는 것** — Python의 `db_manager.ALLOWED_KEYS`는
+  `{device_config, protocol_config, log_config, net_config, ap_config}` (**5개**). Python 은
+  이 5개만 쓴다. `device_config`·`protocol_config`는 dpworldapp/Java 와의 **공유 계약**
+  (Java schema 그대로 — [board_config 키 ownership 정책]), `log_config`·`net_config`·`ap_config`는
+  **Python 전용**(Java/dpworldapp 가 읽지 않음). Python 전용 키를 별도로 둔 이유는 §6.3.
+- 🟧 **다른 프로젝트(Super_Relay)가 쓰는 것** — `security_config`, `transport_config`.
+  사용자의 별도 프로젝트 **Super_Relay** (`c:/Development/Super_Relay`)가 자체
+  `config_bridge.py`로 같은 `board_config` 테이블에 기록한다 — 릴레이 전송 설정
+  (`transport_config`: `relay_enabled`/`type`/`base_url`; `security_config`:
+  Bearer 인증 토큰). NEW Web Configurator는 이 두 키를 읽지도 쓰지도 않으며,
+  레거시 Java 앱과도 무관하다. (2026-05-22 검증: DB의 JSON 내용 +
+  Super_Relay 프로젝트 grep으로 확인.)
+- `event_history` — **dpworldapp** 소유.
+
+### 6.3 ⚠️ `device_config`는 공유 행 — 그래서 `log_config`가 생겼다
+
+`device_config`는 Python Web Configurator와 레거시 Java 앱이 **둘 다 쓴다**.
+Java 앱이 자기 데이터 모델로 `device_config`를 저장하면 **Java가 모르는
+Python 전용 필드가 통째로 사라진다.**
+
+이 때문에 로그 자동압축/정리 설정(`log_auto_compress`, `log_auto_cleanup`,
+`log_cleanup_max_files`, `log_cleanup_max_size_mb`)이 실제로 날아갔고
+자동압축 데몬이 조용히 멈췄다. **해결(v1.0.2)**: 이 4개를 Java가 안 건드리는
+별도 `log_config` 키로 분리. board_config 키 소유권은 `db_manager.ALLOWED_KEYS`를 참고.
+
+> **원칙**: 앞으로 추가하는 **Python 전용 설정은 `device_config`/`protocol_config`에
+> 넣지 말 것.** Java/dpworldapp 가 덮어쓴다. 별도 키를 만들고 `db_manager.ALLOWED_KEYS`에
+> 등록한다 — `log_config`(v1.0.2)·`net_config`(v1.6.0)·`ap_config`(v1.11.x)가 이 패턴이다.
+
+### 6.4 db_manager 3-tier 백엔드
+
+`db_manager.py`는 환경에 따라 백엔드를 자동 선택한다: ① Python `sqlite3`
+모듈(기본), ② `sqlite3` CLI(subprocess), ③ JSON 파일 폴백(임시용). `save_config`은
+"database is locked" 시 신선한 커넥션으로 재시도한다(v1.0.1).
+
+---
+
+## 7. Directory Structure
+
+```
+NEW_Web_Configurator/
+├── src/                      ← 애플리케이션 (배포 단위)
+│   ├── server.py             ← 진입점, HTTP 서버
+│   ├── db_manager.py         ← SQLite 3-tier 접근
+│   ├── config_validator.py   ← 서버 검증
+│   ├── enum_normalizer.py    ← enum case-only 정규화
+│   ├── dpworldapp_enums.py   ← enum 허용집합 (device 계약)
+│   ├── dpworldapp_telemetry.py ← TCP 8989 telemetry 파서
+│   ├── migrations.py         ← 기동 시 1회 마이그레이션
+│   ├── log_manager.py        ← 로그 관리 + 자동압축 데몬
+│   ├── kernel_log.py         ← 커널 로그 번들
+│   ├── system_status.py      ← 대시보드 상태 집계
+│   ├── support_bundle.py     ← 진단 zip
+│   ├── network/              ← Network Apply Engine + Wi-Fi AP
+│   │     ├── apply_engine·netmodel·renderer·validator
+│   │     ├── snapshot·verifier·watchdog·journal·net_routes
+│   │     └── ap_engine·ap_model·ap_renderer·ap_validator·ap_routes
+│   ├── firmware/             ← Firmware OTA (TCP 8990)
+│   │     └── fw_controller·fw_client·protocol·staging·config_safety·fw_routes
+│   └── static/
+│       ├── index.html
+│       ├── css/style.css
+│       ├── img/dp-world-logo.svg
+│       └── js/   app·api·state·view-mode·validator·utils·toast·constants·country-codes
+│             ├── components/ crud-table·ip-input
+│             └── pages/      home·wifi·wifi-ap·ssid·ethernet·io·can·modbus·
+│                             opcua·register·log·firmware·net-apply· … (~18)
+├── deploy/                   ← systemd 유닛 + AP/network apply 셸 스크립트
+├── tests/                    ← pytest(~1557) + node/jsdom(~392) 스위트
+├── scripts/deploy.ps1        ← 버전 태그 기반 디바이스 배포 스크립트
+├── docs/                     ← 문서 (본 문서, wifi-ap-guide, firmware-ota-guide, specs/, …)
+├── CHANGELOG.md  README.md  .gitignore
+```
+
+> 디바이스 배포 위치: `/opt/web-configurator/src/` (systemd가 구동, port 9090).
+> `deploy/`의 systemd 유닛·셸 스크립트는 rootfs `/lib/systemd` 등에 설치되며 **flash 마다 wipe**
+> 된다(§10 caveat, [`wifi-ap-guide.md`](wifi-ap-guide.md) 참조).
+
+---
+
+## 8. Versioning & Deployment
+
+- **버전 체계**: `vMAJOR.MINOR.PATCH` 시맨틱 버전. 단일 소스 = `APP_VERSION`
+  (`src/static/js/constants.js`), 사이드바 표시. 현재 **v1.11.10**.
+- **릴리스**: `APP_VERSION` 갱신 → `CHANGELOG.md` 항목 → 커밋 → `git tag vX.Y.Z`.
+- **배포**: `scripts/deploy.ps1 <device-ip>` — 버전 태그 검사 → `src/` 아카이브
+  전송 → 장비 백업 → 스왑 → `DEPLOYED_VERSION` 기록 → systemd 재시작 → 검증.
+  절차·롤백 상세는 [`DEPLOY.md`](DEPLOY.md).
+
+---
+
+## 9. 기술 제약사항
+
+| 항목 | 제약 | 대응 |
+|------|------|------|
+| Python | stdlib만 (pip 없음) | `http.server`·`sqlite3`·`json`·`tarfile` 등 |
+| 메모리 | 목표 경량 | 레거시 Java ~436MB → Python ~15–30MB |
+| 빌드 도구 | Node/npm 없음 | Vanilla ES-module JS (빌드 불필요) |
+| 공유 DB | Java 앱·dpworldapp과 SQLite 공유 | §6 소유권 규칙 준수, 별도 키 분리 |
+| 디바이스 구동 | systemd `web-configurator.service` :9090 | `DEPLOY.md` 참고 |
+
+---
+
+## 10. 보안 고려사항
+
+| 현재 상태 | 비고 |
+|-----------|------|
+| **인증 없음** | HTTP API(:9090)는 현재 **완전 미인증** — 17개 mutation endpoint + wildcard CORS. 이것이 **문서화된 threat boundary**(폐쇄 LAN 단일 운영자 전제). 운영자 로그인은 설계 완료·구현 백로그 상태. |
+| CORS 전체 허용 | 의도된 설계 (IoT LAN 전용) |
+| HTTP only | TLS 미구현. 운영자 로그인 spec 의 known-limitation(평문) 참조 |
+| SQL Injection | `db_manager`가 키 화이트리스트(`ALLOWED_KEYS`)로 방어 |
+| XSS | 출력은 `escapeHtml` 경유 |
+| Support bundle | config 내 WiFi 비밀번호 마스킹 후 포함 |
+| API 응답 마스킹 | AP `status`/`apply(dry_run)` 응답에서 `ap_passphrase` 제거. `/api/health` 는 db path/pid 미노출 |
+| Wi-Fi AP 접근 게이트 | v1.11.7 이후 AP INPUT 전면 개방(SSH 포함) — **WPA2 PSK 가 게이트**. FORWARD 차단으로 PLC/업링크 격리([`wifi-ap-guide.md`](wifi-ap-guide.md)) |
+
+> **이전 메커니즘 제거됨**: 과거 문서가 언급하던 systemd `WEB_AUTH_USER/PASS`(옵션 Basic 인증)
+> 및 `WEB_SSL_CERT/KEY`(옵션 HTTPS) 환경변수 인증은 **현재 코드/유닛에 존재하지 않는다**.
+> 인증 방향은 위의 operator-login 설계로 대체되었다(아직 미구현).
+
+---
+
+## 11. 변경 이력
+
+| 일자 | 버전 | 변경 |
+|------|------|------|
+| 2026-02-12 | doc v1.0 | 초기 작성 |
+| 2026-02-19 | doc v1.1 | 디렉터리·보안·건강상태 섹션 |
+| 2026-05-22 | doc v2.0 | 앱 v1.0.2 기준 전면 갱신 — 실제 배포 구조(systemd :9090), 6개 백엔드 모듈·9개 페이지, 전체 API 라우트, §6 board_config 소유권(우리/Java/Super_Relay/dpworldapp 구분), `log_config` 분리, 버전관리·배포 섹션 |
+| 2026-05-26 | doc v2.1 | 앱 v1.1.0 — Kernel Log Bundle 기능 — 신규 모듈 `kernel_log.py` (§3.1), 신규 엔드포인트 `GET /setting/kernel-bundle` (§5). `/opt/log/journal/`은 journald 소유로 읽기 전용 처리(텍스트 export). 임시작업 디렉터리는 `/opt` 디스크에 (메모리 제약 장비에서 `/tmp` tmpfs 회피). DB 스키마·소유권 변경 없음 |
+| 2026-05-28 | **doc v2.2** | **앱 v1.2.0 → v1.2.1 → v1.3.0 누적 반영**. v1.2.0 Hardware Modules 카드 — Home 대시보드에 GNSS·WiFi 펌웨어 버전 표시 (`amss.bin` `QC_IMAGE_VERSION_STRING` 추출 + dpworldapp 로그 `[GNSS FW VER]` 스캔), `/api/system-status`에 `hardware_modules` 키 추가. v1.2.1 scanner 견고화 — 64KB chunk-boundary silent miss + 10MB cap 두 결함을 line-iter 기반으로 일괄 해결, locale-independent ISO date 파싱. v1.3.0 dpworldapp Status Tracker — 7 startup phase (FRAM→Steady) + 5 result 상태 + 6 runtime config 필드, `/api/system-status`에 `dpworldapp_status` 키 추가. 모두 module-level cache + `threading.Lock`. §3.1 `system_status.py` 책임 갱신, §5 payload key 목록 갱신. DB 스키마·소유권 변경 없음 |
+| 2026-06-20 | **doc v3.0** | **앱 v1.11.10 전면 동기화** (v1.4~v1.11 누적). 신규 백엔드 서브시스템 2종 — `src/network/`(Network Apply Engine v1.6.0 + Wi-Fi AP v1.11.x)·`src/firmware/`(Firmware OTA v1.5.0 Phase 4a) 및 신규 `src/*.py`(enum_normalizer·dpworldapp_enums·dpworldapp_telemetry·migrations) §3.1 추가. §5 API 표에 firmware/network/AP 엔드포인트 추가. §6 `ALLOWED_KEYS` 5키로 정정(`net_config`·`ap_config` Python 전용). §3.2 프론트 ~18 페이지 + Two Faces(User/Advanced). §7 디렉터리 트리 갱신. §10 보안 — 제거된 `WEB_AUTH_USER/PASS`/`WEB_SSL` 언급 삭제, API 미인증=문서화된 threat boundary 명시 + operator-login 설계(백로그) 링크. 신규 가이드 [`wifi-ap-guide.md`]·[`firmware-ota-guide.md`] 분리 |
+
+> 관련 문서: [`DEPLOY.md`](DEPLOY.md) (배포·버전 런북) ·
+> [`CHANGELOG.md`](../CHANGELOG.md) (릴리스 변경 이력)
diff --git a/docs/architecture/v1.5.4.2-system-overview.md b/docs/architecture/v1.5.4.2-system-overview.md
new file mode 100644
index 0000000..f38bb1b
--- /dev/null
+++ b/docs/architecture/v1.5.4.2-system-overview.md
@@ -0,0 +1,850 @@
+# NEW Web Configurator v1.5.4.2 — 시스템 아키텍처
+
+**문서 버전**: 1.0
+**앱 버전**: v1.5.4.2 (SHA `fe5cd25`, 태그 `v1.5.4.2`)
+**브랜치**: `feature/v1.5-ia-redesign` (origin 푸시 완료)
+**작성일**: 2026-06-08
+**상태**: dev/verify 환경 .54 (192.168.55.54), 운영 .56은 v1.4.6.10 유지
+**상위 문서**: `docs/architecture.md` (v2.2, v1.3.0 시대까지 커버) — 이 문서가 해당 문서를 대체함
+
+---
+
+## 1. 요약
+
+**NEW Web Configurator**는 Telechips TCC8030 IoT 디바이스를 위한 브라우저 기반 설정 도구다. **Python stdlib(표준 라이브러리) 전용 HTTP 서버** (pip 없음, 프레임워크 없음)와 **바닐라 ES 모듈 SPA** (빌드 단계 없음, 번들러 없음)로 구성된다. 기존 Java/Spring Boot 기반 설정 도구를 대체한 것으로, 해당 도구는 TCC8030의 700 MHz ARM에서 메모리를 436 MB 이상 점유했다 — 각 백그라운드 서비스에 48 MB MemoryMax 예산이 배정된 디바이스에서. Python 프로세스는 RSS 기준 10–30 MB 수준으로 동작한다.
+
+핵심 설계 원칙:
+
+1. **LAN 전용 IoT 환경** — 외부 노출 없음, 인증 없음. 모든 클라이언트는 192.168.55.x (디바이스 LAN 세그먼트) 내부에 있다. CORS는 설계상 전체 개방.
+2. **SQLite 공유 소유권** — 세 개의 독립 프로그램(이 서비스, 레거시 Java app-runner, `dpworldapp` 데이터 처리 바이너리)이 동일한 `~/db/dynamic_data.db`를 읽고 쓴다. 키 수준 소유권 정책(`board_config_key_ownership_policy`)이 주된 안전 메커니즘이다.
+3. **config-reader 계약 준수** — `device_config`와 `protocol_config`는 디바이스 config-reader 계약과 정확히 일치해야 한다. 이를 통해 레거시 Java 앱이 .56에서 읽고 쓰는 동작이 예기치 않게 깨지지 않도록 보장한다. 자동화된 드리프트 감지가 이를 강제한다.
+4. **Partial-merge(부분 병합)만 허용** — 전체 행 REPLACE 없음. `DBManager.update_config` (BEGIN IMMEDIATE RMW)가 모든 POST에서 미설정 키를 보존하도록 보장한다.
+5. **v1.5.x IA 재설계** — 사이드바 중첩 5그룹 네비게이션, Firmware OTA 실제 통합, Lucide SVG 아이콘, Inter/JetBrains Mono 셀프 호스팅 폰트, gzip + ETag/304 성능 최적화, behavioral(jsdom) 테스트 인프라.
+
+---
+
+## 2. 하드웨어 컨텍스트 (Telechips TCC8030)
+
+| 항목 | 값 |
+|---|---|
+| CPU | 700 MHz ARM (싱글코어 주, 멀티코어 가능) |
+| OS | Yocto/Poky 4.0.17 (`uname -r`: Telechips) |
+| 펌웨어 업데이트 | A/B 파티션 슬롯 (`slot A` / `slot B`, dpw-fw-update-tool 경유) |
+| 영속 파티션 | `/home/root/db` (mmcblk0p11) — SQLite DB; `/opt/log` (mmcblk0p12) — dpworldapp 로그 |
+| 임시 파티션 | `/tmp` — tmpfs, 서비스별 격리 슬라이스 PrivateTmp=yes |
+| `/etc/systemd/system` | **tmpfs** — 여기에 작성된 유닛 파일은 **재부팅 시 소실됨** |
+| systemd 유닛 위치 | `/lib/systemd/system/web-configurator.service` (영속, v1.5.2 H17 수정) |
+| MemoryMax | 48 MB (서비스 유닛에 설정) |
+| Web Configurator 포트 | **9090** (직접 연결, 앞단 nginx 없음) |
+| Java app-runner 포트 | **8080** (.56에서 nginx :80 → Java :8080) |
+| WiFi 칩셋 | Qualcomm QCA6490 (PCI 17CB:1103, 드라이버 cnss_pci) |
+| 펌웨어 바이너리 | `/lib/firmware/amss.bin` (WiFi FW 버전은 `QC_IMAGE_VERSION_STRING=`으로 추출) |
+| dpworldapp 바이너리 | `/usr/bin/dpworldapp` — CAN/Modbus/OPC-UA 데이터 처리기 |
+| GNSS | u-blox GPS (버전은 dpworldapp 로그 `[GNSS FW VER : ...]`에서 확인) |
+| 앱 로그 경로 | `/opt/log/dpworldapp/dpworldapp_YYYY-MM-DD.log` |
+
+**tmpfs 인시던트** (2026-05-29): Poky 4.0.17에서 `/etc/systemd/system/`은 tmpfs다. v1.4.0 배포 시 유닛을 `/etc/`에 작성했고, 다음 재부팅 전까지는 유지되었다. v1.5.2 H17에서 deploy.ps1이 `/lib/systemd/system/`(영속)에 쓰도록 수정했다.
+
+**ReadWritePaths**: systemd 유닛은 `ProtectSystem=strict`를 사용한다. 서비스가 쓰기 접근해야 하는 경로는 `ReadWritePaths`에 명시적으로 나열해야 한다:
+- `/opt/log/dpworldapp` — 로그 다운로드 임시 부모 경로 (v1.4.6.6에서 `/tmp`로 수정)
+- `/opt/fw_staging` — 펌웨어 스테이징 디렉토리 (v1.5.2 C1)
+- `/opt/config_backups` — 플래시 전 설정 백업 (v1.5.2 C1)
+- `/home/root/db` — SQLite DB 경로
+
+---
+
+## 3. 기술 스택
+
+### 백엔드
+
+| 컴포넌트 | 기술 |
+|---|---|
+| HTTP 서버 | Python 3.10+ `http.server.BaseHTTPRequestHandler` + `socketserver.ThreadingMixIn` |
+| 데이터베이스 | `sqlite3` stdlib |
+| 압축 | `gzip` stdlib (응답 압축) |
+| 설정 | `os.environ` + 상수 |
+| 의존성 | **Python stdlib 전용** (pip 없음, 서드파티 패키지 없음) |
+| 진입점 | `src/server.py:main()` |
+
+### 프론트엔드
+
+| 컴포넌트 | 기술 |
+|---|---|
+| JS 모듈 시스템 | 바닐라 ES 모듈 (`type="module"`, 번들러 없음) |
+| 아이콘 | Lucide v0.460+ SVG 인라인 (`src/static/js/icons.js`, 49개 항목) |
+| 타이포그래피 | Inter (5 웨이트) + JetBrains Mono (2 웨이트) — `.woff2` 셀프 호스팅 (`src/static/fonts/`) |
+| 스타일시트 | 단일 `src/static/css/style.css` (~3000줄 이상) |
+| XSS 이스케이프 | `src/static/js/utils.js`의 `escapeHtml` (5문자 명시 치환: `& < > " '`) |
+
+### 테스트
+
+| 컴포넌트 | 기술 |
+|---|---|
+| Python 테스트 | `pytest` (v1.5.4.2 기준 644개 테스트) |
+| JS behavioral 테스트 | Node 18+ `node:test` + `jsdom` (4개 `.mjs` 파일에 35개 테스트) |
+| 듀얼 러너 | `python -m pytest` + `npm test` |
+| 디바이스 배포 격리 | `deploy.ps1`이 `git archive HEAD src` 사용 — tests/node_modules/package.json은 배포 대상 아님 |
+
+### 배포
+
+- PowerShell `scripts/deploy.ps1` — git archive → scp → tar → atomic mv → systemctl restart
+- 헬스 체크 + 실패 시 자동 롤백 (v1.5.2 H18)
+- `/lib/systemd/system/` 유닛 설치 (v1.5.2 H17 영속화)
+
+---
+
+## 4. 프로세스 모델
+
+```
+systemd web-configurator.service
+    └── Python process (server.py main())
+          ├── ThreadedHTTPServer (ThreadingMixIn + HTTPServer)
+          │     └── ConfigHandler per thread (BaseHTTPRequestHandler)
+          ├── Log auto-compress daemon thread (5-min interval)
+          └── _recover_staging background daemon thread (firmware, v1.5.2 M10/M15)
+```
+
+- `socket.setdefaulttimeout(30.0)` — 글로벌 slowloris 방어 (v1.5.1 H4).
+  비활성 상태 30초 후 모든 연결이 타임아웃된다.
+- `/api/firmware/upload` 라우트는 대용량 펌웨어 파일 업로드 완료를 허용하기 위해 연결별로 `connection.timeout = None`으로 재설정한다 (v1.5.2 H20).
+- `ThreadedHTTPServer.timeout = 30.0` — 서버 수준 accept 타임아웃.
+- 서버 프로세스당 `DBManager` 인스턴스 하나 (`server.py:89`의 모듈 수준 `db = DBManager()`). 각 public 메서드는 SQLite 연결을 건드리기 전에 `self._lock` (threading.Lock)을 획득한다.
+
+---
+
+## 5. 데이터 레이어
+
+### 데이터베이스 파일
+
+```
+/home/root/db/dynamic_data.db   (mmcblk0p11, 영속 파티션)
+```
+
+### 테이블
+
+| 테이블 | 소유자 | 목적 |
+|---|---|---|
+| `board_config` | 공유 (Python + Java + dpworldapp + Super_Relay) | 키-값 설정 저장소 |
+| `event_history` | dpworldapp | 이벤트 큐 — Web Configurator는 쓰기 안 함 |
+| `schema_meta` | Python Web Configurator | 마이그레이션 플래그 (멱등 시작) |
+| `sqlite_sequence` | SQLite 내부 | AUTOINCREMENT 추적 |
+| `board_config_audit` | Python Web Configurator | 설정 변경 감사 로그 |
+
+### board_config 키 — 소유권
+
+| 키 | 소유자 | Java 접근 여부 | dpworldapp 읽기 여부 | 비고 |
+|---|---|---|---|---|
+| `device_config` | Python + Java **공유** | 예, 전체 행 REPLACE | 예 | device config-reader 계약 적용 — 37개 필드 |
+| `protocol_config` | Python 주 | 예 (.56 구버전) | 예 | device register-mapping 계약 — ~21개 필드 |
+| `log_config` | Python 전용 | 아니오 | 아니오 | Web Configurator 로그 관리 — v1.0.2 |
+| `security_config` | Super_Relay 프로젝트 | 아니오 | 아니오 | 외부 프로젝트 — 건드리지 말 것 |
+| `transport_config` | Super_Relay 프로젝트 | 아니오 | 아니오 | 외부 프로젝트 — 건드리지 말 것 |
+
+**핵심 원칙**: Python 전용 설정은 반드시 별도 키에 넣어야 한다(`device_config`/`protocol_config` 금지). Java의 전체 행 REPLACE가 모든 Java POST 시 Python 전용 필드를 조용히 삭제하기 때문이다.
+
+### DBManager 백엔드 (db_manager.py)
+
+우선순위 체인:
+1. `python` — `sqlite3` stdlib 모듈 (권장; 운영 환경에서 사용)
+2. `cli` — subprocess 경유 `sqlite3` CLI (import 실패 시 폴백)
+3. `json` — JSON 파일 폴백 (테스트/긴급 용도만; dpworldapp 호환 없음)
+
+**Atomic RMW** (`db_manager.py:226` `update_config`):
+- `python` 백엔드: 단일 연결 내에서 `BEGIN IMMEDIATE` + SELECT + `INSERT OR REPLACE` + COMMIT 수행. 동시 쓰기 차단. 지수 백오프로 잠금 재시도 (3회, 100 ms 기본).
+- `cli` + `json` 백엔드: `self._lock`으로 직렬화.
+- 결과: N개 동시 스레드 간 업데이트 유실 없음 (10스레드 + 20스레드 동시 증분 테스트 통과 확인 — `tests/test_v1_5_3_multi_instance.py`).
+
+### 마이그레이션 (src/migrations.py)
+
+시작 시 `apply_all_migrations(db)` (`server.py:728`)를 통해 적용됨.
+Fail-soft: `(OperationalError, DatabaseError, JSONDecodeError, ValueError)` 예외를 잡아서 처리.
+
+| 마이그레이션 | schema_meta 키 | 수행 내용 |
+|---|---|---|
+| `migrate_can_baudrate_units` | `can_baudrate_units_v2` | 구 baudrate 값 2500/5000/10000 → 250/500/1000으로 재매핑 |
+| `migrate_log_compress_split` | `log_compress_split_v1` | `log_compress_size_mb`/`log_compress_age_days`를 `device_config` → `log_config`로 이동 |
+| `migrate_port_types` | `port_types_int_v1` | 문자열 타입 서버 포트를 Integer로 정규화 |
+
+---
+
+## 6. 요청 라우팅 (server.py)
+
+### do_GET 라우트
+
+| 경로 | 핸들러 | 설명 |
+|---|---|---|
+| `/setting/get-device` | `_handle_get_device` | `device_config`와 `log_config` 병합 반환 (log 필드 삽입) |
+| `/setting/get-protocol` | `_handle_get_protocol` | `protocol_config` 반환 |
+| `/setting/log-files` | `_handle_get_log_files` | dpworldapp 로그 파일 목록 |
+| `/setting/kernel-bundle` | `_handle_get_kernel_bundle` | journalctl + 커널 로그 `.tar.gz` (v1.1.0) |
+| `/setting/log-stats` | `_handle_get_log_stats` | 로그 디스크 사용량 통계 |
+| `/api/mac` | `_handle_get_mac` | WiFi MAC 주소 (디바이스 식별) |
+| `/api/health` | `_handle_health` | 서버 헬스 (uptime, DB 백엔드) |
+| `/api/system-status` | `_handle_system_status` | 홈 대시보드: core_app / communication / network / system / hardware_modules / dpworldapp_status |
+| `/api/support-bundle` | `_handle_support_bundle` | 진단 ZIP 다운로드 |
+| `/api/firmware/status` | `_FW.status()` | Firmware OTA 상태 스냅샷 (v1.5.0 P4a) |
+| 정적 파일 | `_serve_static_file` | Realpath 경로 순회 방어 + gzip + ETag + Cache-Control |
+
+### do_POST 라우트
+
+| 경로 | 핸들러 | 설명 |
+|---|---|---|
+| `/setting/device` | `_handle_post_device` | device config partial-merge (atomic RMW) |
+| `/setting/protocol` | `_handle_post_protocol` | protocol config partial-merge + `process_protocol_config` |
+| `/setting/log-download` | `_handle_post_log_download` | 선택한 로그 파일 → `.tar.gz` |
+| `/api/test-connections` | `_handle_test_connections` | 설정된 서버 엔드포인트 TCP 프로브 |
+| `/api/restart-dpworldapp` | `_handle_restart_dpworldapp` | `systemctl restart dpworldapp` |
+| `/api/firmware/upload` | `_FW.upload()` | 펌웨어 ZIP을 스테이징 디렉토리로 스트리밍 |
+| `/api/firmware/preflight` | `_FW.preflight()` | 플래시 전 사전 점검 |
+| `/api/firmware/flash` | `_FW.flash()` | 8단계 OTA 플래시 실행 |
+| `/api/firmware/restore-check` | `_FW.restore_check()` | 재부팅 후 설정 무결성 검사 |
+
+### 라우팅 가드
+
+- `/setting/` 접두사: 알 수 없는 경로 → 404 (SPA로 폴스루 없음)
+- `/api/` 접두사: 알 수 없는 경로 → 404 (v1.5.0.1 수정, `server.py` do_GET)
+- 정적 파일: `os.realpath()` + 접두사 검사 (경로 순회 차단, `server.py:237-239`)
+- SPA 폴백: 나머지 모든 GET 경로에 `index.html` 반환
+
+### 정적 파일 서빙 (v1.5.4)
+
+```python
+# server.py:224 _serve_static_file()
+
+ETag = W/"mtime-size"              # weak ETag (저비용, 해시 없음)
+If-None-Match == ETag → 304        # 0바이트 body
+
+Cache-Control:
+  text/html     → no-cache, must-revalidate
+  JS/CSS        → no-cache, must-revalidate   (v1.5.4.2 H1+M2: 즉시 배포 전파)
+  font/image    → public, max-age=86400
+
+gzip:
+  Accept-Encoding q값 파싱 (v1.5.4.2 L1)
+  압축 대상: text/*, application/javascript, application/json, image/svg+xml
+  제외: .woff2, 이미지, 256바이트 미만
+  레벨: 6, Vary: Accept-Encoding 헤더 추가
+```
+
+Body 크기 제한: `MAX_BODY_SIZE = 1 MB` (펌웨어 업로드는 예외 — 소켓 타임아웃 None).
+
+---
+
+## 7. 프론트엔드 아키텍처 (v1.5.0 IA 재설계)
+
+### 진입점
+
+`src/static/index.html` — lang="en", title="IoT Web Configurator", 9개 `modulepreload` 힌트
+(app / state / api / utils / icons / constants / page-dirty / nav-guard / home).
+
+### 사이드바 레이아웃 (5그룹, 11개 활성 리프)
+
+```
+sidebar (aside[role=navigation])
+├── Dashboard
+│   └── home
+├── Network
+│   ├── wifi          (Wi-Fi SSID + 연결 + 지역)
+│   ├── ethernet      (이더넷 IP + LTE 인터페이스)
+│   └── server-setting (TIOT/Update/RTCM/LTE 서버 엔드포인트)
+├── Interface & Protocol
+│   ├── general-settings  (Equipment + Protocol 선택 + Odometer)
+│   ├── sensor-io         (RS485 + Analog/Digital 포트)
+│   ├── can-bus           (CAN 설정 + 프레임 매핑)
+│   ├── opcua             (OPC UA 엔드포인트 + 필드 매핑)
+│   └── modbus            (Modbus 엔드포인트 + 바이트 순서 + 필드 매핑)
+├── Log
+│   └── log               (3탭: Configuration / Files / Kernel)
+└── Firmware
+    └── firmware          (8단계 OTA 스테퍼)
+```
+
+그룹 펼침 상태는 `localStorage("wc.sidebar.groups")`에 유지된다.
+
+`app.js PAGES`에 레거시 별칭 보존 (구 북마크 하위 호환):
+- `ssid` → `wifi`
+- `io` → `ethernet`
+- `network` → `server-setting`
+- `register` → `general` (= `general-settings` 페이지)
+- `can` → `can-bus`
+
+### 페이지 객체 패턴
+
+모든 페이지 모듈은 기본 페이지 객체를 export한다:
+
+```js
+export default {
+    render(container) { ... },   // HTML을 container에 주입
+    mount(container)  { ... },   // 이벤트 리스너 연결, collector 등록
+    destroy()         { ... },   // 리스너 정리 (선택)
+    validate()        { ... },   // 클라이언트 측 유효성 검사 (선택)
+}
+```
+
+구현 대상: `app.js`, `state.js`, 11개 리프 페이지 전체.
+
+### 상태 관리 (state.js)
+
+- `state.device` — 평탄화된 device config 객체 (JS 인메모리)
+- `state.protocol` — 평탄화된 protocol config 객체
+- `state.pageDirty` — 페이지별 dirty 매트릭스 (10개 항목):
+  `{home, wifi, ethernet, server-setting, general, sensor-io, can-bus, opcua, modbus, log, firmware: false}`
+- `state.isDirty` — 불리언 하위 호환 별칭 (모든 pageDirty 값의 OR)
+- `convertFlatToNested(flat)` / `convertNestedToFlat(nested)` — 레거시 앱의 평탄화 표현과 일치하는 중첩 ↔ 평탄 키 변환
+
+### Page Dirty + Nav Guard
+
+`src/static/js/page-dirty.js`:
+- `markDirty(pageId)` / `clearDirty(pageId)` / `hasDirty()` / `getDirtyPages()` / `clearAllDirty()`
+- 사이드바 점 (`.nav-item__dirty`)은 모든 호출 시 자동 동기화.
+
+`src/static/js/nav-guard.js`:
+- `confirmNavigation(currentPageId)` → Promise 모달 (Save / Discard / Cancel)
+- 포커스 트랩 (모달 내부 Tab/Shift+Tab 순환) — v1.5.2 H12 + H13
+- Esc 키 = Cancel
+- 닫을 때 트리거 포커스 복원 (WCAG 2.4.3) — v1.5.2 H13
+
+### 아이콘 (icons.js)
+
+- 49개 Lucide v0.460+ SVG body 문자열 (ISC 라이선스)
+- `icon(name, opts)` 헬퍼: `opts.cls` (클래스, `<>"'` 제거), `opts.aria` (aria-label, `escapeAttr`)
+- `escapeAttr`는 모듈 수준에서 정의 (성능 최적화, 호출별 생성 아님)
+- 모든 아이콘에 `role="img"` + `<title>` 적용 (WCAG 4.1.2)
+- 장식용 아이콘에는 `aria-hidden="true"` 적용
+
+### 보안 (프론트엔드)
+
+- `utils.js`의 `escapeHtml`: `& → &amp;` / `< → &lt;` / `> → &gt;` / `" → &quot;` / `' → &#39;`
+  — 5문자 명시 치환 (v1.5.2 H1 루트 XSS 수정)
+- 운영자 입력값(레지스터 테이블, odometer 필드, import 데이터) 모두 DOM 삽입 전 `escapeHtml` 통과 — v1.4.6.2 F1 + C5 + C6
+- icons.js `icon()`의 cls/aria: `escapeAttr`로 `<>"'` 제거
+- nav-guard.js `_escape`는 `escapeHtml`을 미러링
+- DEBUG console.log: `state.device` 내용 마스킹 (값 대신 키만 표시) — v1.4.6.9 M6
+
+---
+
+## 8. Firmware OTA (v1.5.0 Phase 4a + v1.5.2 하드닝)
+
+### 소스
+
+`C:\Users\F1304\Downloads\dpw-fw-update-tool\webconfig_fw\`에서 `MERGE.md` + `DESIGN.md` (2026-06-06)에 따라 병합.
+
+### 백엔드 패키지 (`src/firmware/`)
+
+| 모듈 | 라인 수 | 역할 |
+|---|---|---|
+| `fw_client.py` | ~110 | dpw-fw-update-tool 데몬용 Wire 클라이언트 (host:port) |
+| `staging.py` | ~47 | ZIP 스테이징: 압축 해제, 유효성 검사, 슬롯 감지 |
+| `config_safety.py` | ~172 | 플래시 전 설정 백업, 재부팅 후 복원 검증 |
+| `protocol.py` | ~64 | Wire 프로토콜 저수준 프레이밍 |
+| `fw_controller.py` | ~480 | 상태 기반 OTA 오케스트레이션, 상태 스키마, 컴포넌트별 진행 바, 재부팅 watchdog |
+| `fw_routes.py` | ~110 | 전송 계층 독립적 HTTP 라우트 핸들러, `RouteError` 예외 타입 |
+
+`server.py:94`에서 초기화:
+```python
+_FW = FirmwareRoutes(FirmwareController(
+    fw_host=os.environ.get("FW_HOST", "127.0.0.1"),
+    fw_port=int(os.environ.get("FW_PORT", "8990")),
+    staging_dir=os.environ.get("FW_STAGING_DIR", "/opt/fw_staging"),
+    backups_dir=os.environ.get("FW_BACKUPS_DIR", "/opt/config_backups"),
+    db_path=DB_PATH,
+))
+```
+
+### 8단계 스테퍼
+
+```
+Upload → Verify → Pre-flight → Backup → Flash → Commit → Reboot → Config check
+```
+
+### 상태 스키마 (UI의 단일 진실 공급원)
+
+```json
+{
+  "state": "idle|staged|flashing|rebooting|verifying|done|failed",
+  "phases": [{ "key", "label", "state": "pending|active|done|error", "tier", "detail" }],
+  "components": [{ "role", "signature", "name", "size", "sha256",
+                   "sent", "pct", "state": "pending|active|done|error" }],
+  "overall": { "sent", "total", "pct", "elapsed_s" },
+  "active_signature": "RTF|null",
+  "backup": { "path", "when" } ,
+  "slot": { "before": "A|B|?", "after": "A|B|?|null" },
+  "message": "human line",
+  "error": null
+}
+```
+
+### v1.5.2 Firmware 하드닝
+
+| 항목 | 수정 내용 |
+|---|---|
+| C1 ProtectSystem | 서비스 유닛 + deploy.ps1에 `/opt/fw_staging` + `/opt/config_backups` → `ReadWritePaths` 추가, 디렉토리 사전 생성 |
+| H4 stage_zip TOCTOU | `fw_controller.stage_zip` — `self._lock` 하에서 'staging' 상태 검사 |
+| H19 default_file | `FirmwareController` default_file 오버라이드를 `server.py`에서 제거 |
+| H20 upload timeout | `/api/firmware/upload` 소켓 타임아웃을 연결별로 `None`으로 재설정 |
+| M10/M15 recover | `_recover_staging`을 백그라운드 데몬 스레드로 실행 (시작 비차단) |
+
+---
+
+## 9. 보안 모델
+
+보안 모델은 레거시 Java 앱 기준선에 맞춰 인증 없는 LAN 전용으로 명시적으로 설계되었다.
+
+| 제어 항목 | 구현 방식 |
+|---|---|
+| 인증 없음 | 의도적 설계 (LAN 전용 IoT, Java 앱과 동일) |
+| CORS | `Access-Control-Allow-Origin: *` (전체 origin 허용, 의도적) |
+| HTTP만 사용 | TLS 미적용 (LAN 환경) |
+| XSS — 출력 | `utils.js`의 `escapeHtml` 5문자 치환 (v1.5.2 H1 루트 수정) |
+| XSS — 속성 | `icons.js`의 `escapeAttr`, 모든 숫자 속성에 숫자 강제 변환 `Number()` (v1.4.6.9 C5/C6) |
+| 경로 순회 | `os.realpath()` + `STATIC_DIR` 접두사 검사 (`server.py:237-239`) |
+| SQL 인젝션 | `DBManager.ALLOWED_KEYS` 화이트리스트 (`db_manager.py:42`) — CLI 백엔드는 키를 파라미터화 |
+| Body 크기 | `MAX_BODY_SIZE = 1 MB` (`server.py:161`) |
+| Slowloris | `socket.setdefaulttimeout(30.0)` (`server.py`, v1.5.1) |
+| enum 인젝션 | 유효하지 않은 enum 값 시 HTTP 400 하드 거부 (`config_validator.py`) |
+| Super_Relay 키 | POST에 `security_config`/`transport_config` 포함 시 HTTP 400 거부 (`v1.4.4`) |
+| systemd 하드닝 | `NoNewPrivileges`, `ProtectSystem=strict`, `ProtectHome=read-only`, `PrivateTmp`, `ReadWritePaths` 화이트리스트 |
+| 지원 번들 | WiFi 비밀번호는 포함 전 마스킹 처리 |
+
+---
+
+## 10. 성능 (v1.5.4 + v1.5.4.2)
+
+### 정적 파일 전달 (LAN, .54 측정값)
+
+| 지표 | 값 |
+|---|---|
+| 최초 로드 전송량 | ~575 KB → ~200 KB (gzip으로 ~65% 감소) |
+| 반복 방문 | ETag/304, 0바이트 body — 거의 즉각 렌더링 |
+| 배포 전파 | 즉시 (JS/CSS no-cache, v1.5.4.2 H1+M2 수정) |
+| 정적 파일 레이턴시 | 20–32 ms (LAN 왕복) |
+| system-status 콜드 | ~6.09 s (journalctl + dpworldapp 로그 스캔) |
+| system-status 웜 | ~1.15 s (모듈 캐시) |
+
+### 적용된 기법
+
+- **gzip**: 레벨 6, text/JS/CSS/JSON/SVG, `≥256B`, q값 인식 Accept-Encoding (v1.5.4.2 L1)
+- **ETag**: `W/"mtime-size"` 약한 ETag, 파일별, `If-None-Match` → 304
+- **Cache-Control**: HTML/JS/CSS `no-cache, must-revalidate`; 폰트/이미지 `max-age=86400`
+- **modulepreload**: 9개 핵심 모듈 (`index.html` 링크 힌트) — app.js 파싱 전 병렬 fetch
+- **셀프 호스팅 폰트**: 7개 `.woff2` 파일 (Inter 5웨이트 + JetBrains Mono 2웨이트, latin 서브셋, 총 ~200 KB)
+  — 외부 CDN 의존 없음 (LAN 전용 IoT에서 필수, v1.5.1.1)
+- **amss.bin에 mmap 사용**: 전체 읽기 대신 `mmap.find()` — 피크 RSS 1 MB 미만 유지 (v1.4.0)
+
+---
+
+## 11. 동시성 모델
+
+```
+Thread A (request)      Thread B (request)      Daemon (auto-compress)
+       │                        │                        │
+   _lock.acquire()          blocks                   _lock.acquire() (after A)
+   BEGIN IMMEDIATE ──────── SQLite WAL ────────── (reads log_config)
+   SELECT + mutator()
+   INSERT OR REPLACE
+   COMMIT
+   _lock.release() ─────── unblocks B
+```
+
+- `DBManager._lock`은 `threading.Lock` — 하나의 Python 객체, 프로세스 로컬.
+- SQLite 측의 `BEGIN IMMEDIATE`는 DB 레벨에서 동시 쓰기를 차단한다
+  (WAL 모드는 동시 읽기 허용).
+- `fw_controller` 상태 머신은 별도 인스턴스의 `self._lock`으로 보호.
+- Nav-guard 이중 모달 레이스: 빠른 클릭 시 시각적 문제만 발생 (기록됨, 허용 수준).
+
+---
+
+## 12. 테스트 인프라 (v1.5.3 듀얼 러너)
+
+### Python pytest (644개 테스트)
+
+`tests/`에 버전/기능별로 구성:
+
+| 패턴 | 설명 |
+|---|---|
+| Grep 테스트 | 코드 패턴 존재/부재 검증 (대다수 테스트) |
+| Behavioral 테스트 | server.py 통합 (FakeDB), config_validator 하드 거부 |
+| Multi-instance | `test_v1_5_3_multi_instance.py` — DBManager BEGIN IMMEDIATE 레이스 (10+20 스레드) |
+| Schema drift | `test_schema_drift.py` — `scripts/audit_schema_drift.py` 대 `tests/fixtures/java_schema_expected.json` |
+
+실행: `python -m pytest tests/ -v`
+
+### Node 18+ jsdom (35개 테스트, 4개 파일)
+
+| 파일 | 테스트 수 | 검증 내용 |
+|---|---|---|
+| `tests/test_nav_guard_behavior.mjs` | 9 | 포커스 트랩 Tab/Shift+Tab, Esc, Save/Discard/Cancel, pageId XSS |
+| `tests/test_icons_svg.mjs` | 10 | SVG 정합성, viewBox/width/height, aria role=img + title, XSS 저항성 |
+| `tests/test_log_tabs_switching.mjs` | 4 | 탭 클릭 → panel.hidden 토글, aria-selected, 기본 상태 |
+| `tests/test_save_all_modal.mjs` | 9 | 모달 role/aria, dirty 페이지 목록, Cancel/Confirm promise, escapeHtml XSS |
+| `tests/test_firmware_logic.mjs` | 3 | (기존) firmware-logic.js 헬퍼 |
+
+실행: `npm test` (Node 18+ 필요, 최초 1회 `npm install`)
+
+**디바이스 배포 격리**: `deploy.ps1`이 `git archive HEAD src` 사용 — `src/`만 배포됨. `tests/`, `node_modules/`, `package.json`, `package-lock.json`은 디바이스로 전송되지 않는다.
+
+---
+
+## 13. 배포 파이프라인 (scripts/deploy.ps1)
+
+### 단계
+
+```
+1. git archive HEAD src → 로컬 tar
+2. SSH: mkdir -p $AppDir /opt/fw_staging /opt/config_backups
+3. scp tar → 디바이스
+4. SSH: tar --warning=no-timestamp -xf tar → _deploy_tmp/
+5. SSH: 기존 src/ 백업 → backups/src-$ts (최근 3개 유지)
+6. SSH: atomic mv _deploy_tmp/ → src/
+7. SSH: /lib/systemd/system/web-configurator.service 설치 (영속)
+8. SSH: systemctl daemon-reload + enable + restart web-configurator
+9. Confirm-Health: /api/health 최대 30초 폴링
+10. 실패 시 자동 롤백: backups/src-$ts 복원 + restart
+```
+
+### 주요 플래그
+
+| 플래그 | 효과 |
+|---|---|
+| (기본값) | 클린 git 워킹 트리 + 버전 태그 필요 |
+| `-AllowUntagged` | 태그 요건 생략 (dev/test 배포) |
+| `-Rollback` | 가장 최근 backup/src-* 복원 |
+
+### 배포 후 디바이스 상태
+
+- `$AppDir` 내 `DEPLOYED_VERSION` 파일 (버전 문자열)
+- `$AppDir` 내 `deploy-history.log` (배포마다 타임스탬프 + 버전)
+- `/lib/systemd/system/web-configurator.service`의 systemd 유닛
+
+### 버전 확인 (배포 후)
+
+```powershell
+ssh root@192.168.55.54 "curl -s http://localhost:9090/api/health"
+# → {"status":"ok","version":"v1.5.4.2","uptime_s":...}
+```
+
+---
+
+## 14. 운영 리뷰 커버리지
+
+### v1.5.2 멀티에이전트 리뷰 (wf_f4786747-995)
+
+- 12개 차원, 318개 에이전트, 약 102건 제기 → **41건 확정**
+- 수정: Critical 1 + High 20 + Medium 7 = 28개 항목
+- 이연: High 5 (behavioral, jsdom) → v1.5.3
+- 방법: 발견 사항별 3-lens 적대 검증 (정확성 / 보안 / 재현성)
+  — 다수 반박 (2/3) = false positive, 폐기
+
+### v1.5.4.2 집중 리뷰 (wf_a4efa2e3-2cb)
+
+- 6개 차원, 21건 제기 → **5건 확정**
+- 수정: H1+M2 Cache-Control JS/CSS, M1 sensor-io placeholder, L1 gzip q-value, L2 focus-visible
+- 잔여: Medium 9 + Low 4 (사용자 체감 영향 0)
+
+---
+
+## 15. v1.5.x 릴리즈 타임라인
+
+| 태그 | 커밋 | 핵심 변경 | 테스트 수 |
+|---|---|---|---|
+| v1.5.0-phase-1 | `c6ec698` | 인프라: 사이드바 5그룹 + icons.js + page-dirty + nav-guard + Firmware placeholder | 481 |
+| v1.5.0-phase-2 | `1effda8` | Network 3-리프: wifi + ethernet + server-setting | 500 |
+| v1.5.0-phase-3 | `6bdc2a7` | Interface & Protocol 5-리프: general + sensor-io + can-bus + opcua + modbus | 523 |
+| v1.5.0-phase-4a | (sha) | Firmware OTA 실제 병합 (webconfig_fw → src/firmware/ + 5개 라우트 + firmware.js 902줄) | 557 |
+| v1.5.0 | `b3776a1` | Phase 4b: 이모지 → Lucide SVG ~80개 인스턴스 + log 3탭 + Save All 확인 모달 | 562 |
+| v1.5.0.1 | `2b74ad2` | 핫픽스: deploy.ps1 최초 배포 mkdir + /api/ 404 가드 | 564 |
+| v1.5.1 | `1c3ffc2` | DBManager.update_config BEGIN IMMEDIATE RMW + slowloris 30초 타임아웃 | 569 |
+| v1.5.1.1 | `73e188d` | Inter + JetBrains Mono .woff2 7개 폰트 셀프 호스팅 | 572 |
+| v1.5.2 | `6b7047d` | 운영 리뷰 번들: 41건 확정 수정 (C1 ProtectSystem + H1 XSS + H17 systemd + H18 rollback + ...) | 599 |
+| v1.5.3 | `3b04e36` | Behavioral 테스트 인프라: jsdom + node:test, 4개 .mjs 파일, 35개 Node 테스트 | Python 615 + Node 35 |
+| v1.5.3.1 | (sha) | 핫픽스: analog_input_level enum 5V/10V/20mA → 2/4/6 (Java 회귀) + sensor-io UI 카드 | 621 |
+| v1.5.3.2 | (sha) | 핫픽스: modbus.js two_byte_order 누락 (Java TwoByte 회귀) | 625 |
+| v1.5.4 | (sha) | 성능: gzip + ETag/304 + Cache-Control + modulepreload (13개 테스트) | 638 |
+| v1.5.4.1 | (sha) | 핫픽스: 잔여 이모지 → SVG (1개 테스트) | 639 |
+| v1.5.4.2 | `fe5cd25` | 핫픽스 집중 리뷰: Cache-Control no-cache JS/CSS + sensor-io placeholder + gzip q-value + focus-visible (5개 테스트) | 644 |
+
+---
+
+## 16. 컴포넌트 다이어그램 (ASCII)
+
+### 최상위 시스템 구성
+
+```
+  Operator Browser (LAN)
+       │
+       ├──:9090 (direct)──► Python web-configurator.service
+       │                          │
+       │                     server.py (ThreadedHTTPServer)
+       │                          │
+       │                    ┌─────┼──────────────────────────────┐
+       │                    │     │                              │
+       │              DBManager  firmware/              system_status.py
+       │              (sqlite3)  fw_controller.py        kernel_log.py
+       │                    │     │                      log_manager.py
+       │                    │  /opt/fw_staging           support_bundle.py
+       │                    │  /opt/config_backups       config_validator.py
+       │                    │                              dpworldapp_enums.py
+       │                    │                              enum_normalizer.py
+       │               ~/db/dynamic_data.db               migrations.py
+       │                    │
+       │           ┌────────┼────────────┐
+       │      board_config  schema_meta  event_history
+       │           │
+       │    ┌──────┼──────────┐
+       │  device_ protocol_  log_
+       │  config   config    config
+       │
+       ├──:80──► nginx ──:8080──► Java app-runner (legacy, .56 only)
+       │                               │
+       │                        ~/db/dynamic_data.db (same file!)
+       │
+       └── (no browser)──► dpworldapp (/usr/bin/dpworldapp)
+                                   │
+                            ~/db/dynamic_data.db (reads device_config + protocol_config)
+                            /opt/log/dpworldapp/*.log (writes)
+```
+
+### 프론트엔드 모듈 그래프
+
+```
+index.html
+    └── app.js (type=module, entry point)
+          ├── state.js          (device/protocol 상태 + flat↔nested)
+          ├── api.js            (모든 REST 엔드포인트 fetch 래퍼)
+          ├── utils.js          (escapeHtml, debounce)
+          ├── icons.js          (49개 Lucide SVG + icon() 헬퍼)
+          ├── constants.js      (APP_VERSION, DEFAULTS, enum 집합)
+          ├── page-dirty.js     (markDirty/clearDirty/사이드바 점)
+          ├── nav-guard.js      (confirmNavigation 모달 + 포커스 트랩)
+          ├── toast.js          (토스트 알림)
+          ├── validator.js      (클라이언트 측 필드 유효성 검사)
+          ├── components/
+          │   ├── crud-table.js  (레지스터 필드 매핑 테이블)
+          │   └── ip-input.js    (IP 주소 입력 위젯)
+          └── pages/
+              ├── home.js             (Dashboard)
+              ├── wifi.js             (Wi-Fi 설정)
+              ├── ethernet.js         (이더넷 + LTE 인터페이스)
+              ├── server-setting.js   (서버 엔드포인트)
+              ├── general-settings.js (Equipment + Protocol + Odometer)
+              ├── sensor-io.js        (RS485 + Analog/Digital 포트)
+              ├── can-bus.js          (CAN 설정 + 프레임 매핑)
+              ├── opcua.js            (OPC UA 엔드포인트 + 매핑)
+              ├── modbus.js           (Modbus 엔드포인트 + 바이트 순서 + 매핑)
+              ├── log.js              (로그 관리 3탭)
+              └── firmware.js         (Firmware OTA 8단계 스테퍼)
+              [legacy aliases: ssid.js / io.js / network.js / register.js / can.js]
+```
+
+### Partial-Merge 데이터 흐름 (POST /setting/device)
+
+```
+Browser POST {partial JSON}
+       │
+  server.py:_handle_post_device
+       │
+  _read_request_body()       ← 1 MB 제한; dict 가드 (배열/스칼라 거부)
+       │
+  normalize_device_input()   ← enum_normalizer.py (case alias: ON→on 등)
+       │
+  validate_wifi_country_code()  ← 유효하지 않은 2자 코드 시 하드 거부 400
+  validate_rs485_integers()     ← bool/string 타입 시 하드 거부 400
+  validate_device_port_types_hard()  ← 유효하지 않은 포트 값 시 하드 거부 400
+  validate_super_relay_keys()   ← security/transport_config 포함 시 하드 거부 400
+       │
+  db.update_config("device_config", mutator)
+       │
+       ├── BEGIN IMMEDIATE (SQLite 쓰기 잠금)
+       ├── SELECT 기존 데이터
+       ├── 기존 데이터 + POST body 병합 (partial-merge)
+       ├── log_config 키 분리 → db.update_config("log_config", ...)
+       ├── INSERT OR REPLACE device_config
+       └── COMMIT
+       │
+  응답: {success, merged_keys, preserved_keys_count}
+```
+
+---
+
+## 17. 운영 런북
+
+### .54 배포 (dev/verify)
+
+```powershell
+cd C:\Development\NEW_Web_Configurator
+.\scripts\deploy.ps1 192.168.55.54 -AllowUntagged
+```
+
+### .54 태그 배포 (릴리즈)
+
+```powershell
+git tag v1.5.4.2 -m "v1.5.4.2"
+.\scripts\deploy.ps1 192.168.55.54
+```
+
+### 롤백
+
+```powershell
+.\scripts\deploy.ps1 192.168.55.54 -Rollback
+```
+
+### 수동 서비스 재시작 (deploy.ps1 restart가 조용히 실패할 때)
+
+```powershell
+ssh root@192.168.55.54 "systemctl restart web-configurator"
+```
+
+### 배포 헬스 확인
+
+```powershell
+ssh root@192.168.55.54 "curl -s http://localhost:9090/api/health"
+# 예상 결과: {"status":"ok","version":"v1.5.4.2",...}
+```
+
+### DB 점검
+
+```powershell
+ssh root@192.168.55.54 "sqlite3 /home/root/db/dynamic_data.db 'SELECT key, length(value) FROM board_config;'"
+# schema_meta 마이그레이션 점검
+ssh root@192.168.55.54 "sqlite3 /home/root/db/dynamic_data.db 'SELECT key, value, applied_at FROM schema_meta;'"
+```
+
+### 펌웨어 업로드 (OTA)
+
+```powershell
+curl -F "file=@firmware.zip" http://192.168.55.54:9090/api/firmware/upload
+curl -s http://192.168.55.54:9090/api/firmware/preflight
+curl -X POST http://192.168.55.54:9090/api/firmware/flash
+```
+
+### 스키마 드리프트 확인 (로컬)
+
+```powershell
+python scripts/audit_schema_drift.py
+# Exit 0 = 정상, 2 = 드리프트 감지, 1 = 오류
+```
+
+### 전체 테스트 실행
+
+```powershell
+python -m pytest tests/ -v      # Python: 644개 테스트
+npm test                         # Node: 35개 jsdom 테스트
+```
+
+---
+
+## 18. 알려진 제한 사항 및 백로그
+
+| 항목 | 상태 | 비고 |
+|---|---|---|
+| system-status 콜드 레이턴시 ~6초 | v1.5.5 후보 | 모든 콜드 호출 시 journalctl + 전체 로그 스캔 |
+| Java 측 wipe 경로 | 미해결 (Java는 수정 불가) | 레거시 앱이 알 수 없는 enum 값을 조용히 null 처리하고, null 필드를 쓰기 시 삭제 — Python 하드 거부가 1차 방어선 |
+| main 브랜치 FF 머지 보류 | 사용자 결정 사항 | .56 운영 환경은 명시적 사용자 승인 전까지 v1.4.6.10 유지 |
+| GNSS 스캐너 최신 로그만 처리 | 낮은 우선순위 | 로그 회전 후 dpworldapp 재시작 시 GNSS 티어가 'na' 표시 — 다음 dpworldapp 시작 시 자가 복구 |
+| collectAllPagesData 비대칭 | v1.5.5 후보 | Device Save → 3행 쓰기, Register Save → 1행 — 구조적 재설계 필요 |
+| 리뷰에서 Medium 9 + Low 4 | 이연 | 사용자 체감 영향 0 — 기각 또는 v1.5.5+ 처리 |
+| 16개 페이지 동적 import | v1.6+ 후보 | 현재 모든 페이지 즉시 로드; 동적 import 적용 시 초기 파싱 감소 가능 |
+
+---
+
+## 부록 A — 파일 트리 (src/)
+
+```
+src/
+├── server.py               ← HTTP 서버, 라우팅, 진입점
+├── db_manager.py           ← SQLite 3티어 + update_config atomic RMW
+├── config_validator.py     ← 서버 측 유효성 검사 + 정규화
+├── dpworldapp_enums.py     ← device 계약 enum 값 (단일 진실 공급원)
+├── enum_normalizer.py      ← Case-only alias 정규화 (ON→on 등)
+├── migrations.py           ← 시작 마이그레이션 (3개 적용)
+├── log_manager.py          ← 로그 목록/다운로드/압축/삭제/통계 + auto-compress 데몬
+├── kernel_log.py           ← journalctl + 커널 로그 번들 빌더
+├── system_status.py        ← 홈 대시보드 상태 집계
+├── support_bundle.py       ← 진단 ZIP 생성기
+├── firmware/
+│   ├── __init__.py
+│   ├── fw_client.py        ← dpw-fw-update-tool 데몬용 Wire 클라이언트
+│   ├── staging.py          ← ZIP 스테이징 및 유효성 검사
+│   ├── config_safety.py    ← 설정 백업/복원
+│   ├── protocol.py         ← Wire 프로토콜 프레이밍
+│   ├── fw_controller.py    ← 상태 기반 OTA 오케스트레이션
+│   └── fw_routes.py        ← HTTP 라우트 핸들러
+└── static/
+    ├── index.html          ← SPA 진입점, 5그룹 사이드바, modulepreload 힌트
+    ├── css/style.css       ← 디자인 토큰 + 컴포넌트 스타일 + firmware CSS
+    ├── fonts/              ← Inter (.woff2 ×5) + JetBrains Mono (.woff2 ×2)
+    ├── img/                ← dp-world-logo.svg
+    └── js/
+        ├── app.js          ← 라우터, Save All, Import/Export, 사이드바 JS
+        ├── api.js          ← REST 클라이언트 (모든 fetch 래퍼)
+        ├── state.js        ← 인메모리 상태 + flat↔nested 변환
+        ├── page-dirty.js   ← 페이지별 dirty 매트릭스 + 사이드바 점
+        ├── nav-guard.js    ← 네비게이션 확인 모달 + 포커스 트랩
+        ├── icons.js        ← Lucide v0.460+ 49개 SVG + icon() 헬퍼
+        ├── constants.js    ← APP_VERSION + DEFAULTS + enum 집합
+        ├── utils.js        ← escapeHtml + 헬퍼
+        ├── toast.js        ← 토스트 알림
+        ├── validator.js    ← 클라이언트 측 필드 유효성 검사
+        ├── country-codes.js ← Wi-Fi 국가 코드 205개 드롭다운용
+        ├── firmware-logic.js ← Firmware OTA 순수 로직 헬퍼
+        ├── components/
+        │   ├── crud-table.js
+        │   └── ip-input.js
+        └── pages/
+            ├── home.js             (활성)
+            ├── wifi.js             (활성)
+            ├── ethernet.js         (활성)
+            ├── server-setting.js   (활성)
+            ├── general-settings.js (활성)
+            ├── sensor-io.js        (활성)
+            ├── can-bus.js          (활성)
+            ├── opcua.js            (활성)
+            ├── modbus.js           (활성)
+            ├── log.js              (활성)
+            ├── firmware.js         (활성)
+            ├── ssid.js             (레거시 별칭 → wifi)
+            ├── io.js               (레거시 별칭 → ethernet, RS485/CAN 잔재)
+            ├── network.js          (레거시 별칭 → server-setting)
+            ├── register.js         (레거시 별칭 → general-settings)
+            └── can.js              (레거시 별칭 → can-bus)
+```
+
+---
+
+## 부록 B — 주요 코드 위치
+
+| 내용 | 파일 | 라인/함수 |
+|---|---|---|
+| 진입점 / main() | `src/server.py` | `main()` (파일 하단) |
+| HTTP 핸들러 클래스 | `src/server.py` | `class ConfigHandler` |
+| 정적 파일 서빙 | `src/server.py` | `_serve_static_file()` ~L224 |
+| gzip + ETag 로직 | `src/server.py` | `_serve_static_file()` ~L254-299 |
+| Partial-merge POST device | `src/server.py` | `_handle_post_device()` |
+| Partial-merge POST protocol | `src/server.py` | `_handle_post_protocol()` |
+| Firmware 라우트 | `src/server.py` | do_GET + do_POST firmware 분기 |
+| Atomic RMW | `src/db_manager.py` | `update_config()` L226 |
+| BEGIN IMMEDIATE | `src/db_manager.py` | `update_config()` L258 |
+| Java enum 값 | `src/dpworldapp_enums.py` | `DEVICE_ENUM_VALUES` L16, `PROTOCOL_ENUM_VALUES` L39 |
+| Case alias 정규화 | `src/enum_normalizer.py` | `normalize_device_input()`, `normalize_protocol_input()` |
+| 마이그레이션 | `src/migrations.py` | `apply_all_migrations()` |
+| escapeHtml (5문자) | `src/static/js/utils.js` | `escapeHtml()` |
+| icon() 헬퍼 | `src/static/js/icons.js` | `icon()` |
+| page-dirty 매트릭스 | `src/static/js/state.js` | `state.pageDirty` |
+| nav-guard 모달 | `src/static/js/nav-guard.js` | `confirmNavigation()` |
+| flat↔nested 변환 | `src/static/js/state.js` | `convertFlatToNested()`, `convertNestedToFlat()` |
+| FirmwareController | `src/firmware/fw_controller.py` | `class FirmwareController` |
+| Schema drift 테스트 | `tests/test_schema_drift.py` | 파일 전체 |
+| Config 계약 스냅샷 | `tests/fixtures/java_schema_expected.json` | 파일 전체 |
+| 감사 스크립트 | `scripts/audit_schema_drift.py` | 파일 전체 |
+| jsdom nav-guard 테스트 | `tests/test_nav_guard_behavior.mjs` | 파일 전체 |
+
+---
+
+## 부록 C — 관련 문서
+
+| 문서 | 위치 | 내용 |
+|---|---|---|
+| 구 아키텍처 (v2.2) | `docs/architecture.md` | v1.3.0 시대, 현재 이 문서로 대체됨 |
+| 배포 런북 | `docs/DEPLOY.md` | 배포 절차, 버전 관리 |
+| 2026-05-29 인시던트 | 내부 인시던트 기록(이 배포물에 미포함) | 전체 행 replace wipe 인시던트 |
+| 변경 이력 | `CHANGELOG.md` | v1.4.0 → v1.5.4.2 전체 릴리즈 이력 |
diff --git a/docs/config-spec/config-contract-proposal.md b/docs/config-spec/config-contract-proposal.md
new file mode 100644
index 0000000..9fe5b50
--- /dev/null
+++ b/docs/config-spec/config-contract-proposal.md
@@ -0,0 +1,131 @@
+# WebConfigurator / dpworldapp Config Contract Proposal
+
+작성일: 2026-06-10
+
+## 목적
+
+이 문서는 WebConfigurator와 dpworldapp이 공유하는 `device_config`, `protocol_config`의 계약을 정리하기 위한 협의안이다. 현재 장비의 `/var/www/html/config_device.json`, `/var/www/html/config_protocol.json`는 dpworldapp 구동 중 DB read/parse 문제가 생겼을 때 fallback seed 또는 restore source로 쓰이는 것으로 이해한다.
+
+핵심 원칙은 두 가지다.
+
+1. 지금 dpworldapp이 실제로 읽는 `Legacy v1` 포맷은 즉시 깨지 않는다.
+2. 사람이 유지보수하고 검증하기 쉬운 `Canonical v2` 포맷을 별도 계약안으로 만들고, WebConfigurator와 dpworldapp 사이에는 명시적인 `adapter`를 둔다.
+
+## 현재 관찰
+
+입력 기본 파일 위치:
+
+- 장비 원본 경로: `/var/www/html/config_device.json`
+- 장비 원본 경로: `/var/www/html/config_protocol.json`
+- 분석에 사용한 복사본: `C:\Users\F1304\Downloads\default www`
+
+현재 WebConfigurator는 SQLite `board_config` 테이블에 다음 key를 사용한다.
+
+- `device_config`: dpworldapp config-reader 계약과 맞춘 flat config
+- `protocol_config`: dpworldapp register 매핑 계약과 맞춘 flat config
+- `log_config`: WebConfigurator/Python 전용 log-management 확장 영역
+
+이미 코드에 들어 있는 중요한 정책은 `src/dpworldapp_enums.py`의 주석과 일치한다. `device_config`와 `protocol_config`는 dpworldapp config-reader 계약 그대로 유지하고, Python 자체 기능 데이터는 별도 `board_config` key로 분리해야 한다.
+
+## Legacy v1 이슈 목록
+
+| 위치 | 현재 값/형태 | 문제 | Canonical v2 제안 |
+| --- | --- | --- | --- |
+| `device_config.wifi_static` | `"on"` / `"off"` string | boolean 의미가 문자열 enum으로 저장됨 | `network.wifi.static: true/false` |
+| `device_config.log_save` | `"on"` / `"off"` string | boolean 의미가 문자열 enum으로 저장됨 | `logging.enabled: true/false` |
+| `device_config.WIFI_SSID` | 대문자 key + `wifi_passwd` | JSON naming이 불균일하고 password 명칭이 UI와 다름 | `network.wifi.ssid_profiles[].password` |
+| `device_config.lte_server_port` | `"20111"` string | server port는 정수로 검증/저장되어야 함 | `servers.lte.port: 20111` |
+| `device_config.lte_port` | `"534"` string | 의미가 network port인지 device interface id인지 불명확 | 의미 확정 전까지 `network.lte.interface_port: "534"` |
+| `protocol_config.protocol` | `"OPC-UA"` | 현재 canonical enum은 `OPC_UA`; hyphen alias는 adapter 책임 | `interface.protocol: "opc_ua"` |
+| `protocol_config.MEID` | `7000` number | 식별자는 산술 대상이 아니며 leading zero 가능성을 고려해야 함 | `device.meid: "7000"` |
+| `protocol_config.dr_on`, `odo_on`, `heading_on` | `"on"` / `"off"` string | boolean 의미가 문자열 enum으로 저장됨 | `positioning.*: true/false` |
+| `protocol_config.odo_speed.source` | `"CAN"` | 현재 Python validator의 source enum은 lower-case `can`/`hw` | `source: "can"` |
+| `protocol_config.odo_speed.shift` | `"8"` string | 현재 WebConfigurator validator는 integer를 기대함 | `shift_bits: 8` |
+| `protocol_config.ai0..ai3`, `di0..di3` | `"0"` / `"1"` string | channel count와 타입이 불명확함. 현재 validator는 0/1번만 엄격 관리 | `io.analog_inputs[]`, `io.digital_inputs[]` boolean array |
+| mapping arrays `OPC_UA`, `CAN` | 대문자 array key + 숫자 문자열 | 저장 관례와 타입 의미가 섞여 있음 | `mappings.opc_ua[]`, `mappings.can[]` |
+
+`odo_speed.shift`는 특히 협의가 필요하다. 현재 default fallback 파일은 string을 쓰지만 WebConfigurator backend는 nested odometer field에서 integer를 기대한다. 따라서 adapter에서 numeric string을 integer로 흡수할지, fallback 파일 자체를 integer로 고칠지 결정해야 한다.
+
+## 제안 아키텍처
+
+### 1. Legacy v1
+
+dpworldapp이 지금 읽는 장비 운용 포맷이다. 이 포맷은 dpworldapp config-reader 호환성을 위해 유지한다.
+
+특징:
+
+- flat top-level key 유지: `wifi_static`, `protocol_server_ip`, `WIFI_SSID`, `OPC_UA`, `CAN`
+- legacy boolean은 `"on"` / `"off"` 유지
+- legacy enum은 dpworldapp 계약 값 유지: `OPC_UA`, `MODBUS`, `CAN`, `NONE`
+- Java가 integer로 기대하는 server port는 integer로 저장
+- dpworldapp이 string으로 기대하거나 의미가 불명확한 field는 합의 전까지 string 유지
+
+### 2. Canonical v2
+
+사람과 WebConfigurator 내부 모델이 기준으로 삼을 typed domain model이다. `docs/config-spec/proposed/` 아래 JSON 파일은 이 안을 default 파일에서 변환한 예시다.
+
+공통 규칙:
+
+- 모든 파일은 `schema_version`을 가진다.
+- boolean 의미는 JSON boolean만 쓴다.
+- port, baudrate, size, duration, namespace, shift 같은 수량은 number를 쓴다.
+- 식별자, CAN id, mask, expression, password, equipment id는 string을 쓴다.
+- enum은 한 가지 표기만 허용한다. v2에서는 lower snake case를 기본으로 한다.
+- 단위가 있는 수량은 key에 단위를 넣는다. 예: `baudrate_kbps`, `max_size_mb`, `max_duration_days`, `shift_bits`.
+- 장비별 차이는 `equipment` code와 protocol-specific mapping array로 표현하고, 공통 positioning/network/server/interface 영역은 유지한다.
+
+### 3. adapter
+
+adapter는 `Canonical v2`와 `Legacy v1` 사이의 유일한 변환 지점이다.
+
+adapter 책임:
+
+- `true/false` <-> `"on"/"off"`
+- `opc_ua` <-> `OPC_UA`, legacy alias `OPC-UA` 흡수
+- `device.meid` string <-> legacy `MEID`
+- `io.analog_inputs[]` <-> legacy `ai0`, `ai1`, `ai2`, `ai3`
+- `io.digital_inputs[]` <-> legacy `di0`, `di1`, `di2`, `di3`
+- `mappings.opc_ua[]` <-> legacy `OPC_UA`
+- `mappings.can[]` <-> legacy `CAN`
+- default/fallback JSON과 DB row를 같은 golden file 테스트로 검증
+
+중요: dpworldapp이 v2를 직접 지원하기 전에는 WebConfigurator가 DB의 `device_config`, `protocol_config`를 v2로 직접 저장하지 않는다. v2는 내부 모델 또는 별도 row/파일로만 관리하고, dpworldapp 경계에는 adapter가 만든 Legacy v1을 저장한다.
+
+## 제안 파일
+
+- `docs/config-spec/proposed/config_device.v2.proposed.json`
+- `docs/config-spec/proposed/config_protocol.v2.proposed.json`
+
+이 두 파일은 현재 default JSON을 사람이 이해하기 쉬운 typed 구조로 옮긴 협의안이다. 장비에 바로 복사하는 배포 파일이 아니다.
+
+## Future Addition Policy
+
+새 config field를 추가할 때는 다음 항목을 spec에 먼저 추가한 뒤 구현한다.
+
+1. `owner`: `device_config`, `protocol_config`, `log_config`, 또는 새 전용 key 중 어디가 소유하는지 명시한다.
+2. type: JSON type을 하나로 정한다. boolean 의미에 string enum을 쓰지 않는다.
+3. default: 장비 factory default, WebConfigurator UI default, migration default를 구분한다.
+4. required/optional: 누락 시 동작과 null 저장 여부를 명시한다.
+5. enum: 허용 값과 alias 흡수 위치를 정한다. alias는 adapter에서만 처리한다.
+6. unit: 수량 field에는 단위를 key에 포함한다.
+7. security: password, token, certificate 등 masking/export policy를 함께 정의한다.
+8. migration: 기존 DB row와 fallback file을 어떻게 변환할지 적고 idempotent test를 만든다.
+9. compatibility: dpworldapp 구버전이 unknown field를 어떻게 처리하는지 확인한다.
+10. golden file: default legacy 파일, v2 proposal, v1 round-trip 결과를 테스트 fixture로 고정한다.
+
+## 변경 절차 제안
+
+1. 현재 장비 fallback 파일을 Legacy v1 기준으로 먼저 정돈한다. 단, dpworldapp이 아직 string을 기대하는 field는 임의로 v2 타입으로 바꾸지 않는다.
+2. WebConfigurator에 `legacy <-> canonical` adapter 테스트를 추가한다.
+3. default fallback 파일을 사람이 직접 수정하지 않고 canonical source에서 생성하는 스크립트를 둔다.
+4. dpworldapp이 v2를 직접 읽을 준비가 되면 `schema_version` 기반 feature flag 또는 별도 `device_config_v2`/`protocol_config_v2` row를 협의한다.
+5. 전환 전까지 운영 DB의 `device_config`, `protocol_config`는 Legacy v1로 유지한다.
+
+## 즉시 결정할 협의 항목
+
+1. `odo_speed.shift`: legacy fallback 파일을 integer로 고칠지, WebConfigurator adapter가 numeric string을 integer로 normalize할지 결정.
+2. `ai2/ai3/di2/di3`: dpworldapp config-reader 계약이 4 channel을 실제 지원하는지 확인. 지원한다면 WebConfigurator enum/validator도 확장.
+3. `lte_port`: network port인지 serial/interface id인지 owner와 type 확정.
+4. mapping row의 `dv`: output type에 맞춰 typed value로 갈지, fallback/default sentinel string으로 유지할지 결정.
+5. log 관련 field: dpworldapp 소유 field와 WebConfigurator 전용 `log_config` field를 명확히 분리.
+
diff --git a/docs/config-spec/proposed/config_device.v2.proposed.json b/docs/config-spec/proposed/config_device.v2.proposed.json
new file mode 100644
index 0000000..cd30a36
--- /dev/null
+++ b/docs/config-spec/proposed/config_device.v2.proposed.json
@@ -0,0 +1,118 @@
+{
+  "schema_version": 2,
+  "compat_profile": "dpworldapp-config-contract-v2-proposal",
+  "generated_from": {
+    "legacy_device_file": "/var/www/html/config_device.json",
+    "captured_path": "C:\\Users\\F1304\\Downloads\\default www\\config_device.json"
+  },
+  "network": {
+    "wifi": {
+      "static": false,
+      "ipv4": {
+        "address": "192.168.78.74",
+        "netmask": "255.255.255.0",
+        "gateway": "192.168.78.1",
+        "dns": [
+          "8.8.8.8",
+          "8.8.8.4"
+        ]
+      },
+      "country_code": "KR",
+      "ssid_profiles": [
+        {
+          "ssid": "mobidigm",
+          "password": "mobidigm",
+          "security": "wpa_wpa2"
+        },
+        {
+          "ssid": "dhautoware",
+          "password": "dhautoware",
+          "security": "wpa_wpa2"
+        },
+        {
+          "ssid": "dpworld",
+          "password": "dpworlddpworld",
+          "security": "wpa_wpa2"
+        },
+        {
+          "ssid": "test",
+          "password": "",
+          "security": "none"
+        }
+      ]
+    },
+    "ethernet": {
+      "ipv4": {
+        "address": "192.168.55.55",
+        "netmask": "255.255.255.0",
+        "gateway": "192.168.55.1"
+      }
+    },
+    "lte": {
+      "ipv4": {
+        "address": "192.168.40.20",
+        "netmask": "255.255.255.0",
+        "gateway": "192.168.40.1"
+      },
+      "interface_port": "534"
+    }
+  },
+  "servers": {
+    "telemetry": {
+      "host": "192.168.78.2",
+      "port": 8080,
+      "transport": "http"
+    },
+    "update": {
+      "host": "192.168.78.2",
+      "port": 8080,
+      "transport": "http"
+    },
+    "rtcm": {
+      "host": "192.168.78.2",
+      "port": 4000
+    },
+    "lte": {
+      "host": "104.208.105.62",
+      "port": 20111
+    },
+    "opc_ua": {
+      "host": "192.168.55.2",
+      "port": 53530
+    },
+    "modbus": {
+      "host": "192.168.55.2",
+      "port": 502
+    }
+  },
+  "interfaces": {
+    "can": {
+      "id_format": "extended",
+      "baudrate_kbps": 1000
+    },
+    "rs485": {
+      "duplex": "half",
+      "baudrate": 9600,
+      "data_bits": 8,
+      "parity": "none",
+      "stop_bits": 0
+    }
+  },
+  "imu": {
+    "axis_remap": {
+      "x": "x",
+      "y": "y",
+      "z": "z"
+    },
+    "axis_sign": {
+      "x": 1,
+      "y": -1,
+      "z": 1
+    }
+  },
+  "logging": {
+    "enabled": true,
+    "max_size_mb": 100,
+    "max_duration_days": 30
+  }
+}
diff --git a/docs/config-spec/proposed/config_protocol.v2.proposed.json b/docs/config-spec/proposed/config_protocol.v2.proposed.json
new file mode 100644
index 0000000..e58e668
--- /dev/null
+++ b/docs/config-spec/proposed/config_protocol.v2.proposed.json
@@ -0,0 +1,124 @@
+{
+  "schema_version": 2,
+  "compat_profile": "dpworldapp-config-contract-v2-proposal",
+  "generated_from": {
+    "legacy_protocol_file": "/var/www/html/config_protocol.json",
+    "captured_path": "C:\\Users\\F1304\\Downloads\\default www\\config_protocol.json"
+  },
+  "device": {
+    "type": "rtls",
+    "version": "v1.0",
+    "equipment": "ITV",
+    "equipment_id": "01",
+    "meid": "7000"
+  },
+  "positioning": {
+    "dead_reckoning": true,
+    "heading": true,
+    "fix_mode": true,
+    "heading_imu": true,
+    "speed_source": "can",
+    "odometer": {
+      "enabled": true,
+      "speed": {
+        "source": "can",
+        "can_id": "0x18FEFC28",
+        "shift_bits": 8,
+        "mask": "0xffff",
+        "expression": "x*0.05+10.0"
+      },
+      "direction": {
+        "source": "hw"
+      }
+    }
+  },
+  "interface": {
+    "protocol": "opc_ua",
+    "can_input": true
+  },
+  "byte_order": {
+    "two_byte": "big",
+    "four_byte": "big"
+  },
+  "io": {
+    "analog_input_level": 6,
+    "analog_inputs": [
+      true,
+      true,
+      true,
+      false
+    ],
+    "digital_inputs": [
+      true,
+      true,
+      false,
+      false
+    ]
+  },
+  "mappings": {
+    "opc_ua": [
+      {
+        "field": "TMP1",
+        "namespace": 3,
+        "address": "1001",
+        "output_type": "integer",
+        "default_value": "-9",
+        "expression": "x*10.0"
+      },
+      {
+        "field": "TMP2",
+        "namespace": 3,
+        "address": "1002",
+        "output_type": "float",
+        "default_value": "-9",
+        "expression": "x/10.0"
+      },
+      {
+        "field": "TMP3",
+        "namespace": 3,
+        "address": "1003",
+        "output_type": "boolean",
+        "default_value": "-9",
+        "expression": "x+10.0"
+      },
+      {
+        "field": "TMP4",
+        "namespace": 3,
+        "address": "1004",
+        "output_type": "string",
+        "default_value": "0",
+        "expression": "x-10.0"
+      }
+    ],
+    "can": [
+      {
+        "field": "CAN1",
+        "can_id": "0x18FEFC28",
+        "shift_bits": 8,
+        "mask": "0xffff",
+        "expression": "x*0.05+10.0",
+        "output_type": "integer",
+        "default_value": "-9"
+      },
+      {
+        "field": "CAN3",
+        "can_id": "0x18FEFC24",
+        "shift_bits": 4,
+        "mask": "0xffff00",
+        "expression": "x/10.0-1.0",
+        "output_type": "integer",
+        "default_value": "-9"
+      },
+      {
+        "field": "CAN2",
+        "can_id": "0x18FEEE00",
+        "shift_bits": 16,
+        "mask": "0xff",
+        "expression": "x*0.05+10.0",
+        "output_type": "float",
+        "default_value": "-9"
+      }
+    ],
+    "modbus": []
+  }
+}
diff --git a/docs/dpworldapp_compatibility.md b/docs/dpworldapp_compatibility.md
new file mode 100644
index 0000000..3d538ea
--- /dev/null
+++ b/docs/dpworldapp_compatibility.md
@@ -0,0 +1,243 @@
+# dpworldapp 호환성 명세서
+
+> Web Configurator 교체 시 dpworldapp과의 호환성을 보장하기 위한 계약(Contract) 문서.
+
+---
+
+## 1. 개요
+
+dpworldapp(`/usr/bin/dpworldapp`)은 IoT 장비의 메인 애플리케이션으로, Web Configurator가 저장한 설정을 SQLite DB에서 직접 읽어 사용합니다.
+
+**핵심 원칙**: dpworldapp은 **일체 변경하지 않으므로**, 새 Web Configurator는 기존 Java 앱이 생성하는 것과 **비트 단위까지 호환되는** 데이터를 생성해야 합니다.
+
+---
+
+## 2. 공유 인터페이스
+
+### 2.1 SQLite DB 파일 경로
+
+```
+~/db/dynamic_data.db    (= /home/root/db/dynamic_data.db)
+```
+
+- **절대 변경 불가**: dpworldapp이 이 경로를 하드코딩하고 있을 가능성 높음
+- busy_timeout: `5000ms` (동시 접근 시 잠금 대기)
+
+### 2.2 board_config 테이블
+
+```sql
+-- 테이블 구조 (변경 불가)
+CREATE TABLE board_config (
+    key   TEXT PRIMARY KEY NOT NULL,
+    value TEXT NOT NULL
+);
+```
+
+| key 값 | 역할 | 쓰기 주체 | 읽기 주체 |
+|--------|------|----------|----------|
+| `device_config` | 디바이스 네트워크/하드웨어 설정 | Web Configurator | dpworldapp |
+| `protocol_config` | 프로토콜/매핑 설정 | Web Configurator | dpworldapp |
+| `log_config` | 로그 관리(auto-compress/cleanup 등) — **Python 전용** | Web Configurator | (dpworldapp 미사용) |
+| `net_config` | Network Apply Engine watchdog 설정(kill-switch 등) — **Python 전용** | Web Configurator | (dpworldapp 미사용) |
+| `ap_config` | Wi-Fi AP(`ap0`) 설정 — **Python 전용** | Web Configurator | (dpworldapp 미사용) |
+
+> [!NOTE]
+> `board_config` 의 전체 허용 키는 위 5개다(`db_manager.py:43` `ALLOWED_KEYS`).
+> dpworldapp 이 읽는 것은 `device_config` / `protocol_config` 둘 뿐이고,
+> `log_config` / `net_config` / `ap_config` 는 Web Configurator 자체 기능을 위한
+> **Python 전용 키**로 dpworldapp 은 읽지 않는다(별도 key ownership 정책 —
+> dpworldapp 공유 키를 오염시키지 않기 위함). 한편 네트워크 적용 엔진이
+> dpworldapp 과 byte-exact 호환을 위해 생성하는 `network_config.json` 은
+> `board_config` 행이 아니라 `/home/root/network/` 의 **파일**이다(혼동 주의).
+
+### 2.3 event_history 테이블
+
+```sql
+CREATE TABLE event_history (
+    id   INTEGER PRIMARY KEY AUTOINCREMENT,
+    data TEXT NOT NULL
+);
+```
+
+| 역할 | 쓰기 주체 | 읽기 주체 |
+|------|----------|----------|
+| 이벤트/경고 이력 | dpworldapp | (선택적 조회 가능) |
+
+> [!CAUTION]
+> Web Configurator는 `event_history`에 **절대 쓰지 않습니다**. dpworldapp 전용.
+
+---
+
+## 3. device_config JSON 스키마
+
+dpworldapp이 읽는 JSON의 정확한 필드명과 타입:
+
+```json
+{
+  "wifi_static": "on",
+  "wifi_ip": "10.227.231.38",
+  "wifi_netmask": "255.255.255.0",
+  "wifi_gateway": "10.227.231.1",
+  "wifi_dns1": "10.226.4.4",
+  "wifi_dns2": "10.226.4.5",
+  "wifi_country_code": "KR",
+  "eth_ip": "192.168.55.44",
+  "eth_netmask": "255.255.255.0",
+  "eth_gateway": "192.168.55.1",
+  "protocol_server_ip": "10.226.22.48",
+  "protocol_server_port": 20101,
+  "update_server_ip": "10.226.22.244",
+  "update_server_port": 9999,
+  "rtcm_server_ip": "10.226.22.48",
+  "rtcm_server_port": 20104,
+  "opc_ua_server_ip": "192.168.55.11",
+  "opc_ua_server_port": 53530,
+  "modbus_server_ip": "192.168.55.100",
+  "modbus_server_port": 502,
+  "lte_server_ip": "...",
+  "lte_server_port": 0,
+  "can_bus_type": "extended",
+  "can_baudrate": 1000,
+  "rs485_mode": "half",
+  "rs485_baudrate": 9600,
+  "rs485_parity": "...",
+  "lte_ip": "...",
+  "lte_netmask": "...",
+  "lte_gateway": "...",
+  "log_save": "on",
+  "log_max_size": 100,
+  "log_max_duration": 1,
+  "WIFI_SSID": [
+    {
+      "wifi_ssid": "KROF01-IT-DEV-Y5",
+      "wifi_passwd": "password",
+      "wifi_security": "wpa/wpa2"
+    }
+  ]
+}
+```
+
+### 타입 규칙
+
+| 필드 패턴 | 타입 | 예시 |
+|-----------|------|------|
+| `*_port` | `Integer` (JSON number) | `20101` |
+| `*_baudrate` | `Integer` | `9600` |
+| `log_max_size`, `log_max_duration` | `Integer` | `100` |
+| `wifi_static`, `log_save` | `String` (`"on"` / `"off"`) | `"on"` |
+| 나머지 | `String` | `"192.168.55.44"` |
+
+> [!NOTE]
+> **dpworldapp-owned 필드 (Web Configurator 미작성):** `imu_remap_x` /
+> `imu_remap_x_sign` / `imu_remap_y` / `imu_remap_y_sign` / `imu_remap_z` /
+> `imu_remap_z_sign` 6개 IMU remap 필드는 **v1.4.5 부터 Web Configurator 가
+> 더 이상 작성하지 않는다**(UI 에서 제거됨, src 에 참조 0). dpworldapp 이
+> 자체적으로 소유·관리하는 값이므로 위 스키마 예시에서 의도적으로 제외했다.
+> Web Configurator 의 partial-merge POST 는 기존 행을 통째로 덮어쓰지 않으므로
+> (`/setting/device` 부분 병합), dpworldapp 이 기록한 이 키들은 보존된다.
+
+---
+
+## 4. protocol_config JSON 스키마
+
+```json
+{
+  "dev_type": "RTLS",
+  "equipment": "ITV",
+  "equipment_id": "01",
+  "MEID": "7000",
+  "protocol": "OPC_UA",
+  "version": "v1.0",
+  "can_input": "on",
+  "speed_data": "CAN",
+  "dr_on": "on",
+  "heading_on": "on",
+  "heading_imu_on": "on",
+  "fix_mode_on": "on",
+  "analog_input_level": "6",
+  "ai0": "0", "ai1": "1", "ai2": "0", "ai3": "0",
+  "di0": "0", "di1": "0", "di2": "0", "di3": "0",
+  "two_byte_order": "big",
+  "four_byte_order": "big",
+  "CAN": [
+    {
+      "field": "CAN1",
+      "id": "0x18FEFC28",
+      "shift": 0,
+      "mask": "0xffff",
+      "expr": "x*0.05+10.0",
+      "odt": "integer",
+      "dv": "-9"
+    }
+  ],
+  "OPC_UA": [
+    {
+      "field": "TMP1",
+      "ns": "3",
+      "addr": "1001",
+      "shift": 0,
+      "expr": "x*10.0",
+      "odt": "float64",
+      "dv": "-9"
+    }
+  ],
+  "MODBUS": [
+    {
+      "field": "TEMP",
+      "addr": "100",
+      "idt": "integer",
+      "odt": "float64",
+      "dv": "-9",
+      "shift": 0,
+      "expr": "x*0.1",
+      "mask": "0xffff"
+    }
+  ]
+}
+```
+
+### 프로토콜별 조건부 필드 존재 규칙
+
+| 조건 | 결과 |
+|------|------|
+| `protocol == "OPC_UA"` | `OPC_UA[]` 포함, `MODBUS` 제외 (null → JSON에서 생략) |
+| `protocol == "MODBUS"` | `MODBUS[]` 포함, `OPC_UA` 제외 |
+| `protocol == "NONE"` | 둘 다 제외 |
+| `can_input == "on"` | `CAN[]` 포함 |
+| `can_input == "off"` | `CAN` 제외 |
+
+---
+
+## 5. 호환성 체크리스트
+
+### 배포 전 필수 확인
+
+- [ ] `~/db/dynamic_data.db` 경로 동일
+- [ ] `board_config` 테이블 구조 동일
+- [ ] `key` 값 문자열 동일 (`"device_config"`, `"protocol_config"`)
+- [ ] JSON 필드명 snake_case 동일
+- [ ] Integer 필드가 JSON number 타입으로 저장
+- [ ] null/None 필드가 JSON에서 제외됨
+- [ ] MEID가 항상 문자열로 저장
+- [ ] 비활성 프로토콜 매핑이 JSON에서 제외됨
+- [ ] `busy_timeout=5000` 설정됨
+- [ ] `event_history` 테이블에 쓰기 없음
+
+### 검증 방법
+
+```bash
+# 1. 기존 Java 앱으로 설정 저장 후 DB 덤프
+sqlite3 ~/db/dynamic_data.db "SELECT value FROM board_config WHERE key='device_config'" > java_device.json
+
+# 2. 새 Python 앱으로 동일 설정 저장 후 DB 덤프
+sqlite3 ~/db/dynamic_data.db "SELECT value FROM board_config WHERE key='device_config'" > python_device.json
+
+# 3. JSON 비교 (필드 순서 무시)
+python3 -c "
+import json
+a = json.loads(open('java_device.json').read())
+b = json.loads(open('python_device.json').read())
+print('MATCH' if a == b else 'MISMATCH')
+print('Diff keys:', set(a.keys()) ^ set(b.keys()))
+"
+```
diff --git a/docs/dpworldapp_schema_handoff/device_schema_v2.json b/docs/dpworldapp_schema_handoff/device_schema_v2.json
new file mode 100644
index 0000000..5e1ff7c
--- /dev/null
+++ b/docs/dpworldapp_schema_handoff/device_schema_v2.json
@@ -0,0 +1,285 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://dpworld/schemas/device_v2.json",
+  "title": "Device configuration (schema v2 — flat 정규화)",
+  "description": "Web Configurator ↔ dpworldapp 합의 schema. 옵션 B (Medium): type 정규화 + naming 일관성 + enum 명시, flat 구조 유지. 본 schema 는 협의용 (안) — 채택 후 양측 동시 도입 예정.",
+  "type": "object",
+  "required": [
+    "schema_version",
+    "wifi_static",
+    "eth_ip",
+    "protocol_server_ip",
+    "protocol_server_port"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "schema_version": {
+      "type": "integer",
+      "const": 2,
+      "description": "본 schema 버전. v1 (legacy on/off string) ↔ v2 호환 정책은 spec §5.1 참조."
+    },
+
+    "wifi_static": {
+      "type": "boolean",
+      "default": false,
+      "description": "WiFi 정적 IP 사용 여부. v1 의 \"on\"/\"off\" → v2 의 true/false. Reader 측 deserializer 는 v1 형식도 관용 수용."
+    },
+    "wifi_ip": {
+      "type": "string",
+      "format": "ipv4",
+      "description": "WiFi 인터페이스 IP 주소 (정적 모드 시 사용)."
+    },
+    "wifi_netmask": {
+      "type": "string",
+      "format": "ipv4",
+      "description": "WiFi 서브넷 마스크."
+    },
+    "wifi_gateway": {
+      "type": "string",
+      "format": "ipv4",
+      "description": "WiFi 게이트웨이."
+    },
+    "wifi_dns1": {
+      "type": "string",
+      "format": "ipv4",
+      "description": "WiFi DNS 1."
+    },
+    "wifi_dns2": {
+      "type": "string",
+      "format": "ipv4",
+      "description": "WiFi DNS 2."
+    },
+    "wifi_country_code": {
+      "type": "string",
+      "pattern": "^[A-Z]{2}$",
+      "default": "KR",
+      "description": "WiFi 국가 코드 (ISO 3166-1 alpha-2)."
+    },
+
+    "eth_ip": {
+      "type": "string",
+      "format": "ipv4",
+      "description": "Ethernet IP 주소 (관리 인터페이스)."
+    },
+    "eth_netmask": {
+      "type": "string",
+      "format": "ipv4",
+      "description": "Ethernet 서브넷 마스크."
+    },
+    "eth_gateway": {
+      "type": "string",
+      "format": "ipv4",
+      "description": "Ethernet 게이트웨이."
+    },
+
+    "lte_ip": {
+      "type": "string",
+      "format": "ipv4",
+      "description": "LTE 인터페이스 IP."
+    },
+    "lte_netmask": {
+      "type": "string",
+      "format": "ipv4",
+      "description": "LTE 서브넷 마스크."
+    },
+    "lte_gateway": {
+      "type": "string",
+      "format": "ipv4",
+      "description": "LTE 게이트웨이."
+    },
+    "lte_port": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 65535,
+      "description": "LTE 모뎀 포트. v1 의 string \"534\" → v2 의 integer 534."
+    },
+    "lte_server_ip": {
+      "type": "string",
+      "format": "ipv4",
+      "description": "LTE 서버 IP."
+    },
+    "lte_server_port": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 65535,
+      "description": "LTE 서버 포트. v1 의 string \"20111\" → v2 의 integer 20111."
+    },
+
+    "protocol_server_ip": {
+      "type": "string",
+      "format": "ipv4",
+      "description": "Protocol 서버 IP (RTLS 데이터 송신 대상)."
+    },
+    "protocol_server_port": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 65535,
+      "description": "Protocol 서버 포트."
+    },
+    "update_server_ip": {
+      "type": "string",
+      "format": "ipv4",
+      "description": "Firmware/Config 업데이트 서버 IP."
+    },
+    "update_server_port": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 65535,
+      "description": "업데이트 서버 포트."
+    },
+    "rtcm_server_ip": {
+      "type": "string",
+      "format": "ipv4",
+      "description": "RTCM 보정 서버 IP (GNSS RTK)."
+    },
+    "rtcm_server_port": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 65535,
+      "description": "RTCM 서버 포트."
+    },
+    "opc_ua_server_ip": {
+      "type": "string",
+      "format": "ipv4",
+      "description": "OPC-UA 서버 IP."
+    },
+    "opc_ua_server_port": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 65535,
+      "description": "OPC-UA 서버 포트."
+    },
+    "modbus_server_ip": {
+      "type": "string",
+      "format": "ipv4",
+      "description": "Modbus 서버 IP."
+    },
+    "modbus_server_port": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 65535,
+      "description": "Modbus 서버 포트."
+    },
+
+    "can_bus_type": {
+      "type": "string",
+      "enum": ["extended", "standard"],
+      "default": "extended",
+      "description": "CAN bus 타입."
+    },
+    "can_baudrate": {
+      "type": "integer",
+      "enum": [100, 250, 500, 1000],
+      "description": "CAN 통신 속도 (kbps). 운영 ground truth 일치."
+    },
+
+    "rs485_mode": {
+      "type": "string",
+      "enum": ["half", "full"],
+      "default": "half",
+      "description": "RS-485 통신 모드."
+    },
+    "rs485_baudrate": {
+      "type": "integer",
+      "enum": [1200, 2400, 4800, 9600, 19200, 38400, 57600, 115200],
+      "default": 9600,
+      "description": "RS-485 통신 속도 (bps)."
+    },
+    "rs485_databits": {
+      "type": "integer",
+      "enum": [5, 6, 7, 8, 9],
+      "default": 8,
+      "description": "RS-485 데이터 비트."
+    },
+    "rs485_parity": {
+      "type": "string",
+      "enum": ["no", "even", "odd"],
+      "default": "no",
+      "description": "RS-485 패리티."
+    },
+    "rs485_stopbits": {
+      "type": "integer",
+      "enum": [0, 1, 2],
+      "default": 1,
+      "description": "RS-485 정지 비트."
+    },
+
+    "imu_remap_x": {
+      "type": "string",
+      "enum": ["x", "y", "z"],
+      "default": "x",
+      "description": "IMU X 축 매핑."
+    },
+    "imu_remap_y": {
+      "type": "string",
+      "enum": ["x", "y", "z"],
+      "default": "y",
+      "description": "IMU Y 축 매핑."
+    },
+    "imu_remap_z": {
+      "type": "string",
+      "enum": ["x", "y", "z"],
+      "default": "z",
+      "description": "IMU Z 축 매핑."
+    },
+    "imu_remap_x_sign": {
+      "type": "string",
+      "enum": ["plus", "minus"],
+      "default": "plus",
+      "description": "IMU X 축 부호."
+    },
+    "imu_remap_y_sign": {
+      "type": "string",
+      "enum": ["plus", "minus"],
+      "default": "plus",
+      "description": "IMU Y 축 부호."
+    },
+    "imu_remap_z_sign": {
+      "type": "string",
+      "enum": ["plus", "minus"],
+      "default": "plus",
+      "description": "IMU Z 축 부호."
+    },
+
+    "log_save": {
+      "type": "boolean",
+      "default": true,
+      "description": "로그 저장 여부. v1 의 \"on\"/\"off\" → v2 의 true/false."
+    },
+    "log_max_size": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "로그 파일 최대 크기 (MB)."
+    },
+    "log_max_duration": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "로그 파일 최대 보관 기간 (일)."
+    },
+
+    "ssid_list": {
+      "type": "array",
+      "description": "WiFi 연결 후보 SSID 목록 (우선순위 순). v1 의 'WIFI_SSID' upper-case → v2 의 ssid_list snake_case.",
+      "items": {
+        "type": "object",
+        "required": ["wifi_ssid", "wifi_security"],
+        "additionalProperties": false,
+        "properties": {
+          "wifi_ssid": {
+            "type": "string",
+            "description": "SSID 이름."
+          },
+          "wifi_passwd": {
+            "type": "string",
+            "description": "WiFi 비밀번호. security 가 'none' 이면 빈 string 가능."
+          },
+          "wifi_security": {
+            "type": "string",
+            "enum": ["wpa/wpa2", "wpa3", "wep", "none"],
+            "description": "WiFi 보안 방식."
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/docs/dpworldapp_schema_handoff/device_schema_v3.json b/docs/dpworldapp_schema_handoff/device_schema_v3.json
new file mode 100644
index 0000000..153be79
--- /dev/null
+++ b/docs/dpworldapp_schema_handoff/device_schema_v3.json
@@ -0,0 +1,174 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://dpworld/schemas/device_v3.json",
+  "title": "Device configuration (schema v3 — nested 재설계)",
+  "description": "Web Configurator ↔ dpworldapp 옵션 C (Aggressive). v2 의 type 정규화 + naming 일관 + Nested grouping. ★ 큰 BC break — 양쪽 소비자 전면 재설계 필요. 협의 통과 가능성 낮음. future ideal 로 제시.",
+  "type": "object",
+  "required": ["schema_version", "network", "servers"],
+  "additionalProperties": false,
+  "properties": {
+    "schema_version": {
+      "type": "integer",
+      "const": 3,
+      "description": "본 schema 버전 (nested 재설계)."
+    },
+
+    "network": {
+      "type": "object",
+      "required": ["wifi", "eth"],
+      "additionalProperties": false,
+      "properties": {
+        "wifi": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "static": {"type": "boolean", "default": false, "description": "정적 IP 사용 여부."},
+            "ip": {"type": "string", "format": "ipv4"},
+            "netmask": {"type": "string", "format": "ipv4"},
+            "gateway": {"type": "string", "format": "ipv4"},
+            "dns1": {"type": "string", "format": "ipv4"},
+            "dns2": {"type": "string", "format": "ipv4"},
+            "country_code": {"type": "string", "pattern": "^[A-Z]{2}$", "default": "KR"},
+            "ssid_list": {
+              "type": "array",
+              "description": "WiFi 연결 후보 SSID 목록.",
+              "items": {
+                "type": "object",
+                "required": ["ssid", "security"],
+                "additionalProperties": false,
+                "properties": {
+                  "ssid": {"type": "string", "description": "SSID 이름."},
+                  "password": {"type": "string", "description": "WiFi 비밀번호."},
+                  "security": {
+                    "type": "string",
+                    "enum": ["wpa/wpa2", "wpa3", "wep", "none"]
+                  }
+                }
+              }
+            }
+          }
+        },
+        "eth": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "ip": {"type": "string", "format": "ipv4"},
+            "netmask": {"type": "string", "format": "ipv4"},
+            "gateway": {"type": "string", "format": "ipv4"}
+          }
+        },
+        "lte": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "ip": {"type": "string", "format": "ipv4"},
+            "netmask": {"type": "string", "format": "ipv4"},
+            "gateway": {"type": "string", "format": "ipv4"},
+            "port": {"type": "integer", "minimum": 1, "maximum": 65535, "description": "LTE 모뎀 포트."},
+            "server": {
+              "type": "object",
+              "additionalProperties": false,
+              "properties": {
+                "ip": {"type": "string", "format": "ipv4"},
+                "port": {"type": "integer", "minimum": 1, "maximum": 65535}
+              }
+            }
+          }
+        }
+      }
+    },
+
+    "servers": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "원격 서버 엔드포인트 (server.ip + server.port 쌍).",
+      "properties": {
+        "protocol": {"$ref": "#/$defs/ServerEndpoint", "description": "Protocol 데이터 송신 서버."},
+        "update": {"$ref": "#/$defs/ServerEndpoint", "description": "Firmware/Config 업데이트 서버."},
+        "rtcm": {"$ref": "#/$defs/ServerEndpoint", "description": "RTCM 보정 서버."},
+        "opc_ua": {"$ref": "#/$defs/ServerEndpoint", "description": "OPC-UA 서버."},
+        "modbus": {"$ref": "#/$defs/ServerEndpoint", "description": "Modbus 서버."}
+      }
+    },
+
+    "serial": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "can": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "bus_type": {"type": "string", "enum": ["extended", "standard"], "default": "extended"},
+            "baudrate": {"type": "integer", "enum": [100, 250, 500, 1000]}
+          }
+        },
+        "rs485": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "mode": {"type": "string", "enum": ["half", "full"], "default": "half"},
+            "baudrate": {"type": "integer", "default": 9600},
+            "databits": {"type": "integer", "enum": [5,6,7,8,9], "default": 8},
+            "parity": {"type": "string", "enum": ["no","even","odd"], "default": "no"},
+            "stopbits": {"type": "integer", "enum": [0,1,2], "default": 1}
+          }
+        }
+      }
+    },
+
+    "hardware": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "imu": {
+          "type": "object",
+          "additionalProperties": false,
+          "description": "IMU 축 매핑 + 부호.",
+          "properties": {
+            "remap": {
+              "type": "object",
+              "additionalProperties": false,
+              "properties": {
+                "x": {"type": "string", "enum": ["x","y","z"], "default": "x"},
+                "y": {"type": "string", "enum": ["x","y","z"], "default": "y"},
+                "z": {"type": "string", "enum": ["x","y","z"], "default": "z"}
+              }
+            },
+            "sign": {
+              "type": "object",
+              "additionalProperties": false,
+              "properties": {
+                "x": {"type": "string", "enum": ["plus","minus"], "default": "plus"},
+                "y": {"type": "string", "enum": ["plus","minus"], "default": "plus"},
+                "z": {"type": "string", "enum": ["plus","minus"], "default": "plus"}
+              }
+            }
+          }
+        }
+      }
+    },
+
+    "log": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "save": {"type": "boolean", "default": true, "description": "로그 저장 여부."},
+        "max_size": {"type": "integer", "minimum": 1, "description": "최대 크기 (MB)."},
+        "max_duration": {"type": "integer", "minimum": 1, "description": "최대 보관 기간 (일)."}
+      }
+    }
+  },
+
+  "$defs": {
+    "ServerEndpoint": {
+      "type": "object",
+      "required": ["ip", "port"],
+      "additionalProperties": false,
+      "properties": {
+        "ip": {"type": "string", "format": "ipv4"},
+        "port": {"type": "integer", "minimum": 1, "maximum": 65535}
+      }
+    }
+  }
+}
diff --git a/docs/dpworldapp_schema_handoff/migration_examples.md b/docs/dpworldapp_schema_handoff/migration_examples.md
new file mode 100644
index 0000000..075118e
--- /dev/null
+++ b/docs/dpworldapp_schema_handoff/migration_examples.md
@@ -0,0 +1,679 @@
+# Migration 예시 — v1 → v2 → v3 변환
+
+본 문서는 `device_config` / `protocol_config` 의 **schema 버전별 변환 예시** 와 양측 (Web Configurator, dpworldapp) 의 **변환 함수 spec** 을 제공합니다.
+
+협의 spec 본문: `docs/config-spec/config-contract-proposal.md`
+
+---
+
+## 1. 변환 순서 + 호환성 정책
+
+```
+v1 (현재 — config_device.json default)
+  │  Phase 1 ~ 3 — Boolean/Integer/Enum 정규화
+  ▼
+v2 (옵션 B — flat 정규화, 권장)
+  │  Phase 5 — nested 재설계 (협의 후 결정)
+  ▼
+v3 (옵션 C — nested, future ideal)
+```
+
+**호환성 약속** (spec §5.7):
+- 양측이 항상 **현재 + 직전** schema_version read 가능
+- write 는 최신 schema 만
+
+**Reader-level deserializer** 가 옛 형식 (`"on"`, `"534"`) 도 관용 수용. Writer 는 신규 형식만.
+
+---
+
+## 2. v1 → v2 변환 (device)
+
+### 2.1 변환 예시 — Boolean 필드
+
+**v1 (현재)**:
+```json
+{
+  "wifi_static": "off",
+  "log_save": "on"
+}
+```
+
+**v2 변환 후**:
+```json
+{
+  "schema_version": 2,
+  "wifi_static": false,
+  "log_save": true
+}
+```
+
+**변환 규칙**:
+| v1 값 | v2 값 |
+|---|---|
+| `"on"` | `true` |
+| `"off"` | `false` |
+| `true` | `true` (이미 v2) |
+| `false` | `false` (이미 v2) |
+| 그 외 | 에러 (validation reject 또는 default 사용) |
+
+### 2.2 변환 예시 — Integer 필드
+
+**v1**:
+```json
+{
+  "lte_port": "534",
+  "lte_server_port": "20111"
+}
+```
+
+**v2**:
+```json
+{
+  "lte_port": 534,
+  "lte_server_port": 20111
+}
+```
+
+**변환 규칙**:
+| v1 값 | v2 값 |
+|---|---|
+| digit string (예: `"534"`) | `int(s)` |
+| int (예: `534`) | 그대로 |
+| 비-digit string | 에러 |
+
+### 2.3 변환 예시 — Naming (WIFI_SSID → ssid_list)
+
+**v1**:
+```json
+{
+  "WIFI_SSID": [
+    {"wifi_ssid": "mobidigm", "wifi_passwd": "mobidigm", "wifi_security": "wpa/wpa2"}
+  ]
+}
+```
+
+**v2**:
+```json
+{
+  "ssid_list": [
+    {"wifi_ssid": "mobidigm", "wifi_passwd": "mobidigm", "wifi_security": "wpa/wpa2"}
+  ]
+}
+```
+
+**참고**: 옵션 B 에서는 array element 의 키 (`wifi_ssid`/`wifi_passwd`/`wifi_security`) 는 그대로. 옵션 C 에서는 `ssid`/`password`/`security` 로 추가 정규화.
+
+### 2.4 device v1 → v2 전체 예시
+
+**v1 (default `/var/www/html/config_device.json`)**:
+```json
+{
+  "wifi_static": "off",
+  "wifi_ip": "192.168.78.74",
+  "wifi_country_code": "KR",
+  "eth_ip": "192.168.55.55",
+  "lte_port": "534",
+  "lte_server_port": "20111",
+  "protocol_server_ip": "192.168.78.2",
+  "protocol_server_port": 8080,
+  "can_baudrate": 1000,
+  "rs485_databits": 8,
+  "rs485_stopbits": 0,
+  "imu_remap_x": "x",
+  "log_save": "on",
+  "log_max_size": 100,
+  "WIFI_SSID": [
+    {"wifi_ssid": "mobidigm", "wifi_passwd": "mobidigm", "wifi_security": "wpa/wpa2"}
+  ]
+}
+```
+
+**v2 변환 후**:
+```json
+{
+  "schema_version": 2,
+  "wifi_static": false,
+  "wifi_ip": "192.168.78.74",
+  "wifi_country_code": "KR",
+  "eth_ip": "192.168.55.55",
+  "lte_port": 534,
+  "lte_server_port": 20111,
+  "protocol_server_ip": "192.168.78.2",
+  "protocol_server_port": 8080,
+  "can_baudrate": 1000,
+  "rs485_databits": 8,
+  "rs485_stopbits": 0,
+  "imu_remap_x": "x",
+  "log_save": true,
+  "log_max_size": 100,
+  "ssid_list": [
+    {"wifi_ssid": "mobidigm", "wifi_passwd": "mobidigm", "wifi_security": "wpa/wpa2"}
+  ]
+}
+```
+
+---
+
+## 3. v1 → v2 변환 (protocol)
+
+### 3.1 변환 예시 — Boolean + ai/di
+
+**v1**:
+```json
+{
+  "dr_on": "on",
+  "odo_on": "on",
+  "ai0": "1",
+  "ai3": "0"
+}
+```
+
+**v2**:
+```json
+{
+  "dr_on": true,
+  "odo_on": true,
+  "ai0": true,
+  "ai3": false
+}
+```
+
+### 3.2 변환 예시 — MEID 정규화
+
+**v1 (default 는 int)**:
+```json
+{"MEID": 7000}
+```
+
+**v2**:
+```json
+{"meid": 7000}
+```
+
+### 3.3 변환 예시 — odo_speed.shift Integer
+
+**v1**:
+```json
+{
+  "odo_speed": {
+    "source": "CAN",
+    "id": "0x18FEFC28",
+    "shift": "8",
+    "mask": "0xffff",
+    "expr": "x*0.05+10.0"
+  }
+}
+```
+
+**v2**:
+```json
+{
+  "odo_speed": {
+    "source": "CAN",
+    "id": "0x18FEFC28",
+    "shift": 8,
+    "mask": "0xffff",
+    "expr": "x*0.05+10.0"
+  }
+}
+```
+
+### 3.4 protocol v1 → v2 전체 예시
+
+**v1 일부**:
+```json
+{
+  "dev_type": "RTLS",
+  "version": "v1.0",
+  "dr_on": "on",
+  "odo_on": "on",
+  "MEID": 7000,
+  "protocol": "OPC-UA",
+  "ai0": "1",
+  "OPC_UA": [
+    {"field": "TMP1", "ns": "3", "addr": "1001", "odt": "integer", "dv": "-9", "expr": "x*10.0"}
+  ]
+}
+```
+
+**v2 변환**:
+```json
+{
+  "schema_version": 2,
+  "dev_type": "RTLS",
+  "version": "v1.0",
+  "dr_on": true,
+  "odo_on": true,
+  "meid": 7000,
+  "protocol": "OPC-UA",
+  "ai0": true,
+  "OPC_UA": [
+    {"field": "TMP1", "ns": 3, "addr": 1001, "odt": "integer", "dv": -9, "expr": "x*10.0"}
+  ]
+}
+```
+
+---
+
+## 4. v2 → v3 변환 (옵션 C 시점)
+
+### 4.1 device v2 → v3 — Nested grouping
+
+**v2 일부**:
+```json
+{
+  "schema_version": 2,
+  "wifi_static": false,
+  "wifi_ip": "192.168.78.74",
+  "wifi_country_code": "KR",
+  "eth_ip": "192.168.55.55",
+  "lte_port": 534,
+  "lte_server_ip": "104.208.105.62",
+  "lte_server_port": 20111,
+  "protocol_server_ip": "192.168.78.2",
+  "protocol_server_port": 8080,
+  "ssid_list": [
+    {"wifi_ssid": "mobidigm", "wifi_passwd": "mobidigm", "wifi_security": "wpa/wpa2"}
+  ]
+}
+```
+
+**v3 변환**:
+```json
+{
+  "schema_version": 3,
+  "network": {
+    "wifi": {
+      "static": false,
+      "ip": "192.168.78.74",
+      "country_code": "KR",
+      "ssid_list": [
+        {"ssid": "mobidigm", "password": "mobidigm", "security": "wpa/wpa2"}
+      ]
+    },
+    "eth": {
+      "ip": "192.168.55.55"
+    },
+    "lte": {
+      "port": 534,
+      "server": {"ip": "104.208.105.62", "port": 20111}
+    }
+  },
+  "servers": {
+    "protocol": {"ip": "192.168.78.2", "port": 8080}
+  }
+}
+```
+
+### 4.2 protocol v2 → v3
+
+**v2 일부**:
+```json
+{
+  "schema_version": 2,
+  "dev_type": "RTLS",
+  "version": "v1.0",
+  "dr_on": true,
+  "odo_on": true,
+  "heading_on": true,
+  "ai0": true, "ai1": false, "ai2": false, "ai3": false,
+  "two_byte_order": "big",
+  "four_byte_order": "big"
+}
+```
+
+**v3 변환**:
+```json
+{
+  "schema_version": 3,
+  "device": {
+    "type": "RTLS",
+    "version": "v1.0"
+  },
+  "features": {
+    "dr": true,
+    "odo": true,
+    "heading": true
+  },
+  "analog_input": {
+    "enabled": [true, false, false, false]
+  },
+  "byte_order": {
+    "two_byte": "big",
+    "four_byte": "big"
+  }
+}
+```
+
+---
+
+## 5. 양측 변환 함수 spec (pseudocode)
+
+### 5.1 Web Configurator (Python)
+
+```python
+# src/migrations.py — v1 → v2 (옵션 B 채택 가정)
+
+# Boolean 필드 변환 정책
+_BOOL_FIELDS_DEVICE = ("wifi_static", "log_save")
+_BOOL_FIELDS_PROTOCOL = (
+    "dr_on", "odo_on", "heading_on", "heading_imu_on",
+    "fix_mode_on", "can_input",
+    "ai0", "ai1", "ai2", "ai3",
+    "di0", "di1", "di2", "di3",
+)
+_INT_FIELDS_DEVICE = ("lte_port", "lte_server_port")
+_RENAME_DEVICE = {"WIFI_SSID": "ssid_list"}
+_RENAME_PROTOCOL = {"MEID": "meid"}
+
+
+def _normalize_bool(v):
+    """v1 'on'/'off' 또는 v2 boolean 모두 v2 boolean 으로."""
+    if isinstance(v, bool):
+        return v
+    if isinstance(v, str):
+        s = v.strip().lower()
+        if s == "on":   return True
+        if s == "off":  return False
+        if s == "1":    return True
+        if s == "0":    return False
+    raise ValueError(f"unrecognized boolean value: {v!r}")
+
+
+def _normalize_int(v):
+    """digit string 또는 int 을 int 로."""
+    if isinstance(v, bool):
+        raise ValueError("bool not allowed for int field")
+    if isinstance(v, int):
+        return v
+    if isinstance(v, str) and v.strip().lstrip("-").isdigit():
+        return int(v)
+    raise ValueError(f"not a valid int: {v!r}")
+
+
+def migrate_device_v1_to_v2(cfg: dict) -> dict:
+    """device_config v1 → v2 변환. idempotent (v2 그대로 두면 no-op)."""
+    out = dict(cfg)
+
+    if out.get("schema_version") == 2:
+        return out  # 이미 v2
+
+    # Boolean
+    for k in _BOOL_FIELDS_DEVICE:
+        if k in out:
+            out[k] = _normalize_bool(out[k])
+
+    # Integer
+    for k in _INT_FIELDS_DEVICE:
+        if k in out:
+            out[k] = _normalize_int(out[k])
+
+    # Rename
+    for old, new in _RENAME_DEVICE.items():
+        if old in out:
+            out[new] = out.pop(old)
+
+    # odo_speed.shift / odo_direction.shift 는 protocol_config 에 있으므로 device 에는 없음
+    # (참고용 — protocol 변환은 별도 함수)
+
+    out["schema_version"] = 2
+    return out
+
+
+def migrate_protocol_v1_to_v2(cfg: dict) -> dict:
+    """protocol_config v1 → v2 변환."""
+    out = dict(cfg)
+
+    if out.get("schema_version") == 2:
+        return out
+
+    # Boolean
+    for k in _BOOL_FIELDS_PROTOCOL:
+        if k in out:
+            out[k] = _normalize_bool(out[k])
+
+    # Rename
+    for old, new in _RENAME_PROTOCOL.items():
+        if old in out:
+            out[new] = out.pop(old)
+
+    # Nested shift Integer
+    for nk in ("odo_speed", "odo_direction"):
+        if isinstance(out.get(nk), dict) and "shift" in out[nk]:
+            out[nk]["shift"] = _normalize_int(out[nk]["shift"])
+
+    # Array element Integer
+    for arr_key in ("OPC_UA", "CAN", "MODBUS"):
+        if isinstance(out.get(arr_key), list):
+            for elem in out[arr_key]:
+                if not isinstance(elem, dict):
+                    continue
+                for k in ("ns", "addr", "shift", "dv"):
+                    if k in elem and not isinstance(elem[k], int):
+                        elem[k] = _normalize_int(elem[k])
+
+    out["schema_version"] = 2
+    return out
+
+
+# v2 → v3 변환 (옵션 C 채택 시)
+def migrate_device_v2_to_v3(cfg: dict) -> dict:
+    """device_config v2 → v3 변환. nested 재설계."""
+    if cfg.get("schema_version") == 3:
+        return cfg
+
+    out = {"schema_version": 3}
+    network = {}
+
+    # wifi
+    wifi = {}
+    if "wifi_static" in cfg:        wifi["static"] = cfg["wifi_static"]
+    if "wifi_ip" in cfg:             wifi["ip"] = cfg["wifi_ip"]
+    if "wifi_netmask" in cfg:        wifi["netmask"] = cfg["wifi_netmask"]
+    if "wifi_gateway" in cfg:        wifi["gateway"] = cfg["wifi_gateway"]
+    if "wifi_dns1" in cfg:           wifi["dns1"] = cfg["wifi_dns1"]
+    if "wifi_dns2" in cfg:           wifi["dns2"] = cfg["wifi_dns2"]
+    if "wifi_country_code" in cfg:   wifi["country_code"] = cfg["wifi_country_code"]
+    if "ssid_list" in cfg:
+        # ssid_list element 도 key rename
+        wifi["ssid_list"] = [
+            {
+                "ssid":     e.get("wifi_ssid"),
+                "password": e.get("wifi_passwd"),
+                "security": e.get("wifi_security"),
+            }
+            for e in cfg["ssid_list"]
+        ]
+    if wifi:
+        network["wifi"] = wifi
+
+    # eth
+    eth = {}
+    if "eth_ip" in cfg:        eth["ip"] = cfg["eth_ip"]
+    if "eth_netmask" in cfg:   eth["netmask"] = cfg["eth_netmask"]
+    if "eth_gateway" in cfg:   eth["gateway"] = cfg["eth_gateway"]
+    if eth:
+        network["eth"] = eth
+
+    # lte
+    lte = {}
+    if "lte_ip" in cfg:           lte["ip"] = cfg["lte_ip"]
+    if "lte_netmask" in cfg:      lte["netmask"] = cfg["lte_netmask"]
+    if "lte_gateway" in cfg:      lte["gateway"] = cfg["lte_gateway"]
+    if "lte_port" in cfg:         lte["port"] = cfg["lte_port"]
+    if "lte_server_ip" in cfg or "lte_server_port" in cfg:
+        lte["server"] = {
+            "ip":   cfg.get("lte_server_ip"),
+            "port": cfg.get("lte_server_port"),
+        }
+    if lte:
+        network["lte"] = lte
+
+    if network:
+        out["network"] = network
+
+    # servers
+    servers = {}
+    for prefix, key in [
+        ("protocol", "protocol"),
+        ("update", "update"),
+        ("rtcm", "rtcm"),
+        ("opc_ua", "opc_ua"),
+        ("modbus", "modbus"),
+    ]:
+        ip_k = f"{prefix}_server_ip"
+        port_k = f"{prefix}_server_port"
+        if ip_k in cfg or port_k in cfg:
+            servers[key] = {"ip": cfg.get(ip_k), "port": cfg.get(port_k)}
+    if servers:
+        out["servers"] = servers
+
+    # serial
+    serial = {}
+    can = {}
+    if "can_bus_type" in cfg:   can["bus_type"] = cfg["can_bus_type"]
+    if "can_baudrate" in cfg:   can["baudrate"] = cfg["can_baudrate"]
+    if can:
+        serial["can"] = can
+
+    rs485 = {}
+    for src, dst in [
+        ("rs485_mode", "mode"),
+        ("rs485_baudrate", "baudrate"),
+        ("rs485_databits", "databits"),
+        ("rs485_parity", "parity"),
+        ("rs485_stopbits", "stopbits"),
+    ]:
+        if src in cfg:
+            rs485[dst] = cfg[src]
+    if rs485:
+        serial["rs485"] = rs485
+
+    if serial:
+        out["serial"] = serial
+
+    # hardware.imu
+    imu_remap = {}
+    imu_sign = {}
+    for axis in ("x", "y", "z"):
+        if f"imu_remap_{axis}" in cfg:
+            imu_remap[axis] = cfg[f"imu_remap_{axis}"]
+        if f"imu_remap_{axis}_sign" in cfg:
+            imu_sign[axis] = cfg[f"imu_remap_{axis}_sign"]
+    if imu_remap or imu_sign:
+        out["hardware"] = {"imu": {}}
+        if imu_remap:
+            out["hardware"]["imu"]["remap"] = imu_remap
+        if imu_sign:
+            out["hardware"]["imu"]["sign"] = imu_sign
+
+    # log
+    log = {}
+    if "log_save" in cfg:         log["save"] = cfg["log_save"]
+    if "log_max_size" in cfg:     log["max_size"] = cfg["log_max_size"]
+    if "log_max_duration" in cfg: log["max_duration"] = cfg["log_max_duration"]
+    if log:
+        out["log"] = log
+
+    return out
+```
+
+### 5.2 dpworldapp (디바이스 측 config-reader 계약)
+
+디바이스 측 동작은 **.56의 배포 dpworldapp 바이너리 대조로 검증**한 아래 contract를
+충족하면 된다 (구현 언어/방식은 무관). 양측이 동일 의미를 보장하도록 동작만 명시한다:
+
+- **`schema_version`**: 정수로 read. 없으면 v1(레거시)로 간주.
+- **`wifi_static`** (boolean, v1 관용 수용): `true`/`false` 외에 문자열
+  `"on"`/`"true"`/`"1"` → `true`, `"off"`/`"false"`/`"0"` → `false` 로 해석.
+  그 외 값은 거부(invalid).
+- **`lte_port`** (string-or-integer 관용 수용): 정수 또는 숫자 문자열(`"5000"`)을
+  모두 정수로 read. 숫자가 아닌 문자열은 거부(invalid).
+
+> 위 관용 수용 규칙은 **reader 단계에서만** 적용되며, write 시점에는 정규(canonical)
+> 형식(boolean·integer)으로 저장한다.
+
+---
+
+## 6. 운영 시나리오
+
+### 6.1 양측 v1 → v2 동시 도입
+
+1. 양측 v1 호환 deserializer + v2 writer 동시 배포
+2. 디바이스 startup 시 양측이 v1 데이터 read 가능 → 메모리에서 v2 형식 유지
+3. 다음 write 시점에 v2 형식으로 DB 저장 + `schema_version=2` 명시
+4. 이후 read 시 schema_version=2 확인 → 변환 skip
+
+### 6.2 옛 fleet 의 v1 → v2 자동 migration
+
+- Web Configurator: `migrations.py` 의 `migrate_device_v1_to_v2` 자동 실행
+- dpworldapp: startup 시 `migrate_*_config()` 자동 실행
+- 양측 모두 idempotent — 여러 번 실행해도 안전
+
+### 6.3 v2 → v3 단계적 전환 (옵션 C 채택 시)
+
+- 양측이 v2 read + write 유지 (안정)
+- v3 호환 deserializer + writer 추가 배포
+- 운영자 결정 시점에 manual schema_version bump (또는 자동)
+- v2 → v3 변환 함수 양측 동시 실행
+
+---
+
+## 7. 검증 (양측 동일 spec)
+
+### 7.1 JSON Schema validation
+
+양측 모두 변환 후 `device_schema_v2.json` (또는 v3) 으로 validation:
+
+```python
+# Web Configurator
+import json
+import jsonschema  # 또는 자체 validator
+schema = json.load(open("docs/dpworldapp_schema_handoff/device_schema_v2.json"))
+jsonschema.validate(instance=device_config, schema=schema)
+```
+
+```java
+// dpworldapp (json-schema-validator 라이브러리 사용 예)
+JsonSchema schema = factory.getSchema(deviceSchemaV2Stream);
+Set<ValidationMessage> errors = schema.validate(deviceConfigJsonNode);
+if (!errors.isEmpty()) {
+    // reject
+}
+```
+
+### 7.2 검증 실패 시
+
+spec §5.8 정책: hard reject + 명시 에러.
+
+---
+
+## 8. 잠재 함정
+
+### 8.1 양측 동시 도입 안 됐을 때
+
+- Web Configurator v2, dpworldapp v1: dpworldapp 이 v2 형식 못 읽음 → BC deserializer 필수
+- Web Configurator v1, dpworldapp v2: Web Configurator 가 v2 read 못 함 → 위 마찬가지
+
+→ **양측 BC deserializer 가 안전망**
+
+### 8.2 array element 의 정규화 불일치
+
+옵션 B: `ssid_list[].wifi_ssid` 유지 vs 옵션 C: `ssid_list[].ssid`
+
+협의 시 array element 의 prefix 정규화도 같이 결정.
+
+### 8.3 정규화 후 enum mismatch
+
+예: dpworldapp 이 `wpa/wpa2` 만 알고 사용자가 `wpa3` 추가하면 reject.
+
+→ 새 enum value 추가는 RFC-like 프로세스 (spec §5.6) 거쳐야 함.
+
+---
+
+## 9. 변경 이력
+
+| 날짜 | 변경 | 출처 |
+|---|---|---|
+| 2026-06-10 | 초안 작성 | Web Configurator team |
+| (협의 후) | 옵션 채택 + 함수 spec 정밀화 | dpworldapp 팀 협의 결과 |
diff --git a/docs/dpworldapp_schema_handoff/protocol_schema_v2.json b/docs/dpworldapp_schema_handoff/protocol_schema_v2.json
new file mode 100644
index 0000000..b39a291
--- /dev/null
+++ b/docs/dpworldapp_schema_handoff/protocol_schema_v2.json
@@ -0,0 +1,222 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://dpworld/schemas/protocol_v2.json",
+  "title": "Protocol configuration (schema v2 — flat 정규화)",
+  "description": "Web Configurator ↔ dpworldapp 합의 schema. 옵션 B (Medium): boolean/integer 정규화 + naming 일관 (MEID→meid) + enum 명시.",
+  "type": "object",
+  "required": ["schema_version", "dev_type", "protocol"],
+  "additionalProperties": false,
+  "properties": {
+    "schema_version": {
+      "type": "integer",
+      "const": 2,
+      "description": "본 schema 버전."
+    },
+
+    "dev_type": {
+      "type": "string",
+      "enum": ["RTLS"],
+      "default": "RTLS",
+      "description": "디바이스 종류. 향후 enum 확장 가능."
+    },
+    "version": {
+      "type": "string",
+      "pattern": "^v\\d+\\.\\d+(\\.\\d+)?$",
+      "default": "v1.0",
+      "description": "Configuration 버전 string (free-form, schema_version 과 별개)."
+    },
+
+    "dr_on": {
+      "type": "boolean",
+      "default": true,
+      "description": "Dead Reckoning 활성. v1 의 \"on\"/\"off\" → v2 의 true/false."
+    },
+    "odo_on": {
+      "type": "boolean",
+      "default": false,
+      "description": "Odometer 활성."
+    },
+    "heading_on": {
+      "type": "boolean",
+      "default": true,
+      "description": "Heading 계산 활성."
+    },
+    "heading_imu_on": {
+      "type": "boolean",
+      "default": false,
+      "description": "IMU 기반 heading 활성."
+    },
+    "fix_mode_on": {
+      "type": "boolean",
+      "default": true,
+      "description": "Fix mode 활성."
+    },
+    "can_input": {
+      "type": "boolean",
+      "default": false,
+      "description": "CAN 입력 활성."
+    },
+
+    "speed_data": {
+      "type": "string",
+      "enum": ["CAN", "HW", "OPC-UA", "MODBUS"],
+      "description": "속도 데이터 source. odo_on=true 시 사용 가능 source 결정."
+    },
+
+    "equipment": {
+      "type": "string",
+      "enum": ["ITV", "FL", "CR"],
+      "description": "장비 종류. ★ 협의 항목: dpworldapp 팀 enum 전체 list 확정 필요 (spec §8 Q1)."
+    },
+    "equipment_id": {
+      "type": "string",
+      "pattern": "^\\d{2}$",
+      "description": "장비 ID (zero-padded 2-digit)."
+    },
+    "meid": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "MEID. v1 의 'MEID' upper-case (int) → v2 의 meid snake_case (int). default file 의 int 형식이 정답."
+    },
+
+    "protocol": {
+      "type": "string",
+      "enum": ["OPC-UA", "MODBUS", "CAN-BUS", "NONE"],
+      "description": "활성 protocol. 'NONE' 시 OPC_UA/CAN/MODBUS array 보존 (data loss 방지)."
+    },
+
+    "two_byte_order": {
+      "type": "string",
+      "enum": ["big", "little"],
+      "default": "big",
+      "description": "2-byte field 의 byte order."
+    },
+    "four_byte_order": {
+      "type": "string",
+      "enum": ["big", "little", "bigSwap", "littleSwap"],
+      "default": "big",
+      "description": "4-byte field 의 byte order."
+    },
+    "analog_input_level": {
+      "type": "string",
+      "enum": ["2", "4", "6"],
+      "description": "Analog input voltage level. string 으로 유지 — device 계약 정합."
+    },
+
+    "ai0": {"type": "boolean", "default": false, "description": "Analog Input 0 활성. v1 의 \"1\"/\"0\" → v2 의 true/false."},
+    "ai1": {"type": "boolean", "default": false, "description": "Analog Input 1 활성."},
+    "ai2": {"type": "boolean", "default": false, "description": "Analog Input 2 활성."},
+    "ai3": {"type": "boolean", "default": false, "description": "Analog Input 3 활성."},
+    "di0": {"type": "boolean", "default": false, "description": "Digital Input 0 활성."},
+    "di1": {"type": "boolean", "default": false, "description": "Digital Input 1 활성."},
+    "di2": {"type": "boolean", "default": false, "description": "Digital Input 2 활성."},
+    "di3": {"type": "boolean", "default": false, "description": "Digital Input 3 활성."},
+
+    "odo_speed": {
+      "$ref": "#/$defs/OdoField",
+      "description": "Odometer speed 필드 정의."
+    },
+    "odo_direction": {
+      "$ref": "#/$defs/OdoField",
+      "description": "Odometer direction 필드 정의."
+    },
+
+    "OPC_UA": {
+      "type": "array",
+      "description": "OPC-UA register mapping 목록. ★ 협의: array name 도 lowercase 통일 'opc_ua' 가능 (옵션 C 부분).",
+      "items": {"$ref": "#/$defs/OpcUaRegister"}
+    },
+    "CAN": {
+      "type": "array",
+      "description": "CAN-BUS register mapping 목록.",
+      "items": {"$ref": "#/$defs/CanRegister"}
+    },
+    "MODBUS": {
+      "type": "array",
+      "description": "Modbus register mapping 목록.",
+      "items": {"$ref": "#/$defs/ModbusRegister"}
+    }
+  },
+
+  "$defs": {
+    "OdoField": {
+      "type": "object",
+      "required": ["source"],
+      "additionalProperties": false,
+      "properties": {
+        "source": {
+          "type": "string",
+          "enum": ["CAN", "HW", "OPC-UA", "MODBUS"],
+          "description": "Odometer 데이터 source."
+        },
+        "id": {
+          "type": "string",
+          "pattern": "^0x[0-9a-fA-F]+$",
+          "description": "CAN ID (hex string, source='CAN' 시 사용). 가독성을 위해 hex string 유지."
+        },
+        "shift": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 63,
+          "description": "비트 shift. v1 의 string \"8\" → v2 의 integer 8."
+        },
+        "mask": {
+          "type": "string",
+          "pattern": "^0x[0-9a-fA-F]+$",
+          "description": "비트 mask (hex string). 가독성을 위해 hex string 유지."
+        },
+        "expr": {
+          "type": "string",
+          "maxLength": 256,
+          "description": "변환 expression DSL (`x*0.05+10.0`). forbidden chars 정책: v1.4.8 Stage 4 참조."
+        }
+      }
+    },
+
+    "OpcUaRegister": {
+      "type": "object",
+      "required": ["field", "ns", "addr", "odt"],
+      "additionalProperties": false,
+      "properties": {
+        "field": {"type": "string", "description": "Logical field 이름."},
+        "ns": {"type": "integer", "minimum": 0, "description": "OPC-UA namespace. v1 의 string \"3\" → v2 의 integer 3."},
+        "addr": {"type": "integer", "minimum": 0, "description": "OPC-UA node address. v1 의 string \"1001\" → v2 의 integer."},
+        "odt": {
+          "type": "string",
+          "enum": ["integer", "float", "float64", "boolean", "string"],
+          "description": "Output data type. ★ float64/float/string 은 v1.5.5+ 시점 dpworldapp 처리에 결함 — handoff doc 참조."
+        },
+        "dv": {"type": "integer", "description": "Default value. v1 의 string → v2 의 integer."},
+        "expr": {"type": "string", "maxLength": 256, "description": "변환 expression."}
+      }
+    },
+
+    "CanRegister": {
+      "type": "object",
+      "required": ["field", "id", "shift", "mask", "odt"],
+      "additionalProperties": false,
+      "properties": {
+        "field": {"type": "string"},
+        "id": {"type": "string", "pattern": "^0x[0-9a-fA-F]+$", "description": "CAN ID (hex string)."},
+        "shift": {"type": "integer", "minimum": 0, "maximum": 63},
+        "mask": {"type": "string", "pattern": "^0x[0-9a-fA-F]+$"},
+        "odt": {"type": "string", "enum": ["integer", "float", "float64", "boolean", "string"]},
+        "dv": {"type": "integer"},
+        "expr": {"type": "string", "maxLength": 256}
+      }
+    },
+
+    "ModbusRegister": {
+      "type": "object",
+      "required": ["field", "addr", "odt"],
+      "additionalProperties": false,
+      "properties": {
+        "field": {"type": "string"},
+        "addr": {"type": "integer", "minimum": 0, "description": "Modbus register address."},
+        "odt": {"type": "string", "enum": ["integer", "float", "float64", "boolean", "string"]},
+        "dv": {"type": "integer"},
+        "expr": {"type": "string", "maxLength": 256}
+      }
+    }
+  }
+}
diff --git a/docs/dpworldapp_schema_handoff/protocol_schema_v3.json b/docs/dpworldapp_schema_handoff/protocol_schema_v3.json
new file mode 100644
index 0000000..bdf6630
--- /dev/null
+++ b/docs/dpworldapp_schema_handoff/protocol_schema_v3.json
@@ -0,0 +1,172 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://dpworld/schemas/protocol_v3.json",
+  "title": "Protocol configuration (schema v3 — nested 재설계)",
+  "description": "Web Configurator ↔ dpworldapp 옵션 C. v2 의 정규화 + Nested grouping. ★ 큰 BC break. future ideal.",
+  "type": "object",
+  "required": ["schema_version", "device", "protocol"],
+  "additionalProperties": false,
+  "properties": {
+    "schema_version": {"type": "integer", "const": 3},
+
+    "device": {
+      "type": "object",
+      "required": ["type"],
+      "additionalProperties": false,
+      "properties": {
+        "type": {"type": "string", "enum": ["RTLS"], "description": "디바이스 종류."},
+        "version": {"type": "string", "pattern": "^v\\d+\\.\\d+(\\.\\d+)?$", "default": "v1.0"},
+        "equipment": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "type": {"type": "string", "enum": ["ITV","FL","CR"]},
+            "id": {"type": "string", "pattern": "^\\d{2}$"},
+            "meid": {"type": "integer", "minimum": 0}
+          }
+        }
+      }
+    },
+
+    "protocol": {
+      "type": "string",
+      "enum": ["OPC-UA", "MODBUS", "CAN-BUS", "NONE"],
+      "description": "활성 protocol."
+    },
+
+    "features": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "On/Off 기능 토글 — v2 의 dr_on/odo_on 등 boolean fields 그룹화.",
+      "properties": {
+        "dr": {"type": "boolean", "default": true, "description": "Dead Reckoning."},
+        "odo": {"type": "boolean", "default": false, "description": "Odometer."},
+        "heading": {"type": "boolean", "default": true, "description": "Heading 계산."},
+        "heading_imu": {"type": "boolean", "default": false, "description": "IMU 기반 heading."},
+        "fix_mode": {"type": "boolean", "default": true, "description": "Fix mode."},
+        "can_input": {"type": "boolean", "default": false, "description": "CAN 입력."}
+      }
+    },
+
+    "speed_data": {
+      "type": "string",
+      "enum": ["CAN", "HW", "OPC-UA", "MODBUS"],
+      "description": "속도 데이터 source."
+    },
+
+    "byte_order": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "v2 의 two_byte_order / four_byte_order 통합 그룹.",
+      "properties": {
+        "two_byte": {"type": "string", "enum": ["big","little"], "default": "big"},
+        "four_byte": {"type": "string", "enum": ["big","little","bigSwap","littleSwap"], "default": "big"}
+      }
+    },
+
+    "analog_input": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Analog input level + ai0~ai3.",
+      "properties": {
+        "level": {"type": "string", "enum": ["2","4","6"]},
+        "enabled": {
+          "type": "array",
+          "minItems": 4,
+          "maxItems": 4,
+          "description": "ai0~ai3 활성 여부 (boolean 4개).",
+          "items": {"type": "boolean"}
+        }
+      }
+    },
+
+    "digital_input": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "enabled": {
+          "type": "array",
+          "minItems": 4,
+          "maxItems": 4,
+          "description": "di0~di3 활성 여부.",
+          "items": {"type": "boolean"}
+        }
+      }
+    },
+
+    "odo": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Odometer 설정.",
+      "properties": {
+        "speed": {"$ref": "#/$defs/OdoField"},
+        "direction": {"$ref": "#/$defs/OdoField"}
+      }
+    },
+
+    "registers": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "v2 의 OPC_UA/CAN/MODBUS upper-case array → lowercase nested 그룹.",
+      "properties": {
+        "opc_ua": {"type": "array", "items": {"$ref": "#/$defs/OpcUaRegister"}},
+        "can": {"type": "array", "items": {"$ref": "#/$defs/CanRegister"}},
+        "modbus": {"type": "array", "items": {"$ref": "#/$defs/ModbusRegister"}}
+      }
+    }
+  },
+
+  "$defs": {
+    "OdoField": {
+      "type": "object",
+      "required": ["source"],
+      "additionalProperties": false,
+      "properties": {
+        "source": {"type": "string", "enum": ["CAN","HW","OPC-UA","MODBUS"]},
+        "id": {"type": "string", "pattern": "^0x[0-9a-fA-F]+$"},
+        "shift": {"type": "integer", "minimum": 0, "maximum": 63},
+        "mask": {"type": "string", "pattern": "^0x[0-9a-fA-F]+$"},
+        "expr": {"type": "string", "maxLength": 256}
+      }
+    },
+    "OpcUaRegister": {
+      "type": "object",
+      "required": ["field","ns","addr","odt"],
+      "additionalProperties": false,
+      "properties": {
+        "field": {"type": "string"},
+        "ns": {"type": "integer", "minimum": 0},
+        "addr": {"type": "integer", "minimum": 0},
+        "odt": {"type": "string", "enum": ["integer","float","float64","boolean","string"]},
+        "dv": {"type": "integer"},
+        "expr": {"type": "string", "maxLength": 256}
+      }
+    },
+    "CanRegister": {
+      "type": "object",
+      "required": ["field","id","shift","mask","odt"],
+      "additionalProperties": false,
+      "properties": {
+        "field": {"type": "string"},
+        "id": {"type": "string", "pattern": "^0x[0-9a-fA-F]+$"},
+        "shift": {"type": "integer", "minimum": 0, "maximum": 63},
+        "mask": {"type": "string", "pattern": "^0x[0-9a-fA-F]+$"},
+        "odt": {"type": "string", "enum": ["integer","float","float64","boolean","string"]},
+        "dv": {"type": "integer"},
+        "expr": {"type": "string", "maxLength": 256}
+      }
+    },
+    "ModbusRegister": {
+      "type": "object",
+      "required": ["field","addr","odt"],
+      "additionalProperties": false,
+      "properties": {
+        "field": {"type": "string"},
+        "addr": {"type": "integer", "minimum": 0},
+        "odt": {"type": "string", "enum": ["integer","float","float64","boolean","string"]},
+        "dv": {"type": "integer"},
+        "expr": {"type": "string", "maxLength": 256}
+      }
+    }
+  }
+}
diff --git a/docs/firmware-boot-hardening.md b/docs/firmware-boot-hardening.md
new file mode 100644
index 0000000..c03183b
--- /dev/null
+++ b/docs/firmware-boot-hardening.md
@@ -0,0 +1,133 @@
+# Firmware Boot Hardening — dpworld-network-apply-hardened.sh
+
+## 근본 원인 (PMU 워치독 재부팅 루프, 2026-06-15)
+
+`.56` (telechips-tcc8030-main)이 하드웨어 재부팅 루프에 진입했다. 타임라인:
+
+1. **트리거:** WiFi 국가 코드 변경이 DB에 대기(pending) 상태였다.
+2. **부팅 경로:** `dpworld-network-seed.service`가 펌웨어 내장
+   `/usr/bin/dpworld-network-apply.sh --boot`를 실행했다.
+3. **행(Hang):** 원본 펌웨어 스크립트가 `modprobe -r wlan`을 호출해
+   새 국가 코드로 WiFi 모듈을 라이브 재로드하려 했다. QCA6490
+   (cnss_pci / Qualcomm WLAN.HSP.1.1) 모듈에서 이 호출은 **무한
+   정지** 상태가 된다 — PCIe 링크 해제가 완료되지 않기 때문이다.
+4. **리셋:** Telechips PMU 하드웨어 워치독이 20초 후 발동 →
+   하드 리셋 → 2단계부터 루프 반복.
+5. **해결:** 하드닝 스크립트를 라이브 디바이스에 설치(~07:44). 이후
+   디바이스 안정 유지 중.
+
+## 하드닝 스크립트
+
+`deploy/dpworld-network-apply-hardened.sh`는 펌웨어 내장
+`dpworld-network-apply.sh`를 POSIX sh로 독립 재작성한 것이다.
+펌웨어 원본의 문서화된 6가지 문제(P1–P6, CC)를 수정하며,
+부팅 하드닝 수정은 **P2**에 해당한다.
+
+### P2: 부팅 시 modprobe -r 제거
+
+| | 펌웨어 원본 | 하드닝 버전 |
+|---|---|---|
+| `--boot` + 국가 코드 변경 | `reload_wifi_modules()` 호출 → `modprobe -r wlan` → **HANG** | `modprobe.d` 기록 + `reboot-required` 마커 설정; **modprobe 호출 없음** |
+| `--country-now` (전문가 모드) | 동일한 `reload_wifi_modules()` | 호환성을 위해 인자 수용하나 **재부팅 지연 처리** — 의도를 로그에 기록하고 `reboot-required` 유지; **라이브 모듈 언로드 없음** (v1.11.6: 행(hang)이 드라이버 언로드 경로 자체에서 발생하므로 가드된 전문가 재로드도 미탑재) |
+| 국가 코드 검증 | `wpa_cli get country` (wpa 설정 렌더링 기반 — 거짓 양성 가능) | `live_country()`: sysfs `/sys/module/wlan/parameters/country_code` → `iw reg get` 폴백 |
+
+### 세 가지 호출 모드
+
+```
+dpworld-network-apply-hardened.sh              # 온디맨드 (apply.service 또는 수동)
+dpworld-network-apply-hardened.sh --boot       # 부팅 시드 (라이브 터치 없음, /run 만 채움)
+dpworld-network-apply-hardened.sh --country-now # 호환 별칭 — 재부팅 지연 처리 (라이브 모듈 재로드 없음)
+```
+
+### reboot-required 마커
+
+- **설정:** 라디오의 실효 국가 코드(sysfs/iw reg)가 원하는 국가 코드와 다를 때
+  `${STATE_DIR}/reboot-required` (`/opt/dpworld-network/reboot-required`)에 생성.
+- **해제:** `live_country()` == 원하는 국가 코드일 때 — 즉, 업데이트된 `modprobe.d`가
+  모듈 로드 시점에 적용된 재부팅 이후.
+- Web Configurator는 이 마커를 읽어 대시보드에 "Reboot required"를 표시한다.
+
+### 빈 네트워크 부트스트랩 (v1.11.6)
+
+`--boot` 실행 시(및 온디맨드 시), `/home/root/network`가 비어 있으면
+`/run/systemd/network` 동기화 **전에** `/etc/dpworld/network-defaults`에서
+시드를 채운다 — 펌웨어의 팩토리/복구 부트스트랩을 복원하는 동작이다.
+디렉터리에 파일이 하나라도 있으면 절대 덮어쓰지 않는다.
+
+## v1.6 Country-Deferred 설계와의 관계
+
+v1.6에서 Python `apply_engine`이 도입됐으며, 이미 국가 코드 변경을
+`modprobe.d`로 지연 처리하고 동일 마커를 설정하도록 설계되어 있다.
+하드닝 스크립트는 **펌웨어 레이어**에서 동일하게 동작하는 계층을 추가한다 —
+Python 엔진이 실행 중이지 않은 경우(예: 새 플래시 직후나 서비스 크래시 시)에도
+펌웨어 자체 부팅 서비스가 modprobe hang을 유발할 수 없게 된다.
+
+두 레이어 모두 동일한 `REBOOT_MARK` 경로와 `MODPROBE_CONF`에 기록하므로
+멱등(idempotent)적이며 조합해서 사용할 수 있다. 하드닝 스크립트는 Python
+엔진의 `country-now` 마커(`/run/dpworld-network/country-now`)를 확인하여
+존재하면 `COUNTRY_NOW=1`로 승격한다 — 엔진 호환성을 유지하기 위함이다.
+v1.11.6부터는 `COUNTRY_NOW=1`이어도 하드닝 스크립트가 WiFi 모듈을 라이브
+언로드하지 **않는다**; 마커를 소비하고, 지연 처리를 로그에 남기며, `reboot-required`
+마커를 유지한다.
+
+## 설치 / 배포
+
+`scripts/deploy.ps1`은 배포 시마다 세 가지 아티팩트를 설치한다
+(해시 비교 방식, 멱등, 영속적 `/lib/systemd/system`):
+
+| 로컬 경로 | 디바이스 경로 |
+|---|---|
+| `deploy/dpworld-network-apply-hardened.sh` | `/usr/bin/dpworld-network-apply-hardened.sh` (chmod +x) |
+| `deploy/dpworld-network-apply.service.d/20-hardened.conf` | `/lib/systemd/system/dpworld-network-apply.service.d/20-hardened.conf` |
+| `deploy/dpworld-network-seed.service.d/20-hardened.conf` | `/lib/systemd/system/dpworld-network-seed.service.d/20-hardened.conf` |
+
+변경 후에는 `systemctl daemon-reload`가 호출된다. 세 경로 모두 영속적
+읽기-쓰기 오버레이(`/lib`) 위에 있어 재부팅 및 유저스페이스 펌웨어 재플래시
+이후에도 유지된다.
+
+펌웨어 원본 `/usr/bin/dpworld-network-apply.sh`는 **수정하지 않는다**.
+
+## 테스트
+
+`tests/test_firmware_apply_hardened.py` (23개 테스트, 표준 라이브러리만 사용, 디바이스 불필요):
+
+- 아티팩트가 예상 경로에 존재하는지 확인.
+- 스크립트 내 **`modprobe -r` 구문이 전혀 없음** (가드된 전문가 경로 포함).
+- `safe_module_reload` / `reload_wifi_modules` 헬퍼가 잔존하지 않음.
+- 빈 네트워크 부트스트랩(`seed_defaults_if_empty`)이 `/run` 동기화 전에
+  `/etc/dpworld/network-defaults`에서 시드를 채우는지 확인.
+- `reboot-required` 마커가 올바르게 설정 및 해제되는지 확인.
+- 마커 판단이 `live_country()`를 사용하는지 확인 (`wpa_cli get country` 아님).
+- 두 드롭인(drop-in) 모두 `ExecStart`가 하드닝 스크립트를 가리키는지 확인.
+- `deploy.ps1`이 스크립트, 두 드롭인을 설치하고 `daemon-reload`를 호출하는지 확인.
+- 세 아티팩트 모두 LF 줄 끝 (CRLF 없음).
+
+## 펌웨어 베이킹 (BSP) — 원본 교체 방법
+
+위 "설치 / 배포" 방식은 Web Configurator가 사용하는 **라이브 디바이스 오버라이드** 방식이다:
+`dpworld-network-apply-hardened.sh`를 별도 파일로 설치하고, 두 개의 systemd 드롭인을
+함께 설치하되, 펌웨어 원본 `/usr/bin/dpworld-network-apply.sh`는 손대지 않는다
+(실행 중인 디바이스는 펌웨어에 베이킹된 원본을 덮어쓸 수 없으며, 재플래시하면 원본이 복원된다).
+
+**펌웨어 이미지(BSP 베이킹) 시에는 대신 다음과 같이 진행한다:**
+
+1. `deploy/dpworld-network-apply-hardened.sh`의 내용을
+   `/usr/bin/dpworld-network-apply.sh`에 설치한다 — 즉, **원본 이름을 유지한 채
+   펌웨어 원본 스크립트를 교체**한다 (root:root, 0755, LF, POSIX /bin/sh).
+   하드닝 스크립트의 헤더에 이미 이 최종 이름이 명시되어 있다.
+2. 두 오버라이드 드롭인(`dpworld-network-apply.service.d/20-hardened.conf`와
+   `dpworld-network-seed.service.d/20-hardened.conf`)은 **베이킹하지 않는다**.
+   이 드롭인들은 라이브 디바이스 오버라이드 전용이며 `…-hardened.sh`를 가리키는데,
+   베이킹 이미지에는 해당 파일이 존재하지 않는다. 펌웨어 자체의
+   `dpworld-network-seed.service` / `dpworld-network-apply.service`가 이미
+   `/usr/bin/dpworld-network-apply.sh`를 호출하므로 하드닝 동작이 자동으로 적용된다.
+3. 하드닝 스크립트는 원본을 완전히 독립적으로 재작성한 것으로 (모든 호출 모드 포함:
+   인자 없음 / `--boot` / `--country-now`), 원본을 내부적으로 호출하지 않는다.
+   베이킹 전 펌웨어 원본과 diff를 수행해 펌웨어 고유 책임 사항이 누락되지 않았는지
+   확인할 것.
+
+**예상되는 동작 변경:** 하드닝 스크립트는 QCA6490 / cnss_pci 모듈에서 PMU 워치독
+재부팅 루프를 유발하는 라이브 `modprobe -r wlan` (국가 코드 라이브 재로드)을
+제거한다 — **이전의 `--country-now` 전문가 경로 포함** (v1.11.6). 국가 코드 변경은
+항상 **재부팅 지연 처리**된다: 새 국가 코드가 `modprobe.d`에 기록되고 `reboot-required`
+마커가 설정되며, 다음 재부팅 시에 적용된다. 이는 P2 수정이며 회귀가 아니다.
diff --git a/docs/firmware-ota-guide.md b/docs/firmware-ota-guide.md
new file mode 100644
index 0000000..6c51844
--- /dev/null
+++ b/docs/firmware-ota-guide.md
@@ -0,0 +1,131 @@
+# Firmware OTA 서브시스템 가이드
+
+> 살아있는 문서(living guide) — 앱 **v1.11.10** 기준. 코드: `src/firmware/*.py`.
+> 아키텍처 전체는 [`architecture.md`](architecture.md) §3.1.2.
+
+웹 UI 에서 펌웨어 ZIP 을 올려 dpworldapp 의 FW-MMI 채널(**TCP 8990**)로 플래시한다.
+플래시 전 config 백업, 재부팅 후 복원 검사까지 한 흐름으로 오케스트레이션한다.
+오케스트레이터는 `FirmwareController`(단일 인스턴스, thread-safe).
+
+---
+
+## 1. staging → flash 흐름
+
+```
+upload(ZIP) → stage(추출·sha256) → preflight(게이트) → flash(백업→전송→commit) → reboot → restore-check
+```
+
+1. **upload** — 요청 본문(펌웨어 ZIP)을 디스크 임시파일에 1MB 청크로 스트리밍.
+   버퍼는 **반드시 디스크 백엔드**(`/opt/fw_upload`) — `MemoryMax=48M`·no-swap 환경에서
+   tmpfs(`/tmp`)에 수백 MB 를 버퍼하면 cgroup OOM 으로 서비스가 죽는다.
+2. **stage** — ZIP 추출 → 확장자로 컴포넌트 자동 식별 → 각 파일 sha256 계산 → `/opt/fw_staging`.
+   zip-bomb/디스크 채움 가드(컴포넌트당·전체 압축 해제 크기 상한, 중복 파일명 거부, free-space 확인).
+   sidecar(`.fw_build_dates.json`)에 sha256+build_date 를 증분 기록 → 서비스 재시작 시
+   `_recover_staging` 가 sha256 재검증으로 안전 복구(불일치/미기록 파일은 거부·삭제).
+3. **preflight** — 게이트 체크리스트. critical 전부 통과해야 `ok`.
+4. **flash** — 백그라운드 워커가 백업 → 컴포넌트 전송 → commit → reboot 트리거.
+5. **restore-check** — 재부팅·재접속 후 운영자가 호출 → reseed 감지 시 config 복원 + dpworldapp 재시작.
+
+### 컴포넌트 식별 (확장자 → wire signature)
+
+| 확장자 | role | signature |
+|--------|------|-----------|
+| `.rom`  | bootloader | `BTL` |
+| `.img`  | kernel     | `KRN` |
+| `.ext4` | rootfs     | `RTF` |
+| `.dtb`  | dtb        | `DTB` |
+
+commit 은 별도 message-only 프레임(`CPU` signature, payload 0).
+
+---
+
+## 2. phase stepper (UI 상태)
+
+`fw_controller._PHASES` — 순서 의미 있음. 각 phase 는 `pending`/`active`/`done`/`error`,
+tier 는 `na`/`warn`/`ok`/`error` 로 매핑.
+
+| key | label | 의미 |
+|-----|-------|------|
+| `upload` | Upload | ZIP 수신 |
+| `verify` | Verify | sha256 계산/검증 |
+| `preflight` | Pre-flight | 게이트 체크 |
+| `backup` | Backup | 플래시 전 config 백업 |
+| `flash` | Flash | 컴포넌트 전송 |
+| `commit` | Commit | 슬롯 기록·커밋(마지막 컴포넌트 100% 시 시작) |
+| `reboot` | Reboot | 장치 재부팅(~10s) |
+| `config` | Config check | 재부팅 후 복원 검사 |
+
+상태머신: `idle`→`staging`→`staged`→`flashing`→`rebooting`→`done` (실패 시 `failed`).
+`flashing`/`staging`/`rebooting`/`done` 중에는 새 upload/flash 를 거부(race 방지).
+
+### preflight 게이트 항목
+
+- `staging`(컴포넌트 staged, **critical**)
+- `space`(여유공간 headroom 128MB, **critical**) — staged 바이트는 이미 디스크에 있으므로 중복 계상 안 함
+- `fw_port`(dpworldapp FW 포트 8990 도달, **critical**)
+- `db`(config DB 존재, non-critical — flash 는 되지만 restore-check 에 필요)
+- `slot`(활성 A/B 슬롯, informational)
+
+---
+
+## 3. config 안전 (config_safety)
+
+- **플래시 전 백업**: `backup_config` 가 `device_config`/`protocol_config`(+ DB)를
+  `/opt/config_backups/<타임스탬프>/` 로 저장. `backup` phase 에서 수행.
+- **재부팅 후 복원 검사**(`detect_and_restore`): 펌웨어 flash 가 config 를 factory default 로
+  reseed 했는지 **필드 단위로 감지**한다. "reseed" 판정 = 사용자 구별 필드가 대거 factory default
+  로 되돌아갔고(≥80%, 최소 2개) **새 편집 흔적이 전혀 없을 때**(do-no-harm). 이 경우에만 백업본을
+  **단일 트랜잭션**(BEGIN IMMEDIATE)으로 원자 복원하고 dpworldapp 을 재시작한다.
+  애매하면 복원하지 않음(fail-safe toward no-restore).
+- DB 가 읽기 불가/잠금/비어 있어도 500 으로 죽지 않고 사유를 보고한다.
+- restore-check 응답은 **정직성** 원칙: dpworldapp 재시작이 실제 실패하면
+  `restart_error` 를 명시하고 "재시작됨" 으로 거짓 보고하지 않는다(v1.5.4.5 STAB-2).
+
+---
+
+## 4. TCP 8990 dpworldapp 채널 (wire protocol)
+
+`fw_client` 가 `protocol` 프레이밍으로 8990 에 전송한다(`server.py`: `FW_HOST`/`FW_PORT`,
+기본 `127.0.0.1:8990`). dpworldapp 유닛 상태와 무관하게 서빙되는 포트다.
+
+- **프레임** = ASCII signature + 8바이트 little-endian size + `<size>` payload.
+  message-only step 은 size 0, payload 없음.
+- **ACK**: 성공 `SUCCESS`, 실패 `FW_FAIL`(deployed firmware behavior 확인). `classify_ack` 가 success 우선 분류.
+- **per-step ACK 타임아웃(ms)**: BTL/KRN/RTF 20000, DTB 10000, CPU(commit) 120000.
+
+---
+
+## 5. A/B rootfs 슬롯 + `/opt` 영속 (flash 생존)
+
+- 장치는 **A/B rootfs 슬롯**(p5=A, p6=B)을 가지며 flash 마다 flip 한다. 활성 슬롯은
+  `/proc/cmdline` 의 `root=` 로 best-effort 탐지(`_detect_slot`). status 에 `slot.before/after` 노출.
+- commit 성공 후 staging(`/opt/fw_staging`)은 공간 회수를 위해 삭제(슬롯에 이미 기록됨).
+  config 백업(`/opt/config_backups`)은 **보존**.
+- `/opt`(p12)·`/home/root`(p11)는 flash 후에도 **영속** — 업로드 버퍼·staging·config 백업·DB 가
+  여기에 있어 flash 를 견딘다. 단, web-configurator/AP 의 systemd 유닛 등 rootfs(`/lib`) 자산은
+  flash 마다 wipe 된다(§6).
+
+---
+
+## 6. ⚠ flash 생존 caveat
+
+펌웨어 flash 는 rootfs 슬롯을 통째로 교체하므로 rootfs(`/lib/systemd` 유닛, `/usr/bin` 스크립트)에
+설치된 web-configurator·Wi-Fi AP·network-apply 자산이 **매번 wipe** 된다. flash 후에는 이들을
+재설치해야 한다. 근본 자동화는 BSP 이미지 베이킹이 정답(백로그) — 메모리 `web-survives-flash` 참조.
+
+---
+
+## 7. API
+
+| Method | Path | 비고 |
+|--------|------|------|
+| `GET`  | `/api/firmware/status` | phase stepper + 컴포넌트 진행률 + slot + backup + message/error |
+| `POST` | `/api/firmware/preflight` | 게이트 체크리스트(`{ok, checks}`) |
+| `POST` | `/api/firmware/upload` | ZIP 스트리밍 업로드(per-read 소켓 타임아웃) → stage. `{ok, components}` |
+| `POST` | `/api/firmware/flash` | staged 컴포넌트 플래시 시작. 진행 중이면 409 |
+| `POST` | `/api/firmware/restore-check` | reseed 감지 → 복원 + dpworldapp 재시작 |
+
+오류는 sanitize 되어 내부 fs 경로/예외 내부를 노출하지 않는다(공간부족 507, 잘못된 ZIP 400 등).
+
+> **API 인증 없음**: :9090 은 현재 미인증(문서화된 threat boundary). 운영자 로그인은 설계
+> 백로그 — [`architecture.md`](architecture.md) §10.
diff --git a/docs/network-apply-engine-guide.md b/docs/network-apply-engine-guide.md
new file mode 100644
index 0000000..b55c3fa
--- /dev/null
+++ b/docs/network-apply-engine-guide.md
@@ -0,0 +1,1403 @@
+# Network Apply Engine (v1.6.0) — 종합 가이드 / Comprehensive Guide
+
+이 문서는 v1.6.0 에서 도입된 **Network Apply Engine**(`src/network/` Python 패키지)을 코드베이스 지식 0 인 엔지니어가 전체 기능과 흐름을 이해할 수 있도록 한 곳에 모은 종합 가이드다. 웹 configurator 에서 바꾼 네트워크 설정을 OS 에 안전하게 적용·검증·롤백하고, 운영 중에는 상시 watchdog 으로 네트워크 무결성을 자가복구하는 전 과정을 다룬다 — 동기와 설계 철학부터 아키텍처, 상태머신, 데이터 계약, HTTP API, 백업/롤백/포렌식, UI, 배포·운영, 그리고 실기기 수락 결과·보안 자세·한계까지를 단일 voice 로 통합했다. 모든 기술 서술은 실제 소스 파일을 근거로 하며 `file:line` 또는 함수명으로 참조를 단다.
+
+| 항목 | 값 |
+|---|---|
+| 도입 버전 | v1.6.0 |
+| 현재 상태 | **v1.11.10** 기준 main 출시 — 엔진은 shipped 라인의 일부다. v1.11.6 부터 country 경로의 live `modprobe -r` 가 완전히 제거되어 **reboot-deferred 단일화**(§3.3 참조, [firmware-boot-hardening.md](firmware-boot-hardening.md)). |
+| branch | `feature/v1.6-network-apply` (도입 당시) |
+| tag | `f9b3acc` (도입 당시) |
+| 대상 장비 | `.56` (192.168.55.56, telechips-tcc8030-main, 유선 eth1) |
+| 작성일 | 2026-06-14 (도입), 갱신 2026-06-20 |
+
+## 목차 / Table of Contents
+
+- [At a Glance / 한눈에 보기](#at-a-glance--한눈에-보기)
+- [1. Overview · Motivation · Features / 개요·동기·기능](#1-overview--motivation--features--개요동기기능)
+- [2. Architecture & Module Map / 아키텍처·모듈 지도](#2-architecture--module-map--아키텍처모듈-지도)
+- [3. Apply Flow & State Machine / 적용 흐름·상태머신](#3-apply-flow--state-machine--적용-흐름상태머신)
+- [4. 22-Field Contract & Byte-Exact Rendering / 22항목 계약·byte-exact 렌더](#4-22-field-contract--byte-exact-rendering--22항목-계약byte-exact-렌더)
+- [5. Watchdog & Self-Healing / 상시 감시·자가복구](#5-watchdog--self-healing--상시-감시자가복구)
+- [6. HTTP API Contract / HTTP API 계약](#6-http-api-contract--http-api-계약)
+- [7. Snapshot · Rollback · Journal · Forensics / 백업·롤백·저널·포렌식](#7-snapshot--rollback--journal--forensics--백업롤백저널포렌식)
+- [8. UI / 사용자 인터페이스](#8-ui--사용자-인터페이스)
+- [9. Deployment & Operations / 배포·운영](#9-deployment--operations--배포운영)
+- [10. Acceptance · Security · Known Limitations / 수락 결과·보안·한계·백로그](#10-acceptance--security--known-limitations--수락-결과보안한계백로그)
+- [관련 문서 / References](#관련-문서--references)
+
+## At a Glance / 한눈에 보기
+
+이 기능의 핵심 UX·안전 결정은 **Save(DB 만) 와 Apply(OS 반영) 의 분리**다. **Save** 는 변경을 SQLite `device_config` 에 기록만 하고(현행 동작 그대로 — dpworldapp 다음 재시작/재부팅 시 반영), **Apply** 는 그 DB 상태를 기준으로 dry-run diff 를 먼저 보여준 뒤 동의를 받아 상태머신을 통해 OS 에 즉시 반영·검증하고 실패 시 자동 롤백한다. eth1(웹·SSH 접속 경로) 변경은 장비 스스로 도달성을 증명할 수 없으므로 **운영자 confirm 이 곧 검증**이며, 90초 안에 새 IP 로 재접속해 확정하지 않으면 이전 IP 로 자동 롤백된다. 운영 중에는 30초 주기 watchdog 이 적용본(`network_config.json`)을 기준으로 무결성을 상시 보증한다.
+
+```mermaid
+flowchart TD
+    A["운영자: Wi-Fi / Ethernet / Server 설정 입력<br/>Save → DB device_config 기록"] --> B["Network → Apply & Status<br/>drift 배너: DB ≠ 적용본"]
+    B --> C{"변경 미리보기<br/>dry_run=true"}
+    C -->|"diff + 경고 뱃지<br/>(eth1 lockout / country reload / wifi 단절)"| D["적용 시작<br/>apply_async → apply_id (STARTED)"]
+    D --> E["VALIDATING → SNAPSHOT<br/>(적용 전 전체 백업 + DB 필드)"]
+    E --> F["WRITING (DB-first) → APPLYING<br/>(networkctl reload/reconfigure)"]
+    F --> G["VERIFYING<br/>link/carrier/주소·라우트/wpa/ping"]
+    G -->|"eth1 변경"| H{"CONFIRM_WAIT<br/>90s monotonic TTL"}
+    G -->|"eth1 무변경 & verify OK"| K["COMMITTED<br/>LKG 포인터 갱신"]
+    H -->|"새 IP 재접속 → confirm"| K
+    H -->|"TTL 만료 (재접속 실패)"| R["ROLLING_BACK"]
+    G -->|"verify fail & !force"| R
+    R -->|"복원+재적용+재검증 OK"| RB["ROLLED_BACK<br/>(이전 IP 복구)"]
+    R -->|"재검증 fail → recover 유닛 → 실패"| FC["FAILED_CRITICAL<br/>(포렌식 번들 수집)"]
+    K -.->|"운영 중 상시"| WD["Watchdog 30s tick<br/>적용본 기준 자가복구"]
+```
+
+핵심 요약 4줄:
+- **분리**: Save 는 DB 만, Apply 는 OS 반영 — 잘못 저장된 값이 곧바로 라이브에 닿지 않는다.
+- **불변식**: dpworldapp 의 매-재시작 재적용을 막을 수 없으므로, 렌더를 **byte-exact** 로 만들어 `cmp -s` no-op 이 되게 한다(안정성 요건).
+- **lockout 방지**: eth1 변경은 90초 confirm-or-rollback(monotonic TTL), 크래시 시 startup recovery 가 미완료 apply 를 보수적으로 롤백.
+- **자가복구**: 30초 watchdog 이 적용본 기준으로 무결성을 감시하되, 히스테리시스·cooldown·시간당 한도·WARN-only ping 으로 churn 을 억제한다.
+
+## 1. Overview · Motivation · Features / 개요·동기·기능
+
+**Network Apply Engine** 은 v1.6.0 에서 도입된 `src/network/` Python 패키지로, 웹 configurator 에서 변경한 네트워크 설정(WiFi / eth0 / eth1 / WiFi country code / 서버 엔드포인트, 총 22항목)을 **OS 에 즉시 적용·검증하고 실패 시 자동 롤백**하며, 운영 중에는 **상시 watchdog 으로 네트워크 무결성을 자가복구**한다. dpworldapp(타 팀 바이너리)은 블랙박스로 두고 그 파일 계약(render contract)을 byte 단위로 그대로 재사용한다.
+
+근거 문서: release design notes, implementation plan, CHANGELOG `[v1.6.0]`(2026-06-13).
+
+### 1.1 왜 만들었나 — 동기
+
+기존에는 web configurator(Java `app.jar` 와 Python 신규 양쪽 모두)가 네트워크 설정을 SQLite `board_config.device_config` 에 **저장만** 했다(spec §1). OS 반영(wpa_supplicant, systemd-networkd)은 **dpworldapp 이 자기 재시작 시점에만** 수행하므로, 웹에서 SSID/passkey/ethernet 을 바꿔도 즉시 반영되지 않았다.
+
+```
+Web → SQLite board_config.device_config            ← 여기서 끊김
+         ↓ dpworldapp 재시작 시에만 (app_init)
+dpworldapp: DB ↔ /home/root/network/network_config.json 비교 후 렌더·적용
+```
+
+이 끊김은 두 가지 실제 문제를 낳았다.
+- **즉시 반영 불가**: 변경이 다음 재부팅/dpworldapp 재시작까지 OS 에 닿지 않음.
+- **실패 복구 수단 부재(실사고)**: `eth_ip`(eth1, 로컬 이더넷)를 잘못 바꾸면 웹 UI·SSH 접근 경로가 끊겨 **SSH 가 유실되는 lockout 사고**가 발생했다(CHANGELOG `[v1.6.0]` 배경). 적용 경로에 검증·롤백이 전혀 없었기 때문이다.
+
+사용자가 제시한 목표는 3가지였다(spec §1): ① 설정이 실제로 OS 에 반영(Apply 시 즉시, 검증 포함), ② 운영 중 네트워크 무결성(드라이버가 내려간 채 방치되는 상황 방지 — 상시 감시·자가복구), ③ debug logging(문제 발생 시 사후 보완조치가 가능한 증거 수집).
+
+### 1.2 무엇을 하나 — 핵심 동작과 A안 아키텍처
+
+웹에서 바꾼 네트워크 22항목을 **dpworldapp 파일 계약을 byte-exact 로 재사용**해 OS 에 즉시 적용·검증·롤백하고, 30초 주기 watchdog 으로 무결성을 상시 보증한다(plan Goal). dpworldapp 을 수정하지 않는 대신, dpworldapp 이 쓰는 적용 경로(`/home/root/network/` 렌더 파일 4종 + `dpworld-network-apply.service`)를 그대로 쓰고, 부족한 **트리거·검증·롤백·로깅**만 Python 안전계층으로 보강하는 **A안 아키텍처**를 채택했다(spec §2, §4).
+
+이 설계의 핵심 불변식은 **byte-exact 렌더**다(spec §4.1, 자세히는 [§4](#4-22-field-contract--byte-exact-rendering--22항목-계약byte-exact-렌더)). dpworldapp 은 load/save 비대칭 버그(spec §3.3-4) 때문에 재시작할 때마다 **무조건** JSON+렌더를 다시 쓰고 apply.service 를 기동한다. 따라서 "재적용을 막는" 것은 불가능하고, 우리 렌더가 dpworldapp 렌더와 **1바이트도 다르지 않게** 만들어 그 재적용이 `cmp -s` 무변화로 판정되어 **no-op** 이 되게 하는 것만이 안정성을 보장한다. 즉 렌더러의 byte 정확성은 미관이 아니라 안정성 요건이며, `.56` 실기기 캡처 golden 대비 **ZERO mismatch** 로 검증됐다(CHANGELOG).
+
+22항목은 단순 WiFi/이더넷 IP 뿐 아니라 **서버 엔드포인트 필드(`lte_server_*`, `opc_ua_server_*`, `modbus_server_*`)까지 포함**한다(spec §3.4). 이들은 UI 상 '서버 설정' 페이지 소속이지만 dpworldapp 의 필드 비교 집합에 들어가므로 drift 감지·Apply 범위에 함께 포함된다.
+
+### 1.3 핵심 기능 목록
+
+- **즉시 적용 / dry-run 미리보기** — `POST /api/network/apply` 의 `dry_run` 플래그로 변경 필드 diff + 경고 뱃지(eth1 lockout / country 드라이버 리로드 / wifi 단절 / 보류 country 동반적용)를 먼저 보여주고, 실제 적용은 비동기로 `apply_id` 를 반환(plan §1.6).
+- **DB-first 쓰기** — 항상 DB → JSON/렌더 순서로 쓴다. 역순이면 중간에 dpworldapp 이 재시작할 때 구 DB 값으로 파일을 되돌려 충돌하므로, DB-first 여야 동일 값으로 수렴한다(spec §4.1). DB 쓰기는 wipe 사고(v1.4.0.2) 재발 방지를 위한 partial-merge + SQLite `busy_timeout`(dpworldapp 의 event_history 상시 INSERT 와 WAL 공유) 사용.
+- **byte-exact 렌더** — `network_config.json` + `10-{wlan0,eth0,eth1}.network` + `wpa_supplicant-wlan0.conf` + `wifi-country-code` 를 dpworldapp 과 byte 동일하게 생성(spec §4.1 no-op 불변식, golden-file 테스트).
+- **사후 검증(verifier)** — link / carrier / 주소·라우트 일치 / `wpa_state=COMPLETED` / gateway ping 확인. carrier 없는 인터페이스는 "config staged" WARN 으로 통과(spec §5 VERIFYING, §5.3).
+- **자동 롤백 + LKG(last-known-good)** — 적용 전 `/home/root/network/*` 전체 + DB 네트워크 필드를 `/opt/config_backups/network/<apply_id>/` 에 manifest(파일 해시)와 함께 스냅샷. 검증 실패 시 자동 롤백, 검증 성공 시에만 last-known-good 포인터 갱신(spec §5 SNAPSHOT/ROLLING_BACK).
+- **eth1 90s confirm-or-rollback** — eth1 은 웹·SSH 접근 경로라 장비 스스로 외부 도달성을 증명할 수 없으므로 **사용자 confirm 이 곧 검증**이다. 적용 후 `CONFIRM_WAIT`(TTL 90초, monotonic 기준) 진입 → 새 IP 로 재접속해 Confirm 하면 COMMITTED, TTL 만료 시 이전 IP 로 자동 롤백(spec §6.1, Cisco `commit confirmed` / MikroTik Safe Mode 패턴).
+- **country deferred / 즉시** — country 변경은 `modprobe -r wlan` 리로드를 동반(IRQ78 패닉 이력 경로)하므로 **기본 reboot-deferred**(렌더만 일관 작성, apply.service 미트리거 + "Reboot required" 뱃지). 전문가 옵션 `country_now=true` 면 즉시 적용 + 강화 검증(spec §6.2).
+- **크래시 복구** — apply 상태+apply_id 를 디스크에 persist(`apply_state.json`). server.py 시작 시 미완료 apply 발견 → 보수적으로 자동 롤백. `recover_on_startup()` 은 HTTP 바인드를 막지 않도록 데몬 스레드로 실행(spec §5, CHANGELOG 리뷰 #1/#3).
+- **상시 watchdog 자가복구** — in-process 데몬 스레드, 30초 주기. 판정 기준은 DB 가 아니라 **적용본 `network_config.json`**. wlan 모듈/wpa/주소·라우트/eth0·eth1 per-iface 체크 + 복구 사다리. 억제 규칙: 히스테리시스(2회 연속 실패 시에만 발동) / cooldown 5분 / 시간당 최대 4회 / apply·confirm 중 일시정지 / gateway ping 은 WARN-only(자세히는 [§5](#5-watchdog--self-healing--상시-감시자가복구)).
+- **kill-switch** — 운영자가 watchdog 을 끄거나 critical 상태를 재무장할 수 있는 `POST/GET /api/network/config`(watchdog 제어 + `reset_critical`). watchdog 튜너블은 web-configurator 소유 신규 DB 키 `net_config` 에 저장(spec §8, CHANGELOG 리뷰 #2/#6).
+- **JSONL 저널 + 포렌식** — `network_journal.jsonl` 에 1줄 1이벤트(ts/uptime/boot_id/apply_id/category/phase/action/result/duration_ms/detail), 5MB×3 로테이션, **psk/password 상시 마스킹**. apply 실패·롤백·CRITICAL 시 dmesg/journalctl/networkctl/ip 상태를 묶은 포렌식 번들(≤2MB×5) 자동 수집(spec §9, 자세히는 [§7](#7-snapshot--rollback--journal--forensics--백업롤백저널포렌식)).
+
+### 1.4 한눈에 보는 동작 — Save / Apply 분리 모델
+
+핵심 UX 결정은 **Save(DB 만)와 Apply(OS 반영)의 분리**다(spec §2). **Save** 는 변경을 DB(`device_config`)에 기록만 한다(현행 동작 그대로 — 이 변경은 dpworldapp 다음 재시작/재부팅 시 dpworldapp 이 적용). **Apply** 는 그 DB 상태를 기준으로 dry-run diff 미리보기를 보여주고, 동의를 받은 뒤 상태머신(`VALIDATING → SNAPSHOT → WRITING → APPLYING → VERIFYING → COMMITTED`, 실패 시 `ROLLING_BACK`)을 통해 OS 에 즉시 반영·검증·롤백한다. 이때 diff 기준선은 **DB vs DB 가 아니라 "적용본"(`network_config.json`) vs DB** 다 — Save 가 이미 DB 를 갱신했으므로 DB-vs-DB 로는 Save→Apply 흐름이 항상 NOOP 이 되기 때문이다(plan §1.2, [§3.2(a)](#3-apply-flow--state-machine--적용-흐름상태머신)). 미적용(Save-only) 변경은 UI drift 뱃지가 "미적용 변경은 다음 재부팅 시 적용됩니다"로 인지시킨다(spec §4.1, [§8.2.1](#8-ui--사용자-인터페이스)).
+
+## 2. Architecture & Module Map / 아키텍처·모듈 지도
+
+이 서브시스템은 `src/network/` 패키지에 응집되어 있다. 운영자가 WiFi·이더넷·LTE 등의 네트워크 설정을 바꾸면, DB(`device_config`)의 의도(intent)를 dpworldapp 가 읽는 디스크 파일로 안전하게 렌더·적용하고, 실패 시 스냅샷에서 자동 롤백하며, 상시 watchdog 가 적용본과 라이브 상태의 drift 를 자가복구한다. 핵심 설계 원칙은 **dpworldapp 바이너리를 블랙박스로 두고 파일 계약만 공유**하는 것이다(dpworldapp 를 한 줄도 고치지 않는다). `src/network/__init__.py` 는 빈 파일이며, 패키지 멤버는 절대 import(`from network import ...`)로 서로를 참조한다.
+
+### 2.1 9개 모듈의 책임 (한 줄 요약)
+
+| 모듈 (`src/network/`) | 책임 (한 줄) | 근거 (docstring / 핵심 심볼) |
+|---|---|---|
+| `netmodel.py` | DB `device_config` ↔ intent ↔ persist JSON 매핑 + 비교(diff) 의미론. dpworldapp 의 필드 비교 동작(32-bit (u32) IP 비교) 정합. apply 가 쓸 수 있는 네트워크 키의 **단일 출처** `NETWORK_DEV_KEYS` 보유. | `netmodel.py:2-3`, `NETWORK_DEV_KEYS` `:11-16`, `intent_from_device` `:47` |
+| `renderer.py` | intent → dpworldapp **바이트 호환** 렌더 (systemd-networkd `[Network]/[Route]`, `wpa_supplicant.conf`, country 파일, `network_config.json` persist). | `renderer.py:2-3`, `render_network_file` `:16`, `render_wpa_conf` `:33`, `render_persist_json` `:57` |
+| `validator.py` | §5.2 hard rule — dpworldapp 파서/렌더 한계(버퍼 절단, escaping 부재, profile gap, 포트 범위 등)를 데이터로 위반하지 않도록 사전 거부. | `validator.py:2`, `validate(intent)` `:39` |
+| `journal.py` | JSONL 네트워크 이벤트 저널(1줄 1이벤트, 5MB×3 로테이션, psk/password 마스킹) + 실패/롤백 시 `forensic_bundle()` 증거 수집. `event()` 는 절대 raise 안 함. | `journal.py:2-3`, `class Journal` `:37`, `event()` `:44` |
+| `snapshot.py` | apply 직전 백업(`/home/root/network/*` 전체 + DB 네트워크 필드) + manifest SHA-256 해시 검증 + 복원. `last_known_good`(LKG) 포인터. | `snapshot.py:1-2`, `take()` `:22`, `verify()` `:54`, `LKG` `:5` |
+| `verifier.py` | 사후 검증(VERIFYING): 존재→carrier→주소·라우트→wpa_state→gateway ping. carrier 없음 = 'config staged' WARN. 모든 외부호출은 runner 주입. | `verifier.py:1-2`, `verify()` `:25`, `_ip_brief()` `:14` |
+| `apply_engine.py` | Apply 상태머신(VALIDATING→SNAPSHOT→WRITING→APPLYING→VERIFYING→CONFIRM_WAIT). 단일 in-flight, 기준선=적용본, DB-first 쓰기, confirm TTL 타이머, 크래시 복구. | `apply_engine.py:1-2`, `class ApplyEngine` `:31`, `apply_async()` `:252`, `recover_on_startup()` `:599` |
+| `watchdog.py` | 상시 감시·자가복구(틱 30s, 히스테리시스 2, cooldown 5분, 시간당 4회 한도). 판정 기준 = `network_config.json`(적용본). 복구 사다리(`_LADDERS`)로 단계적 escalation. | `watchdog.py:1-6`, `class NetworkWatchdog` `:43`, `start()` `:293`, `tick_once()`(loop `:301`) |
+| `net_routes.py` | HTTP 라우팅 글루 — 서버 독립적, dict in/out. `/api/network/*` 요청을 engine/watchdog 메서드로 위임. `RouteError(status, message)` 로 검증 실패 표현. | `net_routes.py:1`, `class NetworkRoutes` `:26`, `apply()` `:31`, `config()` `:99` |
+
+### 2.2 모듈 의존 방향 — 단방향, 순환 없음
+
+패키지 내부 의존은 **단방향**이며 순환이 없다. 상위(라우트/감시) → 하위(엔진) → 말단(렌더/검증/스냅샷/저널/모델)으로만 흐른다.
+
+```mermaid
+flowchart LR
+    NR["net_routes"] --> AE["apply_engine"]
+    WD["watchdog"] -->|"억제 해제 시 위임"| AE
+    AE --> R["renderer"]
+    AE --> V["validator"]
+    AE --> SN["snapshot"]
+    AE -.->|"지연 import :38"| VF["verifier"]
+    AE -->|"주입"| J["journal"]
+    AE --> NM["netmodel"]
+    WD --> VF
+    WD --> J
+    WD --> NM
+    R --> NM
+    V --> NM
+    VF --> NM
+    SN --> NM
+```
+
+구체적 import 증거:
+- `net_routes.py:3` → `from network import netmodel`(write-allowlist `NETWORK_DEV_KEYS` 검사용, `apply()` `:38`).
+- `apply_engine.py:5` → `from network import netmodel, renderer, snapshot, validator`; verifier 는 순환·지연 회피를 위해 메서드 내부 `:38`에서 지연 import.
+- `watchdog.py` 는 생성자(`:44`)로 `engine`·`journal` 를 주입받고, 판정에서 netmodel/verifier 를 사용한다(외부 호출은 `runner` 주입 `:47`).
+- `verifier.py:5` → `from network import netmodel`(`effective_profiles` 로 wpa 검증 게이트 판단 `:57`).
+
+핵심: `NETWORK_DEV_KEYS`(netmodel)가 **단일 출처(single source)** 다. `net_routes.apply()` 의 write-allowlist(`net_routes.py:38`)와 `apply_engine._db_network_fields()` 의 스냅샷 키(`apply_engine.py:120` `sorted(netmodel.NETWORK_DEV_KEYS)`)가 모두 이 집합에서 파생되어, "허용 키 ≠ 스냅샷 키" drift 를 구조적으로 차단한다. 이 집합은 20개 키다(`wifi_*` 7, `WIFI_SSID`, `eth_*` 3, `lte_*` 6, `opc_ua_server_*` 2, `modbus_server_*` 2 — `netmodel.py:11-16`). docstring 의 "22항목"은 spec §3.4 의 intent 수준 항목 집합을 가리키고, "20 네트워크 키"(`net_routes.py:36`)는 device_config 키 화이트리스트를 가리킨다(둘의 관계는 [§4.1](#4-22-field-contract--byte-exact-rendering--22항목-계약byte-exact-렌더) 표 참조).
+
+### 2.3 server.py 가 어떻게 엮는지
+
+`server.py` 는 이 서브시스템의 **유일한 조립점**이며, 세 가지로 통합한다: (a) import-time 인스턴스 생성 + 503 fallback, (b) HTTP 라우트 위임, (c) 시작 시 복구·watchdog 기동·provider 주입.
+
+**(a) import-time 생성 + 503 fallback** — `server.py:148-174`
+
+```python
+try:
+    from network.apply_engine import ApplyEngine
+    from network.journal import Journal as _NetJournal
+    from network.net_routes import NetworkRoutes, RouteError as NetRouteError
+    from network.watchdog import NetworkWatchdog
+    _NET_JOURNAL = _NetJournal(.../"network_journal.jsonl")
+    _NET_ENGINE  = ApplyEngine(db=db, net_dir=NET_DIR, backups_dir=..., state_path=..., journal=_NET_JOURNAL, runner=_net_run)
+    _NET_WATCHDOG = NetworkWatchdog(db=db, engine=_NET_ENGINE, journal=_NET_JOURNAL, net_dir=NET_DIR)
+    _NET = NetworkRoutes(_NET_ENGINE, _NET_JOURNAL, _NET_WATCHDOG, _net_drift, _net_live)
+except Exception as _e:
+    _NET_INIT_ERROR = str(_e)
+    ...   # NetRouteError = _RouteErrorStub
+```
+
+경로 생성 등이 실패하는 환경(예: Windows dev box, `/home/root/network` 부재)에서도 **서버 import 자체는 절대 실패하지 않는다**(`server.py:166` 주석). 이때 `_NET`/`_NET_ENGINE`/`_NET_WATCHDOG` 는 `None` 으로 남고, 모든 `/api/network/*` 요청은 `_net_json()`(`server.py:682`)에서 **503** 으로 응답한다:
+
+```python
+def _net_json(self, fn):
+    if _NET is None:
+        self._send_json_response({"ok": False, "error": f"network subsystem unavailable: {_NET_INIT_ERROR}"}, 503)
+        return
+    try: self._send_json_response(fn())
+    except NetRouteError as e: self._send_json_response({"ok": False, "error": e.message}, e.status)
+    except Exception as e: ... 500
+```
+
+주입 콜백 두 개(`_net_drift` `server.py:126`, `_net_live` `server.py:141`)도 server.py 가 제공한다 — 라우트는 서버 독립적이므로 drift/live 계산은 외부에서 들어온다. runner(`_net_run` `server.py:117`)는 `subprocess.run` 래퍼로 engine 에 주입되어, 모든 OS 명령(`ip`, `networkctl`, `wpa_cli` 등)이 한 곳을 통과한다(테스트 시 교체 가능).
+
+**(b) HTTP 라우트 위임** — engine/watchdog 을 직접 부르지 않고 전부 `_NET`(NetworkRoutes)로 위임한다(엔드포인트별 계약은 [§6](#6-http-api-contract--http-api-계약)).
+
+| HTTP | 위임 | 위치 |
+|---|---|---|
+| `GET /api/network/state` | `_NET.state()` | `server.py:445-446` |
+| `GET /api/network/apply/status?id=` | `_NET.status(aid)` | `:447-451` |
+| `GET /api/network/journal?limit=` | `_NET.journal_tail(lim)` | `:452-456` |
+| `GET /api/network/config` | `_NET.get_config()` | `:457-459` |
+| `POST /api/network/apply` | `_NET.apply(data)` | `:595-604` (non-dict body → 400) |
+| `POST /api/network/apply/confirm` | `_NET.confirm(data)` | `:605-614` |
+| `POST /api/network/rollback` | `_NET.rollback()` | `:615-616` |
+| `POST /api/network/config` | `_NET.config(data)` | `:617-626` (watchdog kill-switch) |
+
+`POST /api/network/apply` 는 비동기다 — `net_routes.apply()`(`net_routes.py:46`)가 `engine.apply_async()` 를 호출해 `STARTED` + `apply_id` 를 즉시 반환하고, 검증·적용 결과는 status 폴링으로 가져온다(eth1 IP 변경 후엔 구 연결로 동기 응답이 불가하기 때문 — `net_routes.py:44`). `apply()` 는 또한 dry_run 분기와 `NETWORK_DEV_KEYS` 화이트리스트 검사(unknown 키 → 400)를 수행해 `/setting/device` 검증을 우회하는 side-door 를 막는다(`net_routes.py:35-40`).
+
+**(c) 시작 시 복구 → watchdog 기동 → provider 주입** — `server.py:1099-1109`(main 의 `run()`)
+
+```python
+if _NET_ENGINE is not None:
+    if _NET_ENGINE.recover_on_startup():            # 1. 미완료 apply 복구 / country_pending 해소
+        print("[startup] network apply recovery: rolled back unfinished apply", ...)
+if _NET_WATCHDOG is not None:
+    _NET_WATCHDOG.start()                           # 2. 상시 감시 데몬 스레드 기동
+if _NET is not None:
+    set_network_apply_provider(_network_apply_provider)   # 3. system_status 에 요약 provider 주입
+```
+
+- (1) `recover_on_startup()`(`apply_engine.py:599`)은 크래시 후 `apply_state.json` 을 읽어 미완료 apply 를 복구한다. 빠른 판정(파일 read)만 인라인, 느린 롤백(subprocess 수십 초)은 데몬 스레드로 띄워 HTTP bind 를 막지 않는다(운영자 lockout 방지 `:602-606`). 자세히는 [§3.6](#3-apply-flow--state-machine--적용-흐름상태머신)·[§7.2(e)](#7-snapshot--rollback--journal--forensics--백업롤백저널포렌식).
+- (2) `watchdog.start()`(`watchdog.py:293`)는 `loop()` 데몬 스레드를 띄워 `tick_once()` 를 interval 마다 호출한다. watchdog 은 절대 죽지 않도록 모든 예외를 삼킨다(`watchdog.py:303-304`, [§5](#5-watchdog--self-healing--상시-감시자가복구)).
+- (3) `set_network_apply_provider()`(`system_status.py:1032`)로 `_network_apply_provider`(`server.py:177`)를 system_status 에 주입한다. **import 순환을 피하기 위해** system_status 는 provider 함수 포인터만 보유하고(`system_status.py:1024`, `:1028-1034`), server.py 가 main 직전에 setter 로 꽂는다. provider 는 watchdog `snapshot()` 1회 + drift + country_pending + iface 상태를 `system_status` 의 `network_apply` 키로 합쳐 노출하며, 실패해도 `{"error": ...}` 로 fail-soft 한다(`server.py:189-190`, UI 표시는 [§8.4](#8-ui--사용자-인터페이스)).
+
+추가로 `support_bundle.py:87-96` 는 진단 번들 생성 시 `network_journal.jsonl` tail 200줄을 포함하되, 부재 시 `"[]"` 로 fail-soft 한다(서브시스템이 없어도 번들 생성은 성공).
+
+### 2.4 dpworldapp 와의 경계 — 블랙박스, 파일 계약만 공유
+
+dpworldapp 는 `/usr/bin/dpworldapp` 바이너리(CAN/Modbus/OPC-UA 데이터 처리)로, 이 서브시스템은 그것을 **수정하지 않으며 직접 호출하지도 않는다**. 경계는 전적으로 **공유 파일 계약**이다:
+
+- **렌더 정합(출력 측)**: `renderer.py` 가 만드는 systemd-networkd 파일·`wpa_supplicant.conf`·country 파일·`network_config.json` 은 dpworldapp 가 생성/소비하는 캡처(golden)와 **1바이트라도 다르면 안 된다**(`renderer.py:2-3`). 예: gateway u32==0 일 때 `[Route]` 생략은 deployed dpworldapp binary 동작과 동일하게 맞춘 것(`renderer.py:23`).
+- **비교 정합(의미 측)**: diff 비교는 dpworldapp 의 필드 비교(32-bit (u32) IP 비교) 의미론을 미러링한다(`netmodel.py:3`, `_ip_u32` `:25-41`). 빈 문자열·`0.0.0.0` 은 zero-동치로 취급(§1.2). dpworldapp 가 dhcp 모드 필드를 파싱하지 않으므로, dhcp 시 DB 잔존값은 무시하고 zero-out 한다(`netmodel.py:59`).
+- **파서 한계 존중(검증 측)**: `validator.py` 가 dpworldapp 의 버퍼 절단(SSID 19/20byte, PSK 8-19byte `validator.py:6-7`)·escaping 부재(`"`/`\` 금지 `:9`)·profile gap(빈 슬롯 뒤 항목은 침묵 탈락 `:46-52`)을 데이터 차원에서 사전 거부한다(전체 규칙은 [§4.5](#4-22-field-contract--byte-exact-rendering--22항목-계약byte-exact-렌더)).
+- **포트/타입 정합**: `render_persist_json` 의 `_port_num`(`renderer.py:51-55`)은 dpworldapp cJSON 이 port 를 JSON number 로 기록한다는 캡처에 맞춰 String DB 값을 캐스팅한다.
+- **빌드 호환 검증(watchdog)**: `watchdog.py:14` `COMPAT_DPWORLDAPP_MD5` 가 렌더 계약이 검증된 dpworldapp 빌드의 md5 를 들고, `start()` 시 `_check_fw_md5()`(`watchdog.py:297`)로 라이브 바이너리와 대조해 계약 drift 를 경고한다.
+- **DB·파일 경계**: 설정 DB(`board_config`/`device_config`)와 적용본 파일(`/home/root/network/*`)이 양측 공유 매체다. watchdog 의 판정 기준선은 DB 가 아니라 **적용본 `network_config.json`**(`watchdog.py:1`, `apply_engine._baseline_intent()` `:88-90`) — Save 가 이미 DB 를 갱신하므로 DB-vs-DB 비교는 Save→Apply 를 항상 NOOP 으로 만들기 때문이다.
+
+정리하면, 이 서브시스템은 dpworldapp 의 **입력 파일을 정확히 그 형식대로 써 주고, dpworldapp 가 보는 그대로 라이브 상태를 검증·복구**할 뿐, dpworldapp 바이너리·프로세스에는 손대지 않는다(파일 수정 0, 코드 수정 0).
+
+## 3. Apply Flow & State Machine / 적용 흐름·상태머신
+
+네트워크 설정 변경을 라이브 시스템에 안전하게 반영하는 핵심 엔진이다. 단순히 파일을 쓰고 `networkctl reload` 를 부르는 수준이 아니라, **검증 → 스냅샷 → 쓰기 → 적용 → 검증 → (eth1) 확인대기 → 커밋** 의 다단계 상태머신으로 구성되며, 어느 단계에서 실패하거나 프로세스가 죽어도 라이브 네트워크를 깨뜨리지 않도록 롤백·크래시 복구 경로를 갖췄다. 구현은 전부 `src/network/apply_engine.py` 의 `ApplyEngine` 클래스이고, HTTP 진입점은 `src/network/net_routes.py` 의 `NetworkRoutes.apply()` 이다([§6](#6-http-api-contract--http-api-계약)).
+
+설계의 위험 핵심은 단 하나다: **운영자가 eth1(원격 관리 인터페이스)의 IP 를 바꾸면, 적용 직후 운영자 자신의 연결이 끊어진다.** 잘못된 설정이면 영영 못 돌아온다. 그래서 이 엔진의 거의 모든 불변(invariant)은 "운영자 lockout 방지"를 향한다.
+
+### 3.1 전체 라이프사이클 (Lifecycle)
+
+#### 진입 — HTTP `apply()` (`net_routes.py:31`)
+
+`NetworkRoutes.apply(body)` 가 단일 진입점이다. 흐름:
+
+1. `body["fields"]` 가 dict 인지 검사 (아니면 `RouteError(400)`).
+2. **화이트리스트 검사**(`net_routes.py:38`): `fields` 의 모든 키가 `netmodel.NETWORK_DEV_KEYS` 에 속해야 한다. 임의 `device_config` 키가 apply 를 통해 들어오면 스냅샷이 그 키를 포착하지 못해 롤백으로도 제거할 수 없으므로(side-door), 미지 키는 `RouteError(400)` 로 즉시 거절.
+3. `dry_run` 분기(`_req_bool` 으로 엄격 bool 파싱): true 면 `engine.dry_run(...)` 결과만 반환 — 라이브 무접촉.
+4. 실제 적용이면 `engine.apply_async(...)` 호출. 반환이 `BUSY` 면 `RouteError(409)`, 아니면 `{"ok": True, "state": "STARTED", "apply_id": ...}` 즉시 반환.
+
+`force` / `country_now` 플래그는 `_req_bool()`(`net_routes.py:11`)로 파싱한다. JSON 문자열 `"false"` 가 Python truthiness 로 True 가 되어 위험 플래그가 잘못 켜지는 것을 막기 위해, **진짜 `bool` 만 수용하고 None=미지정(False), 그 외 타입은 400** 으로 거절한다([§6 입력 검증 가드](#6-http-api-contract--http-api-계약)).
+
+#### dry-run (`apply_engine.py:206`)
+
+`dry_run(new_dev_fields, country_now)` 은 부작용 없이 미리보기를 만든다:
+
+- 기준선 intent(`_baseline_intent()`)와 `{DB ∪ new_fields}` 로 만든 새 intent 를 `diff_intents` 로 비교 → `diff`.
+- `validator.validate(new)` 로 에러/경고 수집.
+- diff 가 있으면 **실 적용과 동일한 country 게이트**(`_country_gate_errors(..., fast=True)`)를 미리 돌려 에러를 노출 — dry-run 은 OK 인데 실제 apply 는 거절되는 divergence 를 막는다. dry-run 은 동기 HTTP 경로이므로 `fast=True` 로 hung `wpa_cli` 가 응답을 ~19s 블록하지 못하게 한다.
+- 경고로 `eth1_confirm`, `wifi_disrupt`, `country_reboot_deferred`, `dns_saved_only`(dns1/dns2 는 현 펌웨어 미적용 dead field), `country_deferred_pending` 등을 부착.
+
+#### apply_async — 즉시 반환 + 데몬 스레드 (`apply_engine.py:252`)
+
+```python
+def apply_async(self, new_dev_fields, force=False, country_now=False):
+    pre = self._begin(force, country_now)
+    if pre["state"] == "BUSY":
+        return pre
+    self._thread = threading.Thread(target=self._run_protected, args=(new_dev_fields,),
+                                    daemon=True, name="net-apply")
+    self._thread.start()
+    return pre   # {"state": "STARTED", "apply_id": ...}
+```
+
+**왜 비동기인가**: eth1 IP 가 바뀌면 `networkctl reconfigure eth1` 이후에는 구 연결로 HTTP 응답을 보낼 수 없다. 따라서 HTTP 핸들러는 `apply_id` 를 즉시(`STARTED`) 반환하고 본체는 데몬 스레드에서 돌린다. 운영자는 (구 IP 가 살아있는 동안) `status(apply_id)` 폴링으로 진행을 추적한다.
+
+`_begin()`(`apply_engine.py:227`)이 in-flight 잠금과 상태 초기화를 담당한다:
+- `_cur["state"]` 가 `_ACTIVE`(VALIDATING/SNAPSHOT/WRITING/APPLYING/VERIFYING/ROLLING_BACK) 또는 `CONFIRM_WAIT` 면 → `BUSY` 반환. **단일 in-flight** 보장.
+- 직전 persist 의 `country_pending` 을 `_read_persisted_pending()` 으로 읽어 `_prior_country_pending` 에 보관 (이후 NOOP/검증실패 persist 가 보류 플래그를 wipe 못 하게).
+- `apply_id` = `ap-{날짜시각}-{monotonic%1000}-{seq}` 생성, `_cur` 를 `VALIDATING` 으로 초기화 후 persist.
+
+#### 본체 — `_run_machine()` 의 단계 순서 (`apply_engine.py:290`)
+
+| 단계 | 하는 일 | 핵심 |
+|------|---------|------|
+| **VALIDATING** | `diff = diff_intents(적용본, DB∪new)` → 빈 diff 면 `NOOP`. `validator.validate` + country 게이트. 에러 시 `FAILED_VALIDATION`. | 게이트는 라이브 실효 변경 기준 |
+| **SNAPSHOT** | `snapshot.take(net_dir, backups_dir, aid, db_fields)` 로 현재 렌더 파일 + DB 네트워크 필드 백업. `snapshot_dir` 저장. | 롤백 기준점. **이 시점 전까지는 라이브 무접촉** |
+| **WRITING** | DB-first: `_write_db(new_fields)`(partial-merge) → `_write_renders(new_it)`(systemd-networkd / wpa conf 등). | DB 가 먼저, 그 다음 파일 |
+| **APPLYING** | `systemctl start dpworld-network-apply.service`(best-effort) → `networkctl reload` → 변경된 iface 별 `networkctl reconfigure` → wpa 변경 시 `wpa_cli reconfigure`(+ fallback `try-restart`). | apply.service 실패는 WARN, networkctl 이 실 적용 |
+| **VERIFYING** | `verify_fn(new_it, changed_ifaces)`. fail 이고 `force` 아니면 → 롤백. force 면 WARN 후 강행. | verify 가 실 게이트 |
+| **CONFIRM_WAIT** | eth1 이 변경 ifaces 에 있으면만. 90s TTL 설정 + 타이머 기동. | 운영자 재접속 confirm 대기 |
+| **COMMITTED** | `_commit()` — 타이머 취소, LKG 마킹/prune(fail-soft). | 최종 성공 |
+
+country-only 변경이면서 `country_now` 미동의 시 WRITING 직후 **deferred** 분기로 빠진다: APPLYING 을 건너뛰고 바로 `COMMITTED` + `country_pending=True`(재부팅 필요). 단, **diff 가 정확히 country 단독일 때만**(`len(diff)==1 and diff[0]["field"]=="wlan0.country_code"`, `apply_engine.py:339`) — 다른 필드가 이 분기로 새어 "COMMITTED 인데 미적용" 되는 lockout hole 을 막는다.
+
+#### 실패·종료 경로
+
+```text
+VERIFY fail / 예외(스냅샷 후) → ROLLING_BACK
+  → 스냅샷 복원(DB-first) + 재적용 + 재검증
+       ├ 재검증 OK → ROLLED_BACK
+       └ 재검증 fail → recover 유닛 1회 → 안 되면 FAILED_CRITICAL
+NOOP / FAILED_VALIDATION / ABORTED(스냅샷 전 예외) — 라이브 무접촉 종료
+```
+
+`_run_protected()`(`apply_engine.py:262`)가 모든 예외를 감싼다:
+- **스냅샷 전 예외**(`snapshot_dir is None`): 라이브 무접촉이므로 거짓 `FAILED_CRITICAL`/recover 유닛을 띄우지 않고 `ABORTED` 로만 마킹(`apply_engine.py:268`).
+- **스냅샷 후 예외**: `_claim(_ACTIVE, "ROLLING_BACK")` 선점 후 `_rollback`.
+- `finally`(`apply_engine.py:280`): 워커가 active state 인 채로 죽으면 무조건 `FAILED_CRITICAL` 로 강등 — **워커는 절대 active state 로 죽지 않는다** 는 불변(I9).
+
+### 3.2 핵심 불변 / 설계 (Invariants)
+
+#### (a) diff 기준선 = 적용본(persist), DB 가 아니다 — `_baseline_intent()` (`apply_engine.py:88`)
+
+```python
+def _baseline_intent(self):
+    """diff 기준선 = 적용본 network_config.json (§1.2)."""
+    try:
+        with open(os.path.join(self.net_dir, "network_config.json"), ...) as f:
+            return renderer.intent_from_persist(json.load(f))
+    except (OSError, ValueError):
+        return netmodel.intent_from_device({})   # 부재/손상 → 전부-변경 취급
+```
+
+diff 를 "DB vs DB" 로 잡으면 안 된다. **Save 가 이미 DB 를 갱신**하므로, Save 직후 Apply 를 누르면 DB==DB 라 항상 NOOP 이 되어 영영 적용이 안 된다. 그래서 기준선은 "마지막으로 실제 적용된 결과"인 `network_config.json`(persist/적용본)이고, 비교 대상이 현재 DB(=user-saved)다. 적용본 파일이 없거나 손상이면 빈 intent → "전부 변경" 으로 취급해 첫 적용이 가능하게 한다(fresh-flash, [§7.1(e)](#7-snapshot--rollback--journal--forensics--백업롤백저널포렌식)).
+
+#### (b) DB-first 쓰기 (`_write_db` 먼저, `_write_renders` 나중)
+
+WRITING 단계와 롤백 복원 양쪽 모두 **DB → 파일 순서**. DB 가 진실의 원천이고, 렌더 파일은 DB 로부터 파생된 산출물이라는 일관성을 지킨다. 롤백의 `_write_db_restore(present, absent)`(`apply_engine.py:132`)는 스냅샷의 present 키 복원 + 스냅샷 시점에 없던 키 pop 까지 하여, merge 복원이 "없던 키를 부활"시키는 결함을 막는다(스냅샷 포맷 `fmt:2`, `apply_engine.py:114`).
+
+#### (c) Monotonic TTL — RTC 불신뢰
+
+confirm 마감은 `confirm_deadline_monotonic = self.clock() + CONFIRM_TTL_S`(기본 `clock=time.monotonic`, `apply_engine.py:36`). 임베디드 보드의 RTC(벽시계)는 NTP 동기 전이나 배터리 방전 시 점프할 수 있어, wall-clock 기반 TTL 은 즉시 만료되거나 영영 안 만료될 수 있다. monotonic 은 단조 증가만 하므로 "90초 경과" 판정에 신뢰 가능하다.
+
+#### (d) 단일 in-flight + CAS 전이
+
+`_begin()` 의 BUSY 체크가 동시 apply 를 막고, `_claim(from_states, to_state)`(`apply_engine.py:75`)가 `_lock` 하에서 현재 state 가 예상과 일치할 때만 전이하는 CAS(compare-and-swap)다. confirm 과 TTL 타이머가 같은 `CONFIRM_WAIT` 를 동시에 소비하려는 race 의 단일 결정점이다 — 승자만 롤백/커밋 본문을 실행한다. `_rollback` 진입부엔 멱등 가드(이미 terminal 이면 재진입 금지, `apply_engine.py:428`)도 있다.
+
+#### (e) 롤백 재검증 기준 = 복원된 persist
+
+롤백 후 재검증의 기준 intent 는 **복원된 `network_config.json`** 이다(`apply_engine.py:478`). Save-then-Apply drift flow 에선 DB 가 apply 전에 이미 NEW 값으로 바뀌어 스냅샷 db_fields 도 NEW 다. 그 NEW 기준으로 재검증하면 복원된 라이브(OLD)와 영원히 불일치해 가짜 `FAILED_CRITICAL` 이 난다. 그래서 기준을 복원 persist 로 잡고, persist 판독 불가일 때만 `intent_from_device(present)` 로 폴백한다([§7.2(b)](#7-snapshot--rollback--journal--forensics--백업롤백저널포렌식)).
+
+### 3.3 country 게이팅 (`_country_gate_errors`, `apply_engine.py:185`)
+
+WiFi regulatory country 변경은 wlan 커널 모듈의 regdomain 파라미터 변경을 동반하므로 특별 취급한다. 게이팅 기준은 "라이브 실효 변경" — 라디오 실효 regdomain(`_live_country`, `apply_engine.py:160`; v1.9.1 부터 `iw reg`/sysfs 기준, `wpa_cli get country` 아님 — wpa conf 렌더값은 라디오 실효값이 아니라 거짓 양성을 내므로)과 target 을 비교하고, live 미상이면 diff 기준으로 보수 폴백한다.
+
+> **v1.11.6 변경 — country 는 항상 reboot-deferred (live `modprobe -r` 제거)**
+> QCA6490(cnss_pci) 에서 런타임 wlan 모듈 unload 가 hang → Telechips PMU
+> 하드웨어 watchdog 리셋 → 부팅 루프를 유발한 이력 때문에, v1.11.6 부터는 **live
+> `modprobe -r` 경로를 완전히 제거**했다. apply.service 는 drop-in
+> (`dpworld-network-apply.service.d/20-hardened.conf`)으로 하드닝 스크립트
+> (`deploy/dpworld-network-apply-hardened.sh`)를 실행하는데, 이 스크립트는 country
+> 를 `/etc/modprobe.d` 에 기록하고 `reboot-required` marker 만 세울 뿐 모듈을
+> 내리지 않는다. 따라서 전문가 옵션 `country_now=true` 라도 **같은 부팅에서는
+> 라디오 실효 country 가 바뀌지 않으며**, 실제 적용은 재부팅 시점이다. 상세는
+> [firmware-boot-hardening.md](firmware-boot-hardening.md) 참조.
+
+| 상황 | 동작 |
+|------|------|
+| **deferred (기본)** | country-only 변경 + `country_now` 미동의 → 파일/DB 만 쓰고 apply.service 미기동, `COMMITTED` + `country_pending=True`. 재부팅 시 실제 반영. |
+| **country_now (전문가 옵션)** | 동의 시 apply.service(=하드닝 스크립트)가 `modprobe.d` 를 갱신하고 `reboot-required` marker 를 세운다 — **live 모듈 리로드 없음**(v1.11.6). 엔진은 이후 강화 검증 사다리(`/sys/module/wlan` → `/sys/class/net/wlan0` → `_live_country == target`)를 돌리는데, 모듈을 내리지 않았으므로 라디오 실효 country 는 아직 OLD 라 보통 검증 불일치 → 롤백(`apply_engine.py:413-427`). 실효 변경은 **재부팅 후**에야 일어난다. |
+| **혼합 (v1.9 split-apply)** | country 실효 변경 + 다른 필드 동반(`len(diff)>1`) → 비-country 필드는 즉시 적용, country 는 deferred 로 분리(split-apply). |
+| **보류 중 동결** | 직전 country 가 재부팅 대기(pending)인데 추가 apply 시도 + `country_now` 미동의 → 거부(deferral 분기로 새는 silent commit 차단). |
+
+> **이력 참고:** 위 표의 `country_now` 행은 코드 경로(엔진이 여전히 강화 검증
+> 사다리를 돈다)를 그대로 기술한 것이다. v1.11.6 이전 빌드는 이 경로에서 모듈을
+> 실제로 리로드해 재부팅 없이 즉시 반영했으나, 현재는 하드닝 스크립트가 리로드를
+> 거부하므로 실효 변경이 재부팅으로 미뤄진다.
+
+### 3.4 force 모드 (검증 생략, 저널 기록)
+
+`force=True` 면 VERIFYING 에서 verify fail 이 나도 롤백하지 않고 강행한다(`apply_engine.py:386`). 단 silent 가 아니라 저널에 `force_commit` WARN 을 남긴다. VALIDATING 단계의 step detail 에도 `[force]` 를 명시한다(`apply_engine.py:322`). 운영자가 verify 로직이 못 따라가는 특수 토폴로지를 강제 적용할 탈출구이되, 흔적은 반드시 남긴다. (country 게이트 자체는 force 로 우회되지 않는다 — VALIDATING 의 `errs` 검사는 force 무관하게 거절.)
+
+### 3.5 eth1 confirm 흐름 (`apply_engine.py:391`, `confirm`/`tick`)
+
+eth1 이 바뀌면 VERIFYING 통과 후 즉시 COMMITTED 하지 않고 `CONFIRM_WAIT` 로 들어간다:
+
+1. `confirm_deadline_monotonic = now + 90s` 설정, persist.
+2. `timer_factory(91s, self.tick)` 데몬 타이머 기동(1차 만료 보장).
+3. 운영자는 **새 IP 로 재접속** 한 뒤 `confirm(apply_id)`(`net_routes.py:56` → `apply_engine.py:535`) 호출 → 매칭되는 CONFIRM_WAIT 이면 `_commit()`.
+4. 90초 내 confirm 이 없으면(= 새 설정이 깨져 재접속 실패) `tick()`(`apply_engine.py:542`)이 마감 경과를 감지하고 `_claim(("CONFIRM_WAIT",), "ROLLING_BACK")` 승리 시 **자동 롤백** → 구 IP 가 복구되어 운영자가 다시 들어올 수 있다.
+
+`tick()` 은 세 경로에서 호출된다: 엔진 자체 타이머(1차), watchdog, 그리고 status/state 폴링(`net_routes.py:53,72` — 폴링이 안전망 타이머 역할). confirm 과 tick 의 race 는 `_claim` CAS 가 단일 소비를 보장한다. `is_busy_or_confirming()`(`apply_engine.py:558`)은 watchdog 의 복구 사다리가 CONFIRM_WAIT 중인 eth1 확인 대기를 침범하지 못하게 억제하는 데 쓴다([§5.4](#5-watchdog--self-healing--상시-감시자가복구)).
+
+### 3.6 크래시 복구 (`recover_on_startup`, `apply_engine.py:599`)
+
+서버 재시작 시 `apply_state.json` 을 읽어 미완료 apply 를 처리한다. 분기:
+
+- **country_pending 해소 검사**: 재부팅으로 라이브 country 가 target 과 일치하면 pending 해제(watchdog 영구 억제 방지). `fast=True` 로 hung wpa_cli 의 startup 블록(~19s) 회피.
+- **VALIDATING / SNAPSHOT 에서 죽음** → 파일/DB 무접촉 단계이므로 변경 0 → `ABORTED` 마킹만(거짓 FAILED_CRITICAL 금지, subprocess 없어 인라인).
+- **WRITING / APPLYING / VERIFYING / CONFIRM_WAIT / ROLLING_BACK 에서 죽음** → 라이브가 건드려진 상태 → **롤백 필요**.
+
+여기서 **async 가 중요하다**: 롤백은 subprocess(apply.service 75s + wpa 45s + recover 60s + forensic)라 동기로 돌리면 HTTP `bind`/`serve_forever` 를 분 단위로 막아 운영자 lockout 이 된다. 그래서 빠른 판정(파일 read)만 인라인으로 하고, **느린 롤백은 데몬 스레드로 띄우고 즉시 `True`(복구 INITIATED) 반환** 한다(`apply_engine.py:646`). `block=True`(테스트)면 인라인 실행해 terminal state 를 동기 검증한다.
+
+### 3.7 상태머신 다이어그램
+
+#### Mermaid stateDiagram
+
+```mermaid
+stateDiagram-v2
+    [*] --> VALIDATING : apply_async / _begin (단일 in-flight, BUSY 거절)
+    VALIDATING --> NOOP : diff 없음 (적용본 == DB)
+    VALIDATING --> FAILED_VALIDATION : validator 에러 / country 게이트 거부
+    VALIDATING --> SNAPSHOT : diff 有 & 검증 통과
+    SNAPSHOT --> WRITING : 백업 완료 (snapshot_dir 설정)
+    WRITING --> COMMITTED : country-only deferred (country_pending=True)
+    WRITING --> APPLYING : 일반 적용
+    APPLYING --> ROLLING_BACK : country_now 강화검증 실패
+    APPLYING --> VERIFYING
+    VERIFYING --> ROLLING_BACK : verify fail & !force
+    VERIFYING --> CONFIRM_WAIT : eth1 변경 (90s monotonic TTL)
+    VERIFYING --> COMMITTED : eth1 무변경 (또는 verify fail & force)
+    CONFIRM_WAIT --> COMMITTED : confirm(apply_id) (새 IP 재접속)
+    CONFIRM_WAIT --> ROLLING_BACK : tick() TTL 만료 -> 자동롤백
+    ROLLING_BACK --> ROLLED_BACK : 복원+재적용+재검증 OK
+    ROLLING_BACK --> FAILED_CRITICAL : 재검증 fail -> recover 유닛 -> 실패
+    note right of VALIDATING
+        스냅샷 전 예외 -> ABORTED
+        (라이브 무접촉, 거짓 CRITICAL 금지)
+    end note
+    note right of ROLLING_BACK
+        기준 = 복원된 persist
+        (NEW 기준 X -> 가짜 CRITICAL 방지)
+    end note
+    NOOP --> [*]
+    FAILED_VALIDATION --> [*]
+    COMMITTED --> [*]
+    ROLLED_BACK --> [*]
+    FAILED_CRITICAL --> [*]
+    ABORTED --> [*]
+```
+
+#### ASCII 폴백
+
+```text
+                          apply_async -> _begin (BUSY? -> 409)
+                                    |
+                                    v
+                            +-------------+
+                            | VALIDATING  |
+                            +-------------+
+              diff 없음 |      | 검증/게이트 실패 | 통과
+                        v      v                  v
+                    [NOOP] [FAILED_VALIDATION]  +----------+
+                                                | SNAPSHOT |  (이전: 라이브 무접촉
+                                                +----------+   -> 예외 시 [ABORTED])
+                                                     |
+                                                     v
+                                                +---------+  country-only deferred
+                                                | WRITING |----------------------+
+                                                +---------+  (country_pending)    |
+                                                     | 일반                       |
+                                                     v                            |
+                                                +----------+                      |
+                                                | APPLYING |-- country_now 강화    |
+                                                +----------+   검증 실패 --+        |
+                                                     |                    |        |
+                                                     v                    |        |
+                                                +-----------+            |        |
+                                                | VERIFYING |            |        |
+                                                +-----------+            |        |
+                            verify fail & !force |   | eth1 변경          |        |
+                                                 |   v                    |        |
+                                                 |  +--------------+      |        |
+                                                 |  | CONFIRM_WAIT |      |        |
+                                                 |  | (90s mono TTL)|     |        |
+                                                 |  +--------------+      |        |
+                                                 |   | TTL 만료    | confirm        |
+                                                 |   v  (tick)     | (새 IP)       |
+                                                 v   v             v               v
+                                            +--------------+  [COMMITTED] <---------+
+                                            | ROLLING_BACK |   (eth1 무변경 /
+                                            +--------------+    force commit 포함)
+                            복원+재적용+재검증 |      | 재검증 fail
+                                    OK         v      v -> recover 유닛 -> 실패
+                                        [ROLLED_BACK] [FAILED_CRITICAL]
+```
+
+`_ACTIVE` = `(VALIDATING, SNAPSHOT, WRITING, APPLYING, VERIFYING, ROLLING_BACK)`(`apply_engine.py:9`). 종료 상태(terminal): `NOOP`, `FAILED_VALIDATION`, `ABORTED`, `COMMITTED`, `ROLLED_BACK`, `FAILED_CRITICAL`. 진행/대기 상태: `_ACTIVE` + `CONFIRM_WAIT`.
+
+## 4. 22-Field Contract & Byte-Exact Rendering / 22항목 계약·byte-exact 렌더
+
+이 섹션은 **핵심 데이터 계약**을 설명한다. web configurator 는 네트워크 설정을 SQLite `board_config.device_config` 에 저장만 하고, 실제 OS 반영(wpa_supplicant / systemd-networkd)은 dpworldapp 이 자기 재시작 시점에 수행한다([§1.1](#1-overview--motivation--features--개요동기기능)). 따라서 우리가 쓰는 파일이 dpworldapp 이 쓰는 파일과 **논리값·바이트 단위로 정확히 같아야** 재시작 시 출렁임이 없다. 그 일치 단위가 바로 **22항목(22-field) 집합**이다.
+
+핵심 코드는 두 모듈이다.
+- `src/network/netmodel.py` — DB `device_config` → 중간 표현 `intent` 변환 + 비교 의미론(comparison semantics)
+- `src/network/renderer.py` — `intent` → dpworldapp byte-호환 출력 파일 6종 렌더
+
+### 4.1 22항목 매핑: DB device_config key ↔ intent ↔ network_config.json
+
+dpworldapp 의 필드 비교 로직은 **18 스칼라 + 4 배열 = 22항목**을 비교한다(deployed-binary 검증 기준, spec §3.4). 우리 `intent_from_device(dev)`(`netmodel.py:47`)는 이 22항목을 정확히 같은 의미로 DB 에서 읽어 `intent` dict(`wlan0`/`eth0`/`eth1` 3 인터페이스 그룹)로 구성한다. `intent` 는 이후 비교·렌더·diff 의 단일 기준점이다.
+
+| # | intent path | DB device_config key | network_config.json 위치 | 비고 |
+|---|---|---|---|---|
+| 1 | `wlan0.mode` | `wifi_static` (on/off) | `wlan0.mode` ("static"/"dhcp") | `_s(g("wifi_static"))=="on"` → static (`netmodel.py:53`) |
+| 2 | `wlan0.ip` | `wifi_ip` | `wlan0.ip` | static 일 때만 파싱 |
+| 3 | `wlan0.netmask` | `wifi_netmask` | `wlan0.netmask` | |
+| 4 | `wlan0.gateway` | `wifi_gateway` | `wlan0.gateway` | u32==0 이면 [Route] 생략 |
+| 5 | `wlan0.dns1` | `wifi_dns1` | `wlan0.dns1` | **dead 필드**(렌더 미출력, spec §3.4/§12-3) |
+| 6 | `wlan0.dns2` | `wifi_dns2` | `wlan0.dns2` | dead 필드 |
+| 7 | `wlan0.country_code` | `wifi_country_code` | `wlan0.country_code` | `_norm_country`(2 alpha, trim/upper) |
+| 8 | `eth0.mode` | (`lte_ip` u32!=0 → static) | `eth0.mode` | `eth0_static = _ip_u32(g("lte_ip")) != 0`(`netmodel.py:56`) |
+| 9 | `eth0.ip` | `lte_ip` | `eth0.ip` | eth0 = LTE uplink |
+| 10 | `eth0.netmask` | `lte_netmask` | `eth0.netmask` | |
+| 11 | `eth0.gateway` | `lte_gateway` | `eth0.gateway` | |
+| 12 | `eth0.server_ip` | `lte_server_ip` | `eth0.server_ip` | host route 판정에 영향 |
+| 13 | `eth0.server_port` | `lte_server_port` | `eth0.server_port` | JSON number 로 기록 |
+| 14 | `eth1.mode` | (`eth_ip` u32!=0 → static) | `eth1.mode` | `eth1_static = _ip_u32(g("eth_ip")) != 0`(`netmodel.py:57`) |
+| 15 | `eth1.ip` | `eth_ip` | `eth1.ip` | eth1 = local ethernet |
+| 16 | `eth1.netmask` | `eth_netmask` | `eth1.netmask` | |
+| 17 | `eth1.gateway` | `eth_gateway` | `eth1.gateway` | spec §12-2 회귀 주의 |
+| 18 | `eth1.opc_ua_server_ip` | `opc_ua_server_ip` | `eth1.opc_ua_server_ip` | **서버 필드지만 네트워크 일관성 집합 포함** |
+| 19 | `eth1.opc_ua_server_port` | `opc_ua_server_port` | `eth1.opc_ua_server_port` | JSON number |
+| 20 | `eth1.modbus_server_ip` | `modbus_server_ip` | `eth1.modbus_server_ip` | |
+| 21 | `eth1.modbus_server_port` | `modbus_server_port` | `eth1.modbus_server_port` | JSON number |
+| 22 | `wlan0.profiles[]` | `WIFI_SSID[]` (각 entry `wifi_ssid`/`wifi_passwd`/`wifi_security`) | `wlan0.saved_wifi_list[]`(`ssid`/`password`/`security`) | 배열 4항목(ssid/passwd/security/country)을 합쳐 1 그룹으로; 최대 5개(`MAX_PROFILES`) |
+
+이 키 집합은 `netmodel.NETWORK_DEV_KEYS`(`netmodel.py:11`)에 **단일 출처(single source)** 로 동결되어 있다. `apply_engine.py:120` 의 write-allowlist 와 `net_routes.py:38` 의 unknown-key 거부가 모두 이 frozenset 에서 파생되므로, 비-네트워크 키(예: `rs485_databits`)는 apply 경로로 `device_config` 를 변형할 수 없다(drift 차단, [§2.2](#2-architecture--module-map--아키텍처모듈-지도)·[§6 입력 검증 가드](#6-http-api-contract--http-api-계약)). frozenset 는 20개 device_config 키(서버 4필드는 `opc_ua_server_*`/`modbus_server_*` 2+2, `lte_server_*` 는 키 `lte_server_ip`/`lte_server_port` 로 포함)이고, intent 수준 비교 항목은 22개다 — "20 키 ↔ 22 항목" 차이는 `WIFI_SSID` 배열이 1 키이지만 4 비교항목(ssid/passwd/security/country)으로 펼쳐지기 때문이다.
+
+> 주의: 서버 엔드포인트 필드(#18~21)는 UI 상 '서버 설정' 페이지 소속이지만 dpworldapp 비교 집합에 포함된다. dpworldapp 의 persist 로드 경로는 이 4필드를 JSON 에서 **다시 읽지 않으므로**(spec §3.3-4 버그, [§10.4](#10-acceptance--security--known-limitations--수락-결과보안한계백로그)), 설정된 장비에서는 필드 비교가 매번 false → 시작할 때마다 재적용이 발생한다. 이것이 byte-exact 불변식을 필수로 만든 직접 원인이다.
+
+### 4.2 렌더되는 6개 파일과 형식
+
+`renderer.RENDER_FILES`(`renderer.py:98`)는 파일명 → 렌더 함수의 공용 상수이며, `apply_engine.py:99` 와 `snapshot.py:87` 가 동일하게 소비한다. 모든 파일은 `/home/root/network/` 에 tmp+rename 으로 원자적 기록된다.
+
+#### 4.2.1 network_config.json — `render_persist_json` (renderer.py:57)
+
+persist 원본. 22항목 전체를 `wlan0`/`eth0`/`eth1` 3 객체로 직렬화한다. `eth0` 에는 `"role":"lte_uplink"`, `eth1` 에는 `"role":"local_ethernet"` 상수가 붙는다. profiles 는 `saved_wifi_list` 로 나가되 **effective(절단된)** 목록만 기록한다(아래 §4.4). 서식은 무관하나 **값·타입**은 정확해야 하므로(spec §4.1), port 는 `_port_num` 으로 JSON number 캐스팅된다(`renderer.py:51`).
+
+```python
+return json.dumps(doc, indent=2, ensure_ascii=False) + "\n"
+```
+
+#### 4.2.2 10-{wlan0,eth0,eth1}.network — `render_network_file` (renderer.py:16)
+
+systemd-networkd 드롭인. metric 은 인터페이스별로 하드코딩(`METRICS = {"wlan0":100, "eth0":200, "eth1":300}`, `netmodel.py:5`).
+
+- **dhcp 모드**: `DHCP=ipv4` + `[DHCPv4]\nRouteMetric=<m>`
+- **static 모드**: `Address=<ip>/<prefix>`(prefix 는 netmask 에서 계산)
+- **[Route] 생략 조건**: `gateway_set(c)`(`netmodel.py:83`)가 false — 즉 gateway 의 u32 가 0 또는 None — 이면 `[Route]` 섹션 자체를 출력하지 않는다. 이는 deployed dpworldapp binary 와 동일한 "gateway 없는 static" 표현이며, eth1 기본 라우트 제거에 사용된다(spec §12-2).
+- **host route(eth0 한정)**: `server_ip` 가 있고 gateway 가 설정되어 있으며 static 이고 `server_ip` 가 LTE subnet **밖**일 때만, Metric 없는 `[Route]\nDestination=<sip>/32\nGateway=<gw>` 를 추가한다(`renderer.py:26-30`). subnet 판정 불가 시 보수적으로 host route 를 만들지 않는다(`_in_subnet` 의 `except ValueError: return True`).
+
+```ini
+[Match]
+Name=eth0
+
+[Network]
+Address=10.0.0.5/24
+
+[Route]
+Destination=0.0.0.0/0
+Gateway=10.0.0.1
+Metric=200
+```
+
+#### 4.2.3 wpa_supplicant-wlan0.conf — `render_wpa_conf` (renderer.py:33)
+
+wpa_supplicant 가 **직접 읽는** 파일(복사 없음). 헤더 후 effective profiles 만 슬롯 0..4 로 렌더한다.
+
+- 헤더: `ctrl_interface=/var/run/wpa_supplicant\nupdate_config=1\n` + country 가 있으면 `country=XX`
+- 각 profile: `network={ ... }` 블록
+  - `security=="none"` → `key_mgmt=NONE`(psk 없음)
+  - 그 외 → `psk="<평문>"` + `key_mgmt=WPA-PSK`
+  - **priority = `5 - i`**(첫 profile 이 priority 5, 가장 높음)
+- psk 는 평문 passphrase, **SSID escaping 없음**, scan_ssid 없음(숨김 SSID 미지원). escaping 부재가 validator 의 금지문자 규칙(§4.5)을 강제하는 이유다.
+
+#### 4.2.4 wifi-country-code — `render_country_file` (renderer.py:47)
+
+`wlan0.country_code` 를 그대로 출력. 캡처(golden) 확정: **정확히 2바이트, trailing newline 없음**.
+
+### 4.3 §4.1 byte-exact 불변식 — 왜 중요한가
+
+> **DB(22항목 집합)와 network_config.json + 렌더 4종은 항상 한 트랜잭션처럼 함께, 동일 논리값·동일 바이트로 쓴다.**(spec §4.1)
+
+spec §3.3-4 의 load/save 비대칭 버그 때문에 dpworldapp 은 **재시작/재부팅마다 무조건** JSON+렌더를 다시 쓰고 `dpworld-network-apply.service` 를 기동한다. 이 재적용을 막는 것은 불가능하므로, 막을 수 있는 유일한 방법은 **재적용을 no-op 으로 만드는 것**이다.
+
+- 우리 렌더가 dpworldapp 렌더와 **byte-동일**하면 → apply.sh 의 `cmp -s` 가 무변화 판정 → networkd/wpa 무접촉 → **재적용 전체가 no-op**(네트워크 출렁임 0).
+- **1바이트라도 다르면** → dpworldapp 재시작/재부팅마다 networkd reload 가 발생(주기적 단절).
+
+따라서 `renderer.py` 의 상수(metric 값, 줄바꿈, `priority=5-i`, country 2바이트, JSON port 타입 등)는 미관이 아니라 **안정성 요건**이다. 캡처와 다르면 본 모듈 상수를 캡처에 맞춘다(`renderer.py:2-3` 주석). 수락 테스트 #8 은 "우리 apply 후 `systemctl restart dpworldapp` → 렌더 byte-무변화 + networkd reload 이벤트 0건"으로 이를 직접 증명한다(spec §10, [§10.1](#10-acceptance--security--known-limitations--수락-결과보안한계백로그)). golden-file 테스트가 ZERO mismatch 를 회귀 가드한다. (단 #8 검증에서 dpworldapp 이 `network_config.json` 만은 자체 cJSON tab 포맷으로 재직렬화함이 확인돼, JSON 은 "값 동일성", networkd 렌더 파일은 "byte-exact" 로 불변식이 정밀화됐다 — [§10.1](#10-acceptance--security--known-limitations--수락-결과보안한계백로그)의 정정 참조.)
+
+### 4.4 비교 의미론 (comparison semantics)
+
+`intent_from_device` 와 `_canon`(`netmodel.py:87`)은 dpworldapp 의 strict dotted-quad 파싱 후 u32 비교를 미러링한다. 표기가 달라도 같은 IP 면 같다고 판정해야 false drift 를 피한다.
+
+| 의미론 | 동작 | 코드 |
+|---|---|---|
+| **zero-동치** | `''` ≡ `0.0.0.0` (둘 다 u32 0) | `_ip_u32("")==0`(`netmodel.py:30`) |
+| **dhcp zero-out** | dhcp 모드면 ip/netmask/gateway/dns 를 빈 값으로 — dpworldapp 이 dhcp 모드 필드를 파싱하지 않으므로 DB 잔존값 무시 | `net()`(`netmodel.py:58-62`) |
+| **strict dotted-quad** | 정확히 4 octet, 선행 0 거부(`p[0]=='0'` 이고 길이>1), octet>255 거부, **ASCII digit 만**(unicode 거부) | `_ip_u32`(`netmodel.py:25-41`) |
+| **port number 동치** | `"20111" == 20111` — port 는 문자열로 정규화 후 비교 | `_canon` port leaf(`netmodel.py:95-96`) |
+| **gap 절단** | profiles 는 첫 빈 SSID 에서 중단(effective) — 빈 trailing 행은 변경 아님 | `effective_profiles`(`netmodel.py:74`) |
+| **legacy 'Open'→none tolerant read** | DB 의 legacy `"open"` 값을 읽을 때 `"none"` 으로 정규화(거부 아님) | `_norm_security`(`netmodel.py:43-45`) |
+| **unparseable → static + raw 보존** | ip 가 파싱 불가(u32==None)면 dhcp 가 아닌 static 으로 두고 원문 보존 → validator 가 명확한 에러로 거부 | `netmodel.py:54-57` |
+
+`_canon` 은 비교가 안 되는 값(`_ip_u32` 가 None)은 `("raw", s)` 로 폴백해 원문 문자열 비교로 떨어진다(`netmodel.py:94`). `diff_intents`(`netmodel.py:114`)는 이 정규화로 변경 필드 목록 `[{field, old, new}]` 을 만들어 UI diff 미리보기·drift 뱃지에 공용으로 쓰며([§8.2.5](#8-ui--사용자-인터페이스)), profiles 는 effective 기준으로 비교하되 password-only 변경은 "(자격증명 변경)" 마커를 붙인다(`netmodel.py:130-131`).
+
+역변환은 `intent_from_persist`(`renderer.py:75`)가 담당한다. network_config.json → intent 로 되돌려 watchdog 판정(§5)과 golden 역변환에 쓰며, null/non-dict 에 tolerant 하고(`(doc.get("iface") or {})`), `saved_wifi_list` 에서 dict 아닌 entry 와 빈 ssid 는 걸러낸다(`renderer.py:88`).
+
+### 4.5 검증 규칙 (validator §5.2)
+
+`validate(intent)`(`validator.py:39`)는 dpworldapp 파서/렌더의 한계를 데이터로 위반하지 않기 위한 hard rule 이다. `(errors, warnings)` 를 반환하며 errors 가 하나라도 있으면 적용을 거부한다(spec §5.2).
+
+| 항목 | 규칙 | 상수/코드 |
+|---|---|---|
+| **security enum** | `{"wpa/wpa2", "none"}` 만 허용 — 그 외는 dpworldapp 이 프로파일 통째 삭제 | `ALLOWED_SECURITY`(`validator.py:5`, 검사 `:63`) |
+| **SSID 바이트길이** | UTF-8 기준 ≤ 19 byte(dpworldapp 20byte 버퍼 snprintf 절단) | `MAX_SSID=19`(`validator.py:6`, `:57-59`) |
+| **psk 바이트길이** | `wpa/wpa2` 면 8~19 byte; `none` 이면 password 빈 값 강제 | `PSK_MIN/MAX=8,19`(`validator.py:7`, `:65-71`) |
+| **금지문자** | SSID·password 에 `"`, `\`, 제어문자(ord<0x20) 금지 — wpa 렌더에 escaping 없음 | `_has_forbidden_char`(`validator.py:25-27`) |
+| **netmask 연속성** | static 이면 연속(contiguous) netmask 필수(예 `255.255.255.0`) | `_netmask_contiguous`(`validator.py:17-23`, `:86`) |
+| **포트 범위** | 빈 값 허용; 아니면 ASCII digit + 1~65535 | `_port_ok`(`validator.py:29-37`), 검사 대상 `eth0.server_port`/`eth1.opc_ua_server_port`/`eth1.modbus_server_port`(`:104-112`) |
+| **gap 금지** | 첫 빈 SSID 뒤에 비어있지 않은 profile 이 있으면 거부 — trailing 빈 슬롯은 허용 | `validator.py:48-52` |
+| **profile 개수** | 최대 5개(`MAX_PROFILES`) | `validator.py:8`, `:44-45` |
+| **country** | 비어있거나, 2자리 **대문자** 알파벳 | `validator.py:75-77` |
+| **static IP 정합** | static 인데 IP 없음/형식오류 거부; gateway 빈 값 허용([Route] 생략) | `validator.py:78-102` |
+
+경고(warnings, 비차단)로는 gateway 가 subnet 밖인 경우(`validator.py:99-100`)와 인터페이스 간 서브넷 중복(`validator.py:113-124`)이 있으며, 후자는 모든 pair 비교를 `try/except ValueError` 로 감싸 절대 throw 하지 않는다.
+
+### 4.6 요약
+
+22항목은 deployed dpworldapp binary 검증 기준에서 도출된 비교 단위이고, `netmodel.NETWORK_DEV_KEYS` 가 그 단일 출처다. `intent` 가 DB ↔ 비교 ↔ 렌더 ↔ diff 의 공통 기준이며, 렌더 6 파일은 `RENDER_FILES` 로 동결된다. byte-exact 불변식이 핵심인 이유는 dpworldapp 의 매-재시작 재적용을 막을 수 없고 **no-op 으로 만들 수밖에 없기** 때문이다. 비교 의미론(zero-동치/dhcp zero-out/strict quad/port number/gap 절단/legacy tolerant read)은 dpworldapp 의 strict dotted-quad·정규화 동작을 미러링해 false drift 를 막고, validator(§4.5)는 dpworldapp 파서가 데이터를 silent 하게 손상시키는 모든 경계를 사전 차단한다.
+
+## 5. Watchdog & Self-Healing / 상시 감시·자가복구
+
+`NetworkWatchdog`(`src/network/watchdog.py`)는 별도 daemon thread 에서 일정 주기로 network 상태를 점검하고, 의도(intent)와 어긋난 항목을 정해진 복구 사다리(recovery ladder)로 자가복구하는 컴포넌트다. 핵심 설계 철학은 두 가지다. 첫째, 판정 기준은 사용자가 화면에서 추측한 값이 아니라 **실제 적용본인 `network_config.json`** 이다. 둘째, watchdog 자신은 **절대 죽지 않으며**, 동시에 잘못된 복구로 production network 를 흔들지 않도록 다층 억제·안전장치를 둔다.
+
+### 5.1 30초 틱(tick)과 판정 기준
+
+watchdog 의 심장은 `tick_once()`(`watchdog.py:205`)이며, `start()`(`watchdog.py:293`)가 띄운 daemon thread 의 `loop()` 가 이를 반복 호출한다.
+
+```python
+def loop():
+    while True:
+        try:
+            self.tick_once()
+            time.sleep(self._cfg()["interval_s"])
+        except Exception:   # noqa: BLE001 — watchdog 은 절대 죽지 않는다
+            time.sleep(30)   # I2: sleep 도 try 안 — _cfg 예외로 thread 사망/tight-loop 금지
+```
+
+틱 주기(interval)는 `_cfg()`(`watchdog.py:64`)가 DB 의 `net_config` 키에서 읽는 `watchdog_interval_s` 값이며, 기본 30초다. 단 안전을 위해 **10~300초로 clamp** 된다(`watchdog.py:72`):
+
+```python
+interval = max(10, min(300, int(cfg.get("watchdog_interval_s", 30))))
+```
+
+값이 정수로 변환 불가하거나(`TypeError`/`ValueError`) `net_config` 자체가 dict 이 아니면(list 등 이형) 모두 기본값 30 으로 폴백한다 — 잘못된 config 로 thread 가 죽는 것을 막기 위함이다(`watchdog.py:70-74`).
+
+**판정 입력**은 `_intent()`(`watchdog.py:80`)가 만든다. `net_dir/network_config.json` 을 읽어 `renderer.intent_from_persist()` 로 변환한 "적용본 의도"가 모든 체크의 기준점이다. 파일이 없거나(`OSError`) 손상되면(`ValueError`) `None` 을 반환하고, 이 경우 `_collect_checks()` 는 빈 dict 을 돌려주어(`watchdog.py:108-109`) 그 틱은 아무것도 복구하지 않는다.
+
+### 5.2 체크 5종 (health checks)
+
+`_collect_checks()`(`watchdog.py:104`)는 `name → bool(healthy)` 형태의 dict 을 만든다. 이름은 `wlan_module`, `wpa_state`, `addr_route`, `eth0`, `eth1` 이다.
+
+| 체크 이름 | 조건 | 판정 방식 | 근거 |
+|---|---|---|---|
+| `wlan_module` | WiFi profile 이 설정됨(`netmodel.effective_profiles(it)`) | `/sys/module/wlan` 디렉터리 + `/sys/class/net/wlan0` 존재 | `watchdog.py:114` |
+| `wpa_state` | 동상 | `wpa_cli -i wlan0 status` 출력에 `wpa_state=COMPLETED` 포함 | `watchdog.py:116-119` |
+| `addr_route` | `wlan0.mode == "static"` | `ip -br addr show wlan0` 에 의도 IP **정확 일치** + gateway 설정 시 `ip route show` 에 `default via <gw> dev wlan0` 존재 | `watchdog.py:124-130` |
+| `eth0` / `eth1` (per-iface) | 각 iface `mode == "static"` 이고 IP 있음 | `ip -br addr show <ifc>` 에 의도 IP 정확 일치 | `watchdog.py:131-156` |
+
+체크들은 WiFi 가 실제 설정된 경우(`wifi_configured`)에만 `wlan_module`/`wpa_state`/`addr_route` 를 평가하고, eth 는 각각 static + IP 가 있을 때만 키를 만든다. 즉 설정되지 않은 항목은 아예 체크 dict 에 들어가지 않아 오탐을 원천 차단한다.
+
+**주소 매칭 정확성** — `_addrs_in()`(`watchdog.py:27`)은 `ip -br addr` 출력을 파싱해 prefix(`/24`)를 떼고 주소 목록만 추출한다. 단순 substring 비교가 아니라 정확 일치를 쓰는 이유는, 설정값 `192.168.55.5` 가 라이브 `192.168.55.54/24` 에 substring 으로 잘못 매칭되던 결함(M2) 때문이다.
+
+**wpa 쿼리 실패는 UNKNOWN** — `wpa_cli status` 가 `rc != 0` 이면 `wpa_state` 키를 아예 **생략**한다(`watchdog.py:120-123`). 부팅 race 로 wpa_supplicant 제어 소켓이 아직 준비 안 된 상황을 unhealthy 로 오판해 production wpa 를 flap 시키지 않기 위함이다. 이때 `_note_wpa_query(False)`(`watchdog.py:95`)가 transition 시 1회만 WARN 을 남긴다(C3).
+
+### 5.3 복구 사다리 (_LADDERS) 와 단계 선택
+
+복구 절차는 `_LADDERS`(`watchdog.py:17`)와 per-iface 처리(`_ladder_for`, `watchdog.py:37`)로 정의된다. 각 사다리는 `[단계1, 단계2, ...]` 이고 각 단계는 실행할 `argv` 목록이다.
+
+```python
+_LADDERS = {
+    "wlan_module": [[["systemctl", "start", "dpworld-net-recover.service"]]],
+    "wpa_state": [[["wpa_cli", "-i", "wlan0", "reconfigure"]],
+                  [["systemctl", "restart", "wpa_supplicant@wlan0.service"]]],
+    # §3.3-5: apply.service 단독은 gateway/metric-only 변경 침묵 누락 -> reload 동반 필수
+    "addr_route": [[["networkctl", "reconfigure", "wlan0"]],
+                   [["systemctl", "start", APPLY_SERVICE], ["networkctl", "reload"]]],
+}
+```
+
+| 체크 | 1단계 | 2단계 |
+|---|---|---|
+| `wlan_module` | `dpworld-net-recover.service` 시작 | (없음) |
+| `wpa_state` | `wpa_cli reconfigure` | `wpa_supplicant@wlan0.service` 재시작 |
+| `addr_route` | `networkctl reconfigure wlan0` | apply.service 시작 **+** `networkctl reload`(2단 reload) |
+| `eth0`/`eth1` | `networkctl reconfigure <ifc>`(실패한 그 iface) | (없음) |
+
+**`addr_route` 의 2단 reload(§3.3-5)** 가 중요하다. 2단계에서 apply.service 단독으로는 gateway/metric-only 변경이 침묵 누락되므로 `networkctl reload` 를 반드시 동반한다.
+
+**단계 선택 — 사다리를 한 칸씩 오른다.** `tick_once()` 안에서 `ladder_idx = max(0, self._fail_streak[name] - 2)`(`watchdog.py:263`)로 계산한다. 히스테리시스 2 를 넘긴 직후(streak=2)에는 idx=0(가벼운 1단계), 복구해도 계속 실패하면 streak 가 늘며 idx 가 올라가 더 강한 단계로 에스컬레이션한다. `_do_recover()`(`watchdog.py:183`)가 `min(ladder_idx, len(ladder)-1)` 로 사다리 끝을 clamp 한 뒤 단계 내 모든 argv 를 순차 실행하며, 각 명령의 성공/실패를 journal 에 `ok`/`fail` 로 기록한다.
+
+### 5.4 억제 규칙 (suppression)
+
+watchdog 은 정당한 다른 작업과 경합하거나 무의미한 churn 을 일으키지 않도록 여러 단계에서 복구를 억제한다. 모두 `tick_once()` 와 하위 함수에 구현되어 있다.
+
+| 억제 규칙 | 동작 | 위치 |
+|---|---|---|
+| **Grace 120s** | `start()` 직후 `_grace_until = now + GRACE_S(120)`. 그 전까지 틱은 early-return | `watchdog.py:218-221`, `296` |
+| **apply busy / CONFIRM_WAIT** | `is_busy_or_confirming()`(없으면 `is_busy` 폴백)가 True 면 전체 스킵 — eth1 확인 대기 중 사다리 침범 금지(I1a, [§3.5](#3-apply-flow--state-machine--적용-흐름상태머신)) | `watchdog.py:224` |
+| **seed/apply.service active** | apply.service 또는 `dpworld-network-seed.service` 가 active 면 전체 스킵(재적용과 경합 금지, §3.3-4) | `watchdog.py:226-228` |
+| **country-pending** | 전면 정지가 **아니라** apply.service **에스컬레이션만** 금지. `_do_recover` 내에서 해당 argv 만 skip 하고 나머지 사다리는 계속(자가복구 목표 약화 방지) | `watchdog.py:187-191` |
+| **eth DOWN / NO-CARRIER 복구 억제** | `NO-CARRIER` 또는 `state == "DOWN"` 이면 복구하지 않고 streak 를 0 으로 리셋 후 `continue`. 케이블 churn 으로 5분마다 무의미 reconfigure -> 시간당 한도 도달 -> CRITICAL 자멸을 막음 | `watchdog.py:139-154` |
+| ↳ **주소 drift WARN** | 위 DOWN 상태에서 iface 가 stale/wrong IP 를 들고 있으면(의도 IP 부재) transition-only WARN 로 가시성만 추가(복구는 여전히 보류, M1) | `watchdog.py:141-152` |
+
+country-pending 억제의 정밀함이 핵심이다. country code 변경 보류 중에는 전면 정지하면 자가복구 능력 자체가 약화되므로, `_do_recover()` 안에서 `engine.country_pending()` 이고 argv 에 apply.service 가 포함될 때만 그 명령을 건너뛴다(`watchdog.py:188`).
+
+### 5.5 안전장치 (safeguards)
+
+복구가 폭주하거나 watchdog thread 가 죽는 것을 막는 장치들이다.
+
+- **히스테리시스 2** — `_fail_streak[name] < 2` 인 동안은 복구하지 않고 `continue`(`watchdog.py:249`). 일시적 깜빡임을 복구 트리거로 삼지 않는다.
+- **Cooldown 5분(COOLDOWN_S=300)** — `now - self._last_recover[name] < COOLDOWN_S` 면 skip(`watchdog.py:255`). 같은 체크를 5분 안에 다시 복구하지 않는다.
+- **시간당 4회 한도(HOURLY_MAX=4) -> critical** — 최근 1시간 발동 시각(`_recover_times`)이 4 이상이면 `_critical = True` 로 잠그고 `critical_stop` 을 journal 에 남긴 뒤 return(`watchdog.py:257-262`).
+- **critical 자동 재무장 + 수동 reset** — `tick_once()` 가 매 틱 early-return 전에 1시간 창을 청소한다(`watchdog.py:211`). critical 이 잠긴 뒤 1시간 윈도가 비면 스스로 `_critical = False` 로 풀고 `critical_auto_rearmed` 를 남긴다(`watchdog.py:212-215`). 이 평가가 enabled/critical early-return 보다 **앞에** 있어야 잠긴 상태에서도 재무장이 동작한다. 즉시 되살리는 수동 경로는 `reset_critical()`(`watchdog.py:197`)으로, critical 잠금과 1시간 이력을 함께 비운다(config 라우트의 `reset_watchdog_critical` 이 호출, [§6](#6-http-api-contract--http-api-계약)).
+- **engine.tick() 무조건 호출** — `tick_once()` 첫 줄에서 억제조건·enabled 와 무관하게 항상 `self.engine.tick()` 을 호출한다(`watchdog.py:206`). watchdog 이 멈춰도 confirm TTL(확인 타임아웃) 안전망이 계속 돌게 하기 위함이다([§3.5](#3-apply-flow--state-machine--적용-흐름상태머신)).
+- **정상 틱 디스크 무기록 + 1h heartbeat** — 정상 틱은 RAM 카운터만 갱신하고 디스크에 쓰지 않는다. `HEARTBEAT_S(3600)` 마다 한 번만 `heartbeat` 이벤트로 현재 체크 결과를 남긴다(`watchdog.py:269-272`). 로그 폭주를 막는다.
+- **firmware md5 drift 감시** — `start()` 시 1회 `_check_fw_md5()`(`watchdog.py:274`)가 `/usr/bin/dpworldapp` 의 md5 를 계산해 렌더 계약 검증된 빌드 목록(`COMPAT_DPWORLDAPP_MD5`)과 비교하고, 불일치면 `fw_md5_drift` WARN 을 남긴다. `MemoryMax=48M` 제약 하에서 수십 MB 바이너리를 통째 읽지 않도록 **1MB 청크** 로 읽는다(I6, `watchdog.py:280`).
+- **절대 죽지 않는 loop** — `loop()` 의 `tick_once()` + `time.sleep()` 전체가 `try/except Exception` 으로 감싸여 있고, 예외 시 30초 쉰 뒤 계속한다(`watchdog.py:298-304`). sleep 까지 try 안에 둔 이유는 `_cfg()` 예외로 thread 가 죽거나 tight-loop 에 빠지지 않게 하기 위함이다(I2).
+
+추가로, gateway ping 체크(체크 4)는 자동복구를 절대 하지 않는다. `_gateway_ping_warn()`(`watchdog.py:168`)는 `_tick_count % 2 == 0` 일 때, 즉 **2틱마다(interval×2)** 실행되며 ping 실패 transition 시 WARN 로그만 남긴다(`watchdog.py:267-268`). 과거 auth-loop 사고의 교훈에 따른 의도적 WARN-only 설계다.
+
+또한 새 apply 가 지나가면 구 구성 기준의 상태를 무효화한다. `engine.status().get("apply_id")` 가 직전 값과 다르면 `_fail_streak`/`_ping_state`/`_carrier_state` 를 모두 비운다(I1b, `watchdog.py:230-240`).
+
+### 5.6 Kill-switch (net_config 튜너블 3종)
+
+`_cfg()`(`watchdog.py:64-77`)가 DB `net_config` 키에서 읽는 3개 값이 watchdog 의 외부 제어 손잡이다. 이는 `log_config` 키 분리 전례를 따른 별도 키 패턴이다(API 는 [§6](#6-http-api-contract--http-api-계약), 운영 절차는 [§9.4.4](#9-deployment--operations--배포운영)).
+
+| 키 | 기본값 | 효과 |
+|---|---|---|
+| `watchdog_enabled` | `"on"` | `"on"` 이 아니면 `tick_once()` 가 복구 없이 early-return(`watchdog.py:216-217`). **단 engine.tick()/critical 재무장은 계속** |
+| `watchdog_auto_recover` | `"on"` | `"on"` 이 아니면 unhealthy 를 감지해 `detect` WARN 만 남기고 실제 복구는 하지 않음(`watchdog.py:251-254`) |
+| `watchdog_interval_s` | `30`(10–300 clamp) | 틱 주기. 잘못된 값은 30 으로 폴백(`watchdog.py:72-74`) |
+
+`watchdog_enabled` 와 `watchdog_auto_recover` 의 차이가 중요하다. 전자는 watchdog 의 능동 동작 전체를 끄지만 confirm TTL 안전망(engine.tick)과 critical 재무장은 살려두고, 후자는 감시·로깅은 유지하되 시스템에 손대는 복구 행위만 끈다. `snapshot()`(`watchdog.py:289`)은 현재 `enabled`/`critical`/`fail_streak`/`last_results` 를 노출해 운영자가 상태를 조회할 수 있게 한다([§8.2.3](#8-ui--사용자-인터페이스)).
+
+## 6. HTTP API Contract / HTTP API 계약
+
+Network apply subsystem 은 `/api/network/*` 아래 7개 endpoint 를 제공한다. 라우팅은 `src/server.py` 의 `do_GET`(445-459) / `do_POST`(595-626) 분기에서 시작하고, request body 검증을 통과한 dict 를 `src/network/net_routes.py` 의 `NetworkRoutes` 메서드로 위임한다([§2.3](#2-architecture--module-map--아키텍처모듈-지도)). 실제 상태머신 결과는 `src/network/apply_engine.py` 의 `ApplyEngine` 가 만든다([§3](#3-apply-flow--state-machine--적용-흐름상태머신)).
+
+전 endpoint 는 server-independent 한 dict-in / dict-out 규약을 따른다(`net_routes.py:1`). server 계층은 단지 HTTP body 를 parse 해 dict 를 넘기고, route 가 돌려준 dict 를 JSON 으로 직렬화할 뿐이다.
+
+### 6.1 엔드포인트 일람
+
+| Method + Path | Request body | Success Response | 비고 |
+|---|---|---|---|
+| `GET /api/network/state` | 없음 | `{interfaces, interfaces_ok, drift, watchdog, last_apply, country_pending}` | live ip 표 + drift + watchdog + 최근 apply 상태 종합(`net_routes.py:71`) |
+| `POST /api/network/apply` | `{fields:{}, dry_run?, country_now?, force?}` | dry_run: `{ok, diff, errors, warnings}` / real: `{ok, state:"STARTED", apply_id}` | 비동기. real 적용은 즉시 `apply_id` 반환 후 폴링(`net_routes.py:31`) |
+| `GET /api/network/apply/status?id=<apply_id>` | 없음 (query `id`) | `{apply_id, state, steps[], confirm_remaining_s, country_pending}` | 폴링이 confirm TTL 타이머 역할 겸함(`apply_engine.py:581`) |
+| `POST /api/network/apply/confirm` | `{apply_id}` | `{ok, state:"COMMITTED", ...}` | eth1 변경 시 `CONFIRM_WAIT` 확정(`net_routes.py:56`) |
+| `POST /api/network/rollback` | 없음 | `{ok, state:"ROLLED_BACK"\|"FAILED_CRITICAL", apply_id}` | last-known-good 스냅샷 수동 롤백(`net_routes.py:63`) |
+| `GET /api/network/config` | 없음 | `{net_config:{watchdog_*}}` | watchdog kill-switch 현재값(기본값 merge)(`net_routes.py:96`) |
+| `POST /api/network/config` | `{watchdog_enabled?, watchdog_auto_recover?, watchdog_interval_s?}` 또는 `{reset_watchdog_critical:true}` | `{ok, net_config:{...}}` | watchdog 토글 + critical 재무장(`net_routes.py:99`) |
+| `GET /api/network/journal?limit=<n>` | 없음 (query `limit`) | `{events:[...]}` | apply 저널 tail. limit 1-500, 파싱 불가 시 50 폴백(`net_routes.py:78`) |
+
+### 6.2 POST /api/network/apply — 핵심 동작
+
+`apply()`(`net_routes.py:31`)의 분기 로직:
+
+- `fields` 가 dict 가 아니면 `RouteError(400, "fields must be an object")`.
+- `dry_run` 이 true 면 `engine.dry_run(fields, country_now=...)` 를 동기 실행해 `{diff, errors, warnings}` 를 반환(라이브 무접촉, 검증·게이트 미리보기).
+- `dry_run` 이 아니면 `engine.apply_async(...)` 로 비동기 시작. eth1 IP 변경 시 networkctl 적용 후엔 구 연결로 응답할 수 없으므로 동기 실행을 금지하고 `apply_id` 를 즉시 돌려준다(`net_routes.py:44`).
+- 이미 in-flight apply 가 있으면 engine 이 `state:"BUSY"` 를 돌려주고, route 는 이를 `RouteError(409, "apply in flight: <id>")` 로 변환.
+
+#### country_now / force 의 의미
+
+- `country_now` — WiFi country code 변경은 wlan 모듈 리로드(10-20s 단절)를 유발하므로 기본은 재부팅까지 deferred 다. `country_now=true` 동의 시 다른 변경과 함께 즉시 적용한다(`apply_engine.py:365` 의 §6.2 전문가 즉시 적용 경로, [§3.3](#3-apply-flow--state-machine--적용-흐름상태머신)). dry_run 단계에서도 동일 게이트가 미리 노출되어 dry_run OK 인데 apply 거절되는 divergence 를 방지한다(`apply_engine.py:212`).
+- `force` — verify 실패 시에도 롤백하지 않고 강제 commit(`apply_engine.py:386`, 저널에 `force_commit` warn 기록).
+
+### 6.3 입력 검증 가드 (강조)
+
+이 subsystem 은 4개의 엄격한 입력 가드로 silent 변형·side-door 를 차단한다.
+
+#### 1. fields 네트워크 allowlist (`NETWORK_DEV_KEYS`)
+
+`apply()` 는 `fields` 의 모든 키가 `netmodel.NETWORK_DEV_KEYS`(`netmodel.py:11`, 20개 네트워크 키)에 속하는지 검사하고, 하나라도 벗어나면 거절한다(`net_routes.py:38`):
+
+```python
+unknown = sorted(k for k in fields if k not in netmodel.NETWORK_DEV_KEYS)
+if unknown:
+    raise RouteError(400, f"unknown network field(s): {', '.join(unknown)}")
+```
+
+이는 apply 가 임의 `device_config` 키를 쓰면 스냅샷(20 네트워크 키)이 그 변경을 못 잡아 롤백으로도 제거 불가해지는 결함, 그리고 `/setting/device` 의 enum 검증을 우회하는 side-door 를 막는다. 같은 allowlist 가 snapshot 키 목록의 단일 출처이기도 해서(`apply_engine.py:120`), write-allowlist 와 snapshot-keys 간 drift 가 발생하지 않는다([§2.2](#2-architecture--module-map--아키텍처모듈-지도)·[§4.1](#4-22-field-contract--byte-exact-rendering--22항목-계약byte-exact-렌더)). dry_run·real apply 양쪽에 동일 적용된다(`net_routes.py:36`).
+
+`NETWORK_DEV_KEYS` 구성: `wifi_static, wifi_ip, wifi_netmask, wifi_gateway, wifi_dns1, wifi_dns2, wifi_country_code, WIFI_SSID, eth_ip, eth_netmask, eth_gateway, lte_ip, lte_netmask, lte_gateway, lte_server_ip, lte_server_port, opc_ua_server_ip, opc_ua_server_port, modbus_server_ip, modbus_server_port`.
+
+#### 2. 엄격 bool 파서 (`_req_bool`)
+
+`dry_run` / `country_now` / `force` 는 `_req_bool`(`net_routes.py:11`)로 파싱한다. JSON 문자열 `"false"` 가 Python truthiness 로 True 가 되어 `force`/`country_now` 가 잘못 활성화되는 결함을 차단한다. `None`(미지정)=False, 진짜 `bool` 만 수용, 그 외엔 거절:
+
+```python
+if v is None:
+    return False
+if isinstance(v, bool):
+    return v
+raise RouteError(400, f"{name} must be a boolean")
+```
+
+즉 `{"dry_run":"false"}` 같은 문자열 body 는 `400 dry_run must be a boolean` 으로 거절된다(silent coercion 금지).
+
+#### 3. config 엄격 int + 화이트리스트
+
+`POST /api/network/config`(`net_routes.py:99`)는 watchdog 키만 쓰기 허용하는 엄격 화이트리스트다.
+
+- `watchdog_enabled` / `watchdog_auto_recover` — `"on"`/`"off"` 만 허용, 그 외 400.
+- `watchdog_interval_s` — `int(v)` 가 float `10.9` 를 silently 10 으로 truncate 하는 것을 막기 위해 엄격 검사: `bool`(int 서브클래스) 명시 차단 + `int` 아니면 400 + 범위 `[10, 300]` 벗어나면 400(`net_routes.py:118`).
+- 미지 키는 `unknown key: <k>` 로 400, 유효 키가 하나도 없으면 `no valid keys to write` 400.
+- `reset_watchdog_critical:true` 는 단일 의도이므로 다른 키와 동시 전송 시 400(`net_routes.py:104`).
+
+#### 4. 비-dict body 400
+
+server 계층에서 `_read_request_body`(`server.py:251`)가 JSON 을 parse 한 뒤, 각 POST 핸들러가 dict 가 아니면(JSON array `[1,2,3]` / scalar 등) 400 으로 거절한다(`server.py:600`, `:610`, `:622`). 빈 body·Content-Length 이상·과대 payload 도 body reader 가 각각 400/413 으로 차단한다(`server.py:259-271`). route 메서드 내부 `config()` 도 자체적으로 `if not isinstance(body, dict): RouteError(400)` 를 한 번 더 가진다(`net_routes.py:102`).
+
+### 6.4 실제 응답 JSON 예시
+
+dry_run 미리보기(POST /api/network/apply, `{"dry_run":true, "fields":{"wifi_ip":"192.168.55.60"}}`):
+
+```json
+{
+  "ok": true,
+  "diff": [{"field": "wlan0.ipv4_address", "from": "192.168.55.56", "to": "192.168.55.60"}],
+  "errors": [],
+  "warnings": ["wifi_disrupt"]
+}
+```
+
+real apply 시작(POST /api/network/apply, `{"fields":{"eth_ip":"10.0.0.5"}}`):
+
+```json
+{ "ok": true, "state": "STARTED", "apply_id": "ap-20260614-101530-742-3" }
+```
+
+상태 폴링(GET /api/network/apply/status?id=ap-...):
+
+```json
+{
+  "apply_id": "ap-20260614-101530-742-3",
+  "state": "CONFIRM_WAIT",
+  "steps": [
+    {"phase": "VALIDATING", "result": "ok", "detail": "1 fields", "t": "10:15:31"},
+    {"phase": "APPLYING", "result": "ok", "detail": "", "t": "10:15:36"}
+  ],
+  "confirm_remaining_s": 84,
+  "country_pending": false
+}
+```
+
+검증 가드 거부 예시(`{"dry_run":"false"}` → 400):
+
+```json
+{ "ok": false, "error": "dry_run must be a boolean" }
+```
+
+watchdog 조회(GET /api/network/config):
+
+```json
+{ "net_config": { "watchdog_enabled": "on", "watchdog_auto_recover": "on", "watchdog_interval_s": 30 } }
+```
+
+### 6.5 에러 봉투 (error envelope) 와 503
+
+모든 `/api/network/*` 는 server 측 `_net_json(fn)` 헬퍼(`server.py:682`)를 통과한다.
+
+- network subsystem 이 import-time 에 초기화 실패했으면(`_NET is None`, 예: Windows dev box) `503 {"ok": false, "error": "network subsystem unavailable: <reason>"}`.
+- route 가 `RouteError(status, message)` 를 raise 하면 그 status 코드로 `{"ok": false, "error": <message>}`.
+- 그 외 예외는 traceback 출력 후 `500 {"ok": false, "error": <str(e)>}`.
+
+즉 클라이언트는 비-2xx 응답에서 항상 `{ok:false, error}` 형태를 기대할 수 있다.
+
+### 6.6 보안 posture (한 줄)
+
+전 endpoint 는 미인증이며, 현재는 폐쇄(LAN-only) IoT 네트워크 전제 정책에 의존한다 — 인증·서명 보호는 별도 SEC-2 작업으로 분리되어 있다(상세 자세 평가는 [§10.3](#10-acceptance--security--known-limitations--수락-결과보안한계백로그), 운영 완화는 [§9.5](#9-deployment--operations--배포운영)).
+
+## 7. Snapshot · Rollback · Journal · Forensics / 백업·롤백·저널·포렌식
+
+네트워크 설정을 실제로 적용(apply)하다가 운영자가 SSH/HTTP 접속을 잃는 "lockout" 을 막기 위해, 이 기능은 **변경 직전에 전체 상태를 백업(snapshot)** 하고, 검증이 실패하면 **그 백업으로 자동 복원(rollback)** 한다. 모든 단계는 **JSONL 저널** 에 1줄씩 기록되고, 롤백/치명 실패 시에는 **포렌식 번들**(dmesg/journalctl 등)을 tar.gz 로 수집한다. 비밀(wifi password, wpa psk)은 디스크 보호 권한(0600/0700)과 마스킹으로 보호된다.
+
+관련 파일:
+- `src/network/snapshot.py` — 백업 생성/검증/복원, last-known-good(LKG), prune
+- `src/network/apply_engine.py` — 롤백 본문(`_rollback`), DB 필드 캡처/복원, 상태 영속화([§3](#3-apply-flow--state-machine--적용-흐름상태머신))
+- `src/network/journal.py` — JSONL 저널 클래스 + 포렌식 번들
+
+### 7.1 Snapshot — apply 직전 백업
+
+apply 흐름에서 `SNAPSHOT` 단계에 진입하면(`apply_engine.py:327-330`) `snapshot.take()` 가 호출되어 **파일 + DB 네트워크 필드** 두 가지를 한 디렉토리(`backups_dir/<apply_id>/`)에 묶어 저장한다.
+
+**(a) 무엇을 백업하나**
+
+| 대상 | 내용 | 근거 |
+|------|------|------|
+| `net_dir` 전체 파일 | `10-eth1.network`, wpa conf, `network_config.json`(persist) 등 렌더 산출물 일체 | `snapshot.take()` `snapshot.py:27-37` |
+| DB 네트워크 필드 | `device_config` 중 네트워크 키만 추출한 dict → `db_fields.json` | `_db_network_fields()` `apply_engine.py:114-123` |
+| manifest | 각 파일의 sha256 + `db_fields.json` 의 sha256 + `taken_at` | `snapshot.py:42-49` |
+
+DB 필드는 **fmt 2** 형식으로 저장된다(`apply_engine.py:121-123`). 키 목록은 `netmodel.NETWORK_DEV_KEYS` 단일 출처에서 정렬해 파생하므로 write-allowlist 와 snapshot 키 사이 drift 가 생기지 않는다([§2.2](#2-architecture--module-map--아키텍처모듈-지도)).
+
+```python
+return {"fmt": 2,
+        "present": {k: dev[k] for k in keys if k in dev},   # 존재하는 키 = 값
+        "absent":  [k for k in keys if k not in dev]}        # 부재하는 키 = 이름만
+```
+
+`present`/`absent` 를 분리 기록하는 이유: 롤백 시 단순 merge 복원이면 "원래 없던 키" 를 부활시키는 결함이 생긴다. 부재 키를 명시 기록해야 롤백이 `present` 복원 + `absent` pop 으로 **정확히 원상복구** 할 수 있다.
+
+**(b) manifest self-verify (sha256)**
+
+`take()` 는 백업을 만든 직후 같은 함수 안에서 `verify(dest)` 를 호출하고(`snapshot.py:50-51`), 실패하면 `RuntimeError("snapshot self-verify failed")` 를 던진다. `verify()` 는 manifest 의 각 파일 sha256 과 `db_fields.json` sha256 을 디스크 실파일과 재계산해 대조한다(`snapshot.py:54-64`). manifest 자체도 `manifest.json.tmp` → `os.replace` 원자적 쓰기로 만든다(`snapshot.py:44-48`).
+
+**(c) last-known-good (LKG) 포인터**
+
+apply 가 최종 `COMMITTED` 되면 `_lkg_bookkeeping(aid)` 가 `mark_last_known_good()` 으로 `backups_dir/last_known_good` 파일에 그 `apply_id` 문자열을 기록한다(`apply_engine.py:410-414`, `snapshot.py:94-99`, 상수 `LKG = "last_known_good"` `snapshot.py:5`). 이 LKG 가 수동 롤백(`rollback_to_lkg`)의 복원 대상이 된다. 이 북키핑은 부가 작업이라 실패해도 COMMITTED 는 유지하고 저널 warn 만 남긴다(`apply_engine.py:411`).
+
+**(d) prune — keep 5, LKG 보존**
+
+`prune(backups_dir, keep=5)` 는 백업 디렉토리를 mtime 내림차순 정렬 후 상위 5개만 남기고 삭제한다(`snapshot.py:107-124`). 단:
+- `forensic` 으로 시작하는 항목은 백업 집계에서 제외(`snapshot.py:113`)
+- 가장 오래됐더라도 **LKG 가 가리키는 디렉토리는 절대 삭제하지 않음**(`snapshot.py:119-120`)
+- per-dir fail-soft: `listdir` 와 `getmtime` 사이 디렉토리가 사라져도 무시(`snapshot.py:115-116, 123-124`)
+
+**(e) fresh-flash 빈 baseline 가드**
+
+`restore_files(..., on_empty_keep=True)`(기본값)은 스냅샷이 **0개 파일** 을 캡처한 경우(fresh-flash: dpworldapp 미시드로 `net_dir` 가 비어 있던 baseline) 삭제 루프를 돌리지 않는다(`snapshot.py:66-92`, 특히 `86`). "아무것도 없음" 으로 되돌리면 `10-eth1.network` 가 사라져 eth1 이 lockout 되기 때문이다. 즉 빈 스냅샷이면 **현재 적용된 렌더를 그대로 두어 운영자 연결을 유지** 한다. 복원 시 파일은 per-file `tmp` → `os.replace` 로 쓰고, 스냅샷에 없던(=이번 apply 가 새로 만든) 파일은 우리 계약 파일(`RENDER_FILES`)일 때만 제거한다(`snapshot.py:80-91`). 이 cold-start 클래스는 [§10.4](#10-acceptance--security--known-limitations--수락-결과보안한계백로그) 참조.
+
+### 7.2 Rollback — 자동/수동 복원
+
+롤백 본문은 `_rollback(reason, claimed)` 한 곳(`apply_engine.py:424-533`)이다. 검증 실패(`_rollback_from(("VERIFYING",), "verify failed")` `apply_engine.py:387`), country apply 게이트 실패, CONFIRM_WAIT TTL 만료(`tick()` `apply_engine.py:553`), 수동 API, startup recovery 가 모두 여기로 수렴한다.
+
+**(a) 멱등 가드 + claim**
+
+진입 즉시 현재 state 가 이미 종결 상태(`ROLLED_BACK`/`FAILED_CRITICAL`/`COMMITTED`)면 그대로 반환해 double-rollback 을 차단한다(`apply_engine.py:428-429`). race 가 가능한 경로는 `_claim()` CAS 로 승자만 본문을 실행한다(`apply_engine.py:551-553`, [§3.2(d)](#3-apply-flow--state-machine--적용-흐름상태머신)).
+
+**(b) 복원 순서 (DB-first → 파일 → 재적용 → 재검증)**
+
+1. **스냅샷 무결성 확인**: `snapshot.verify(snap)` 실패 시 즉시 예외 → 복구 사다리로(`apply_engine.py:436-438`)
+2. **DB-first 복원**: `db_fields.json` 로드 후 fmt 2 면 `present` 복원 + `absent` pop. fmt 없는 구형 스냅샷은 전체를 present 로 취급(`apply_engine.py:440-446`). 복원은 `_write_db_restore(present, absent)`(`apply_engine.py:132-140`)
+3. **파일 복원**: `snapshot.restore_files(snap, net_dir)`(`apply_engine.py:459`). 빈 baseline 이면 적용본 렌더 유지 + warn 저널(`apply_engine.py:449-458`)
+4. **재적용(re-apply)**: `dpworld-network-apply.service` 는 **best-effort**(`must_ok=False`) — rc≠0 이면 warn 만(`apply_engine.py:462-467`). 실제 적용 수단은 `networkctl reload`, 변경된 iface 별 `networkctl reconfigure`, wpa 변경 시 `wpa_cli reconfigure`(`apply_engine.py:468-473`)
+5. **재검증(re-verify) — 실 게이트**: 검증 기준은 **복원된 persist**(`network_config.json` 에서 `intent_from_persist`)이다(`apply_engine.py:478-484`). Save-then-Apply drift flow 에서 스냅샷 DB 는 NEW 값이라 그 기준으로 재검증하면 복원된 라이브(OLD)와 영원히 불일치 → 가짜 FAILED_CRITICAL 이 나기 때문([§3.2(e)](#3-apply-flow--state-machine--적용-흐름상태머신)). persist 판독 불가 시에만 `intent_from_device(present)` 폴백. `result == "fail"` 이면 예외를 던져 FAILED_CRITICAL 사다리로(`apply_engine.py:485-486`)
+6. **country 변경 특례**: country apply 의 롤백은 라디오의 실효 country 까지 확인한다. 라이브가 복원된 OLD 가 아니라 이번에 적용 시도한 NEW target 그대로면 라디오가 못 되돌아간 것 → FAILED_CRITICAL 로 에스컬레이트(`apply_engine.py:494-501`)
+7. **성공 시** state = `ROLLED_BACK` 영속화(`apply_engine.py:502`). DB 는 의도적으로 user-saved 값 그대로 두어, persist 와 다르면 drift 로 남아 재시도 가능하게 하고 이를 저널 warn 으로 명시(`apply_engine.py:503-514`)
+
+**(c) 실패 시 복구 사다리 → FAILED_CRITICAL**
+
+위 try 안의 어떤 단계든 예외가 나면 마지막 사다리로 `dpworld-net-recover.service` 를 1회 기동(60s)하고, state = `FAILED_CRITICAL` 로 마킹한 뒤 reason 을 담아 반환한다(`apply_engine.py:517-525`).
+
+**(d) 수동 롤백 API — rollback_to_lkg**
+
+`rollback_to_lkg()`(`apply_engine.py:562-579`)는 LKG 스냅샷으로 되돌린다. in-flight apply/CONFIRM_WAIT 중이면 진행 중 apply 의 `_cur` 강탈을 막기 위해 `BUSY` 반환(`apply_engine.py:566-567`). LKG 가 없으면 `INVALID`. 있으면 `apply_id = "rb-<lkg>"` 의 가상 `_cur` 를 구성해 `_rollback(claimed=True)` 호출. HTTP 진입점은 `POST /api/network/rollback`([§6.1](#6-http-api-contract--http-api-계약)).
+
+**(e) startup recovery (lockout 방지 비동기)**
+
+`recover_on_startup()`(`apply_engine.py:599-648`)는 서버 시작 시 미완료 apply 를 복구한다. `_rollback` 은 subprocess(apply.service 75s + wpa 45s + recover 60s + forensic)로 느려 HTTP bind 를 분 단위로 막을 수 있으므로, **느린 롤백은 데몬 스레드로 띄우고 즉시 반환** 한다(`apply_engine.py:645-648`). 단, `VALIDATING`/`SNAPSHOT` 단계 크래시는 파일·DB 무접촉이라 변경 0 → 거짓 FAILED_CRITICAL 없이 `ABORTED` 마킹만(`apply_engine.py:627-634`). `block=True` 는 테스트용 인라인 실행(`apply_engine.py:641-644`). 전체 흐름은 [§3.6](#3-apply-flow--state-machine--적용-흐름상태머신).
+
+### 7.3 Journal — JSONL 이벤트 저널
+
+`Journal` 클래스(`journal.py:37-93`)는 모든 apply/rollback 이벤트를 **1줄 1 JSON** 으로 append 한다. 각 줄에는 `ts`, `uptime`(`/proc/uptime`), `boot_id`(`/proc/sys/kernel/random/boot_id`), `apply_id`, `category`, `phase`, `action`, `result`, `duration_ms`, `detail` 이 들어간다(`journal.py:46-49`).
+
+- **never-raise 계약**: `event()` 는 rotate/write 중 OSError 가 나도 절대 raise 하지 않고 `self.last_error` 에 저장 후 조용히 반환(`journal.py:44-58`). apply 흐름이 저널 I/O 때문에 죽으면 안 되기 때문.
+- **로테이션 5MB × 3**: 기본 `max_bytes=5MB`, `keep=3`(`journal.py:38`). 다음 줄을 쓰면 한도를 넘을 때 `.3 <- .2 <- .1 <- live` 순으로 `os.replace`(`journal.py:60-72`).
+- **마스킹**: `_mask()` 가 dict/list/tuple 을 재귀하며 키가 `password`/`psk`/`wifi_passwd`(`_MASK_KEYS` `journal.py:6`)이면 값을 `"***"` 로 치환(`journal.py:30-35`). 저널에 평문 비밀이 남지 않게 한다.
+- **tail(n)**: support bundle/진단용. live + 로테이션 파일을 newest-first 로 모아 마지막 n줄을 파싱하되, **lock 없이** 읽어 torn line 은 `json.loads` 실패 시 건너뛴다(`journal.py:74-93`). HTTP 진입점은 `GET /api/network/journal?limit=`([§6.1](#6-http-api-contract--http-api-계약)).
+
+### 7.4 Forensic bundle — 증거 수집
+
+`forensic_bundle()`(`journal.py:96-154`)은 **ROLLED_BACK / FAILED_CRITICAL 양쪽 모두** `_rollback` 의 `finally` 에서 수집된다(`apply_engine.py:526-533`). 포렌식 실패가 롤백 결과를 바꾸지 않도록 try/except 로 감싼다.
+
+수집 소스(`journal.py:105-113`):
+
+| 산출 파일 | 명령 |
+|-----------|------|
+| `dmesg.txt` | `dmesg \| grep -iE 'wlan\|cnss\|pci' \| tail -200` |
+| `units.txt` | `journalctl -u wpa_supplicant@wlan0 -u systemd-networkd -u dpworld-network-apply -u dpworld-net-recover --since -10 min` |
+| `networkctl.txt` | `networkctl status` |
+| `wpa_status.txt` | `wpa_cli -i wlan0 status` |
+| `ip.txt` | `ip addr; ip route` |
+| `renders/*` | `render_dir` 의 설정 파일 (비밀 마스킹 후) |
+
+특성:
+- **크기 한도 ≤2MB, 최근 5개 유지**: `max_bytes=2MB`, 각 add 마다 budget 차감, 0 이하면 중단(`journal.py:97, 119-127`). 오래된 `forensic_*` 번들은 mtime 기준 5개 초과분 삭제(`journal.py:149-153`).
+- **per-command 8s timeout + 전체 wall budget 40s**: 각 source 전에 경과시간이 `max_wall_s`(기본 40s)를 넘으면 수집을 멈추고 `budget_note.txt` 로 partial 표시(`journal.py:128-134`). 5개 외부 cmd 동기 실행이 startup recovery 를 부풀리지 않게 함.
+- **렌더 파일 psk 마스킹**: 번들에 담는 렌더는 세 가지 정규식으로 비밀을 제거(`journal.py:143-148`):
+  ```python
+  body = re.sub(r'psk="[^"]*"', 'psk="***"', body)                                  # wpa conf 인용 psk
+  body = re.sub(r'("(?:password|psk|wifi_passwd)"\s*:\s*)"[^"]*"', r'\1"***"', body)  # persist JSON
+  body = re.sub(r'(?m)^(\s*psk=)[0-9a-fA-F]{64}\s*$', r'\1***', body)               # 64-hex psk
+  ```
+
+번들 위치는 `/opt/config_backups/network/forensic_<apply_id>.tar.gz`([§9.4.6](#9-deployment--operations--배포운영)).
+
+### 7.5 보안 (at-rest 권한)
+
+스냅샷·저널·apply_state 는 wifi password / wpa psk 평문 복사본을 포함할 수 있으므로 best-effort 로 owner-only 권한을 건다. 세 파일 모두 `_restrict(path, mode)` 헬퍼를 쓰며, OSError 는 삼키고 raise 하지 않는다(Windows 에선 read-only 비트만 토글되어 효과 제한적, `snapshot.py:7-13`, `journal.py:8-14`, `apply_engine.py:18-24`).
+
+| 대상 | 권한 | 근거 |
+|------|------|------|
+| 스냅샷 디렉토리 `<apply_id>/` | `0o700` | `snapshot.py:25` |
+| 렌더 복사본(wpa conf/persist) | `0o600` | `snapshot.py:36` |
+| `db_fields.json`(wifi_passwd 평문) | `0o600` | `snapshot.py:41` |
+| `manifest.json` | `0o600` | `snapshot.py:49` |
+| 저널 live + 로테이션 파일 | `0o600`(매 append best-effort) | `journal.py:55, 72` |
+| `apply_state.json` | `0o600`(심층방어) | `apply_engine.py:68` |
+
+## 8. UI / 사용자 인터페이스
+
+이 섹션은 v1.6.0 Network 적용 기능의 프런트엔드(브라우저) 구성을 다룬다. 핵심은 새 페이지 **Network → Apply & Status**(`src/static/js/pages/net-apply.js`)와, 기존 **Wi-Fi** 페이지(`wifi.js`)의 §5.2 정합 변경, 그리고 **Home Dashboard** 의 Network row(`home.js`)다. 설정값 입력과 OS 적용(apply)이 의도적으로 분리되어 있다는 점([§1.4](#1-overview--motivation--features--개요동기기능))이 전체 UX 의 큰 틀이다.
+
+### 8.1 페이지 위치 / 내비게이션
+
+좌측 사이드바 `Network` 그룹의 4번째 leaf 로 추가된다(`src/static/index.html:73-76`). 라벨은 `Apply & Status`, `data-page="net-apply"`, 아이콘은 `plug-zap`(`app.js:118` 에서 `icon-nav-net-apply` 슬롯에 등록). 같은 그룹의 앞 3개는 입력 페이지(Wi-Fi / Ethernet / Server Setting)이고, 마지막 Apply & Status 만 적용·상태 전용이다.
+
+```
+Network
+ ├─ Wi-Fi             <- 설정 입력
+ ├─ Ethernet         <- 설정 입력
+ ├─ Server Setting   <- 설정 입력
+ └─ Apply & Status   <- 미리보기 -> 적용 -> 확인 (net-apply.js)
+```
+
+다른 입력 leaf 들과 달리 `nav-net-apply` 에는 `nav-item__dirty`(미저장 표시 점) 마크업이 없다 — 이 페이지는 설정을 입력하는 곳이 아니라 적용하는 곳이기 때문이다. 같은 이유로 페이지 내 모든 컨트롤은 `data-no-dirty` 가 붙어 page-dirty / nav-guard 모달을 트리거하지 않는다(아래 §8.2.8).
+
+페이지는 page object 패턴(`render`/`mount`/`destroy`/`validate`)을 따르며 `app.js:85` 에서 `netApplyPage` 로 라우팅 테이블에 등록된다.
+
+### 8.2 Apply & Status 페이지 구성
+
+`netApplyPage.render()`(`net-apply.js:243-268`)가 정적 골격을 그리고, `mount()` 가 이벤트 바인딩 + 첫 데이터 로드 + 폴링을 건다. 페이지 헤더 설명이 분리 원칙을 명시한다: "저장(Save)된 네트워크 설정을 OS 에 적용하고 상태를 감시합니다. 설정 입력은 Wi-Fi/Ethernet/Server Setting 페이지에서." 상단 액션 바에는 `변경 미리보기`(dry-run)와 `LKG 롤백` 두 버튼이 있다.
+
+연결되는 API: `/api/network/state`, `/api/network/apply`, `/api/network/apply/status`, `/api/network/apply/confirm`, `/api/network/rollback`, `/api/network/journal`, `/api/network/config`(`net-apply.js:1-3`, `83`, `94`, 계약은 [§6](#6-http-api-contract--http-api-계약)).
+
+#### 8.2.1 drift / country 배너 (`#net-state`)
+
+`renderState(s)`(`net-apply.js:23-46`)가 `/api/network/state` 응답으로 두 종류의 경고 배너를 조건부로 그린다.
+
+| 조건 | 배너 | 의미 |
+|---|---|---|
+| `s.drift.dirty` | `alert-triangle` warning | DB ≠ 적용본. `drift.fields.length` 개 필드 미적용 + 필드명 mono 나열. "미적용 변경은 다음 재부팅 시 dpworldapp 이 적용" |
+| `s.country_pending` | `refresh-cw` warning | Country 변경 보류 중 — **Reboot required**(§6.2 권고) |
+
+#### 8.2.2 Live Interfaces 카드
+
+`s.interfaces` 의 각 항목을 `이름 → 상태 + 주소` row 로 렌더(`net-apply.js:27-29, 37`). 비어 있으면 `—`. OS 라이브 인터페이스 상태를 보여준다.
+
+#### 8.2.3 Watchdog 상태 카드
+
+`s.watchdog` 에서 두 row(`net-apply.js:38-42`):
+- **상태**: `wd.critical` 이면 `CRITICAL`(fail 뱃지), 아니면 `wd.enabled` 시 `enabled`(ok), 그 외 `off`(na).
+- **최근 판정**: `wd.last_results` 를 mono JSON 으로 표시(watchdog 내부는 [§5](#5-watchdog--self-healing--상시-감시자가복구)).
+
+#### 8.2.4 마지막 Apply 카드 + CONFIRM_WAIT Confirm 버튼
+
+`lastApplyCard(la)`(`net-apply.js:48-56`)가 `apply_id` 와 `state`(기본 `IDLE`)를 보여준다. `la.state === 'CONFIRM_WAIT'` 이면 경고 배너에 남은 초(`confirm_remaining_s`)와 함께 **Confirm** 버튼을 그린다. 이 버튼은 `data-net-confirm="<apply_id>"` 속성을 갖고, 클릭은 직접 바인딩이 아니라 **위임(delegation)** 으로 처리된다.
+
+위임이 중요한 이유: eth1(웹 접속 경로) 변경 시 사용자는 *새 IP 로 재접속* 하여 페이지를 다시 로드해야 한다(`net-apply.js:50-51`, [§3.5](#3-apply-flow--state-machine--적용-흐름상태머신)). re-render/재접속으로 DOM 이 갈아끼워져도 Confirm 이 동작하도록, `mount()` 에서 컨테이너에 단일 위임 리스너 `onDelegatedClick`(`net-apply.js:233-236`)을 건다. SPA 가 페이지 전환 시 `#page-container` 의 `innerHTML` 만 교체하고 엘리먼트는 재사용하므로, 방문마다 리스너가 누적되어 Confirm 이 N중 발화하는 것을 막기 위해 `boundContainer` 를 추적해 이전 리스너를 제거 후 재등록하고(`net-apply.js:277-279`), `destroy()` 에서도 제거한다(`net-apply.js:300-303`).
+
+#### 8.2.5 dry-run diff 모달 (`#net-diff-modal`)
+
+`변경 미리보기` 클릭 → `doDryRun()`(`net-apply.js:111-150`)이 `POST /api/network/apply {dry_run:true, fields:{}}` 를 호출한다. `fields:{}` 는 "현 DB 기준 drift 를 적용 대상으로 삼으라" 는 의미. 응답의 `diff` 를 `필드 / 적용본 / DB(새값)` 3열 테이블로, `warnings` 를 뱃지로 모달에 채운다. diff 가 비면 "변경 없음" 문구. 모달은 `nav-guard__backdrop` 구조를 재사용한다(`net-apply.js:256`).
+
+모달 내 게이트 컨트롤(`net-apply.js:259-263`)은 서버 warning 에 따라 조건부 노출/리셋된다.
+
+| 컨트롤 | id | 표시 조건 | 효과 |
+|---|---|---|---|
+| eth1 동의 체크박스 | `net-eth1-consent` | `warnings` 에 `eth1_confirm` 포함 시 행 노출(`:132`) | **미체크면 `적용 시작` 비활성**(게이트, `:141-147`) |
+| country 지금 적용 | `net-country-now` | `warnings` 에 `country_reboot_deferred` 포함 시(`:133`) | 체크 시 `country_now:true` 로 전송. v1.11.6 부터 live 모듈 리로드가 제거되어 실효 변경은 재부팅 시점이다(§3.3) — 이 옵션은 호환용 플래그로 남아 있다 |
+| 검증 생략(force) | `net-force` | 항상 | 체크 시 `force:true` — 사전 프로비저닝용, 저널 기록([§3.4](#3-apply-flow--state-machine--적용-흐름상태머신)) |
+
+세 체크박스는 **모달이 열릴 때마다 false 로 리셋** 된다(`net-apply.js:138-140`) — 동의가 dry-run 간에 잔존하면 안 되기 때문. `gate()` 가 `diff.length > 0 && errors.length === 0 && consentOk` 를 만족할 때만 `net-apply-go` 를 활성화한다(`net-apply.js:141-147`). 세 체크박스와 동의 라벨, `적용 시작`/`닫기` 모두 `data-no-dirty`.
+
+#### 8.2.6 적용 실행 + 1s 진행 폴링 (epoch 가드)
+
+`적용 시작` → `doApply()`(`net-apply.js:152-164`)가 `POST /api/network/apply {dry_run:false, force, country_now, fields:{}}` 를 보내고 비동기 `apply_id` 를 받은 뒤 `pollStatus()` 를 시작한다. 적용은 즉시 끝나지 않고 status 폴링으로 진행을 추적한다.
+
+`pollStatus()`(`net-apply.js:167-213`)는 `setInterval` 이 아니라 **체이닝된 `setTimeout(tick, 1000)`**(1초 간격)으로 동작하며 **epoch 가드** 를 둔다:
+- 모듈 전역 `pollEpoch` 를 매 호출마다 증가시키고, 각 `tick()` 은 자기 `epoch` 가 현재 `pollEpoch` 와 일치할 때만 결과를 반영/재예약한다(`net-apply.js:169, 176, 208`). 새 apply 가 시작되면(`doApply` 의 `pollEpoch++`, `:160`) 이전 세대의 in-flight tick 은 stale 로 스스로 폐기된다.
+- 진행 카드(`#net-progress`)는 `state|apply_id|steps.length` 키가 바뀔 때만 `innerHTML` 을 다시 그린다(`lastProgressKey`, `:179-191`). `CONFIRM_WAIT` 일 때는 카운트다운 텍스트만 `[data-net-count]` 에 갱신해 깜빡임/리스너 손실을 막는다(`:192-196`).
+- 각 step 은 결과별 글리프(`ok`→체크, `warn`→삼각, 그 외→엑스)로 표시(`:182-185`). 진행 중 `CONFIRM_WAIT` 면 진행 카드 안에도 동일한 위임형 Confirm 버튼을 그린다(`:186-190`).
+- 종료 상태 집합 `TERMINAL = [COMMITTED, ROLLED_BACK, FAILED_CRITICAL, FAILED_VALIDATION, NOOP]` 에 도달하면 폴링을 멈추고 토스트 + `refreshState()` 후 재예약하지 않는다(`:198-205`).
+- 폴링 중 fetch 실패는 조용히 무시한다 — eth1 IP 변경 도중 연결 단절이 정상적으로 발생할 수 있기 때문(`:206`).
+
+페이지 재진입/새로고침 시 `mount()` 가 status 를 한 번 조회해 `IN_FLIGHT` 상태(`VALIDATING/SNAPSHOT/WRITING/APPLYING/VERIFYING/CONFIRM_WAIT`)면 폴링을 자동 재개한다(`net-apply.js:281-291`). 별도 10초 주기 `refreshState` 타이머(`#net-state`/watchdog/journal 갱신)도 돈다(`:292`).
+
+#### 8.2.7 Journal 뷰어 (`#net-journal`)
+
+`refreshState()` 가 `GET /api/network/journal?limit=50` 결과를 `ts [category/phase] action → result` 라인으로 `<pre>` 에 출력한다(`net-apply.js:104-108`). 최근 50건. 저널 내부 포맷은 [§7.3](#7-snapshot--rollback--journal--forensics--백업롤백저널포렌식).
+
+#### 8.2.8 Watchdog 제어 카드 (`#net-watchdog-control`)
+
+`renderWatchdogControl(cfg)`(`net-apply.js:59-79`)가 `/api/network/config` 의 `net_config` 로 운영자용 watchdog 제어를 그린다:
+- **kill-switch 토글** `net-wd-enabled`: `watchdog_enabled`(`on`/`off`) — 끄면 자율 watchdog 정지.
+- **자동 복구 토글** `net-wd-auto`: `watchdog_auto_recover` — 끄면 이상 감지 시 WARN 로그만.
+- **복구 재무장 버튼** `net-wd-reset`: `reset_watchdog_critical:true` 전송(critical reset).
+
+토글/버튼은 `postWatchdogConfig()`(`net-apply.js:81-90`)로 `POST /api/network/config` 한 뒤 응답의 `net_config` 로 카드를 다시 그리고 `refreshState()` 한다. 실패 시 토스트 + `refreshWatchdogControl()` 로 서버 기준 재동기화(낙관적 UI 되돌림). 셋 다 `data-no-dirty`.
+
+모든 페이지 내 컨트롤에 `data-no-dirty` 를 붙이는 이유: dirty-tracker 는 capture-phase input/change 에서 `target.closest('[data-no-dirty]')` 가 잡히면 `markDirty` 를 건너뛴다(`dirty-tracker.js:23, 34-35`). 적용·watchdog 제어는 "설정 변경" 이 아니라 즉시 동작/일시 UI 이므로 page-dirty 와 nav-guard 모달을 트리거하면 안 된다.
+
+### 8.3 Wi-Fi 페이지 §5.2 정합 (`wifi.js`)
+
+Apply 기능과 연동되는 dpworldapp 한계를 입력 단계에서 미러링하도록 Wi-Fi 페이지가 v1.6.0 §5.2 로 조정됐다(검증 규칙 원본은 [§4.5](#4-22-field-contract--byte-exact-rendering--22항목-계약byte-exact-렌더)).
+
+- **Security 옵션 축소**: 드롭다운은 `WPA/WPA2`(값 `wpa/wpa2`)와 `Open (none)`(값 `none`) 둘만 제공한다(`wifi.js:173-176`). **WEP 제거**.
+- **legacy tolerant read**: 저장된 값이 `none`/`Open`/`open` 이면 Open 으로, `WEP` 이면 WPA/WPA2 가 선택되고 "WEP 미지원 — 저장 시 WPA/WPA2 로 전환" 힌트를 띄운다(`wifi.js:159-162, 177`). 새 행 기본은 `wpa/wpa2`(`:143, 410`).
+- **19바이트 제한**: SSID/비밀번호 입력 모두 `maxlength="19"`(`wifi.js:165, 168`). `validate()`(`:460-475`)는 UTF-8 바이트 길이(`TextEncoder`) 기준으로 SSID ≤19바이트, `"`·`\` 금지, `none` 은 빈 비밀번호, 그 외는 8-19바이트 검증.
+- **DNS '저장만 됨' 라벨**: DNS 1/DNS 2 라벨에 `(저장만 됨 — 현 펌웨어 미적용)` 힌트(`wifi.js:322, 328`). 즉 입력·저장은 되지만 현재 펌웨어는 적용하지 않음을 명시(dead 필드, [§4.1](#4-22-field-contract--byte-exact-rendering--22항목-계약byte-exact-렌더) #5/#6).
+- **Country Code**: 별도 Region 카드에 `Frequently used` + 5개 대륙 그룹(205코드) 드롭다운. 미인식/공란/stale 값은 기본 `AE` 로 폴백하며 dpworldapp 이 Wi-Fi 모듈에 적용(`wifi.js:26-45, 336-347`).
+
+### 8.4 Home Dashboard — Network row
+
+`renderNetwork()`(`home.js:568-601`)의 Network 카드 맨 아래에 `networkApplyRows(status.network_apply)` 한 줄이 추가된다(`home.js:599`). `networkApplyRows(na)`(`home.js:752-766`)는 `system_status.network_apply` 요약([§2.3 (c)](#2-architecture--module-map--아키텍처모듈-지도))을 뱃지로 압축 표시한다. provider 미주입/구버전이거나 `na.error` 면 아무것도 그리지 않는다(`:753-754`).
+
+| 뱃지 | 출처 | 표시 |
+|---|---|---|
+| 인터페이스 OK/FAIL | `na.interfaces`(이름→tier) | tier `ok` 면 ok 뱃지, 아니면 fail 뱃지(`:755-756`) |
+| drift | `na.drift.dirty` | `drift <필드수>`(warn)(`:757-758`) |
+| watchdog | `na.watchdog` | `critical` → `watchdog CRITICAL`(fail), `enabled` 아니면 `watchdog off`(na), enabled 면 무표시(`:759-761`) |
+| country | `na.country_pending` | `country: reboot 필요`(warn)(`:762-763`) |
+
+같은 Network 카드의 인터페이스별 IP/MAC 에는 OS vs dpworldapp **drift indicator** 가 별도로 붙는다(`home.js:570-584`, MAC 은 `_normalizeMac` 정규화 후 비교, `:747-749`). 대시보드는 한눈에 적용 건전성을 보고, 상세/조치는 Apply & Status 페이지로 가는 구조다.
+
+### 8.5 운영자 관점 흐름 (end-to-end)
+
+```
+[Wi-Fi / Ethernet / Server Setting 페이지]
+        |  값 입력 -> Save (DB 저장, dirty 표시)
+        v
+[Network -> Apply & Status]
+   1) drift 배너로 "DB != 적용본" 확인
+   2) 변경 미리보기(dry-run) -> diff 모달
+        - eth1 변경이면 동의 체크박스 필수(게이트)
+        - country 변경이면 'country 지금 적용' 선택 가능
+   3) 적용 시작 -> 1s 진행 폴링(steps 체크/삼각/엑스)
+   4) (eth1 변경 시) CONFIRM_WAIT
+        - 새 IP 로 재접속: http://<새 IP>:9090
+        - 같은 페이지에서 Confirm (미확정 시 자동 롤백)
+        v
+   COMMITTED / ROLLED_BACK / FAILED_* / NOOP
+```
+
+핵심 원칙: **입력(Save)과 적용(Apply)이 분리** 되어 있어, 잘못 저장된 값이 곧바로 OS 에 반영되지 않는다. eth1(웹 접속 경로) 변경은 자기 자신을 끊을 수 있으므로 동의 게이트 + 새 IP 재접속 후 Confirm + 미확정 자동 롤백이라는 안전장치를 둔다([§3.5](#3-apply-flow--state-machine--적용-흐름상태머신)). 문제가 생기면 상단 `LKG 롤백` 버튼으로 last-known-good 설정으로 되돌릴 수 있다(`doRollback()`, `net-apply.js:225-230`, confirm 다이얼로그 포함, [§7.2(d)](#7-snapshot--rollback--journal--forensics--백업롤백저널포렌식)).
+
+## 9. Deployment & Operations / 배포·운영
+
+이 섹션은 Web Configurator(특히 v1.6.0 네트워크 적용 엔진)를 운영 장비에 배포하고, 운영 중 안전하게 다루기 위한 systemd 유닛 구성, 배포 스크립트의 네트워크 단계, 경로/포트 사실관계, 운영 런북, 보안 운영 완화를 다룬다. 대상 장비는 운영기 `192.168.55.56`(telechips-tcc8030-main), 검증기 `192.168.55.54` 이다.
+
+### 9.1 systemd 유닛 구성
+
+세 개의 유닛이 협력한다. 모두 영속 overlay 인 `/lib/systemd/system/` 에 설치된다(`/etc/systemd/system/` 은 이 보드에서 재부팅 시 소실되는 tmpfs overlay 이기 때문 — `deploy.ps1:166-172`, `:201` 주석).
+
+#### 9.1.1 `web-configurator.service` (메인 HTTP 서비스)
+
+근거: `deploy/web-configurator.service`.
+
+```ini
+[Unit]
+After=network.target wpa_supplicant@wlan0.service
+Wants=network.target wpa_supplicant@wlan0.service
+StartLimitIntervalSec=60
+StartLimitBurst=5
+
+[Service]
+ExecStart=/usr/bin/python3 /opt/web-configurator/src/server.py
+Environment=DB_PATH=/home/root/db/dynamic_data.db
+Environment=LOG_DIR=/opt/log/dpworldapp
+Environment=PORT=9090
+MemoryMax=48M
+Restart=always
+RestartSec=5
+```
+
+핵심 운영 포인트:
+
+| 항목 | 값/설정 | 이유 (파일:라인) |
+|------|---------|------------------|
+| `After=`/`Wants=` | `wpa_supplicant@wlan0.service` | watchdog 첫 틱에서 `/var/run/wpa_supplicant` 제어 소켓이 보이도록 기동 순서 보장 — 부팅 race 로 인한 wpa 쿼리 실패 → production WiFi flap 방지([§5.2](#5-watchdog--self-healing--상시-감시자가복구), `web-configurator.service:8-11`) |
+| `PrivateTmp=no` | 공유 `/tmp` 사용 | `wpa_cli` 가 응답 수신용 클라이언트 소켓을 `/tmp/wpa_ctrl_<pid>` 에 bind 하는데(컴파일 고정), 사설 tmpfs 는 호스트의 `wpa_supplicant` 가 못 봐서 영구 무응답이 됨. 따라서 공유 `/tmp` 로 전환하고 `ReadWritePaths` 에 `/tmp` 를 명시. v1.4.6.6 의 log-download `/tmp` staging 도 같은 라인이 유지(`web-configurator.service:31-39`) |
+| `ProtectSystem=strict` + `ReadWritePaths` | 화이트리스트 | `strict` 는 `/tmp` 까지 RO 로 만들므로 쓰기 경로를 명시해야 함. 화이트리스트: `/home/root/db`, `/opt/log/dpworldapp`, `/opt/web-configurator`, `/opt/fw_staging`, `-/opt/config_backups`, `-/home/root/network`, `/tmp`(`:39`) |
+| wpa 제어 소켓 RW | `-/var/run/wpa_supplicant -/run/wpa_supplicant` | `/var/run` 은 `/run` 의 symlink — namespace 는 실경로 기준이므로 둘 다 지정(`:40-41`) |
+| `MemoryMax=48M` | 메모리 캡 | v1.1.1 안정화 도입. dpworldapp 등 펌웨어 프로세스와의 공존 — amss.bin/펌웨어 MD5 read 시 1MB 청크 강제 등이 이 캡 전제([§5.5](#5-watchdog--self-healing--상시-감시자가복구), `:24`) |
+| 추가 샌드박싱 | `NoNewPrivileges`, `ProtectHome=read-only`, `PrivateDevices`, `ProtectKernelTunables/Modules/ControlGroups`, `RestrictSUIDSGID`, `LockPersonality` | OS 레벨 최소비용 sandboxing(`:42-46`) |
+
+`ProtectKernelModules=yes` 때문에 메인 서비스는 `modprobe` 를 직접 호출할 수 없다 — 이를 별도 recover 유닛에 위임한다(아래 9.1.2).
+
+#### 9.1.2 `dpworld-net-recover.service` (wlan 모듈 복구)
+
+근거: `deploy/dpworld-net-recover.service`.
+
+```ini
+[Service]
+Type=oneshot
+ExecStart=/bin/sh -c 'modprobe wlan_cnss_core_pcie; modprobe wlan; systemctl try-restart wpa_supplicant@wlan0.service'
+```
+
+- 목적: `apply.sh` 가 다루지 못하는 "wlan 모듈 완전 다운" 사각지대 복구.
+- 메인 서비스 샌드박스의 `ProtectKernelModules=yes` 를 유지하면서 `modprobe` 만 수행하도록 분리 — 웹/watchdog 은 `systemctl start dpworld-net-recover.service` 로만 호출한다(`dpworld-net-recover.service:3-5`).
+- `modprobe -r`(모듈 제거)는 의도적으로 미포함 — 과거 `ExecStopPost=modprobe -r` 사고 재발 방지(`:5`).
+- oneshot 이라 `enable` 불필요(파일만 설치). watchdog 복구 사다리(`wlan_module`)와 롤백 마지막 사다리에서 호출된다([§5.3](#5-watchdog--self-healing--상시-감시자가복구) `watchdog.py:18`, [§7.2(c)](#7-snapshot--rollback--journal--forensics--백업롤백저널포렌식) `apply_engine.py:520`).
+
+#### 9.1.3 `dpworld-network-apply-ondemand.conf` (drop-in)
+
+근거: `deploy/dpworld-network-apply-ondemand.conf`. 설치 경로 `/lib/systemd/system/dpworld-network-apply.service.d/10-ondemand.conf`.
+
+```ini
+[Unit]
+Requires=
+```
+
+- 문제: 펌웨어 소유 oneshot `dpworld-network-apply.service` 가 `Requires=dpworld-network-seed.service` 를 가지는데, `seed` 는 boot-only oneshot 이라 재부팅 후 웹이 `systemctl start` 로 온디맨드 호출하면 `seed` 가 inactive → "Dependency failed" rc=1 이 됨(.56 실측).
+- 해소: 런타임 `Requires=` 를 빈 값으로 override. `apply.sh` 자체는 자족적이므로 무해. `After=` 는 비우지 않아 부팅 순서는 유지(`dpworld-network-apply-ondemand.conf:1-7`).
+- 참고: `apply.service` 호출은 어차피 best-effort 이고(`must_ok=False`), 실제 적용 게이트는 `networkctl reload/reconfigure` + verify 다(`apply_engine.py:347-356`, [§3.1](#3-apply-flow--state-machine--적용-흐름상태머신)).
+
+### 9.2 `deploy.ps1` 네트워크 단계
+
+근거: `scripts/deploy.ps1`. 고정 사실: `$AppDir=/opt/web-configurator`, `$Service=web-configurator`, `$Port=9090`, SSH 는 `root@<ip>` + `StrictHostKeyChecking=no -o BatchMode=yes`(`deploy.ps1:31-35`).
+
+배포 순서의 핵심 설계는 **유닛/디렉토리 설치를 src swap 전에 수행** 하는 것이다 — scp 실패 시 OLD src 가 디스크에 살아있는 상태로 중단되어 롤백 창을 보호한다(`deploy.ps1:173-174`).
+
+1. 디렉토리 사전 생성(`deploy.ps1:146`, `:198`):
+   - `mkdir -p $AppDir /opt/fw_staging /opt/config_backups` — `ProtectSystem=strict` 가 존재+화이트리스트를 동시에 요구하므로 미리 만든다.
+   - `mkdir -p /home/root/network /opt/config_backups/network && chmod 700 /opt/config_backups/network` — 후자는 plaintext PSK 가 담기는 백업 디렉토리라 world-read 차단(700). 전자는 dpworldapp 공유 디렉토리라 기본 권한 유지(`:196-198`).
+2. `web-configurator.service` 설치(`:175-193`): 첫 배포면 scp 후 `daemon-reload && enable`. 이후엔 `sha256sum`(원격) vs `Get-FileHash`(로컬) **hash-compare** — 변경 시에만 재설치 + `daemon-reload`.
+3. `dpworld-net-recover.service` 설치(`:204-222`): 동일 hash-compare 패턴. oneshot 이라 enable 없이 파일만. 구버전이 만든 휘발성 `/etc/systemd/system/` 사본은 `rm -f` 로 제거(systemd 우선순위가 `/etc` 를 먼저 보기 때문).
+4. `10-ondemand.conf` drop-in 설치(`:229-248`): `mkdir -p .../dpworld-network-apply.service.d` 후 hash-compare scp + `daemon-reload`. 디렉토리도 영속 `/lib` 하에 둔다.
+5. swap & 검증(`:250-291`): `rm -rf src && mv _deploy_tmp/src src` → 버전 스탬프(`DEPLOYED_VERSION`, `deploy-history.log`) → `systemctl restart` + `Confirm-Health`. health 실패 시 **자동 롤백**(`backups/src-$ts` 복원 + 재시작, `DEPLOYED_VERSION` 을 `version=rolled-back` 으로 갱신). src 백업은 최근 3개 유지(`:155-164`).
+
+검증: `ssh root@<ip> cat /opt/web-configurator/DEPLOYED_VERSION`(`:300`).
+
+### 9.3 경로 / 포트 (운영 .56 기준)
+
+| 항목 | 값 | 출처 (env / 기본값) |
+|------|-----|---------------------|
+| HTTP 포트 | `9090` | `PORT` env(유닛에서 9090 지정; 코드 기본은 8080) — `server.py:79`, `web-configurator.service:23` |
+| 바인드 주소 | `0.0.0.0`(기본) | `HOST` env(`server.py:78`) — 보안 완화는 §9.5 참조 |
+| 설정 DB | `/home/root/db/dynamic_data.db` | `DB_PATH` env(`server.py:92`) |
+| 로그 디렉토리 | `/opt/log/dpworldapp` | `LOG_DIR` env(`server.py:154`) |
+| 네트워크 렌더 디렉토리 | `/home/root/network` | `NET_DIR` env, 기본 `network_config.json` 등 렌더 산출물(`server.py:132,157,164`) |
+| 네트워크 백업/스냅샷 | `/opt/config_backups/network` | `NET_BACKUPS_DIR` env(`server.py:158`) |
+| apply 상태 파일 | `/opt/config_backups/network/apply_state.json` | `NET_STATE_PATH` env(`server.py:159-160`) |
+| 네트워크 저널 | `/opt/log/dpworldapp/network_journal.jsonl` | `LOG_DIR + network_journal.jsonl`(`server.py:154-155`) |
+| 포렌식 번들 | `/opt/config_backups/network/forensic_<apply_id>.tar.gz` | `backups_dir` 하(`apply_engine.py:530`, `journal.py:114`) |
+| firmware staging / 백업 | `/opt/fw_staging`, `/opt/config_backups` | `FW_STAGING_DIR`, `FW_BACKUPS_DIR` env(`server.py:104-105`) |
+
+네트워크 서브시스템은 import 시 실패해도 서버가 죽지 않도록 try/except 로 감싸져 있고, 실패 시 `/api/network/*` 는 503 을 반환한다(`server.py:166-168`, `:684-687`, [§2.3](#2-architecture--module-map--아키텍처모듈-지도)·[§6.5](#6-http-api-contract--http-api-계약)). Windows dev box 안전을 위한 fail-soft 다.
+
+### 9.4 운영 런북
+
+#### 9.4.1 네트워크 설정 적용 절차
+
+비동기 상태머신이다. apply 는 `apply_id` 와 함께 `STARTED` 를 즉시 반환하고, 결과는 status 폴링으로 확인한다(eth1 IP 변경 시 networkctl 이후엔 구 연결로 동기 응답이 불가하기 때문 — `net_routes.py:44-50`, `apply_engine.py:252-260`).
+
+1. (선택) **Dry-run** — `POST /api/network/apply` body `{"fields":{...},"dry_run":true}`. diff/errors/warnings 만 계산(라이브 무접촉). 경고 예: `eth1_confirm`, `wifi_disrupt`, `country_reboot_deferred`, `dns_saved_only`(`apply_engine.py:206-225`).
+2. **Apply** — `POST /api/network/apply` body `{"fields":{...}}`. `fields` 는 `netmodel.NETWORK_DEV_KEYS` 화이트리스트만 허용(미지 키는 400 — 스냅샷이 못 잡는 side-door 차단, `net_routes.py:35-40`, [§6.3](#6-http-api-contract--http-api-계약)).
+3. **Status 폴링** — `GET /api/network/apply/status?id=<id>`. 폴링이 confirm TTL 타이머의 안전망 역할을 겸한다(`engine.tick()`, `net_routes.py:52-54`). state 진행: `VALIDATING → SNAPSHOT → WRITING → APPLYING → VERIFYING → (CONFIRM_WAIT) → COMMITTED`. 실패 분기: `FAILED_VALIDATION`, `ABORTED`(스냅샷 전), `ROLLED_BACK`, `FAILED_CRITICAL`([§3.7](#3-apply-flow--state-machine--적용-흐름상태머신)).
+4. **상태 종합** — `GET /api/network/state`(interfaces live + drift + watchdog snapshot + last_apply + country_pending, `net_routes.py:71-76`).
+
+쓰기는 DB-first(§4.1)다: 스냅샷 채취 → DB partial-merge → 렌더 파일(`network_config.json` 등) 작성 → `systemctl start dpworld-network-apply.service`(best-effort) → `networkctl reload` + 변경 iface `reconfigure` → 필요 시 `wpa_cli reconfigure` → verify(`apply_engine.py:326-384`).
+
+#### 9.4.2 eth1 변경 시 주의 — confirm 필수 (자기 차단 방지)
+
+eth1(운영자 접속 인터페이스로 가정)이 변경 대상에 포함되면 verify 후 `COMMITTED` 로 바로 가지 않고 **`CONFIRM_WAIT`** 로 진입하며 TTL 90초 타이머가 무장된다(`CONFIRM_TTL_S=90`, `apply_engine.py:7`, `:391-398`).
+
+- 운영자는 **새 IP 로 재접속** 해 `POST /api/network/apply/confirm` body `{"apply_id":"<id>"}` 로 확정해야 한다(`net_routes.py:56-61`, `apply_engine.py:535-540`).
+- 90초 내 confirm 이 없으면 엔진 타이머/폴링/watchdog 중 하나가 TTL 만료를 감지해 **자동 롤백** 한다 — 잘못된 IP 로 운영자가 영구 lockout 되는 것을 막는 안전장치(`apply_engine.py:542-553`, [§3.5](#3-apply-flow--state-machine--적용-흐름상태머신)).
+- `country_code` 변경은 별도 정책: 단독 변경이면서 `country_now` 미동의면 `COMMITTED + country_pending`(재부팅 필요)로 deferred. 다른 필드와 혼합된 country 실효 변경은 v1.9 split-apply 로 분리(비-country 즉시 + country deferred)된다. **v1.11.6 부터 country 는 `country_now` 동의 여부와 무관하게 live `modprobe -r` 없이 항상 재부팅 시점에 반영**된다(`apply_engine.py:185-203`, `:336-344`, [§3.3](#3-apply-flow--state-machine--적용-흐름상태머신), [firmware-boot-hardening.md](firmware-boot-hardening.md)).
+
+#### 9.4.3 롤백
+
+- **자동**: verify 실패(non-force) 또는 confirm TTL 만료, 또는 startup recovery 시 미완료 apply 발견 시. 스냅샷에서 DB(present 복원 + absent pop) + 렌더 파일 복원 후 재적용·재검증. 재검증 실패 시 `dpworld-net-recover.service` 1회 호출 후에도 안 되면 `FAILED_CRITICAL`(`apply_engine.py:424-525`, [§7.2](#7-snapshot--rollback--journal--forensics--백업롤백저널포렌식)).
+- **수동(LKG)**: `POST /api/network/rollback` → last-known-good 스냅샷으로 복원. in-flight apply/CONFIRM_WAIT 중엔 409 BUSY, LKG 없으면 409 INVALID(`net_routes.py:63-69`, `apply_engine.py:562-579`).
+
+#### 9.4.4 Watchdog 끄기 (kill-switch)
+
+상시 감시·자가복구 데몬(틱 기본 30초, 튜너블 10–300초, 히스테리시스 2, cooldown 5분, 시간당 4회 한도)이 `net_config` DB 키를 읽어 동작한다(`watchdog.py:1-6`, `:64-77`, [§5.6](#5-watchdog--self-healing--상시-감시자가복구)).
+
+- 현재 설정 조회: `GET /api/network/config`(기본값 merge — `watchdog_enabled=on`, `watchdog_auto_recover=on`, `watchdog_interval_s=30`, `net_routes.py:96-97`, `:22-23`).
+- **kill-switch**: `POST /api/network/config` body `{"watchdog_enabled":"off"}` 또는 자동복구만 끄려면 `{"watchdog_auto_recover":"off"}`(감지 WARN 은 계속, 복구 액션만 중단). 엄격 화이트리스트 — 미지 키/이상치는 400(`net_routes.py:99-137`).
+- 틱 주기 변경: `{"watchdog_interval_s":<10..300 정수>}`(float/bool 거절, `net_routes.py:118-126`).
+- **CRITICAL 재무장**: 시간당 4회 한도 도달 시 watchdog 가 스스로 `_critical` 잠금(자멸 방지). 1시간 창이 비면 자동 재무장되지만, 즉시 되살리려면 `POST /api/network/config` body `{"reset_watchdog_critical":true}`(단독 전송 필수, `net_routes.py:104-111`, `watchdog.py:197-203`).
+
+주의: gateway ping 은 2틱마다 WARN 로그만 남기고 **자동복구를 하지 않는다**(auth-loop 이력 교훈, `watchdog.py:168-177`). 케이블 미연결/링크 DOWN 인 eth0/eth1 도 복구 보류(시간당 한도로 인한 watchdog 자멸 방지, `watchdog.py:131-154`).
+
+#### 9.4.5 Soak / 운영 확인 명령
+
+- 서비스 상태: `ssh root@192.168.55.56 systemctl status web-configurator`.
+- 헬스/버전: `curl http://192.168.55.56:9090/api/system-status`(network_apply provider 가 watchdog/drift/interfaces 를 fail-soft 로 포함, `server.py:177-190`), 그리고 `cat /opt/web-configurator/DEPLOYED_VERSION`.
+- 네트워크 종합/drift: `curl 'http://192.168.55.56:9090/api/network/state'`.
+- 저널 tail(이벤트 추적, soak 관찰): `curl 'http://192.168.55.56:9090/api/network/journal?limit=50'`(최대 500, psk/password 마스킹됨, `net_routes.py:78-83`, `journal.py:6,30-35`). 파일 직접: `/opt/log/dpworldapp/network_journal.jsonl`(+ `.1/.2/.3` 로테이션, 5MB×3).
+- watchdog heartbeat 는 정상 시 1시간마다만 디스크 기록(정상 틱은 RAM 카운터) — soak 중 heartbeat 라인 존재로 생존 확인(`watchdog.py:269-272`).
+
+#### 9.4.6 장애 시 포렌식 번들 위치
+
+apply 가 `ROLLED_BACK` 또는 `FAILED_CRITICAL` 로 끝날 때마다 자동으로 증거 tar.gz 가 수집된다(`apply_engine.py:526-533`, [§7.4](#7-snapshot--rollback--journal--forensics--백업롤백저널포렌식)).
+
+- 위치: `/opt/config_backups/network/forensic_<apply_id>.tar.gz`(개당 ≤2MB, 최근 5개 유지, `journal.py:96-99`, `:149-154`).
+- 내용: `dmesg`(wlan/cnss/pci grep), `journalctl`(wpa_supplicant/networkd/apply/recover 최근 10분), `networkctl status`, `wpa_cli status`, `ip addr; ip route`, 그리고 `renders/` 의 렌더 파일들(psk/password/64-hex psk 마스킹). per-cmd 8초 + 전체 40초 wall budget 으로 startup recovery 를 부풀리지 않게 제한(`journal.py:104-148`).
+
+### 9.5 보안 운영 완화 (C1: 관리 IF 바인딩 + 방화벽 allow-list)
+
+현재 코드 기본값은 `HOST=0.0.0.0`(`server.py:78`)이며 인증이 없다 — LAN 의 누구나 `/api/network/*`, firmware OTA 등 모든 엔드포인트에 도달할 수 있다(보안 자세 평가는 [§10.3](#10-acceptance--security--known-limitations--수락-결과보안한계백로그)). 코드 변경 없이 적용 가능한 운영 완화:
+
+1. **관리 인터페이스로만 바인딩**: 메인 서비스 유닛에 `Environment=HOST=<관리망 IP>` 를 추가(예: 운영자 접속용 eth1 의 고정 IP). `server.py:78,1115` 가 `(HOST, PORT)` 로 bind 하므로 외부/필드망 인터페이스에서는 9090 이 열리지 않는다. 단, eth1 IP 를 네트워크 적용으로 바꾸는 경우 바인딩 주소와 충돌하지 않도록 주의(§9.4.2 confirm 절차와 병행).
+2. **방화벽 allow-list**: 9090(및 nginx 가 앞단이면 80/443)에 대해 운영자 워크스테이션 서브넷만 허용하는 ingress 규칙을 둔다. iptables 예시:
+   ```sh
+   iptables -A INPUT -p tcp --dport 9090 -s <운영자_서브넷>/24 -j ACCEPT
+   iptables -A INPUT -p tcp --dport 9090 -j DROP
+   ```
+3. 두 완화는 보완적이다 — 바인딩은 인터페이스 노출면을 줄이고, allow-list 는 동일 관리망 내 비인가 호스트를 차단한다. 근본적 엔드포인트 인증(로그인 기능)은 별도 SEC-2 트랙으로 분리되어 있으므로([§10.3](#10-acceptance--security--known-limitations--수락-결과보안한계백로그)), 그 전까지는 위 망/방화벽 레벨 완화를 운영 표준으로 적용한다.
+
+## 10. Acceptance · Security · Known Limitations / 수락 결과·보안·한계·백로그
+
+이 섹션은 v1.6.0 Network Apply Engine 의 실기기 수락 결과, 출시 전 다단 리뷰 과정, 미인증 API 의 보안 자세(security posture), 그리고 dpworldapp 협의 대기 항목을 포함한 알려진 한계와 백로그를 정리한다. 근거: 수락 시나리오·soak 검증 기록(내부, 이 배포물에 미포함), `CHANGELOG.md` `[v1.6.0]`.
+
+### 10.1 `.56` 실기기 수락 — 10/10 + A-0 PASS
+
+수락은 운영기 `.56` 에서 2026-06-12 ~ 06-13 사이 수행됐다. SSH fallback 경로로 wlan0(10.227.231.38)를 확보해 eth1 단절 시나리오에서도 Wi-Fi 독립 접속을 유지했다. 사용자 결정 ① `lte_server_ip = 104.208.105.62` 유지(A-0 drift 정정 후 확정), 결정 ② 나머지 시나리오 전체 자율 진행 승인.
+
+| 시나리오 | 내용 | 결과 | 핵심 수치 / 증거 |
+|---|---|---|---|
+| A-0 | drift 정정 — `lte_server_ip` DB 동기화 | PASS | `preserved_keys_count: 36`(partial-merge 정책 준수), drift `dirty:false`, real apply NOOP |
+| #1 | wifi 프로파일 추가(happy path) | PASS | wpa_supplicant 2-block conf 렌더, 복원 byte-identical(md5 동일) |
+| #2 | 오류 PSK — wpa 인증 실패 자동 롤백 | PASS | `wpa_cli status` DISCONNECTED → ROLLING_BACK → `ROLLED_BACK`, wpa conf 이전 값 복원 |
+| #3 | eth1 IP 변경 미confirm → TTL 자동 롤백 | PASS | **91초** 경과 후 `.99`→`.56` 자동 복원, `ROLLED_BACK` |
+| #4 | eth1 IP 변경 confirm → 영속 COMMITTED | PASS | `COMMITTED`, 재부팅 후 `.99` 유지, 복원 byte-identical |
+| #5 | country deferred + 재부팅 → firmware US 적용 | PASS | 재부팅 후 apply.service 자동 실행, `wpa_cli -i wlan0 get country` = `US`, `country_pending` 자동 해제 |
+| #6 | country_now KR 즉시 적용 | PASS | 재부팅 없이 `wpa_cli get country` = `KR`, `_live_country=KR` 강화 검증 |
+| #7 | wlan 모듈 강제 다운 자가복구(`rmmod wlan`) | PASS | watchdog 감지 → 복구 **51초**(`wlan0 UP` + `wpa_supplicant COMPLETED`), 수동 개입 0건, 스펙 한도 120초 내 |
+| #8 | dpworldapp 재시작 무변화(§4.1 불변식) | PASS | networkd 렌더 파일 4종 + wifi-country-code + wpa_supplicant.conf **md5 전부 동일**, networkd 이벤트 0건 |
+| #9 | CONFIRM_WAIT 중 SIGKILL → `recover_on_startup` 롤백 | PASS | 재시작 시 동일 boot_id(monotonic 유효) 기준 TTL 롤백, gateway 이전 값 복원, journal `RECOVER` |
+| #10a | eth1 gateway 제거(§3.3-5 quirk 중화 증명) | PASS | 재부팅 없이 default 라우트 라이브 소멸, `networkctl reload` 43ms / `reconfigure` 27ms |
+| #10b | eth1 gateway 복원(1차 FAIL → fix 후 PASS) | PASS | 결함 2건 수정(`7d6dab7`) 후 재시도, gateway `192.168.55.1` 복원, byte-identical |
+
+**24h soak**: 2026-06-13 등록 완료, 익일 confirm 예정. 판정 기준은 watchdog `recover` 이벤트 0건 + `heartbeat` ≥1건 + network state `critical` 부재. CHANGELOG 의 "24h soak 등록 완료 — 익일 confirm" 기재대로 진행되며, soak 종료 검증 명령은 acceptance 문서 하단에 등재돼 있다([§9.4.5](#9-deployment--operations--배포운영)).
+
+#### §8 §4.1 불변식 해석 정정 (조건부 판정)
+
+#8 검증에서 dpworldapp 이 매 기동 시 `network_config.json` 을 자체 cJSON(tab 들여쓰기) 포맷으로 **재직렬화** 함이 확인됐다. 따라서 JSON 바이트 동일성은 불일치하지만, **값 수준 동일성은 완전 동일**(drift `dirty:false` 유지)하고 networkd 관련 렌더 파일은 byte-exact md5 동일이다. §4.1 불변식은 "JSON 바이트 동일성" 이 아닌 **"JSON 값 동일성 + 렌더 파일 byte-exact"** 로 정립됐다([§4.3](#4-22-field-contract--byte-exact-rendering--22항목-계약byte-exact-렌더)). 이 사실은 내부 handoff 기록에 추가 문서화 대상이다.
+
+### 10.2 검증 과정 요약 — phase별 2단 리뷰 + 종합 13건 + codex 5건
+
+v1.6.0 은 기능 수락 PASS 만으로 운영 안전성을 보장하지 않는다는 원칙 하에 다단 검증을 거쳤다.
+
+1. **단계별 2단 리뷰**: release design notes 기반 구현 중 다단 적대적 리뷰로 출시 전 60+건 차단 — 적용본-기준선 결함(Save→Apply NOOP), confirm-vs-TTL 레이스, country 게이팅 구멍, 포렌식 평문 유출, recover 유닛 tmpfs 설치, wpa 부팅 race 등(`CHANGELOG.md` Quality 항목).
+2. **라이브 발견·수정 결함 4건**(수락 중 실기기에서만 재현 가능했던 통합 결함):
+
+   | # | 증상 | 수정 | commit |
+   |---|---|---|---|
+   | D-1 | networkd 비동기 과도 상태 false fail(#10b 1차 FAIL) — reconfigure 20ms 후 eth1 주소 순간 `[]` | VERIFYING settle-retry(N회 polling + 최종 판정) | `7d6dab7` |
+   | D-2 | 롤백 재검증 기준 오류 — 스냅샷 DB(새 값) 기준 비교 → 영구 불일치 | 기준 = 복원된 persist(이전 값) | `7d6dab7` |
+   | D-3 | wlan0 carrier-DOWN 시 wpa-gate bypass(#2 틀린 PSK 커밋) | carrier DOWN이어도 `wpa_cli` 확인 강제 | `f5a6aff` |
+   | D-4 | firmware apply.service `Requires=seed` 의존(#5 재부팅 후 FAILED_CRITICAL) | best-effort 전환 + `/lib` drop-in 으로 `Requires=` 제거 | `f5a6aff` |
+
+   기기 선행 조건 수정: PrivateTmp=no(wpa control socket 공유) + eth0 link-DOWN watchdog 복구 억제 + `/run/wpa_supplicant` ReadWritePaths(`ed366ac`/`019a951`).
+3. **출시 전 종합 리뷰 13건**(2026-06-13): 10/10 수락 PASS 후 6렌즈 × 2-skeptic 적대적 검증(50 에이전트)에서 수락·단계별 리뷰가 모두 놓친 **운영·생애주기** 결함 13건(HIGH 1 + MEDIUM 6 + LOW 6) 확인·수정. cold-start / startup block / 운영자 kill switch 부재 / 비밀 저장 권한(PSK 0644) / watchdog 재무장 / 검증 누락 클래스 — 사전 시드된 건강한 장비에서는 드러나지 않는 클래스. commit `8c649be`(startup 비동기·empty net_dir·dry-run probe·forensic budget), `d2cb031`(kill switch·재무장·권한·country 롤백 검증), `898f820`(유닛 설치 순서·dry-run 설명·SSID 바이트 길이). 950 pytest PASS / 1 skip / 46 npm.
+4. **codex 2차 리뷰 대응 5건**(2026-06-14, commit `e92a5f7`): handoff 6 finding 의 adversarial 2차 검증. **H1** apply 임의 `device_config` 키 기록+롤백 미제거 → `netmodel.NETWORK_DEV_KEYS` allowlist + 미인식 키 400 거부; **H2** bool truthiness `"false"`→`True` → `_req_bool` strict 파서; **M1** watchdog eth DOWN+주소 drift 미표시 → 전환 시 1회 `{ifc}_down_addr_drift` WARN; **M2** `watchdog_interval_s` float 절삭 → strict int; **L1** fake clock 무한 루프 가능성 → 방어적 반복 상한. **969 pytest PASS / 1 skip / 46 npm PASS**, `.56` 라이브 13 케이스 **ALL_PASS**(H1 allowlist 거부 + H2 bool strict 거부 + M2 float/bool 거부 라이브 확인).
+
+### 10.3 보안 자세 (Security Posture)
+
+#### C1 — 미인증 API + CORS `*`: 릴리스 비차단, 정책 문서화
+
+codex C1 finding 은 설정·network apply·firmware API 가 모두 미인증이라는 점을 지적했다. 근거: `src/server.py:78` 가 기본 `0.0.0.0` 바인딩, `src/server.py:201-205` 가 `Access-Control-Allow-Origin: *` 응답, 변경(mutating) 라우트는 `/setting/device`·`/setting/protocol`(`server.py:572-575`), firmware upload/flash(`server.py:588-592`), network apply/confirm/rollback/config(`server.py:595-617`).
+
+**판정**: 릴리스 비차단. 미인증 API 와 CORS `*` 는 **v1.6.0 신규 회귀가 아니다** — 둘 다 초기 커밋(2026-02-13)부터 존재했으며, 이 프로젝트의 설계 전제인 **"폐쇄 LAN, 단일 운영자"** 운용 모델에서 의도된 결과다. CORS `*` 는 Java `CorsConfig` 미러로 전체 앱 계약상 단독 변경이 불가능하다.
+
+단, v1.6.0 의 network reconfig API 추가로 **미인증 mutation 표면이 넓어진 것은 사실** 이며, 다음 운영 완화책(operational mitigation)을 권고한다(실 명령은 [§9.5](#9-deployment--operations--배포운영)):
+
+- **HOST 바인딩 제한**: `server.py` 의 `0.0.0.0` 바인딩을 배포 환경 관리 인터페이스(eth1 등) IP 로 교체, 또는 systemd `IPAddressDeny=` 활용.
+- **방화벽 allow-list**: iptables / nftables 로 9090 포트를 관리 대역(예: `192.168.55.0/24`)만 허용.
+
+#### 남은 결정사항 / 백로그
+
+- **(a) CORS 좁히기**: 전체 앱이 Java `CorsConfig` 동일 계약 공유 → 독립 변경은 사용자 결정 사안, 현재 보류.
+- **(b) 미인증 전체 엔드포인트**: **SEC-2 로그인 백로그** 소유(HOLD). 목표는 firmware OTA 단독 보호가 아닌 Web Configurator 전체 endpoint 보호 + 운영자 password 1개. 200대+ fleet 에는 secret-per-device 모델이 부적합하다는 사용자 결정에 따라 SEC-2 spec 은 historical reference 로 HOLD, 로그인 기능 spec 은 "다른 기능 완료 후" 별도 작성.
+- **(c) 운영 완화**: 위 HOST 바인딩 + 방화벽 allow-list 권고.
+
+### 10.4 알려진 한계 / 백로그
+
+#### dpworldapp 협의 대기 (handoff 항목 H)
+
+v1.6.0 은 `/home/root/network/` 6종 파일을 dpworldapp 과 동일한 계약으로 직접 작성·적용하며 byte-exact golden 검증을 통과했다(H-1). 하지만 dpworldapp 단독 경로(Web Configurator 미경유)에는 펌웨어 측 버그가 남아 있어 협의·수정 대기 상태다. 우리 엔진의 byte-exact 렌더가 `cmp -s` no-op 으로 이를 중화하므로 Web Configurator 경유 적용에는 실해가 없다([§4.3](#4-22-field-contract--byte-exact-rendering--22항목-계약byte-exact-렌더)).
+
+- **§3.3-4 load/save 비대칭**(H-3, 버그 리포트): deployed dpworldapp binary 의 필드 비교 로직은 `opc_ua_server_ip/port`·`modbus_server_ip/port` 4필드를 비교하지만 persist 로드 경로는 이 4필드를 JSON 에서 **읽지 않아**(로드 시 0 으로 초기화), OPC-UA/Modbus 설정이 있는 모든 production 장비에서 필드 비교 이 **항상 불일치** → dpworldapp 재시작마다 JSON 재작성 + apply.service 기동(churn). 권장 수정: load 경로에 4필드 역직렬화 추가.
+- **§3.3-5 seed quirk**(H-4, 버그 리포트): `dpworld-network-apply.service` 의 `Requires=dpworld-network-seed.service` 때문에 apply 기동 시 seed(`apply.sh --boot`)가 먼저 실행되어 `cmp -s` 동일 판정 → gateway/metric-only 변경이 dpworldapp 단독 경로(재부팅)에서 **침묵 누락** 가능. v1.6.0 은 apply.service 완료 후 항상 `networkctl reload` + `reconfigure` 를 직접 수행해 중화([§9.1.3](#9-deployment--operations--배포운영)), #10a 에서 라이브 입증. 권장 수정: `Requires=` 제거 또는 cmp 기준선을 live 파일로 변경.
+- **`lte_server_ip` 확인**(H-5, 확인 요청): `.56` 캡처에서 DB `device_config` = `10.226.22.48` vs 적용본 `network_config.json` = `104.208.105.62` 불일치 발견. A-0 수락에서 사용자가 `104.208.105.62` 유지로 확정·동기화했으나, 어느 쪽이 운영 의도인지 dpworldapp 팀 공식 확인이 남아 있다.
+
+#### 기타 한계
+
+- **Fresh-flash cold-start**: 최초 flash 시 빈 `/home/root/network` 에서의 미확인 롤백 lockout 은 종합 리뷰 #4(`8c649be`)로 수정됐으나(스냅샷 기준이 빈 경우 적용된 렌더 파일 유지, [§7.1(e)](#7-snapshot--rollback--journal--forensics--백업롤백저널포렌식)), 수락은 사전 시드된 건강한 `.56` 에서 수행됐으므로 진짜 cold-start 경로는 **`.54`(dev/verify) 검증 대상** 으로 남는다.
+- **장비 RTC 시계 skew**: TTL/confirm 타이머는 엔진 자체 monotonic 타이머 기반(#3 91초, #9 동일 boot_id monotonic 유효)이라 wall-clock skew 에 내성이 있으나, journal/apply_state 의 wall-clock 타임스탬프는 장비 RTC 정확도에 의존한다([§3.2(c)](#3-apply-flow--state-machine--적용-흐름상태머신)).
+- **watchdog `DOWN + address present` 의미론**(M1): 케이블-다운 복구 억제는 의도된 동작(`ed366ac` 자기파괴 방지)으로 유지하되, soak 중 실제 `DOWN` 샘플에 stale 주소가 포함되는지 관찰 후 가시성 정책 확정 — 현재는 전환 시 1회 WARN 만 추가([§5.4](#5-watchdog--self-healing--상시-감시자가복구)).
+
+## 관련 문서 / References
+
+| 종류 | 경로 |
+|---|---|
+| spec (Rev 2) | Internal source, not included in this export |
+| plan | Internal source, not included in this export |
+| changelog | `CHANGELOG.md` `[v1.6.0]` |
+| acceptance(수락 시나리오 + soak 검증) | 내부 기록, 이 배포물에 미포함 |
+| review handoff (+ Claude Review Response) | Internal source, not included in this export |
+| dpworldapp handoff (항목 H) | Internal source, not included in this export |
+| dpworldapp 파서 데이터 계약 | `docs/dpworldapp_schema_handoff/` (후보 스키마 v2/v3) |
+| SEC-2 로그인 백로그 (HOLD, archived) | Internal source, not included in this export |
diff --git a/docs/wifi-ap-guide.md b/docs/wifi-ap-guide.md
new file mode 100644
index 0000000..f749482
--- /dev/null
+++ b/docs/wifi-ap-guide.md
@@ -0,0 +1,132 @@
+# Wi-Fi AP 서브시스템 가이드
+
+> 살아있는 문서(living guide) — 앱 **v1.11.10** 기준. 코드: `src/network/ap_*.py`,
+> `deploy/dpworld-ap-apply.sh`. 아키텍처 전체는 [`architecture.md`](architecture.md) §3.1.1.
+
+장비를 소프트 AP(`ap0`)로 띄워 운영자가 무선으로 Web Configurator(:9090)에 접속하게 한다.
+STA(`wlan0`, 업스트림 Wi-Fi)는 **무접촉**으로 유지한다.
+
+---
+
+## 1. ap0 가상 인터페이스 (vif)
+
+- `wlan0` 위에 `iw dev wlan0 interface add ap0 type __ap` 로 **별도 vif** 생성.
+- **MAC**: `wlan0` MAC 첫 옥텟에 local-admin bit(`0x02`)를 OR 해서 별도 MAC 부여
+  (`ap_mac()` in `dpworld-ap-apply.sh`) — STA 와 충돌하지 않는 LA-bit 주소.
+- **채널 = SCC(Single-Channel Concurrency)**: 기본(`ap_band=auto`)은 STA 가 붙어 있는 채널을
+  **추종**한다(`ap_engine.resolve_channel`). 단일 라디오는 동시에 한 채널만 쓸 수 있어,
+  STA 와 AP 가 같은 채널이어야 둘 다 동작한다. STA 미연결 시 2.4GHz 채널 6 으로 폴백.
+  `2g`/`5g` 명시(MCC)는 옵트인이며 STA 와 채널이 갈리면 한쪽이 끊길 수 있다.
+
+---
+
+## 2. ap_engine 라이프사이클
+
+`ApEngine`(`src/network/ap_engine.py`)이 적용을 오케스트레이션한다. 직렬화 lock 으로
+동시 apply 의 tmp 파일 경합·서비스 중복 start 를 막는다.
+
+1. `ap_config` → intent 정규화(`ap_model.ap_intent_from_db`).
+2. `validate_ap()` hard-rule 검증 → 실패 시 상태 `REJECTED`(파일 미작성).
+3. 활성화면: 채널 산정 → `hostapd-ap0.conf` / `udhcpd-ap0.conf` 렌더(0600, 디렉터리 0700) →
+   **marker** `ap-enabled` 작성. 비활성화면 marker 제거.
+4. `systemctl start dpworld-ap-apply.service` 트리거(oneshot, `dpworld-ap-apply.sh` 실행).
+5. 결과 상태 persist: `APPLYING`→`COMMITTED` / `FAILED`.
+
+상태값: `REJECTED`, `APPLYING`, `COMMITTED`, `FAILED`.
+
+### marker = kill-switch
+
+`/home/root/network/ap/ap-enabled` 파일의 **존재 여부**가 enable/disable 판정 기준이다.
+`dpworld-ap-apply.sh` 는 marker 가 있으면 `ap_up`, 없으면 `ap_down`(멱등 정리)을 한다.
+
+---
+
+## 3. `ap_config` DB 키 + 필드
+
+별도 `board_config` 키 — **Python 전용**(`device_config` 무관, Java/dpworldapp 미사용).
+`db_manager.ALLOWED_KEYS` 에 등록됨. 기본값(`ap_model.DEFAULT_AP_CONFIG`):
+
+| 필드 | 기본값 | 설명 |
+|------|--------|------|
+| `ap_enabled` | `false` | AP on/off |
+| `ap_ssid` | `""` | SSID (최대 32 byte, `"`·`\`·`#`·제어문자 금지) |
+| `ap_passphrase` | `""` | WPA2-PSK passphrase (8–63 byte, 동일 금지문자) |
+| `ap_band` | `"auto"` | `auto`(SCC) / `2g` / `5g` |
+| `ap_channel` | `0` | 0 = auto. band 별 유효 채널만 허용 |
+| `ap_hidden` | `false` | SSID 브로드캐스트 숨김 |
+| `ap_ip` | `192.168.50.1` | AP 게이트웨이 IP (/24) |
+| `dhcp_start` | `192.168.50.50` | DHCP 풀 시작 (AP 서브넷 내) |
+| `dhcp_end` | `192.168.50.150` | DHCP 풀 끝 |
+| `dhcp_lease` | `43200` | 리스 시간(초) |
+
+> 검증은 `ap_validator.validate_ap` — SSID/PSK 바이트 길이, hostapd-conf 인젝션 차단
+> (`#`·따옴표·역슬래시·개행), 채널-밴드 정합, DHCP 범위가 AP /24 서브넷 안인지·AP IP 와
+> 겹치지 않는지, 그리고 **유효한 country regdomain 이 있어야** 활성화 가능
+> (`country_pending`이면 "reboot required").
+
+---
+
+## 4. systemd 유닛 (`deploy/`)
+
+| 유닛 | 역할 |
+|------|------|
+| `dpworld-ap-apply.service` | oneshot — `dpworld-ap-apply.sh` 실행(엔진이 on-demand start, `[Install]` 없음). `--boot`(seed)/무인자(on-demand) |
+| `dpworld-ap-seed.service` | 부팅 시 marker 기준 AP 재구성(seed) |
+| `dpworld-hostapd-ap0.service` | `hostapd /home/root/network/ap/hostapd-ap0.conf` |
+| `dpworld-udhcpd-ap0.service` | `udhcpd` (ap0 DHCP 서버) |
+
+`dpworld-ap-apply.sh` 가 vif 생성 → MAC 설정 → IP 부여 → 방화벽 → hostapd/udhcpd restart 순으로
+멱등 reconcile 한다(`ap_up`). 어느 단계든 실패하면 `ap_down` 으로 fail-closed.
+
+---
+
+## 5. 방화벽 (v1.11.7)
+
+`ap0` 전용 iptables chain(`DPWORLD_AP_IN` / `DPWORLD_AP_FWD`)을 쓴다 — STA/eth 무영향.
+
+- **INPUT(장치 자체)**: **전면 개방**(SSH 22 포함). 즉 **WPA2 PSK 가 유일한 접근 게이트**.
+  (이전 default-deny[9090/DHCP/ICMP 만 허용]에서 v1.11.7 에 전환 — 현장 관리 접근성 우선,
+  비밀번호 강화 전제.)
+- **FORWARD(경유)**: **blanket DROP**. `ip_forward=1` 이어도 AP 클라이언트가 PLC(eth1)·업링크로
+  라우팅하는 것을 전면 차단 = **provisioning 격리**(PLC/내부망 보호). 이 격리는 유지된다.
+
+★ 요약: AP 클라이언트는 **장치 자체엔 접근 가능**하나(PSK 통과 시), **내부망/PLC 로는 경유 불가**.
+
+---
+
+## 6. API
+
+| Method | Path | 비고 |
+|--------|------|------|
+| `GET`  | `/api/network/ap/status` | 라이브 상태 — 응답에서 **`ap_passphrase` 제거**(미인증 API) |
+| `POST` | `/api/network/ap/config` | `ap_config` 저장(필드 화이트리스트 merge, 알 수 없는 키 400) |
+| `POST` | `/api/network/ap/apply` | bring-up/down 적용. `{"dry_run": true}` 면 적용 없이 config 회신(PSK 제거) |
+
+`status` 응답: `ap_enabled`·`ap0_up`·`hostapd_running`·`clients`·`country_pending` + 마스킹된 `config`.
+서브시스템 import 실패(예: Windows dev box) 시 503 fail-soft.
+
+> **API 인증 없음**: :9090 은 현재 미인증(문서화된 threat boundary). AP 가 열리면 PSK 만이
+> 게이트이므로 **강한 AP PSK** 가 사실상의 1차 방어선이다. 운영자 로그인은 설계 백로그
+> ([`architecture.md`](architecture.md) §10).
+
+---
+
+## 7. kill-switch (수동 비활성화)
+
+엔진/웹이 응답하지 않을 때 root 셸에서 즉시 AP 를 내릴 수 있다:
+
+```sh
+rm /home/root/network/ap/ap-enabled && /usr/bin/dpworld-ap-apply.sh
+```
+
+marker 가 사라지면 스크립트가 `ap_down`(데몬 stop + 방화벽 flush + ap0 삭제)을 수행한다.
+
+---
+
+## 8. ⚠ flash 생존 caveat
+
+`/home/root/network/ap/*`(config·marker)와 `/opt` 상태는 펌웨어 flash 후에도 **생존**한다.
+그러나 `deploy/` 의 systemd 유닛·`dpworld-ap-apply.sh` 는 rootfs(`/lib`, `/usr/bin`)에 설치되며
+**flash 마다 wipe** 된다. 따라서 flash 후에는 AP 유닛/스크립트를 **재설치**해야 AP 가 다시 뜬다.
+근본 해결(BSP 이미지 베이킹)은 백로그 — `firmware-ota-guide.md` §6 및 메모리
+`web-survives-flash` 참조.
diff --git a/scripts/deploy.ps1 b/scripts/deploy.ps1
new file mode 100644
index 0000000..7de64d6
--- /dev/null
+++ b/scripts/deploy.ps1
@@ -0,0 +1,434 @@
+<#
+.SYNOPSIS
+    Deploy the NEW Web Configurator to a device, or roll back the last deploy.
+
+.DESCRIPTION
+    Builds a clean archive of the committed src/ tree, transfers it over SSH,
+    backs up the device's current src/, swaps in the new tree, stamps the
+    deployed version, and restarts the web-configurator systemd service.
+
+    Every deploy must sit on a version tag (vX.Y.Z); use -AllowUntagged for a
+    flagged dev build. See docs/DEPLOY.md.
+
+.EXAMPLE
+    .\scripts\deploy.ps1 192.168.55.56
+.EXAMPLE
+    .\scripts\deploy.ps1 192.168.55.56 -AllowUntagged
+.EXAMPLE
+    .\scripts\deploy.ps1 192.168.55.56 -Rollback
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $true, Position = 0)]
+    [string]$DeviceIp,
+    [switch]$AllowUntagged,
+    [switch]$Rollback
+)
+
+$ErrorActionPreference = 'Stop'
+
+# --- Fixed device facts ---------------------------------------------------
+$AppDir    = '/opt/web-configurator'
+$Service   = 'web-configurator'
+$Port      = 9090
+$SshTarget = "root@$DeviceIp"
+$SshOpts   = @('-o', 'StrictHostKeyChecking=no', '-o', 'BatchMode=yes')
+
+# --- Helpers --------------------------------------------------------------
+function Write-Step([string]$Message) {
+    Write-Host "==> $Message" -ForegroundColor Cyan
+}
+
+# Run a command on the device; throw on non-zero exit.
+function Invoke-Ssh([string]$Command) {
+    $output = & ssh @SshOpts $SshTarget $Command
+    if ($LASTEXITCODE -ne 0) {
+        throw "SSH command failed (exit $LASTEXITCODE): $Command"
+    }
+    return $output
+}
+
+# Run a git command allowed to fail; return trimmed stdout, or $null.
+function Invoke-GitSafe([string]$GitArgs) {
+    $out = cmd /c "git $GitArgs 2>nul"
+    if ($LASTEXITCODE -eq 0 -and $out) { return ($out | Out-String).Trim() }
+    return $null
+}
+
+function Test-ServiceHealthy {
+    $active = (Invoke-Ssh "systemctl is-active $Service" | Out-String).Trim()
+    if ($active -ne 'active') { return $false }
+    try {
+        $resp = Invoke-WebRequest -Uri "http://${DeviceIp}:$Port/" `
+            -TimeoutSec 5 -UseBasicParsing
+        return ($resp.StatusCode -eq 200)
+    } catch {
+        return $false
+    }
+}
+
+function Confirm-Health {
+    Write-Step "Verifying service health"
+    for ($i = 1; $i -le 5; $i++) {
+        Start-Sleep -Seconds 3
+        if (Test-ServiceHealthy) {
+            Write-Host "    service active, HTTP 200 on :$Port" -ForegroundColor Green
+            return
+        }
+    }
+    throw "Verification failed: $Service not healthy on $DeviceIp after restart"
+}
+
+# --- Rollback -------------------------------------------------------------
+if ($Rollback) {
+    Write-Step "Rollback on $DeviceIp"
+    $raw = Invoke-Ssh "ls -1dt $AppDir/backups/src-* 2>/dev/null || true"
+    $backups = @($raw | Where-Object { $_ -and $_.Trim() })
+    if ($backups.Count -eq 0) {
+        throw "No backups found on $DeviceIp under $AppDir/backups"
+    }
+    $latest = $backups[0].Trim()
+    Write-Host "    restoring $latest" -ForegroundColor Yellow
+    Invoke-Ssh "cd $AppDir && rm -rf src && cp -r '$latest' src" | Out-Null
+    $now = (Get-Date).ToString('o')
+    $deployedBy = "$env:USERNAME@$env:COMPUTERNAME"
+    Invoke-Ssh ("printf 'version=rolled-back\nrestored_from=%s\ndeployed_at=%s\ndeployed_by=%s\n'" +
+        " '$latest' '$now' '$deployedBy' > $AppDir/DEPLOYED_VERSION") | Out-Null
+    Invoke-Ssh ("printf '%s  %s  %s  %s\n' '$now' 'rolled-back' '$latest' '$deployedBy'" +
+        " >> $AppDir/deploy-history.log") | Out-Null
+    Invoke-Ssh "systemctl restart $Service" | Out-Null
+    Confirm-Health
+    Write-Host "Rollback complete on $DeviceIp ($latest)" -ForegroundColor Green
+    return
+}
+
+# --- Pre-flight -----------------------------------------------------------
+Write-Step "Pre-flight checks"
+try { Invoke-Ssh "echo ok" | Out-Null }
+catch { throw "Cannot reach $DeviceIp over SSH. Check the IP and that your key is authorized." }
+
+$dirtyRaw = & git status --porcelain
+if ($LASTEXITCODE -ne 0) { throw "git status failed — not a git repo?" }
+# Skip untracked-only lines (??) — only staged/modified tracked files block deploy
+$dirty = @($dirtyRaw | Where-Object { $_ -and $_ -notmatch '^\?\?' })
+if ($dirty.Count -gt 0) { throw "Local working tree is not clean. Commit or stash before deploying." }
+
+$commit = (& git rev-parse HEAD).Trim()
+if ($LASTEXITCODE -ne 0) { throw "git rev-parse HEAD failed" }
+$short  = (& git rev-parse --short HEAD).Trim()
+if ($LASTEXITCODE -ne 0) { throw "git rev-parse --short HEAD failed" }
+$tag    = Invoke-GitSafe 'describe --exact-match --tags HEAD'
+
+if ($tag) {
+    $version = $tag
+    Write-Host "    deploying release $version" -ForegroundColor Green
+} elseif ($AllowUntagged) {
+    $nearest = Invoke-GitSafe 'describe --tags --abbrev=0'
+    if (-not $nearest) { $nearest = 'v0.0.0' }
+    $version = "$nearest-dev+$short"
+    Write-Host "    WARNING: HEAD is untagged - dev build $version" -ForegroundColor Yellow
+} else {
+    throw "HEAD is not at a version tag. Tag a release, or pass -AllowUntagged for a dev build."
+}
+
+# --- Deploy ---------------------------------------------------------------
+$localTar = Join-Path $env:TEMP "webcfg-deploy-$short.tar"
+try {
+    Write-Step "Building archive of committed src/"
+    & git archive --format=tar --output="$localTar" HEAD src
+    if ($LASTEXITCODE -ne 0) { throw "git archive failed" }
+
+    Write-Step "Transferring to $DeviceIp"
+    # v1.5.0: first-deploy guard — ensure $AppDir exists before scp (otherwise
+    # scp fails with "dest open: No such file or directory" on a fresh device).
+    # v1.5.2 C1: pre-create firmware OTA dirs (ProtectSystem=strict requires they exist
+    # AND be in ReadWritePaths). systemd unit lists them; we ensure presence.
+    Invoke-Ssh "mkdir -p $AppDir /opt/fw_staging /opt/fw_upload /opt/config_backups" | Out-Null
+    & scp @SshOpts "$localTar" "${SshTarget}:$AppDir/_deploy.tar"
+    if ($LASTEXITCODE -ne 0) { throw "scp failed" }
+    # v1.4.6.6: GNU tar의 timestamp warning이 stderr로 출력되면 PowerShell 5.1
+    # NativeCommandError로 wrap되어 ErrorActionPreference=Stop과 결합 시 terminating
+    # 에러 발생. --warning=no-timestamp로 시간 차 warning만 끄고 진짜 에러는 보존.
+    Invoke-Ssh ("rm -rf $AppDir/_deploy_tmp && mkdir -p $AppDir/_deploy_tmp" +
+        " && tar --warning=no-timestamp -xf $AppDir/_deploy.tar -C $AppDir/_deploy_tmp") | Out-Null
+
+    Write-Step "Backing up current src/ (keep last 3)"
+    $ts = Get-Date -Format 'yyyyMMdd-HHmmss'
+    Invoke-Ssh "cd $AppDir && mkdir -p backups && if [ -d src ]; then cp -r src backups/src-$ts; fi" | Out-Null
+    $raw = Invoke-Ssh "ls -1dt $AppDir/backups/src-* 2>/dev/null || true"
+    $backups = @($raw | Where-Object { $_ -and $_.Trim() })
+    if ($backups.Count -gt 3) {
+        foreach ($old in $backups[3..($backups.Count - 1)]) {
+            Invoke-Ssh "rm -rf '$($old.Trim())'" | Out-Null
+        }
+    }
+
+    # v1.5.2 D1 (H17): install unit to /lib/systemd/system/ — persistent across reboots on
+    # Telechips/Poky 4.0.17. /etc/systemd/system/ is a tmpfs overlay that is lost on every
+    # reboot; all firmware-native services (dpworldapp, app-runner, nginx) live in
+    # /lib/systemd/system/ which is on the read-write overlay (persistent). Installing here
+    # ensures web-configurator survives power cycles without manual re-registration.
+    # Enable symlink is created in /etc/systemd/system/multi-user.target.wants/ (which also
+    # survives because it is backed by the same persistent overlay).
+    # #8 review fix: unit/dir installs are idempotent and independent of the src tree — done
+    # BEFORE the src swap so a scp failure aborts while the OLD src is still active on disk.
+    $unitPath  = "/lib/systemd/system/web-configurator.service"
+    $unitCheck = (Invoke-Ssh "test -f $unitPath && echo yes || echo no").Trim()
+    $localUnit = (Resolve-Path (Join-Path $PSScriptRoot "..\deploy\web-configurator.service")).Path
+
+    if ($unitCheck -ne "yes") {
+        Write-Host "[deploy] first deploy on $DeviceIp — installing systemd unit to persistent /lib/systemd/system/" -ForegroundColor Yellow
+        & scp @SshOpts "$localUnit" "${SshTarget}:${unitPath}"
+        if ($LASTEXITCODE -ne 0) { throw "scp of unit file failed" }
+        Invoke-Ssh "systemctl daemon-reload && systemctl enable web-configurator" | Out-Null
+    } else {
+        $remoteHash = (Invoke-Ssh "sha256sum $unitPath | cut -d' ' -f1").Trim()
+        $localHash  = (Get-FileHash $localUnit -Algorithm SHA256).Hash.ToLower()
+        if ($remoteHash -ne $localHash) {
+            Write-Host "[deploy] unit file changed — reinstalling to /lib/systemd/system/ and daemon-reload" -ForegroundColor Yellow
+            & scp @SshOpts "$localUnit" "${SshTarget}:${unitPath}"
+            if ($LASTEXITCODE -ne 0) { throw "scp of updated unit file failed" }
+            Invoke-Ssh "systemctl daemon-reload" | Out-Null
+        }
+    }
+
+    # v1.6.0: 네트워크 적용 엔진 디렉토리 생성 (ReadWritePaths - prefix 와 쌍 — src swap 전 보장)
+    # #5/#8 review fix: /opt/config_backups/network 는 plaintext PSK 저장 — chmod 700 으로 world-read 차단.
+    # /home/root/network 는 dpworldapp 공유 디렉토리로 기본 권한 유지.
+    Invoke-Ssh "mkdir -p /home/root/network /opt/config_backups/network && chmod 700 /opt/config_backups/network" | Out-Null
+
+    # v1.6.0: dpworld-net-recover.service 설치 (oneshot — enable 불필요, 파일만)
+    # C2 review fix: /etc/systemd/system 은 tmpfs overlay 로 재부팅 시 소실 (v1.5.2 D1 참조)
+    # → web-configurator.service 와 동일한 hash-compare 패턴으로 영속 /lib/systemd/system 에 설치.
+    # 구버전이 설치한 휘발성 /etc 사본은 /lib 유닛을 가리므로(systemd 우선순위) 제거.
+    $recoverPath  = "/lib/systemd/system/dpworld-net-recover.service"
+    $recoverUnit  = (Resolve-Path (Join-Path $PSScriptRoot "..\deploy\dpworld-net-recover.service")).Path
+    $recoverCheck = (Invoke-Ssh "test -f $recoverPath && echo yes || echo no").Trim()
+
+    if ($recoverCheck -ne "yes") {
+        Write-Host "[deploy] installing dpworld-net-recover.service to persistent /lib/systemd/system/" -ForegroundColor Yellow
+        & scp @SshOpts $recoverUnit "${SshTarget}:${recoverPath}"
+        if ($LASTEXITCODE -ne 0) { throw "scp of dpworld-net-recover.service failed" }
+        Invoke-Ssh "rm -f /etc/systemd/system/dpworld-net-recover.service && systemctl daemon-reload" | Out-Null
+    } else {
+        $recoverRemoteHash = (Invoke-Ssh "sha256sum $recoverPath | cut -d' ' -f1").Trim()
+        $recoverLocalHash  = (Get-FileHash $recoverUnit -Algorithm SHA256).Hash.ToLower()
+        if ($recoverRemoteHash -ne $recoverLocalHash) {
+            Write-Host "[deploy] dpworld-net-recover.service changed — reinstalling to /lib/systemd/system/ and daemon-reload" -ForegroundColor Yellow
+            & scp @SshOpts $recoverUnit "${SshTarget}:${recoverPath}"
+            if ($LASTEXITCODE -ne 0) { throw "scp of updated dpworld-net-recover.service failed" }
+            Invoke-Ssh "rm -f /etc/systemd/system/dpworld-net-recover.service && systemctl daemon-reload" | Out-Null
+        }
+    }
+
+    # v1.6.0: dpworld-network-apply.service 온디맨드 drop-in 설치
+    # firmware 소유 apply.service 의 Requires=dpworld-network-seed.service (boot-only oneshot) 을
+    # 런타임에 빈 값으로 override — 재부팅 후 systemctl start 가 "Dependency failed" rc=1 을 내던
+    # 결함 해소 (.56 실측, DEF-2b). 드롭인 디렉토리는 /lib/systemd/system/ 하 (persistent overlay —
+    # /etc 는 tmpfs 로 재부팅 시 소실, v1.5.2 D1 참조).
+    $ondemandConfPath  = "/lib/systemd/system/dpworld-network-apply.service.d/10-ondemand.conf"
+    $ondemandConfLocal = (Resolve-Path (Join-Path $PSScriptRoot "..\deploy\dpworld-network-apply-ondemand.conf")).Path
+    $ondemandCheck     = (Invoke-Ssh "test -f $ondemandConfPath && echo yes || echo no").Trim()
+
+    if ($ondemandCheck -ne "yes") {
+        Write-Host "[deploy] installing dpworld-network-apply ondemand drop-in to persistent /lib/systemd/system/" -ForegroundColor Yellow
+        Invoke-Ssh "mkdir -p /lib/systemd/system/dpworld-network-apply.service.d" | Out-Null
+        & scp @SshOpts $ondemandConfLocal "${SshTarget}:${ondemandConfPath}"
+        if ($LASTEXITCODE -ne 0) { throw "scp of dpworld-network-apply-ondemand.conf failed" }
+        Invoke-Ssh "systemctl daemon-reload" | Out-Null
+    } else {
+        $ondemandRemoteHash = (Invoke-Ssh "sha256sum $ondemandConfPath | cut -d' ' -f1").Trim()
+        $ondemandLocalHash  = (Get-FileHash $ondemandConfLocal -Algorithm SHA256).Hash.ToLower()
+        if ($ondemandRemoteHash -ne $ondemandLocalHash) {
+            Write-Host "[deploy] dpworld-network-apply ondemand drop-in changed — reinstalling and daemon-reload" -ForegroundColor Yellow
+            & scp @SshOpts $ondemandConfLocal "${SshTarget}:${ondemandConfPath}"
+            if ($LASTEXITCODE -ne 0) { throw "scp of updated dpworld-network-apply-ondemand.conf failed" }
+            Invoke-Ssh "systemctl daemon-reload" | Out-Null
+        }
+    }
+
+    # v1.7.1: firmware boot hardening — dpworld-network-apply-hardened.sh + 2 drop-ins.
+    # 배경: 펌웨어 dpworld-network-seed.service 가 --boot 에서 modprobe -r wlan 을 호출 →
+    # QCA6490(cnss_pci) 모듈 hang → Telechips PMU 하드웨어 watchdog(20 s) 리셋 → 부팅 루프.
+    # 조치: 두 drop-in(20-hardened.conf) 이 seed/apply 양쪽 ExecStart 를 하드닝본으로 교체.
+    # 하드닝본은 --boot 경로에서 modprobe -r 을 절대 호출하지 않음. country 는 modprobe.d +
+    # reboot-deferred 로 처리. 펌웨어 원본 /usr/bin/dpworld-network-apply.sh 은 무수정 보존.
+    # 설치 경로 모두 /lib/systemd/system (persistent overlay — /etc 는 tmpfs, v1.5.2 D1 참조).
+    $needsDaemonReload  = $false
+    $hardenedScript     = (Resolve-Path (Join-Path $PSScriptRoot "..\deploy\dpworld-network-apply-hardened.sh")).Path
+    $hardenedScriptPath = "/usr/bin/dpworld-network-apply-hardened.sh"
+    $hardenedScriptCheck = (Invoke-Ssh "test -f $hardenedScriptPath && echo yes || echo no").Trim()
+
+    if ($hardenedScriptCheck -ne "yes") {
+        Write-Host "[deploy] installing dpworld-network-apply-hardened.sh to $hardenedScriptPath" -ForegroundColor Yellow
+        & scp @SshOpts $hardenedScript "${SshTarget}:${hardenedScriptPath}"
+        if ($LASTEXITCODE -ne 0) { throw "scp of dpworld-network-apply-hardened.sh failed" }
+        Invoke-Ssh "chmod +x $hardenedScriptPath" | Out-Null
+        $needsDaemonReload = $true
+    } else {
+        $hardenedRemoteHash = (Invoke-Ssh "sha256sum $hardenedScriptPath | cut -d' ' -f1").Trim()
+        $hardenedLocalHash  = (Get-FileHash $hardenedScript -Algorithm SHA256).Hash.ToLower()
+        if ($hardenedRemoteHash -ne $hardenedLocalHash) {
+            Write-Host "[deploy] dpworld-network-apply-hardened.sh changed — reinstalling" -ForegroundColor Yellow
+            & scp @SshOpts $hardenedScript "${SshTarget}:${hardenedScriptPath}"
+            if ($LASTEXITCODE -ne 0) { throw "scp of updated dpworld-network-apply-hardened.sh failed" }
+            Invoke-Ssh "chmod +x $hardenedScriptPath" | Out-Null
+            $needsDaemonReload = $true
+        }
+    }
+
+    # drop-in: dpworld-network-apply.service.d/20-hardened.conf
+    $applyDropinLocal  = (Resolve-Path (Join-Path $PSScriptRoot "..\deploy\dpworld-network-apply.service.d\20-hardened.conf")).Path
+    $applyDropinPath   = "/lib/systemd/system/dpworld-network-apply.service.d/20-hardened.conf"
+    $applyDropinCheck  = (Invoke-Ssh "test -f $applyDropinPath && echo yes || echo no").Trim()
+
+    if ($applyDropinCheck -ne "yes") {
+        Write-Host "[deploy] installing dpworld-network-apply drop-in 20-hardened.conf" -ForegroundColor Yellow
+        Invoke-Ssh "mkdir -p /lib/systemd/system/dpworld-network-apply.service.d" | Out-Null
+        & scp @SshOpts $applyDropinLocal "${SshTarget}:${applyDropinPath}"
+        if ($LASTEXITCODE -ne 0) { throw "scp of dpworld-network-apply 20-hardened.conf failed" }
+        $needsDaemonReload = $true
+    } else {
+        $applyDropinRemoteHash = (Invoke-Ssh "sha256sum $applyDropinPath | cut -d' ' -f1").Trim()
+        $applyDropinLocalHash  = (Get-FileHash $applyDropinLocal -Algorithm SHA256).Hash.ToLower()
+        if ($applyDropinRemoteHash -ne $applyDropinLocalHash) {
+            Write-Host "[deploy] dpworld-network-apply 20-hardened.conf changed — reinstalling" -ForegroundColor Yellow
+            & scp @SshOpts $applyDropinLocal "${SshTarget}:${applyDropinPath}"
+            if ($LASTEXITCODE -ne 0) { throw "scp of updated dpworld-network-apply 20-hardened.conf failed" }
+            $needsDaemonReload = $true
+        }
+    }
+
+    # drop-in: dpworld-network-seed.service.d/20-hardened.conf
+    $seedDropinLocal  = (Resolve-Path (Join-Path $PSScriptRoot "..\deploy\dpworld-network-seed.service.d\20-hardened.conf")).Path
+    $seedDropinPath   = "/lib/systemd/system/dpworld-network-seed.service.d/20-hardened.conf"
+    $seedDropinCheck  = (Invoke-Ssh "test -f $seedDropinPath && echo yes || echo no").Trim()
+
+    if ($seedDropinCheck -ne "yes") {
+        Write-Host "[deploy] installing dpworld-network-seed drop-in 20-hardened.conf" -ForegroundColor Yellow
+        Invoke-Ssh "mkdir -p /lib/systemd/system/dpworld-network-seed.service.d" | Out-Null
+        & scp @SshOpts $seedDropinLocal "${SshTarget}:${seedDropinPath}"
+        if ($LASTEXITCODE -ne 0) { throw "scp of dpworld-network-seed 20-hardened.conf failed" }
+        $needsDaemonReload = $true
+    } else {
+        $seedDropinRemoteHash = (Invoke-Ssh "sha256sum $seedDropinPath | cut -d' ' -f1").Trim()
+        $seedDropinLocalHash  = (Get-FileHash $seedDropinLocal -Algorithm SHA256).Hash.ToLower()
+        if ($seedDropinRemoteHash -ne $seedDropinLocalHash) {
+            Write-Host "[deploy] dpworld-network-seed 20-hardened.conf changed — reinstalling" -ForegroundColor Yellow
+            & scp @SshOpts $seedDropinLocal "${SshTarget}:${seedDropinPath}"
+            if ($LASTEXITCODE -ne 0) { throw "scp of updated dpworld-network-seed 20-hardened.conf failed" }
+            $needsDaemonReload = $true
+        }
+    }
+
+    if ($needsDaemonReload) {
+        Invoke-Ssh "systemctl daemon-reload" | Out-Null
+    }
+
+    # AP: install — begin
+    # WiFi AP 엔진: applier 스크립트(/usr/bin) + 4 유닛(/lib/systemd/system) 설치.
+    # seed 만 enable(부팅 reconcile). apply/hostapd/udhcpd 는 enable 안 함 — apply 스크립트가 기동.
+    # 설치 경로 /lib/systemd/system (persistent overlay — /etc 는 tmpfs, v1.5.2 D1 참조).
+    $apNeedsReload = $false
+    # 1) applier 스크립트
+    $apScript      = (Resolve-Path (Join-Path $PSScriptRoot "..\deploy\dpworld-ap-apply.sh")).Path
+    $apScriptPath  = "/usr/bin/dpworld-ap-apply.sh"
+    $apScriptCheck = (Invoke-Ssh "test -f $apScriptPath && echo yes || echo no").Trim()
+    if ($apScriptCheck -ne "yes") {
+        Write-Host "[deploy] installing dpworld-ap-apply.sh to $apScriptPath" -ForegroundColor Yellow
+        & scp @SshOpts $apScript "${SshTarget}:${apScriptPath}"
+        if ($LASTEXITCODE -ne 0) { throw "scp of dpworld-ap-apply.sh failed" }
+        Invoke-Ssh "chmod 0755 $apScriptPath" | Out-Null
+        $apNeedsReload = $true
+    } else {
+        $apScriptRemoteHash = (Invoke-Ssh "sha256sum $apScriptPath | cut -d' ' -f1").Trim()
+        $apScriptLocalHash  = (Get-FileHash $apScript -Algorithm SHA256).Hash.ToLower()
+        if ($apScriptRemoteHash -ne $apScriptLocalHash) {
+            Write-Host "[deploy] dpworld-ap-apply.sh changed — reinstalling" -ForegroundColor Yellow
+            & scp @SshOpts $apScript "${SshTarget}:${apScriptPath}"
+            if ($LASTEXITCODE -ne 0) { throw "scp of updated dpworld-ap-apply.sh failed" }
+            Invoke-Ssh "chmod 0755 $apScriptPath" | Out-Null
+            $apNeedsReload = $true
+        }
+    }
+    # 2) systemd 유닛 4종 (영속 /lib/systemd/system, 휘발성 /etc 사본 제거)
+    $apUnits = @("dpworld-ap-seed.service", "dpworld-ap-apply.service",
+                 "dpworld-hostapd-ap0.service", "dpworld-udhcpd-ap0.service")
+    foreach ($u in $apUnits) {
+        $uLocal = (Resolve-Path (Join-Path $PSScriptRoot "..\deploy\$u")).Path
+        $uPath  = "/lib/systemd/system/$u"
+        $uCheck = (Invoke-Ssh "test -f $uPath && echo yes || echo no").Trim()
+        if ($uCheck -ne "yes") {
+            Write-Host "[deploy] installing $u to /lib/systemd/system/" -ForegroundColor Yellow
+            & scp @SshOpts $uLocal "${SshTarget}:${uPath}"
+            if ($LASTEXITCODE -ne 0) { throw "scp of $u failed" }
+            Invoke-Ssh "rm -f /etc/systemd/system/$u" | Out-Null
+            $apNeedsReload = $true
+        } else {
+            $uRemoteHash = (Invoke-Ssh "sha256sum $uPath | cut -d' ' -f1").Trim()
+            $uLocalHash  = (Get-FileHash $uLocal -Algorithm SHA256).Hash.ToLower()
+            if ($uRemoteHash -ne $uLocalHash) {
+                Write-Host "[deploy] $u changed — reinstalling" -ForegroundColor Yellow
+                & scp @SshOpts $uLocal "${SshTarget}:${uPath}"
+                if ($LASTEXITCODE -ne 0) { throw "scp of updated $u failed" }
+                Invoke-Ssh "rm -f /etc/systemd/system/$u" | Out-Null
+                $apNeedsReload = $true
+            }
+        }
+    }
+    if ($apNeedsReload) { Invoke-Ssh "systemctl daemon-reload" | Out-Null }
+    # seed 만 enable — 부팅 시 마커 기준 reconcile (apply/데몬 유닛은 apply 스크립트가 기동)
+    Invoke-Ssh "systemctl enable dpworld-ap-seed.service" | Out-Null
+    # AP: install — end
+
+    Write-Step "Swapping in new src/"
+    Invoke-Ssh ("cd $AppDir && rm -rf src && mv _deploy_tmp/src src" +
+        " && rm -rf _deploy_tmp _deploy.tar") | Out-Null
+
+    Write-Step "Stamping version $version"
+    $deployedBy = "$env:USERNAME@$env:COMPUTERNAME"
+    $now = (Get-Date).ToString('o')
+    $tagField = if ($tag) { $tag } else { '(untagged)' }
+    Invoke-Ssh ("printf 'version=%s\ntag=%s\ncommit=%s\ndeployed_at=%s\ndeployed_by=%s\n'" +
+        " '$version' '$tagField' '$commit' '$now' '$deployedBy' > $AppDir/DEPLOYED_VERSION") | Out-Null
+    Invoke-Ssh ("printf '%s  %s  %s  %s\n' '$now' '$version' '$short' '$deployedBy'" +
+        " >> $AppDir/deploy-history.log") | Out-Null
+
+    # v1.5.2 D2 (H18): wrap swap + unit install + restart in try/catch for auto-rollback.
+    # If Confirm-Health throws (service not healthy after restart), restore the backed-up
+    # src/ from backups/src-$ts and restart — leaving the device in a known-good state.
+    Write-Step "Restarting $Service"
+    try {
+        Invoke-Ssh "systemctl restart $Service" | Out-Null
+        Confirm-Health
+    }
+    catch {
+        Write-Host "[deploy] FAILED — auto-rolling back to backups/src-$ts" -ForegroundColor Red
+        try {
+            Invoke-Ssh "cd $AppDir && rm -rf src && cp -r backups/src-$ts src" | Out-Null
+            Invoke-Ssh "systemctl restart $Service" | Out-Null
+            Start-Sleep -Seconds 3
+            if (Test-ServiceHealthy) {
+                Write-Host "    rollback succeeded — device is back on previous version" -ForegroundColor Yellow
+            } else {
+                Write-Host "    WARNING: rollback restart may still be starting up" -ForegroundColor Yellow
+            }
+            $rollbackBy = "$env:USERNAME@$env:COMPUTERNAME"
+            $rollbackAt = (Get-Date).ToString('o')
+            Invoke-Ssh ("printf 'version=rolled-back\nfrom=failed-$version\nrestored_from=backups/src-$ts\nrolled_back_at=$rollbackAt\nrolled_back_by=$rollbackBy\n'" +
+                " > $AppDir/DEPLOYED_VERSION") | Out-Null
+        }
+        catch {
+            Write-Host "[deploy] CRITICAL: rollback also failed — device may need manual recovery" -ForegroundColor Red
+        }
+        throw  # re-throw original error so the caller sees failure
+    }
+}
+finally {
+    Remove-Item -Path $localTar -ErrorAction SilentlyContinue
+}
+
+Write-Host ""
+Write-Host "Deployed $version to $DeviceIp" -ForegroundColor Green
+Write-Host "  commit: $commit"
+Write-Host "  verify: ssh $SshTarget cat $AppDir/DEPLOYED_VERSION"
diff --git a/src/config_validator.py b/src/config_validator.py
new file mode 100644
index 0000000..0dfc1e5
--- /dev/null
+++ b/src/config_validator.py
@@ -0,0 +1,845 @@
+"""
+config_validator.py — Configuration Validation & Processing
+
+Handles:
+1. Stripping None/null values from dicts (matching the legacy app's behavior of omitting null-valued keys on save)
+2. Processing protocol config (removing inactive protocol mappings)
+3. Basic validation of device and protocol configurations
+
+These rules ensure dpworldapp receives the exact JSON format it expects.
+"""
+
+from dpworldapp_enums import (
+    DEVICE_ENUM_VALUES,
+    PROTOCOL_ENUM_VALUES,
+    PROTOCOL_ALIASES,
+    ODO_SOURCE_VALUES,
+)
+
+# v1.4.4: Super_Relay 프로젝트 소유 키 (board_config 별도 row).
+# 우리 device_config/protocol_config에 들어가면 의미 충돌 → strict reject.
+# Source: [[memory:board-config-key-ownership-policy]] + java_app_drift verified evidence.
+_FORBIDDEN_KEYS_DEVICE = frozenset({"security", "transport_config"})
+_FORBIDDEN_KEYS_PROTOCOL = frozenset({"security", "transport_config"})
+
+# v1.4.8 Stage 4: rs485 운영 강제 범위
+_RS485_DATABITS_RANGE = range(5, 10)   # 5-9 inclusive (시리얼 표준)
+_RS485_STOPBITS_RANGE = range(0, 3)    # 0-2 inclusive (0=none, 1=1, 2=2)
+
+# v2: expr length cap = 39 (reader calc_str[40]; >=40 silently dropped)
+_ODO_EXPR_MAX_LEN = 39
+# v2 + v1.11.10 reconciliation (register-expr path only): the reader does NOT
+# validate expr content, so math/operator chars and backtick stay allowed
+# (v1.11.8 TestRegisterEntriesExpr accepts backtick, ';', parens, &, |). Block
+# only '$' (command substitution — v1.11.10 injection guard) plus control chars.
+# NOTE: project tests are intentionally narrow here; revisit if expr injection
+# policy is later unified.
+_ODO_EXPR_FORBIDDEN_CHARS = frozenset("$\n\r\x00")
+
+# v1.11.8 E: odo.shift 운영 범위 (CAN 8byte → uint64 >> shift, 0..63) + mask/id 길이 상한
+_ODO_SHIFT_RANGE = range(0, 64)        # 0-63 inclusive (CAN_8bytes_as_LE_uint64 >> shift)
+_ODO_FIELD_STR_MAX_LEN = 64            # mask / id 문자열 상한 (DoS / 비정상 입력 방어)
+
+# v2: idt = device config-reader contract (case-insensitive match); float64 removed, float added;
+# variants (unsignedInteger/shor/unsignedShort) accepted via case-insensitive lookup.
+# The check is CASE-INSENSITIVE (lowercase before membership).
+_REGISTER_IDT_VALUES = frozenset({
+    "integer", "float", "boolean", "unsigned integer", "unsignedinteger",
+    "short", "shor", "unsigned short", "unsignedshort",
+})
+# odt canonical set unchanged; synonyms float/double→float64, bool→boolean handled
+# in _validate_register_entry (normalize before membership; case-insensitive).
+_REGISTER_ODT_VALUES = frozenset({"integer", "float64", "boolean", "string"})
+_REGISTER_MAX_ENTRIES = 30             # v2: reader truncates at 30
+_REGISTER_STR_MAX_LEN = 64             # mask / id 문자열 상한
+_REGISTER_SHIFT_RANGE = range(0, 64)   # 0-63 inclusive
+
+
+# v1.4.6.7 C-2: defense in depth — frontend convertNestedToFlat이 ports를 Integer로 emit
+# (state.js fix와 정합). 외부 도구 / Java app POST 회귀 / MMI 직접 입력에서 string port가
+# 들어와도 backend에서 silently Integer로 normalize. dha baseline 운영 ground truth Integer.
+_DEVICE_PORT_KEYS = frozenset({
+    "protocol_server_port",
+    "update_server_port",
+    "rtcm_server_port",
+    "opc_ua_server_port",
+    "modbus_server_port",
+    "lte_server_port",
+})
+
+
+def normalize_device_port_types(cfg):
+    """Coerce string-typed port keys in `device_config` to Integer.
+    Returns the same dict mutated in place (or unchanged if not a dict).
+    device contract Integer + dha baseline 일치 (verify-before-asserting 2026-06-04).
+    """
+    if not isinstance(cfg, dict):
+        return cfg
+    for k in _DEVICE_PORT_KEYS:
+        v = cfg.get(k)
+        if isinstance(v, str) and v.strip().lstrip("-").isdigit():
+            cfg[k] = int(v)
+    return cfg
+
+
+# v1.4.6.9 H5: ports type/range hard-reject helper — sibling of validate_rs485_integers /
+# validate_wifi_country_code. server.py에서 400으로 reject. multi-agent review에서 노출:
+# validate_device_config가 port errors를 soft-warn으로 처리해 string 'http' / '80.5' /
+# negative / out-of-range가 device_config에 잔존 → 정수 파싱 실패로 값이 wipe될 수 있음.
+_PORT_VALID_RANGE = range(1, 65536)  # IANA-valid range (port 0 reserved)
+
+
+def validate_device_port_types_hard(data):
+    """Hard-reject port type / range errors. Returns list[str] of error messages.
+    None / missing keys are OK (partial-merge POST 시 미포함 키 자연 보존).
+    """
+    errors = []
+    if not isinstance(data, dict):
+        return errors
+    for k in _DEVICE_PORT_KEYS:
+        if k not in data:
+            continue
+        v = data[k]
+        if v is None:
+            continue
+        # bool은 int 서브클래스 — 명시 reject (e.g. True가 1로 변환되어 port=1 되는 결함 차단)
+        if isinstance(v, bool):
+            errors.append(f"{k} must be int 1..65535, got bool {v!r}")
+            continue
+        if isinstance(v, int):
+            if v not in _PORT_VALID_RANGE:
+                errors.append(f"{k} out of range 1..65535: {v}")
+            continue
+        if isinstance(v, str):
+            s = v.strip()
+            if not s.isdigit():
+                errors.append(f"{k} must be digit string, got {v!r}")
+                continue
+            try:
+                iv = int(s)
+            except (ValueError, TypeError):
+                errors.append(f"{k} int parse failed: {v!r}")
+                continue
+            if iv not in _PORT_VALID_RANGE:
+                errors.append(f"{k} out of range 1..65535: {iv}")
+            continue
+        errors.append(f"{k} unsupported type: {type(v).__name__}")
+    return errors
+
+
+def strip_none_values(obj):
+    """
+    Recursively remove keys with None values from dicts.
+    Matches the legacy app's behavior of omitting null-valued keys on save.
+
+    Args:
+        obj: dict, list, or primitive value
+
+    Returns:
+        Cleaned object with no None values
+    """
+    if isinstance(obj, dict):
+        return {
+            k: strip_none_values(v)
+            for k, v in obj.items()
+            if v is not None
+        }
+    elif isinstance(obj, list):
+        return [strip_none_values(item) for item in obj]
+    return obj
+
+
+def process_protocol_config(data):
+    """
+    Process protocol configuration before saving.
+
+    IMPORTANT: Unlike the legacy app's save behavior,
+    we intentionally PRESERVE all protocol mapping arrays (OPC_UA, MODBUS, CAN)
+    even when they are not the currently active protocol. This prevents data loss
+    when the user switches protocols — the inactive mappings stay in the DB
+    and are restored when the user switches back.
+
+    Args:
+        data: Protocol config dict
+
+    Returns:
+        Processed dict with all mapping arrays preserved
+    """
+    if not isinstance(data, dict):
+        return data
+
+    result = dict(data)
+
+    # Ensure OPC_UA, MODBUS, and CAN arrays always exist (at least as empty lists)
+    # This prevents data from being lost and ensures consistent JSON structure
+    if "OPC_UA" not in result or result["OPC_UA"] is None:
+        result["OPC_UA"] = []
+    if "MODBUS" not in result or result["MODBUS"] is None:
+        result["MODBUS"] = []
+    if "CAN" not in result or result["CAN"] is None:
+        result["CAN"] = []
+
+    return result
+
+
+def ensure_meid_string(data):
+    """
+    Ensure MEID is always stored as a string.
+    Matches the legacy app's behavior of storing MEID as a string.
+
+    Args:
+        data: Config dict potentially containing MEID
+
+    Returns:
+        Dict with MEID converted to string if present
+    """
+    if not isinstance(data, dict):
+        return data
+
+    if "MEID" in data and data["MEID"] is not None:
+        data["MEID"] = str(data["MEID"])
+
+    return data
+
+
+def validate_wifi_country_code(value):
+    """Validate wifi_country_code: accept 2 ASCII letters (case-insensitive, trim).
+
+    Returns None if valid or missing; returns error message string if invalid.
+    v2: reader trims + uppercases, never rejects on case. We trim+upper on input
+    (normalize_device_input) then accept any 2 alpha chars here.
+    """
+    if value is None:
+        return None
+    if not isinstance(value, str):
+        return f"Invalid wifi_country_code (expected string): {value!r}"
+    stripped = value.strip()
+    if len(stripped) == 2 and stripped.isalpha():
+        return None
+    return f"Invalid wifi_country_code (expected 2 letters after strip): {value!r}"
+
+
+def validate_super_relay_keys(data, owner_label):
+    """Reject keys owned by Super_Relay project (board_config 별도 row).
+
+    Args:
+        data: device_config 또는 protocol_config dict
+        owner_label: "device" 또는 "protocol"
+
+    Returns:
+        List of error strings (empty if valid)
+    """
+    if not isinstance(data, dict):
+        return []
+    errors = []
+    forbidden = _FORBIDDEN_KEYS_DEVICE if owner_label == "device" else _FORBIDDEN_KEYS_PROTOCOL
+    for k in forbidden:
+        if k in data:
+            errors.append(
+                f"'{k}' is owned by Super_Relay project (board_config 별도 row) — "
+                f"do not include in {owner_label}_config"
+            )
+    return errors
+
+
+def validate_rs485_integers(data):
+    """H1: rs485_databits / rs485_stopbits type check (Integer) + 운영 강제 범위."""
+    if not isinstance(data, dict):
+        return []
+    errors = []
+    # type check (v1.4.4 + v1.4.5.1 bool reject)
+    for k in ("rs485_databits", "rs485_stopbits"):
+        v = data.get(k)
+        if v is None:
+            continue
+        if isinstance(v, bool) or not isinstance(v, int):
+            errors.append(f"{k} must be integer (got {type(v).__name__})")
+            continue
+        # v1.4.8 운영 강제 범위
+        if k == "rs485_databits" and v not in _RS485_DATABITS_RANGE:
+            errors.append(f"rs485_databits={v} out of range 5-9")
+        elif k == "rs485_stopbits" and v not in _RS485_STOPBITS_RANGE:
+            errors.append(f"rs485_stopbits={v} out of range 0-2")
+    return errors
+
+
+def validate_device_config(data):
+    """
+    Validate device configuration structure.
+    Returns list of error messages (empty if valid).
+
+    Args:
+        data: Device config dict
+
+    Returns:
+        List of error message strings
+    """
+    errors = []
+
+    if not isinstance(data, dict):
+        errors.append("Device config must be a JSON object")
+        return errors
+
+    # Validate IP format for known IP fields
+    ip_fields = [
+        "wifi_ip", "wifi_netmask", "wifi_gateway", "wifi_dns1", "wifi_dns2",
+        "eth_ip", "eth_netmask", "eth_gateway",
+        "protocol_server_ip", "update_server_ip", "rtcm_server_ip",
+        "opc_ua_server_ip", "modbus_server_ip", "lte_server_ip", "lte_ip"
+    ]
+    for field in ip_fields:
+        value = data.get(field)
+        if value and isinstance(value, str) and value.strip():
+            if not _is_valid_ip(value):
+                errors.append(f"Invalid IP address format for '{field}': {value}")
+
+    # Validate port numbers
+    # v1.4.6.4 I2: lte_port는 device contract에서 String 타입 (interface 또는 free-form, dha='534').
+    # port_fields에 추가하지 말 것 — 타입 mismatch.
+    # 참고: lte_server_port는 정수 키 (다른 키, port_fields 정상 포함)
+    port_fields = [
+        "protocol_server_port", "update_server_port", "rtcm_server_port",
+        "opc_ua_server_port", "modbus_server_port", "lte_server_port"
+    ]
+    for field in port_fields:
+        value = data.get(field)
+        if value is not None:
+            try:
+                port = int(value)
+                if port < 1 or port > 65535:
+                    errors.append(f"Port out of range for '{field}': {value}")
+            except (ValueError, TypeError):
+                errors.append(f"Invalid port number for '{field}': {value}")
+
+    # WiFi regulatory country code (ISO 3166-1 alpha-2). Non-blocking:
+    # mirrors the client constraint server-side. The legacy app did no
+    # server validation here — this is intentionally stricter.
+    # v1.4.2 I2: delegate to dedicated function (DRY)
+    cc_error = validate_wifi_country_code(data.get("wifi_country_code"))
+    if cc_error:
+        errors.append(cc_error)
+
+    # log_auto_cleanup — enum
+    auto_cleanup = data.get("log_auto_cleanup")
+    if auto_cleanup is not None and auto_cleanup not in ("on", "off"):
+        errors.append(
+            f"Invalid log_auto_cleanup (expected 'on' or 'off'): {auto_cleanup!r}"
+        )
+
+    # log_cleanup_max_files — hard floor 5
+    max_files = data.get("log_cleanup_max_files")
+    if max_files is not None:
+        try:
+            if int(max_files) < 5:
+                errors.append(
+                    f"Invalid log_cleanup_max_files (must be >= 5): {max_files!r}"
+                )
+        except (TypeError, ValueError):
+            errors.append(
+                f"Invalid log_cleanup_max_files (must be integer): {max_files!r}"
+            )
+
+    # log_cleanup_max_size_mb — hard floor 50
+    max_size_mb = data.get("log_cleanup_max_size_mb")
+    if max_size_mb is not None:
+        try:
+            if int(max_size_mb) < 50:
+                errors.append(
+                    f"Invalid log_cleanup_max_size_mb (must be >= 50): {max_size_mb!r}"
+                )
+        except (TypeError, ValueError):
+            errors.append(
+                f"Invalid log_cleanup_max_size_mb (must be integer): {max_size_mb!r}"
+            )
+
+    return errors
+
+
+def validate_odo_field(obj, key_label):
+    """Validate odo_speed / odo_direction nested object.
+
+    Device contract: {source: speed/dir source enum, id: String, shift: Integer,
+                  mask: String, expr: String}.
+    All keys optional (the legacy app omits null-valued keys on save). Validates types/enum when present.
+
+    Returns list of error strings (empty if valid).
+    """
+    errors = []
+    if obj is None:
+        return errors
+    if not isinstance(obj, dict):
+        errors.append(f"{key_label} must be an object (got {type(obj).__name__})")
+        return errors
+
+    src = obj.get("source")
+    if src is not None and src not in ODO_SOURCE_VALUES:
+        errors.append(f"{key_label}.source={src!r} not in {sorted(ODO_SOURCE_VALUES)}")
+
+    id_v = obj.get("id")
+    if id_v is not None:
+        if not isinstance(id_v, str):
+            errors.append(f"{key_label}.id must be string")
+        elif len(id_v) > _ODO_FIELD_STR_MAX_LEN:
+            errors.append(f"{key_label}.id too long ({len(id_v)} > {_ODO_FIELD_STR_MAX_LEN})")
+
+    shift = obj.get("shift")
+    # v2: accept int OR digit-string (reader accepts digit-strings — "8" is valid)
+    if shift is not None:
+        iv = _coerce_int_or_none(shift)
+        if iv is None:
+            errors.append(f"{key_label}.shift must be integer (got {shift!r})")
+        elif iv not in _ODO_SHIFT_RANGE:
+            errors.append(f"{key_label}.shift out of range 0-63: {iv}")
+
+    mask = obj.get("mask")
+    if mask is not None:
+        if not isinstance(mask, str):
+            errors.append(f"{key_label}.mask must be string")
+        elif len(mask) > _ODO_FIELD_STR_MAX_LEN:
+            errors.append(f"{key_label}.mask too long ({len(mask)} > {_ODO_FIELD_STR_MAX_LEN})")
+
+    expr = obj.get("expr")
+    if expr is not None:
+        if not isinstance(expr, str):
+            errors.append(f"{key_label}.expr must be string")
+        else:
+            # v2: length bound only (<=39); reader does NOT validate odo expr content
+            # (odo_speed/odo_direction expr stays permissive — see v1.4.8 accept tests)
+            if len(expr) > _ODO_EXPR_MAX_LEN:
+                errors.append(f"{key_label}.expr too long ({len(expr)} > {_ODO_EXPR_MAX_LEN})")
+
+    return errors
+
+
+def validate_protocol_config(data):
+    """
+    Validate protocol configuration structure.
+    Returns list of error messages (empty if valid).
+
+    Args:
+        data: Protocol config dict
+
+    Returns:
+        List of error message strings
+    """
+    errors = []
+
+    if not isinstance(data, dict):
+        errors.append("Protocol config must be a JSON object")
+        return errors
+
+    # Validate protocol mapping arrays if present
+    # v2: cap = 30 (reader truncates at 30)
+    MAX_MAPPING_ENTRIES = 30
+    protocol = data.get("protocol", "")
+
+    for arr_key in ("MODBUS", "OPC_UA", "CAN"):
+        arr = data.get(arr_key)
+        if isinstance(arr, list) and len(arr) > MAX_MAPPING_ENTRIES:
+            errors.append(f"{arr_key} array too large ({len(arr)} > {MAX_MAPPING_ENTRIES})")
+
+    if protocol == "MODBUS" and "MODBUS" in data:
+        modbus = data["MODBUS"]
+        if modbus is not None and not isinstance(modbus, list):
+            errors.append("MODBUS mapping must be a JSON array")
+        elif isinstance(modbus, list):
+            for i, entry in enumerate(modbus):
+                if not isinstance(entry, dict):
+                    errors.append(f"MODBUS entry {i} must be an object")
+                    continue
+                if not entry.get("field"):
+                    errors.append(f"MODBUS entry {i}: 'field' is required")
+                if not entry.get("addr") and entry.get("addr") != 0:
+                    errors.append(f"MODBUS entry {i}: 'addr' is required")
+
+    if protocol == "OPC_UA" and "OPC_UA" in data:
+        opcua = data["OPC_UA"]
+        if opcua is not None and not isinstance(opcua, list):
+            errors.append("OPC_UA mapping must be a JSON array")
+        elif isinstance(opcua, list):
+            for i, entry in enumerate(opcua):
+                if not isinstance(entry, dict):
+                    errors.append(f"OPC_UA entry {i} must be an object")
+                    continue
+                if not entry.get("field"):
+                    errors.append(f"OPC_UA entry {i}: 'field' is required")
+
+    if data.get("can_input") == "on" and "CAN" in data:
+        can = data["CAN"]
+        if can is not None and not isinstance(can, list):
+            errors.append("CAN mapping must be a JSON array")
+        elif isinstance(can, list):
+            for i, entry in enumerate(can):
+                if not isinstance(entry, dict):
+                    errors.append(f"CAN entry {i} must be an object")
+                    continue
+                if not entry.get("field"):
+                    errors.append(f"CAN entry {i}: 'field' is required")
+                if not entry.get("id"):
+                    errors.append(f"CAN entry {i}: 'id' is required")
+
+    # v1.4.3 C2: nested odo object validation
+    errors.extend(validate_odo_field(data.get("odo_speed"), "odo_speed"))
+    errors.extend(validate_odo_field(data.get("odo_direction"), "odo_direction"))
+
+    return errors
+
+
+def _coerce_int_or_none(v):
+    """int (not bool) or a clean integer string → int; else None.
+
+    Frontend CRUD tables emit register fields as STRINGS (e.g. shift "0"),
+    while imported/legacy configs may carry native ints — accept both, reject
+    bool and anything non-integer.
+    """
+    if isinstance(v, bool):
+        return None
+    if isinstance(v, int):
+        return v
+    if isinstance(v, str):
+        s = v.strip()
+        if s.lstrip("-").isdigit():
+            try:
+                return int(s)
+            except (ValueError, TypeError):
+                return None
+    return None
+
+
+def _is_numeric_value(v):
+    """True iff v is a real number (int/float, not bool) or a numeric string.
+
+    DV (default value) is stored as a string by the frontend (e.g. "-1.0") but
+    may be a native number in imported configs.
+    """
+    if isinstance(v, bool):
+        return False
+    if isinstance(v, (int, float)):
+        return True
+    if isinstance(v, str):
+        try:
+            float(v.strip())
+            return True
+        except (ValueError, TypeError):
+            return False
+    return False
+
+
+def _validate_register_entry(entry, label, errors, require_addr=False, require_id=False):
+    """Per-entry field validation for a single register mapping object."""
+    if not isinstance(entry, dict):
+        errors.append(f"{label} must be an object")
+        return
+
+    if not entry.get("field"):
+        errors.append(f"{label}: 'field' is required")
+    # addr presence: 0 is a legitimate address (matches validate_protocol_config)
+    if require_addr and not entry.get("addr") and entry.get("addr") != 0:
+        errors.append(f"{label}: 'addr' is required")
+    if require_id and not entry.get("id"):
+        errors.append(f"{label}: 'id' is required")
+
+    # expr — string, length <=39 only; reader does NOT validate expr content
+    expr = entry.get("expr")
+    if expr is not None and expr != "":
+        if not isinstance(expr, str):
+            errors.append(f"{label}.expr must be string")
+        else:
+            # v2: length bound; math chars allowed; block injection chars only
+            if len(expr) > _ODO_EXPR_MAX_LEN:
+                errors.append(f"{label}.expr too long ({len(expr)} > {_ODO_EXPR_MAX_LEN})")
+            if any(c in _ODO_EXPR_FORBIDDEN_CHARS for c in expr):
+                errors.append(f"{label}.expr contains a forbidden character")
+
+    # shift — int (not bool) or numeric string, range 0..63
+    shift = entry.get("shift")
+    if shift is not None and shift != "":
+        iv = _coerce_int_or_none(shift)
+        if iv is None:
+            errors.append(f"{label}.shift must be integer (got {shift!r})")
+        elif iv not in _REGISTER_SHIFT_RANGE:
+            errors.append(f"{label}.shift out of range 0-63: {iv}")
+
+    # mask / id — bounded strings (type + length only; charset intentionally
+    # unconstrained — the device accepts free-form hex like '0xff' / CAN id
+    # '0x18FEFC28', and no contract evidence demands a hex-only charset here).
+    for fkey in ("mask", "id"):
+        fv = entry.get(fkey)
+        if fv is not None and fv != "":
+            if not isinstance(fv, str):
+                errors.append(f"{label}.{fkey} must be string")
+            elif len(fv) > _REGISTER_STR_MAX_LEN:
+                errors.append(f"{label}.{fkey} too long ({len(fv)} > {_REGISTER_STR_MAX_LEN})")
+
+    # idt / odt — device config-reader contract
+    # idt: case-insensitive membership (lowercase before check)
+    idt = entry.get("idt")
+    if idt is not None and idt != "":
+        if idt.lower() not in _REGISTER_IDT_VALUES:
+            errors.append(f"{label}.idt={idt!r} not in reader idt set")
+    # odt: accept synonyms float/double→float64, bool→boolean (case-insensitive)
+    odt = entry.get("odt")
+    _odt_normalized = None
+    if odt is not None and odt != "":
+        _odt_lower = odt.lower()
+        if _odt_lower in ("float", "double"):
+            _odt_normalized = "float64"
+        elif _odt_lower == "bool":
+            _odt_normalized = "boolean"
+        else:
+            _odt_normalized = _odt_lower
+        if _odt_normalized not in _REGISTER_ODT_VALUES:
+            errors.append(f"{label}.odt={odt!r} not in reader odt set")
+
+    # dv — numeric normally; arbitrary string allowed when odt=string
+    dv = entry.get("dv")
+    if dv is not None and dv != "":
+        _odt_is_string = (_odt_normalized == "string") if _odt_normalized else False
+        if not _odt_is_string and not _is_numeric_value(dv):
+            errors.append(f"{label}.dv must be numeric (got {dv!r})")
+
+
+def validate_register_entries(data, merged_data=None):
+    """v1.11.8 A: hard-reject malformed register entries in the ACTIVE protocol's
+    MODBUS / OPC_UA / CAN array. Sibling of validate_odo_field — returns list[str]
+    (non-empty → the POST handler returns 400). Promotes the structural checks
+    that validate_protocol_config only soft-warned (non-list array type, >1000
+    entry cap, required field/addr/id) to hard rejects, and adds per-field
+    constraints on expr / shift / mask / id / dv / idt / odt.
+
+    Only the currently-active protocol's array is validated so an inactive
+    (preserved) array cannot block an unrelated save — matches the gating in
+    validate_protocol_config and the POST handler.
+    """
+    errors = []
+    if not isinstance(data, dict):
+        return errors
+
+    # v1.11.9 Fix 3: the CAN gate must use the EFFECTIVE can_input — a partial
+    # POST may carry a CAN array but omit can_input, while the DB already has it
+    # 'on'. merged_data (DB ∪ incoming) supplies that effective value so the
+    # per-entry checks (incl. the expr injection guard) are not silently skipped.
+    # Falls back to `data` when no merged view is provided (backward compatible).
+    gate = merged_data if isinstance(merged_data, dict) else data
+
+    # v1.11.10 Fix 1: the MODBUS/OPC_UA gate must use the EFFECTIVE protocol
+    # (same reasoning as the CAN gate above) — a partial POST may carry a MODBUS
+    # array but omit the unchanged 'protocol' key, leaving it '' so the per-entry
+    # checks (incl. the expr injection guard) were silently skipped.
+    protocol = gate.get("protocol", "")
+
+    # (array_key, active?, require_addr, require_id)
+    specs = [
+        ("MODBUS", protocol == "MODBUS", True, False),
+        ("OPC_UA", protocol == "OPC_UA", False, False),
+        ("CAN", gate.get("can_input") == "on", False, True),
+    ]
+    for arr_key, active, require_addr, require_id in specs:
+        if not active or arr_key not in data:
+            continue
+        arr = data[arr_key]
+        if arr is None:
+            continue  # treated as absent (process_protocol_config will default to [])
+        if not isinstance(arr, list):
+            errors.append(f"{arr_key} mapping must be a JSON array (got {type(arr).__name__})")
+            continue
+        if len(arr) > _REGISTER_MAX_ENTRIES:
+            errors.append(f"{arr_key} array too large ({len(arr)} > {_REGISTER_MAX_ENTRIES})")
+            continue
+        for i, entry in enumerate(arr):
+            _validate_register_entry(
+                entry, f"{arr_key} entry {i}", errors,
+                require_addr=require_addr, require_id=require_id,
+            )
+
+    return errors
+
+
+def validate_log_config_hard(data):
+    """v1.11.8 B: hard-reject destructive log-config values before they reach
+    log_config / drive auto-cleanup. Sibling of validate_rs485_integers — returns
+    list[str] (non-empty → 400). Mirrors the floors that validate_device_config
+    only soft-warned, plus the two compress thresholds, and rejects bool for the
+    integer fields (bool is an int subclass → would silently coerce).
+    """
+    errors = []
+    if not isinstance(data, dict):
+        return errors
+
+    for k in ("log_auto_cleanup", "log_auto_compress"):
+        v = data.get(k)
+        if v is not None and v not in ("on", "off"):
+            errors.append(f"Invalid {k} (expected 'on' or 'off'): {v!r}")
+
+    # (key, floor)
+    int_floors = [
+        ("log_cleanup_max_files", 5),
+        ("log_cleanup_max_size_mb", 50),
+        ("log_compress_size_mb", 1),
+        ("log_compress_age_days", 1),
+    ]
+    for key, floor in int_floors:
+        v = data.get(key)
+        if v is None:
+            continue
+        if isinstance(v, bool):
+            errors.append(f"Invalid {key} (must be integer, got bool): {v!r}")
+            continue
+        try:
+            iv = int(v)
+        except (TypeError, ValueError):
+            errors.append(f"Invalid {key} (must be integer): {v!r}")
+            continue
+        if iv < floor:
+            errors.append(f"Invalid {key} (must be >= {floor}): {v!r}")
+
+    return errors
+
+
+def validate_device_ip_fields_hard(data):
+    """v1.11.8 D: hard-reject malformed IPv4 in device_config IP fields before the
+    write. Empty string = "clear" (allowed). Uses the shared strict _is_valid_ip
+    (leading-zero rule), so the device path and the network-apply path agree.
+    Sibling of validate_device_port_types_hard — returns list[str] (non-empty → 400).
+    """
+    errors = []
+    if not isinstance(data, dict):
+        return errors
+    ip_fields = (
+        "wifi_ip", "wifi_netmask", "wifi_gateway", "wifi_dns1", "wifi_dns2",
+        "eth_ip", "eth_netmask", "eth_gateway",
+        "protocol_server_ip", "update_server_ip", "rtcm_server_ip",
+        "opc_ua_server_ip", "modbus_server_ip", "lte_server_ip", "lte_ip",
+        "lte_netmask", "lte_gateway",
+    )
+    for field in ip_fields:
+        v = data.get(field)
+        if v is None:
+            continue
+        if not isinstance(v, str):
+            errors.append(f"Invalid IP for '{field}' (must be string): {v!r}")
+            continue
+        s = v.strip()
+        if s == "":
+            continue  # empty = clear (allowed)
+        if not _is_valid_ip(s):
+            errors.append(f"Invalid IPv4 address for '{field}': {v}")
+    return errors
+
+
+def validate_wifi_ssid_profiles(data):
+    """v1.11.8 C: hard-reject malformed device_config WIFI_SSID profiles on the
+    save-path, REUSING the network/validator SSID/PSK/security rules so the save
+    path and the network-apply path cannot diverge. Returns list[str] (non-empty
+    → 400). The profile array key/shape mirrors netmodel.intent_from_device:
+    each entry is {wifi_ssid, wifi_passwd, wifi_security}.
+    """
+    errors = []
+    if not isinstance(data, dict):
+        return errors
+    if "WIFI_SSID" not in data or data.get("WIFI_SSID") is None:
+        return errors
+    raw = data["WIFI_SSID"]
+    if not isinstance(raw, list):
+        errors.append(f"WIFI_SSID must be a JSON array (got {type(raw).__name__})")
+        return errors
+
+    # Factor through the network model + validator: build a wlan0 intent fragment
+    # so the SSID/PSK/security/gap rules come from the single source of truth.
+    from network import netmodel as _netmodel
+    from network import validator as _net_validator
+
+    # v1.11.8 fix: validate ONLY the first MAX_PROFILES entries — the apply path
+    # truncates extras at MAX_PROFILES (intent_from_device[:MAX_PROFILES]). We do
+    # NOT hard-reject on profile COUNT: the WiFi UI permits up to 10 rows and legacy
+    # device_config may already hold >5, so a count-400 would break otherwise-valid
+    # saves with no safety gain (profiles 6+ are never rendered). Content
+    # (SSID/PSK/security/gap) of the used profiles is still enforced.
+    profiles = [
+        {
+            "ssid": _netmodel._s(e.get("wifi_ssid")) if isinstance(e, dict) else "",
+            "password": _netmodel._s(e.get("wifi_passwd")) if isinstance(e, dict) else "",
+            "security": _netmodel._norm_security(e.get("wifi_security")) if isinstance(e, dict) else "wpa/wpa2",
+        }
+        for e in raw[: _net_validator.MAX_PROFILES]
+    ]
+    intent = {
+        "wlan0": {"mode": "dhcp", "ip": "", "netmask": "", "gateway": "",
+                  "dns1": "", "dns2": "", "country_code": "", "profiles": profiles},
+        "eth0": {"mode": "dhcp", "ip": "", "netmask": "", "gateway": "",
+                 "server_ip": "", "server_port": ""},
+        "eth1": {"mode": "dhcp", "ip": "", "netmask": "", "gateway": "",
+                 "opc_ua_server_ip": "", "opc_ua_server_port": "",
+                 "modbus_server_ip": "", "modbus_server_port": ""},
+    }
+    errs, _warns = _net_validator.validate(intent)
+    # Only surface profile-related errors (the intent's network fields are all
+    # dhcp/empty so they never error, but be defensive and keep wlan0/profile msgs).
+    for e in errs:
+        if "profiles" in e or "SSID" in e or "password" in e or "security" in e:
+            errors.append(e)
+    return errors
+
+
+def _format_allowed(allowed):
+    """Format an allowed-values set for human-readable error messages.
+
+    Handles mixed-type sets that include None (e.g. can_baudrate frozenset).
+    sorted() on such sets raises TypeError (None < int unsupported), so we
+    sort with a safe key: None always first, then remaining items by str(v).
+
+    Returns a string like: [null, 100, 250, 500, 1000]
+    """
+    items_str = [
+        "null" if v is None else (f'"{v}"' if isinstance(v, str) else str(v))
+        for v in sorted(allowed, key=lambda v: (v is not None, str(v) if v is not None else ""))
+    ]
+    return "[" + ", ".join(items_str) + "]"
+
+
+def validate_device_enums(cfg):
+    """Return list of error messages; empty if all provided keys are valid."""
+    errors = []
+    for key, allowed in DEVICE_ENUM_VALUES.items():
+        if key in cfg and cfg[key] not in allowed:
+            errors.append(f"{key}={cfg[key]!r} not allowed (valid: {_format_allowed(allowed)})")
+    return errors
+
+
+def validate_protocol_enums(cfg):
+    """Normalize legacy protocol form + equipment case, then validate. Does not mutate caller."""
+    normalized = dict(cfg)
+    if normalized.get("protocol") in PROTOCOL_ALIASES:
+        normalized["protocol"] = PROTOCOL_ALIASES[normalized["protocol"]]
+    # v2: equipment matching case-insensitive (uppercase before membership check)
+    if "equipment" in normalized and isinstance(normalized["equipment"], str):
+        normalized["equipment"] = normalized["equipment"].upper()
+    errors = []
+    for key, allowed in PROTOCOL_ENUM_VALUES.items():
+        if key in normalized and normalized[key] not in allowed:
+            errors.append(f"{key}={normalized[key]!r} not allowed (valid: {_format_allowed(allowed)})")
+    return errors
+
+
+def _is_valid_ip(ip_str):
+    """
+    Validate IPv4 address format.
+
+    Args:
+        ip_str: String to validate
+
+    Returns:
+        True if valid IPv4 format
+    """
+    parts = ip_str.strip().split(".")
+    if len(parts) != 4:
+        return False
+    for part in parts:
+        # strict, matching netmodel._ip_u32: ASCII digits only, no leading zero (except "0"), 0-255
+        if not (part.isascii() and part.isdigit()):
+            return False
+        if len(part) > 1 and part[0] == "0":
+            return False
+        if int(part) > 255:
+            return False
+    return True
diff --git a/src/db_manager.py b/src/db_manager.py
new file mode 100644
index 0000000..71944de
--- /dev/null
+++ b/src/db_manager.py
@@ -0,0 +1,443 @@
+"""
+db_manager.py — Configuration Storage Layer (Multi-Backend)
+
+Storage priority:
+  1. sqlite3 Python module (preferred, full dpworldapp compat)
+  2. sqlite3 CLI via subprocess (dpworldapp compat on minimal Python)
+  3. JSON file fallback (no dpworldapp compat, temp only)
+"""
+
+import os
+import sys
+import json
+import subprocess
+import shutil
+import threading
+import time
+from datetime import datetime, timezone
+
+try:
+    import sqlite3
+    HAS_SQLITE = True
+except ImportError:
+    HAS_SQLITE = False
+
+DB_PATH_DEFAULT = os.path.join(os.path.expanduser("~"), "db", "dynamic_data.db")
+
+# save_config retries transient SQLite "database is locked" errors: a competing
+# writer can briefly hold the lock even with PRAGMA busy_timeout set. Total
+# attempts, and the pause between them.
+_WRITE_MAX_ATTEMPTS = 3
+_WRITE_RETRY_DELAY_S = 0.1
+
+
+def _has_sqlite3_cli():
+    """Check if sqlite3 command-line tool is available."""
+    return shutil.which("sqlite3") is not None
+
+
+class DBManager:
+    """Configuration storage manager with 3-tier backend."""
+
+    # Whitelist of allowed config keys (SQL injection defense for CLI backend)
+    ALLOWED_KEYS = frozenset({'device_config', 'protocol_config', 'log_config', 'net_config', 'ap_config'})  # AP: ap_config key
+
+    def __init__(self, db_path=None, backend=None):
+        self.db_path = db_path or os.environ.get("DB_PATH", DB_PATH_DEFAULT)
+        self._lock = threading.Lock()
+
+        if backend is not None:
+            # Explicit backend override (used in tests and special deployments)
+            self._backend = backend
+            if backend == "json":
+                self._json_dir = os.path.dirname(self.db_path)
+                os.makedirs(self._json_dir, exist_ok=True)
+            print(f"[DB] Backend override: {backend} ({self.db_path})")
+        elif HAS_SQLITE:
+            self._backend = "python"
+            print(f"[DB] Using Python sqlite3: {self.db_path}")
+        elif _has_sqlite3_cli():
+            self._backend = "cli"
+            print(f"[DB] Using sqlite3 CLI: {self.db_path}")
+        else:
+            self._backend = "json"
+            self._json_dir = os.path.dirname(self.db_path)
+            os.makedirs(self._json_dir, exist_ok=True)
+            print(f"[DB] Fallback to JSON files: {self._json_dir}")
+
+    # ─── Python sqlite3 module ───────────────────────────────────
+
+    def _connect(self):
+        conn = sqlite3.connect(self.db_path)
+        conn.execute("PRAGMA busy_timeout = 5000")
+        conn.execute("PRAGMA journal_mode = WAL")
+        conn.row_factory = sqlite3.Row
+        return conn
+
+    def _validate_key(self, key):
+        """Validate config key against whitelist to prevent SQL injection."""
+        if not isinstance(key, str):
+            raise ValueError(f"Invalid config key type: {type(key)}")
+        if key not in self.ALLOWED_KEYS:
+            raise ValueError(f"Invalid config key: {key}")
+
+    # ─── sqlite3 CLI (subprocess) ────────────────────────────────
+
+    def _cli_exec(self, sql):
+        """Execute SQL via sqlite3 CLI and return stdout."""
+        os.makedirs(os.path.dirname(self.db_path), exist_ok=True)
+        result = subprocess.run(
+            ["sqlite3", self.db_path],
+            input=sql,
+            capture_output=True,
+            text=True,
+            timeout=10
+        )
+        if result.returncode != 0:
+            raise RuntimeError(f"sqlite3 CLI error: {result.stderr.strip()}")
+        return result.stdout.strip()
+
+    def _cli_query(self, sql):
+        """Execute query via CLI and return result string."""
+        return self._cli_exec(sql)
+
+    # ─── JSON file helpers ───────────────────────────────────────
+
+    def _json_path(self, key):
+        return os.path.join(self._json_dir, f"{key}.json")
+
+    def _read_json_file(self, key):
+        path = self._json_path(key)
+        if not os.path.exists(path):
+            return None
+        try:
+            with open(path, "r", encoding="utf-8") as f:
+                return json.load(f)
+        except (json.JSONDecodeError, IOError):
+            return None
+
+    def _write_json_file(self, key, data):
+        path = self._json_path(key)
+        tmp_path = path + ".tmp"
+        json_str = json.dumps(data, ensure_ascii=False, indent=2)
+        with open(tmp_path, "w", encoding="utf-8") as f:
+            f.write(json_str)
+            f.flush()
+            os.fsync(f.fileno())
+        os.replace(tmp_path, path)
+
+    # ─── Public API ──────────────────────────────────────────────
+
+    def ensure_tables(self):
+        if self._backend == "python":
+            with self._lock:
+                conn = self._connect()
+                try:
+                    conn.execute("""
+                        CREATE TABLE IF NOT EXISTS board_config (
+                            key TEXT PRIMARY KEY NOT NULL,
+                            value TEXT NOT NULL
+                        )
+                    """)
+                    conn.execute("""
+                        CREATE TABLE IF NOT EXISTS event_history (
+                            id INTEGER PRIMARY KEY AUTOINCREMENT,
+                            data TEXT NOT NULL
+                        )
+                    """)
+                    conn.commit()
+                finally:
+                    conn.close()
+        elif self._backend == "cli":
+            with self._lock:
+                self._cli_exec(
+                    "CREATE TABLE IF NOT EXISTS board_config "
+                    "(key TEXT PRIMARY KEY NOT NULL, value TEXT NOT NULL);\n"
+                    "CREATE TABLE IF NOT EXISTS event_history "
+                    "(id INTEGER PRIMARY KEY AUTOINCREMENT, data TEXT NOT NULL);"
+                )
+        else:
+            os.makedirs(self._json_dir, exist_ok=True)
+
+    def get_config(self, key):
+        self._validate_key(key)
+        if self._backend == "python":
+            with self._lock:
+                conn = self._connect()
+                try:
+                    cursor = conn.execute(
+                        "SELECT value FROM board_config WHERE key = ?", (key,)
+                    )
+                    row = cursor.fetchone()
+                    if row is None:
+                        return None
+                    try:
+                        return json.loads(row["value"])
+                    except json.JSONDecodeError:
+                        print(f"[DB] WARNING: malformed JSON in board_config key={key!r}; returning None", file=sys.stderr)
+                        return None
+                finally:
+                    conn.close()
+        elif self._backend == "cli":
+            with self._lock:
+                raw = self._cli_query(
+                    f"SELECT value FROM board_config WHERE key = '{key}';"
+                )
+            if not raw:
+                return None
+            try:
+                return json.loads(raw)
+            except json.JSONDecodeError:
+                print(f"[DB] WARNING: malformed JSON in board_config key={key!r}; returning None", file=sys.stderr)
+                return None
+        else:
+            with self._lock:
+                return self._read_json_file(key)
+
+    def save_config(self, key, data):
+        self._validate_key(key)
+        json_str = json.dumps(data, ensure_ascii=False, indent=2)
+
+        if self._backend == "python":
+            last_error = None
+            for attempt in range(_WRITE_MAX_ATTEMPTS):
+                # #37 fix: acquire the lock only around the actual DB op; the retry
+                # backoff sleep below runs OUTSIDE the lock so a contended write
+                # does not stall every other DB thread for the backoff window.
+                with self._lock:
+                    conn = self._connect()
+                    try:
+                        conn.execute(
+                            "INSERT OR REPLACE INTO board_config (key, value) VALUES (?, ?)",
+                            (key, json_str)
+                        )
+                        conn.commit()
+                        return
+                    except sqlite3.OperationalError as e:
+                        # Retry only the transient lock; re-raise anything else.
+                        if "database is locked" not in str(e).lower():
+                            raise
+                        last_error = e
+                    finally:
+                        conn.close()
+                if attempt < _WRITE_MAX_ATTEMPTS - 1:
+                    time.sleep(_WRITE_RETRY_DELAY_S)  # outside the lock
+            raise last_error
+        elif self._backend == "cli":
+            # Escape single quotes in JSON for SQL
+            escaped = json_str.replace("'", "''")
+            with self._lock:
+                self._cli_exec(
+                    f"INSERT OR REPLACE INTO board_config (key, value) "
+                    f"VALUES ('{key}', '{escaped}');"
+                )
+        else:
+            with self._lock:
+                self._write_json_file(key, data)
+
+    def update_config(self, key, mutator, default=None):
+        """
+        Atomic read-modify-write of board_config entry.
+
+        Args:
+            key: board_config key (must be in ALLOWED_KEYS)
+            mutator: callable(current_value) -> new_value. current_value is
+                     the JSON-deserialized current value (or `default` if absent).
+                     Must NOT mutate input — return a new dict.
+            default: value to pass to mutator when key is missing (default: None)
+
+        Returns:
+            The new value (after mutator) — i.e., what was actually saved.
+            If mutator returns None the key is deleted and None is returned.
+
+        Atomic guarantees:
+            - python backend: BEGIN IMMEDIATE + SELECT + UPDATE + COMMIT within
+              one connection. Other writers block; lock retries with exponential
+              backoff (same _WRITE_MAX_ATTEMPTS pattern).
+            - cli backend: serialized by _lock (cli is sequential).
+            - json backend: lock + read + mutator + atomic write (tempfile+rename).
+        """
+        self._validate_key(key)
+
+        if self._backend == "python":
+            last_error = None
+            for attempt in range(_WRITE_MAX_ATTEMPTS):
+                # #37 fix: lock only around the atomic RMW; the retry backoff sleep
+                # below runs OUTSIDE the lock so a contended write does not stall
+                # every other DB thread for the backoff window.
+                with self._lock:
+                    conn = self._connect()
+                    try:
+                        # BEGIN IMMEDIATE — acquires write lock immediately,
+                        # blocking other writers but allowing concurrent reads.
+                        conn.execute("BEGIN IMMEDIATE")
+                        cursor = conn.execute(
+                            "SELECT value FROM board_config WHERE key = ?", (key,)
+                        )
+                        row = cursor.fetchone()
+                        if row is None:
+                            current = default
+                        else:
+                            try:
+                                current = json.loads(row["value"])
+                            except json.JSONDecodeError:
+                                print(f"[DB] WARNING: malformed JSON in board_config key={key!r}; using default", file=sys.stderr)
+                                current = default
+                        new_value = mutator(current)
+                        if new_value is None:
+                            # mutator returned None → delete key
+                            conn.execute(
+                                "DELETE FROM board_config WHERE key = ?", (key,)
+                            )
+                        else:
+                            json_str = json.dumps(new_value, ensure_ascii=False, indent=2)
+                            conn.execute(
+                                "INSERT OR REPLACE INTO board_config (key, value) VALUES (?, ?)",
+                                (key, json_str)
+                            )
+                        conn.commit()
+                        return new_value
+                    except sqlite3.OperationalError as e:
+                        if "database is locked" not in str(e).lower():
+                            raise
+                        last_error = e
+                        try:
+                            conn.rollback()
+                        except Exception:
+                            pass
+                    finally:
+                        conn.close()
+                if attempt < _WRITE_MAX_ATTEMPTS - 1:
+                    time.sleep(_WRITE_RETRY_DELAY_S)  # outside the lock
+            raise last_error
+        elif self._backend == "cli":
+            with self._lock:
+                raw = self._cli_query(
+                    f"SELECT value FROM board_config WHERE key = '{key}';"
+                )
+                if not raw:
+                    current = default
+                else:
+                    try:
+                        current = json.loads(raw)
+                    except json.JSONDecodeError:
+                        print(f"[DB] WARNING: malformed JSON in board_config key={key!r}; using default", file=sys.stderr)
+                        current = default
+                new_value = mutator(current)
+                if new_value is None:
+                    self._cli_exec(f"DELETE FROM board_config WHERE key = '{key}';")
+                else:
+                    json_str = json.dumps(new_value, ensure_ascii=False, indent=2)
+                    escaped = json_str.replace("'", "''")
+                    self._cli_exec(
+                        f"INSERT OR REPLACE INTO board_config (key, value) "
+                        f"VALUES ('{key}', '{escaped}');"
+                    )
+                return new_value
+        else:  # json backend
+            with self._lock:
+                current = self._read_json_file(key)
+                if current is None:
+                    current = default
+                new_value = mutator(current)
+                if new_value is None:
+                    path = self._json_path(key)
+                    if os.path.exists(path):
+                        os.remove(path)
+                else:
+                    self._write_json_file(key, new_value)
+                return new_value
+
+    def config_exists(self, key):
+        self._validate_key(key)
+        if self._backend == "python":
+            with self._lock:
+                conn = self._connect()
+                try:
+                    cursor = conn.execute(
+                        "SELECT 1 FROM board_config WHERE key = ? LIMIT 1", (key,)
+                    )
+                    return cursor.fetchone() is not None
+                finally:
+                    conn.close()
+        elif self._backend == "cli":
+            with self._lock:
+                raw = self._cli_query(
+                    f"SELECT 1 FROM board_config WHERE key = '{key}' LIMIT 1;"
+                )
+            return bool(raw)
+        else:
+            with self._lock:
+                return os.path.exists(self._json_path(key))
+
+    # ─── Schema meta (migration flags) ──────────────────────────
+
+    def _ensure_schema_meta_table(self) -> None:
+        # _lock is acquired here independently; callers must NOT hold the
+        # lock when calling this method (sequential acquisition only).
+        with self._lock:
+            conn = self._connect()
+            try:
+                conn.execute("""
+                    CREATE TABLE IF NOT EXISTS schema_meta (
+                        key TEXT PRIMARY KEY,
+                        value TEXT NOT NULL,
+                        applied_at TEXT NOT NULL
+                    )
+                """)
+                conn.commit()
+            finally:
+                conn.close()
+
+    def get_schema_meta(self, key: str):
+        self._ensure_schema_meta_table()
+        with self._lock:
+            conn = self._connect()
+            try:
+                row = conn.execute(
+                    "SELECT value FROM schema_meta WHERE key = ?", (key,)
+                ).fetchone()
+                return row[0] if row else None
+            finally:
+                conn.close()
+
+    def set_schema_meta(self, key: str, value: str) -> None:
+        self._ensure_schema_meta_table()
+        now = datetime.now(timezone.utc).isoformat()
+        with self._lock:
+            conn = self._connect()
+            try:
+                conn.execute("""
+                    INSERT INTO schema_meta(key, value, applied_at)
+                    VALUES (?, ?, ?)
+                    ON CONFLICT(key) DO UPDATE SET value=excluded.value,
+                                                    applied_at=excluded.applied_at
+                """, (key, value, now))
+                conn.commit()
+            finally:
+                conn.close()
+
+    def get_raw_json(self, key):
+        self._validate_key(key)
+        if self._backend == "python":
+            with self._lock:
+                conn = self._connect()
+                try:
+                    cursor = conn.execute(
+                        "SELECT value FROM board_config WHERE key = ?", (key,)
+                    )
+                    row = cursor.fetchone()
+                    return row["value"] if row else None
+                finally:
+                    conn.close()
+        elif self._backend == "cli":
+            with self._lock:
+                raw = self._cli_query(
+                    f"SELECT value FROM board_config WHERE key = '{key}';"
+                )
+            return raw if raw else None
+        else:
+            with self._lock:
+                data = self._read_json_file(key)
+            return json.dumps(data, ensure_ascii=False, indent=2) if data else None
+
diff --git a/src/dpworldapp_enums.py b/src/dpworldapp_enums.py
new file mode 100644
index 0000000..c48d45e
--- /dev/null
+++ b/src/dpworldapp_enums.py
@@ -0,0 +1,90 @@
+"""dpworldapp enum value sets — canonical = device config-reader contract.
+
+source-of-truth: the device config-reader contract, verified against the deployed
+dpworldapp binary on .56 (string table + observed runtime behavior) and the live
+working DB. Pivoted fields (rs485_parity, two/four_byte_order, idt, protocol, ai/di)
+match the reader's accepted literals exactly.
+
+Un-pivoted fields stay consistent with the values the legacy configurator accepts,
+established from operational ground truth on the working DB.
+
+v2 (2026-06-20): contract alignment —
+- rs485_parity: "no" → "none" (reader accepts "none")
+- two_byte_order: add "little swap"/"big swap" space forms (reader accepts them)
+- four_byte_order: camelCase → space forms (reader accepts the space forms)
+- protocol: drop "CAN" (reader has no CAN protocol; CAN is gated by can_input)
+- add ai2/ai3/di2/di3 {0,1} (reader reads all 8 ai/di channels)
+- can_baudrate: widen (reader imposes no allow-list)
+- rs485_baudrate: widen (reader imposes no allow-list; UI already offers 4800/19200/38400/57600)
+
+operational notes:
+- can_baudrate {100,250,500,1000}: operational ground truth (.56 DB=250, dha=500).
+- heading_on/heading_imu_on/fix_mode_on: present in the reader; read directly from
+  board_config (no separate UI field).
+- can_input: protocol_config only (absent from device_config).
+"""
+
+DEVICE_ENUM_VALUES = {
+    # device_config enum fields only
+    # "" = the "not configured" value stored in DB for CAN bus type
+    "can_bus_type":      frozenset({"", "extended", "standard"}),
+    # None = SQL NULL / "not configured"; reader imposes no baudrate allow-list
+    "can_baudrate":      frozenset({None, 100, 125, 250, 500, 800, 1000}),
+    # can_input belongs to protocol_config only (absent from device_config) —
+    # see PROTOCOL_ENUM_VALUES["can_input"].
+    "wifi_security":     frozenset({"none", "wpa/wpa2"}),
+    "wifi_static":       frozenset({"on", "off"}),
+    # wifi_country_code: free-form string in the schema — config_validator applies
+    # the 2-upper-alpha check.
+
+    # RS485 (device_config)
+    "rs485_mode":      frozenset({"", "half", "full"}),
+    # None = SQL NULL / not configured; reader imposes no baudrate allow-list
+    "rs485_baudrate":  frozenset({None, 4800, 9600, 19200, 38400, 57600, 115200}),
+    # v2: canonical "none" (reader accepts "none"); aliases map to "none" in enum_normalizer
+    "rs485_parity":    frozenset({"none", "even", "odd"}),
+    # rs485_databits / rs485_stopbits: Integer types only — handled in config_validator.py
+}
+
+PROTOCOL_ENUM_VALUES = {
+    # protocol_config enum fields only
+    # v2: drop "CAN" — reader has no CAN protocol; CAN data gated by can_input
+    "protocol":          frozenset({"NONE", "OPC_UA", "MODBUS"}),
+    "equipment":         frozenset({"ITV", "RS", "ECH", "RTG", "RMG", "MHC", "STS"}),
+    "can_input":         frozenset({"on", "off"}),
+    "speed_data":        frozenset({"CAN", "GPS"}),
+    # odo_on: stored as "on"/"off" string — Python strict enum
+    # (sibling of dr_on/wifi_static/can_input)
+    "odo_on":            frozenset({"on", "off"}),
+    # odo_speed/odo_direction = nested source objects — handled separately
+    # transport_config / security: separate board_config row, not validated here
+
+    # Analog input level + per-channel enable flags
+    "analog_input_level":  frozenset({"2", "4", "6"}),
+    # ai/di channels are {"0","1"}; "true"/"false" inputs are mapped in enum_normalizer
+    "ai0":                 frozenset({"0", "1"}),
+    "ai1":                 frozenset({"0", "1"}),
+    # v2: add ai2/ai3/di2/di3 — reader reads all 8 ai/di channels
+    "ai2":                 frozenset({"0", "1"}),
+    "ai3":                 frozenset({"0", "1"}),
+    "di0":                 frozenset({"0", "1"}),
+    "di1":                 frozenset({"0", "1"}),
+    "di2":                 frozenset({"0", "1"}),
+    "di3":                 frozenset({"0", "1"}),
+
+    # device type / DR / byte order (protocol_config)
+    "dev_type":            frozenset({"TIOT", "RTLS"}),
+    "dr_on":               frozenset({"on", "off"}),
+    # read directly from board_config by the reader (no separate UI field)
+    "heading_on":          frozenset({"on", "off"}),
+    "heading_imu_on":      frozenset({"on", "off"}),
+    "fix_mode_on":         frozenset({"on", "off"}),
+    # v2: space forms match the reader's accepted literals ("little swap"/"big swap")
+    "two_byte_order":      frozenset({"little", "little swap", "big swap", "big"}),
+    "four_byte_order":     frozenset({"little", "little swap", "big swap", "big"}),
+}
+
+PROTOCOL_ALIASES = {"OPC-UA": "OPC_UA"}
+
+# odo_speed.source / odo_direction.source accepted values
+ODO_SOURCE_VALUES = frozenset({"can", "hw"})
diff --git a/src/dpworldapp_telemetry.py b/src/dpworldapp_telemetry.py
new file mode 100644
index 0000000..6445ba2
--- /dev/null
+++ b/src/dpworldapp_telemetry.py
@@ -0,0 +1,196 @@
+"""
+v1.5.5 — dpworldapp telemetry stream parser (TCP 8989).
+
+dpworldapp 가 `127.0.0.1:8989` 에 LISTEN 하며 connection 직후 헤더 스냅샷 8 frame
+(static info) + 이후 실시간 telemetry stream 을 push 한다. 우리는 connect →
+헤더 frame parse → disconnect 의 **stateless query 패턴** 으로 정적 정보 (firmware
+version / MAC / IP) 만 수집한다.
+
+발견 경위 (2026-06-09):
+- 6-byte command flow를 TCP telemetry 동작과 비교 검증
+- TCP 포트 inventory 결과 `.54` dpworldapp 가 8989 + 8990 두 포트만 listen
+  (8990 = firmware OTA, 이미 알려진 채널)
+- 8989 에 6-byte ReadAll/GetFwVersion/GetMacAddress 모두 송신 시 같은 응답 →
+  명령 분기 없이 connection trigger 만으로 8 frame 스냅샷 + 실시간 stream
+- 6-byte 명령은 사실상 무시되지만 (혹시 server-side validation 가능성) connect
+  직후 송신해 두는 게 안전
+
+응답 frame 예 (timestamp prefix 가 붙음):
+    2026-06-09 04:16:10: #[FWVER] ITV-01-2026052801\r\n
+    2026-06-09 04:16:10: #[GNSS_FW_VER] HPS 1.4\r\n
+    2026-06-09 04:16:10: #[WIFI_MAC] bc2a33acf9f8\r\n
+    2026-06-09 04:16:10: #[ETH0_MAC] 92d478cd597b\r\n
+    2026-06-09 04:16:10: #[ETH1_MAC] 2e6f303d719f\r\n
+    2026-06-09 04:16:10: #[WIFI_IP] 10.227.231.38\r\n
+    2026-06-09 04:16:10: #[ETH0_IP] 192.168.55.54\r\n
+    2026-06-09 04:16:10: #[ETH1_IP] 192.168.40.20\r\n
+    ... (이후 실시간 [AI]/[DI]/[GNSS]/[OPC-UA]/[MSG_TURF]/[SERVER] stream)
+
+Frame format: `<arbitrary prefix>#[KEY] <value>\r\n`
+"""
+import re
+import socket
+import threading
+import time
+
+DEFAULT_HOST = "127.0.0.1"
+DEFAULT_PORT = 8989
+# v1.5.5.1: timeout 2s/3s → 1s. 헤더 8 frame 수신은 실측 100ms 이내라 충분.
+# 짧게 잡아 system_status response latency 단축 + dpworldapp 부담 감소.
+DEFAULT_TIMEOUT_S = 1.0
+# v1.5.5.1: TTL cache — 매 system_status 호출마다 8989 connect 회피.
+# Dashboard 폴링 10s 간격에 30s cache 면 평균 3회당 1회만 실 query → dpworldapp 부담 1/3.
+DEFAULT_CACHE_TTL_S = 30.0
+
+# 우리가 수집하는 헤더 frame key 들 (8 static info fields)
+HEADER_KEYS = (
+    "FWVER",
+    "GNSS_FW_VER",
+    "WIFI_MAC",
+    "ETH0_MAC",
+    "ETH1_MAC",
+    "WIFI_IP",
+    "ETH0_IP",
+    "ETH1_IP",
+)
+
+# 6-byte ReadAll command (frame start = '#', Type='A', Cmd='A', CRC=0, Term='*', End=0xFE).
+# dpworldapp 가 명령 분기 안 함을 verify 했지만 connect 시 send 해 두는 게 안전 (혹시
+# server-side validation 도입 시 호환).
+_TRIGGER_CMD = bytes([0x23, 0x41, 0x41, 0x00, 0x2A, 0xFE])
+
+# Frame parser: timestamp / log prefix 가 있어도 `#[KEY] value` 패턴만 추출
+_FRAME_PATTERN = re.compile(
+    rb"#\[(?P<key>[A-Z0-9_]+)\]\s+(?P<value>[^\r\n]+)"
+)
+
+
+def query_telemetry(host=DEFAULT_HOST, port=DEFAULT_PORT, timeout_s=DEFAULT_TIMEOUT_S):
+    """dpworldapp telemetry stream 에 connect 해 헤더 frame 수집.
+
+    Args:
+        host: dpworldapp 호스트. 디바이스 안에서는 127.0.0.1.
+        port: 8989 (telemetry stream channel).
+        timeout_s: 전체 query timeout. 모든 헤더 frame 수신 시 조기 종료.
+
+    Returns:
+        dict: {key: value} 로 HEADER_KEYS 중 발견된 것만. connection 실패 / timeout /
+              parse 실패 시 빈 dict.
+
+    Raises:
+        없음 — 모든 예외는 빈 dict 로 흡수. Dashboard 표시용이라 실패 시 silent.
+    """
+    result = {}
+    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    s.settimeout(timeout_s)
+    buf = b""
+    try:
+        s.connect((host, port))
+        # 6-byte trigger. dpworldapp 가 명령 분기 안 하지만 호환 위해 send.
+        s.sendall(_TRIGGER_CMD)
+
+        deadline = time.monotonic() + timeout_s
+        while time.monotonic() < deadline:
+            remaining = deadline - time.monotonic()
+            if remaining <= 0.0:
+                break
+            s.settimeout(min(0.5, remaining))
+            try:
+                chunk = s.recv(4096)
+            except socket.timeout:
+                break
+            if not chunk:
+                break
+            buf += chunk
+            # 모든 헤더 frame 수신했으면 조기 종료 (실시간 stream 안 받음 — CPU/network 절약)
+            if all(k.encode("ascii") in buf for k in HEADER_KEYS):
+                break
+    except (socket.error, OSError):
+        return {}
+    finally:
+        try:
+            s.close()
+        except OSError:
+            pass
+
+    # Frame parse — 중복 key 는 처음 발견된 값 유지
+    for m in _FRAME_PATTERN.finditer(buf):
+        key = m.group("key").decode("ascii", errors="ignore")
+        if key in HEADER_KEYS and key not in result:
+            value = m.group("value").decode("utf-8", errors="ignore").strip()
+            result[key] = value
+
+    return result
+
+
+# ─── v1.5.5.1: TTL cache ───────────────────────────────────────────
+# Thread-safe singleton cache. system_status 가 매 polling 마다 telemetry_summary
+# 를 호출해도 30s 안에는 stale 결과 반환 (dpworldapp 8989 connect 회피).
+_CACHE_LOCK = threading.Lock()
+_CACHE_STATE = {"data": None, "expires_at": 0.0}
+
+
+def _cache_clear():
+    """test 전용 — cache 초기화."""
+    with _CACHE_LOCK:
+        _CACHE_STATE["data"] = None
+        _CACHE_STATE["expires_at"] = 0.0
+
+
+def telemetry_summary(host=DEFAULT_HOST, port=DEFAULT_PORT, timeout_s=DEFAULT_TIMEOUT_S,
+                      cache_ttl_s=DEFAULT_CACHE_TTL_S):
+    """Dashboard 표시용 요약 + TTL cache.
+
+    Returns:
+        dict: 다음 구조 (모든 호출이 같은 dict reference 가 아닌 fresh copy 반환)
+            {
+              "available": bool,           # query 성공 여부
+              "firmware": str|None,        # [FWVER]
+              "gnss_firmware": str|None,   # [GNSS_FW_VER]
+              "wifi_mac": str|None,
+              "eth0_mac": str|None,
+              "eth1_mac": str|None,
+              "wifi_ip": str|None,
+              "eth0_ip": str|None,
+              "eth1_ip": str|None,
+              "cached": bool,              # cache hit 인 경우 True
+              "cache_age_s": float,        # cache 적중 시 캐시된 시간 경과 (sec)
+            }
+
+    Cache 동작:
+        - cache_ttl_s=0 으로 설정하면 cache bypass (매번 fresh query)
+        - 실패한 결과 (available=False) 도 cache 됨 — connection refused 가 30초 동안
+          반복 query 방지. 다만 짧은 retry 가 필요하면 ttl 명시적 단축 가능.
+    """
+    now = time.monotonic()
+    # Fast path: cache hit
+    if cache_ttl_s > 0:
+        with _CACHE_LOCK:
+            entry = _CACHE_STATE["data"]
+            expires = _CACHE_STATE["expires_at"]
+            if entry is not None and expires > now:
+                cached = dict(entry)
+                cached["cached"] = True
+                cached["cache_age_s"] = max(0.0, cache_ttl_s - (expires - now))
+                return cached
+
+    # Cache miss — actual query
+    raw = query_telemetry(host=host, port=port, timeout_s=timeout_s)
+    fresh = {
+        "available": bool(raw),
+        "firmware": raw.get("FWVER"),
+        "gnss_firmware": raw.get("GNSS_FW_VER"),
+        "wifi_mac": raw.get("WIFI_MAC"),
+        "eth0_mac": raw.get("ETH0_MAC"),
+        "eth1_mac": raw.get("ETH1_MAC"),
+        "wifi_ip": raw.get("WIFI_IP"),
+        "eth0_ip": raw.get("ETH0_IP"),
+        "eth1_ip": raw.get("ETH1_IP"),
+        "cached": False,
+        "cache_age_s": 0.0,
+    }
+    if cache_ttl_s > 0:
+        with _CACHE_LOCK:
+            _CACHE_STATE["data"] = dict(fresh)
+            _CACHE_STATE["expires_at"] = now + cache_ttl_s
+    return fresh
diff --git a/src/enum_normalizer.py b/src/enum_normalizer.py
new file mode 100644
index 0000000..ffc5589
--- /dev/null
+++ b/src/enum_normalizer.py
@@ -0,0 +1,171 @@
+"""Input normalization for enum values — v2 canonical = device config-reader contract.
+
+Maps external inputs (case variants, camelCase aliases, legacy forms) to the
+device config-reader canonical form. Semantic-equivalence guessing is risky and
+intentionally excluded.
+
+v2 (2026-06-20): contract alignment —
+- rs485_parity: all "no"/"n"/"NONE"/etc aliases → "none" (new canonical)
+- four_byte_order: camelCase/underscore/upper → space forms ("little swap"/"big swap")
+- two_byte_order: same swap aliases added
+- ai2/ai3/di2/di3: true/false → "1"/"0" (mirror ai0/ai1)
+- normalize_device_input: rs485_baudrate string→int coercion added
+- normalize_device_input: wifi_country_code strip+upper when 2-letter string
+
+board_config key ownership policy (v1.4.1 stage-1): odo_*, transport_config, security
+keys are not validated here — they are owned by separate components / board_config
+rows. enum_normalizer only performs aliasing; ownership policy lives in dpworldapp_enums.py.
+"""
+
+_INPUT_ALIASES_DEVICE = {
+    "wifi_static":   {"ON": "on", "OFF": "off"},
+    # can_input is a protocol_config key (absent from device_config) — alias removed here.
+    # _INPUT_ALIASES_PROTOCOL["can_input"] is kept.
+    # wifi_security: case-equivalent only. "None" (title-case) absorbs Python str(None)
+    # or common external-tool patterns. Semantic guessing (WEP/WPA3 → wpa/wpa2 etc.)
+    # is intentionally excluded — wrong-conversion risk. ([[memory:v1-4-0-3-enum-alignment]])
+    "wifi_security": {
+        "NONE": "none", "None": "none",
+        "WPA/WPA2": "wpa/wpa2", "wpa/WPA2": "wpa/wpa2", "WPA/wpa2": "wpa/wpa2",
+    },
+    "can_bus_type": {
+        "NONE": "", "None": "",
+        "EXTENDED": "extended", "Extended": "extended",
+        "STANDARD": "standard", "Standard": "standard",
+    },
+    # H1 RS485 case alias
+    "rs485_mode": {
+        "HALF": "half", "Half": "half",
+        "FULL": "full", "Full": "full",
+    },
+    # v2: canonical "none"; all no/n/NONE variants → "none"
+    "rs485_parity": {
+        "NO": "none", "No": "none", "no": "none",
+        "NONE": "none", "None": "none",
+        "N": "none", "n": "none",
+        "EVEN": "even", "Even": "even",
+        "ODD": "odd", "Odd": "odd",
+    },
+}
+
+_INPUT_ALIASES_PROTOCOL = {
+    "can_input": {"ON": "on", "OFF": "off"},
+    "odo_on":    {"ON": "on", "OFF": "off"},
+    # H2 analog ports "true"/"false" → "1"/"0"
+    "ai0": {"true": "1", "True": "1", "TRUE": "1", "false": "0", "False": "0", "FALSE": "0"},
+    "ai1": {"true": "1", "True": "1", "TRUE": "1", "false": "0", "False": "0", "FALSE": "0"},
+    # v2: ai2/ai3/di2/di3 — same pattern as ai0/ai1/di0/di1
+    "ai2": {"true": "1", "True": "1", "TRUE": "1", "false": "0", "False": "0", "FALSE": "0"},
+    "ai3": {"true": "1", "True": "1", "TRUE": "1", "false": "0", "False": "0", "FALSE": "0"},
+    "di0": {"true": "1", "True": "1", "TRUE": "1", "false": "0", "False": "0", "FALSE": "0"},
+    "di1": {"true": "1", "True": "1", "TRUE": "1", "false": "0", "False": "0", "FALSE": "0"},
+    "di2": {"true": "1", "True": "1", "TRUE": "1", "false": "0", "False": "0", "FALSE": "0"},
+    "di3": {"true": "1", "True": "1", "TRUE": "1", "false": "0", "False": "0", "FALSE": "0"},
+    # H3 case alias
+    "dr_on": {"ON": "on", "OFF": "off"},
+    # v1.4.6.3 H2: sibling pattern with dr_on
+    "heading_on":     {"ON": "on", "OFF": "off"},
+    "heading_imu_on": {"ON": "on", "OFF": "off"},
+    "fix_mode_on":    {"ON": "on", "OFF": "off"},
+    # v2: space forms canonical; camelCase/underscore/upper all map to space form
+    "two_byte_order": {
+        "BIG": "big", "Big": "big",
+        "LITTLE": "little", "Little": "little",
+        # swap aliases → space canonical
+        "littleSwap": "little swap", "LITTLE_SWAP": "little swap",
+        "littleswap": "little swap", "little_swap": "little swap",
+        "bigSwap": "big swap", "BIG_SWAP": "big swap",
+        "bigswap": "big swap", "big_swap": "big swap",
+        # uppercase pass-through helpers
+        "BIG SWAP": "big swap", "LITTLE SWAP": "little swap",
+    },
+    # v2: space forms canonical; camelCase/underscore/upper all map to space form
+    "four_byte_order": {
+        "BIG": "big", "Big": "big",
+        "LITTLE": "little", "Little": "little",
+        # swap aliases → space canonical
+        "littleSwap": "little swap", "LITTLE_SWAP": "little swap",
+        "littleswap": "little swap", "little_swap": "little swap",
+        "bigSwap": "big swap", "BIG_SWAP": "big swap",
+        "bigswap": "big swap", "big_swap": "big swap",
+        # uppercase pass-through helpers
+        "BIG SWAP": "big swap", "LITTLE SWAP": "little swap",
+    },
+}
+
+# nested odo_speed / odo_direction source alias (case-only)
+_ODO_SOURCE_ALIASES = {
+    "CAN": "can", "Can": "can",
+    "HW": "hw", "Hw": "hw",
+}
+
+
+def _normalize_odo_field(obj):
+    """Apply case-only alias to the source field of odo_speed / odo_direction."""
+    if not isinstance(obj, dict):
+        return obj
+    result = dict(obj)
+    src = result.get("source")
+    if isinstance(src, str) and src in _ODO_SOURCE_ALIASES:
+        result["source"] = _ODO_SOURCE_ALIASES[src]
+    return result
+
+
+def normalize_device_input(cfg):
+    """alias + baudrate string->int + wifi_country_code strip/upper. No semantic guessing."""
+    if not isinstance(cfg, dict):
+        return cfg
+    result = dict(cfg)
+    for key, aliases in _INPUT_ALIASES_DEVICE.items():
+        v = result.get(key)
+        if isinstance(v, str) and v in aliases:
+            result[key] = aliases[v]
+    # can_baudrate type coercion
+    v = result.get("can_baudrate")
+    if isinstance(v, str):
+        try:
+            result["can_baudrate"] = int(v)
+        except ValueError:
+            pass
+    # v2: rs485_baudrate string→int coercion (mirror can_baudrate)
+    v = result.get("rs485_baudrate")
+    if isinstance(v, str):
+        try:
+            result["rs485_baudrate"] = int(v)
+        except ValueError:
+            pass
+    # v2: wifi_country_code strip+uppercase (reader trims + uppercases)
+    v = result.get("wifi_country_code")
+    if isinstance(v, str):
+        stripped = v.strip()
+        if len(stripped) == 2 and stripped.isalpha():
+            result["wifi_country_code"] = stripped.upper()
+    return result
+
+
+def normalize_protocol_input(cfg):
+    """alias + byte_order lowercase fallback for protocol enum inputs."""
+    if not isinstance(cfg, dict):
+        return cfg
+    result = dict(cfg)
+    # v1.9.1 I-2: protocol value alias — persists canonical form to DB
+    from dpworldapp_enums import PROTOCOL_ALIASES
+    p = result.get("protocol")
+    if isinstance(p, str) and p in PROTOCOL_ALIASES:
+        result["protocol"] = PROTOCOL_ALIASES[p]
+    for key, aliases in _INPUT_ALIASES_PROTOCOL.items():
+        v = result.get(key)
+        if isinstance(v, str) and v in aliases:
+            result[key] = aliases[v]
+    # v2: after alias map, lowercase any remaining two/four_byte_order strings
+    # (reader is case-insensitive; handles "BIG SWAP" → "big swap")
+    for bo_key in ("two_byte_order", "four_byte_order"):
+        v = result.get(bo_key)
+        if isinstance(v, str):
+            result[bo_key] = v.lower()
+    # v1.4.3: nested odo fields source alias
+    if "odo_speed" in result:
+        result["odo_speed"] = _normalize_odo_field(result["odo_speed"])
+    if "odo_direction" in result:
+        result["odo_direction"] = _normalize_odo_field(result["odo_direction"])
+    return result
diff --git a/src/firmware/__init__.py b/src/firmware/__init__.py
new file mode 100644
index 0000000..9bbd4ea
--- /dev/null
+++ b/src/firmware/__init__.py
@@ -0,0 +1 @@
+"""Firmware OTA module (merged from webconfig_fw, v1.5.0 Phase 4a)."""
diff --git a/src/firmware/config_safety.py b/src/firmware/config_safety.py
new file mode 100644
index 0000000..095332d
--- /dev/null
+++ b/src/firmware/config_safety.py
@@ -0,0 +1,216 @@
+"""Config backup + factory-default-reseed detection + restore (sqlite board_config)."""
+import json
+import os
+import shutil
+import sqlite3
+import time
+
+CONFIG_KEYS = ("device_config", "protocol_config")
+
+
+def _read(db_path, key):
+    con = sqlite3.connect(db_path, timeout=5.0)
+    try:
+        row = con.execute("SELECT value FROM board_config WHERE key=?", (key,)).fetchone()
+        return row[0] if row else None
+    finally:
+        con.close()
+
+
+def _write(db_path, key, value):
+    con = sqlite3.connect(db_path, timeout=5.0)
+    try:
+        con.execute(
+            "INSERT INTO board_config(key,value) VALUES(?,?) "
+            "ON CONFLICT(key) DO UPDATE SET value=excluded.value",
+            (key, value),
+        )
+        con.commit()
+    finally:
+        con.close()
+
+
+def _write_atomic(db_path, key_value_pairs):
+    """Write multiple board_config keys in a single SQLite transaction.
+
+    v1.5.4.4 STAB-1 fix: detect_and_restore가 device_config + protocol_config을
+    별도 connection / commit으로 write하던 결함을 차단. 단일 connection +
+    명시적 BEGIN IMMEDIATE로 두 키를 묶어 원자성을 보장 — 두 번째 write 실패 시
+    SQLite가 첫 번째 write도 rollback 처리. DBManager.update_config 패턴과 일관.
+
+    Args:
+        db_path: SQLite DB path.
+        key_value_pairs: iterable of (key, value) tuples. 빈 입력은 no-op.
+
+    Raises:
+        sqlite3.Error: 어느 한 write라도 실패하면 rollback 후 그대로 전파.
+    """
+    if not key_value_pairs:
+        return
+    con = sqlite3.connect(db_path, timeout=5.0, isolation_level=None)
+    try:
+        con.execute("BEGIN IMMEDIATE")
+        try:
+            for key, value in key_value_pairs:
+                con.execute(
+                    "INSERT INTO board_config(key,value) VALUES(?,?) "
+                    "ON CONFLICT(key) DO UPDATE SET value=excluded.value",
+                    (key, value),
+                )
+            con.execute("COMMIT")
+        except Exception:
+            try:
+                con.execute("ROLLBACK")
+            except sqlite3.Error:
+                pass
+            raise
+    finally:
+        con.close()
+
+
+def _coerce(v):
+    """Type-insensitive canonical form for comparing one config value.
+    Note: list comparison is order-sensitive by design — a reordered list
+    reads as a change, which fails safe toward no-restore.
+    bool check must come before int because bool is a subclass of int."""
+    if isinstance(v, bool):
+        return "true" if v else "false"
+    if isinstance(v, int):
+        return str(v)
+    if isinstance(v, float):
+        return str(int(v)) if v.is_integer() else repr(v)
+    if isinstance(v, (dict, list)):
+        return json.dumps(v, sort_keys=True, ensure_ascii=False)
+    if v is None:
+        return ""
+    return str(v).strip()
+
+
+def _as_dict(text):
+    if text is None:
+        return None
+    try:
+        d = json.loads(text)
+    except (ValueError, TypeError):
+        return None
+    return d if isinstance(d, dict) else None
+
+
+class ResetAssessment:
+    def __init__(self, is_reset, reason, reverted, user_changed, considered):
+        self.is_reset = is_reset
+        self.reason = reason
+        self.reverted = reverted          # keys reverted to factory default
+        self.user_changed = user_changed  # keys holding a genuinely new value
+        self.considered = considered      # user-distinguishing keys judged
+
+
+def assess_reset(current_value, backup_value, default_value):
+    """Field-level reseed detection. current/backup/default are JSON strings.
+
+    A "reseed" = the user's distinguishing fields were wholesale reverted to
+    factory defaults AND nothing looks like a genuine new edit (do-no-harm).
+    Robust to dpworldapp re-serializing the default differently than the file.
+    """
+    cur, bak, dft = _as_dict(current_value), _as_dict(backup_value), _as_dict(default_value)
+    if cur is None or bak is None or dft is None:
+        return ResetAssessment(False, "missing or invalid config json", [], [], [])
+    considered, reverted, user_changed = [], [], []
+    for k in (set(bak) & set(dft)):
+        bv, dv = _coerce(bak.get(k)), _coerce(dft.get(k))
+        if bv == dv:
+            continue  # not user-distinguishing (user value already equals default)
+        considered.append(k)
+        if k not in cur:
+            reverted.append(k)   # device dropped the key on reseed -> treat as reverted
+            continue
+        cv = _coerce(cur.get(k))
+        if cv == dv:
+            reverted.append(k)          # user value lost back to factory default
+        elif cv != bv:
+            user_changed.append(k)      # a genuinely new value (not backup, not default)
+        # else cv == bv -> user value preserved
+    n = len(considered)
+    is_reset = (
+        n >= 2
+        and len(user_changed) == 0
+        and len(reverted) >= max(2, (n * 4 + 4) // 5)  # >= ceil(0.8 * n), min 2
+    )
+    if is_reset:
+        reason = "reseed: %d/%d user fields reverted to factory default, 0 new edits" % (len(reverted), n)
+    else:
+        reason = "not a clean reseed (reverted=%d, user_changed=%d, considered=%d)" % (
+            len(reverted), len(user_changed), n)
+    return ResetAssessment(is_reset, reason, reverted, user_changed, considered)
+
+
+def backup_config(db_path, extra_files, out_dir, stamp=None):
+    stamp = stamp or time.strftime("%Y%m%d-%H%M%S")
+    dest = os.path.join(out_dir, stamp)
+    os.makedirs(dest, exist_ok=True)
+    saved = []
+    for key in CONFIG_KEYS:
+        val = _read(db_path, key)
+        if val is not None:
+            with open(os.path.join(dest, key + ".json"), "w", encoding="utf-8") as f:
+                f.write(val)
+            saved.append(key)
+    for fp in extra_files or []:
+        if os.path.isfile(fp):
+            shutil.copy2(fp, dest)
+    with open(os.path.join(dest, "manifest.json"), "w", encoding="utf-8") as f:
+        json.dump({"stamp": stamp, "keys": saved, "db": db_path}, f)
+    return dest
+
+
+def latest_backup(out_dir):
+    if not os.path.isdir(out_dir):
+        return None
+    subs = [os.path.join(out_dir, d) for d in os.listdir(out_dir)]
+    subs = [d for d in subs if os.path.isdir(d)]
+    return max(subs, key=os.path.getmtime, default=None)
+
+
+class RestoreResult:
+    def __init__(self, restored, reason, backup=None):
+        self.restored = restored
+        self.reason = reason
+        self.backup = backup
+
+
+def detect_and_restore(db_path, default_file_path, backups_dir):
+    current = _read(db_path, "device_config")
+    backup = latest_backup(backups_dir)
+    if backup is None:
+        return RestoreResult(False, "no backup available")
+    backup_file = os.path.join(backup, "device_config.json")
+    if not os.path.isfile(backup_file):
+        return RestoreResult(False, "backup has no device_config", backup)
+    with open(backup_file, "r", encoding="utf-8") as f:
+        backup_value = f.read()
+    if not os.path.isfile(default_file_path):
+        return RestoreResult(False, "default config file not found", backup)
+    with open(default_file_path, "r", encoding="utf-8") as f:
+        default_value = f.read()
+    assessment = assess_reset(current, backup_value, default_value)
+    if not assessment.is_reset:
+        return RestoreResult(False, assessment.reason, backup)
+    if _as_dict(backup_value) is None:
+        return RestoreResult(False, "backup JSON invalid", backup)
+    # Validate protocol_config BEFORE writing anything — prevent a half-write.
+    proto = os.path.join(backup, "protocol_config.json")
+    proto_value = None
+    if os.path.isfile(proto):
+        with open(proto, "r", encoding="utf-8") as f:
+            proto_value = f.read()
+        if _as_dict(proto_value) is None:
+            return RestoreResult(False, "backup protocol_config invalid", backup)
+    # Both validated — now write atomically.
+    # v1.5.4.4 STAB-1 fix: 이전엔 두 _write 호출이 별도 connection / commit이라
+    # 두 번째 write 실패 시 device_config만 복원된 zombie state가 발생할 수 있었다.
+    # 이제 단일 BEGIN IMMEDIATE transaction으로 묶어 atomicity 보장.
+    pairs = [("device_config", backup_value)]
+    if proto_value is not None:
+        pairs.append(("protocol_config", proto_value))
+    _write_atomic(db_path, pairs)
+    return RestoreResult(True, "restored from backup (%s)" % assessment.reason, backup)
diff --git a/src/firmware/fw_client.py b/src/firmware/fw_client.py
new file mode 100644
index 0000000..1a15a61
--- /dev/null
+++ b/src/firmware/fw_client.py
@@ -0,0 +1,124 @@
+"""Replay client: drives the dpworldapp FW-MMI channel exactly like DPWMMI."""
+import os
+import socket
+import time
+
+from . import protocol
+
+
+class StepResult:
+    def __init__(self, ok, signature, status, detail="", bytes_sent=0):
+        self.ok = ok
+        self.signature = signature
+        self.status = status  # success|failure|timeout|closed|error|success_pending|empty_file|socket_error
+        self.detail = detail
+        self.bytes_sent = bytes_sent
+
+
+class Outcome:
+    def __init__(self, ok, results, failed_step=None):
+        self.ok = ok
+        self.results = results
+        self.failed_step = failed_step
+
+
+class FirmwareStep:
+    def __init__(self, signature, path, ack_timeout_ms, is_message_only=False):
+        self.signature = signature
+        self.path = path
+        self.ack_timeout_ms = ack_timeout_ms
+        self.is_message_only = is_message_only
+
+
+def _read_ack(sock, timeout_ms):
+    end = time.monotonic() + timeout_ms / 1000.0
+    buf = bytearray()
+    while True:
+        remaining = end - time.monotonic()
+        if remaining <= 0:
+            return "timeout", buf.decode("ascii", "replace")
+        sock.settimeout(remaining)
+        try:
+            chunk = sock.recv(256)
+        except socket.timeout:
+            return "timeout", buf.decode("ascii", "replace")
+        except OSError:
+            return "closed", buf.decode("ascii", "replace")
+        if not chunk:
+            return "closed", buf.decode("ascii", "replace")
+        buf.extend(chunk)
+        text = buf.decode("ascii", "replace")
+        verdict = protocol.classify_ack(text)
+        if verdict in ("success", "failure"):
+            return verdict, text
+        # Buffer cap MUST run every iteration, before the 'unknown' continue,
+        # otherwise an endless stream of non-terminal bytes grows buf without
+        # bound (the cap was previously dead code after the continue).
+        if len(buf) > 65536:
+            return "error", text
+        # 'unknown' means the buffer hasn't yet accumulated a recognisable
+        # terminal token — keep reading (timeout / socket-close / buffer-cap
+        # are the only other exits from the loop).
+        if verdict == "unknown":
+            continue
+
+
+def send_file(sock, signature, path, ack_timeout_ms, progress_cb=None):
+    sock.setblocking(True)
+    size = os.path.getsize(path)
+    if size <= 0:
+        return StepResult(False, signature, "empty_file", "refusing to send 0-byte file: %s" % path, 0)
+    sent = 0
+    try:
+        sock.sendall(protocol.build_file_header(signature, size))
+        with open(path, "rb") as f:
+            while True:
+                chunk = f.read(protocol.CHUNK)
+                if not chunk:
+                    break
+                sock.sendall(chunk)
+                sent += len(chunk)
+                if progress_cb:
+                    progress_cb(signature, sent, size)
+    except OSError as e:
+        return StepResult(False, signature, "socket_error", str(e), sent)
+    status, detail = _read_ack(sock, ack_timeout_ms)
+    return StepResult(status == "success", signature, status, detail, sent)
+
+
+def send_message(sock, signature, ack_timeout_ms):
+    sock.setblocking(True)
+    try:
+        sock.sendall(protocol.build_message_frame(signature))
+    except OSError as e:
+        return StepResult(False, signature, "socket_error", str(e), 0)
+    status, detail = _read_ack(sock, ack_timeout_ms)
+    return StepResult(status == "success", signature, status, detail, 0)
+
+
+def run_update(host, port, steps, progress_cb=None, connect_timeout=10.0):
+    results = []
+    # Fix 4 (fw_client): initialise sock to None so the finally block's
+    # sock.close() call does not raise NameError when create_connection itself
+    # raises (e.g. connection refused / network unreachable).  Without this a
+    # real OSError is replaced by an unrelated NameError, masking the root cause.
+    sock = None
+    try:
+        sock = socket.create_connection((host, port), timeout=connect_timeout)
+        for step in steps:
+            if step.is_message_only:
+                r = send_message(sock, step.signature, step.ack_timeout_ms)
+            else:
+                r = send_file(sock, step.signature, step.path, step.ack_timeout_ms, progress_cb)
+            results.append(r)
+            if not r.ok:
+                # The CPU commit dropping the link is expected (device reboots).
+                if step.signature == protocol.COMMIT_SIGNATURE and r.status in ("closed", "timeout"):
+                    r.ok = True
+                    r.status = "success_pending"
+                    continue
+                return Outcome(False, results, failed_step=step.signature)
+    finally:
+        if sock is not None:
+            sock.close()
+    return Outcome(True, results)
diff --git a/src/firmware/fw_controller.py b/src/firmware/fw_controller.py
new file mode 100644
index 0000000..90f98ed
--- /dev/null
+++ b/src/firmware/fw_controller.py
@@ -0,0 +1,602 @@
+"""Stateful firmware-update orchestration for the production web UI.
+
+Wraps the *validated* dpw_fw_tool engine (fw_client / staging / config_safety /
+protocol) and exposes a single rich status dict that drives all of the UI's
+graphical state (stepper, per-component bars, preflight, reboot watchdog).
+
+Pure stdlib. Thread-safe. No change to the tested engine modules — this is a
+fresh orchestration layer so the standalone "v1" webui keeps passing its tests.
+
+Merge target: NEW_Web_Configurator/src/firmware/fw_controller.py
+"""
+import json
+import os
+import shlex
+import shutil
+import socket
+import subprocess
+import sys
+import threading
+import time
+import zipfile
+
+from firmware import config_safety, fw_client, protocol, staging
+
+# firmware component identification by file extension
+_EXT_TO_ROLE = {
+    ".rom": ("bootloader", "BTL"),
+    ".img": ("kernel", "KRN"),
+    ".ext4": ("rootfs", "RTF"),
+    ".dtb": ("dtb", "DTB"),
+}
+_ALL_SIGS = ("BTL", "KRN", "RTF", "DTB")
+_ORDER = {s: i for i, s in enumerate(_ALL_SIGS)}
+_MB = 1024 * 1024
+_SIDECAR = ".fw_build_dates.json"   # name -> {"sha256":..., "build_date":...} (survives restart/recovery)
+# zip-bomb / disk-fill guards (largest real component, rootfs, is ~0.9 GB)
+_MAX_FILE = 1200 * _MB              # per-component uncompressed cap
+_MAX_UNCOMPRESSED = 1536 * _MB      # total recognized-component uncompressed cap
+
+
+def _zip_build_date(info):
+    """Image build date from a ZIP entry's mtime. None if unset (epoch 1980)."""
+    dt = getattr(info, "date_time", None)
+    if not dt or dt[0] < 1981:
+        return None
+    return "%04d-%02d-%02d" % (dt[0], dt[1], dt[2])
+
+# Lifecycle phases shown in the UI stepper (order matters).
+_PHASES = [
+    ("upload", "Upload"),
+    ("verify", "Verify"),
+    ("preflight", "Pre-flight"),
+    ("backup", "Backup"),
+    ("flash", "Flash"),
+    ("commit", "Commit"),
+    ("reboot", "Reboot"),
+    ("config", "Config check"),
+]
+
+
+def _now():
+    """Monotonic seconds — safe for elapsed math (no wall-clock dependency)."""
+    return time.monotonic()
+
+
+class FirmwareController:
+    def __init__(self, fw_host="127.0.0.1", fw_port=8990,
+                 staging_dir="/opt/fw_staging", backups_dir="/opt/config_backups",
+                 db_path="/home/root/db/dynamic_data.db",
+                 default_file="/var/www/html/config_device.json",
+                 restart_cmd="systemctl restart dpworldapp.service",
+                 run_update=None):
+        # injectable flash runner (defaults to the real wire client) — lets the
+        # flash state machine be unit-tested without a device.
+        self._run_update = run_update or fw_client.run_update
+        # normalise restart_cmd to an argv list so it is always run without a
+        # shell (no injection surface), accepting either a string or a list.
+        restart_argv = (list(restart_cmd) if isinstance(restart_cmd, (list, tuple))
+                        else shlex.split(restart_cmd))
+        if not restart_argv or not all(isinstance(a, str) and a for a in restart_argv):
+            raise ValueError("restart_cmd must yield a non-empty list of non-empty strings")
+        self.cfg = dict(fw_host=fw_host, fw_port=fw_port, staging_dir=staging_dir,
+                        backups_dir=backups_dir, db_path=db_path,
+                        default_file=default_file, restart_cmd=restart_cmd,
+                        restart_argv=restart_argv)
+        self._lock = threading.RLock()
+        self._thread = None
+        self._components = []        # list of component dicts (with sent/pct/state)
+        self._phase_state = {}       # key -> 'pending'|'active'|'done'|'error'
+        self._phase_detail = {}      # key -> str
+        self._state = "idle"
+        self._message = ""
+        self._error = None
+        self._backup = None
+        self._slot = {"before": self._detect_slot(), "after": None}
+        self._t0 = None              # flash start (monotonic)
+        self._reset_phases()
+        # v1.5.2 B5 (M10/M15): defer _recover_staging to a background daemon thread so
+        # sha256 hash of large staged files does not block server startup on TCC8030.
+        threading.Thread(target=self._recover_staging, daemon=True).start()
+
+    # ---- internal helpers ----------------------------------------------
+    def _recover_staging(self):
+        """If staging_dir already holds recognized components (e.g. the service
+        was restarted after an upload), rebuild the staged component list so the
+        operator does not have to upload again. One-time sha256 cost on startup."""
+        sdir = self.cfg["staging_dir"]
+        if not os.path.isdir(sdir):
+            return
+        try:
+            with open(os.path.join(sdir, _SIDECAR)) as f:
+                build_dates = json.load(f)
+        except (OSError, ValueError):
+            build_dates = {}
+        found = []
+        for name in sorted(os.listdir(sdir)):
+            path = os.path.join(sdir, name)
+            if not os.path.isfile(path):
+                continue
+            ext = os.path.splitext(name)[1].lower()
+            if ext not in _EXT_TO_ROLE:
+                continue
+            role, sig = _EXT_TO_ROLE[ext]
+            try:
+                actual_sha = staging.sha256_of(path)
+            except OSError:
+                continue
+            # Fix 3: reject components whose on-disk sha256 does not match the
+            # recorded metadata — this catches partial/corrupt files left behind
+            # by a mid-extraction failure (disk-full, power-loss, etc.).  A
+            # component with no metadata entry at all is also rejected: we have
+            # no baseline to verify against so we cannot trust it.
+            meta = build_dates.get(name)  # build_dates loaded from sidecar above
+            if isinstance(meta, dict):
+                # New incremental sidecar format: {"sha256": "...", "build_date": "..."}
+                recorded_sha = meta.get("sha256")
+                build_date = meta.get("build_date")
+            else:
+                # Legacy sidecar format stored build_date string directly (or None).
+                # No sha256 was recorded — cannot verify; reject to be safe.
+                recorded_sha = None
+                build_date = meta  # may be a date string or None
+            if recorded_sha is None or actual_sha != recorded_sha:
+                # Partial / unverifiable file — do not accept it as staged.
+                # I-1: log so a rejection (legacy pre-v1.11.5 sidecar OR partial/corrupt
+                # file) is NOT silent — otherwise recovery yields an empty set with no
+                # explanation and the operator can't tell why a re-upload is needed.
+                reason = ("no recorded sha256 (legacy/partial sidecar)"
+                          if recorded_sha is None else "sha256 mismatch (partial/corrupt)")
+                sys.stderr.write(
+                    "[fw-recover] rejecting staged component %r: %s — re-upload required\n"
+                    % (name, reason))
+                # Remove it so it doesn't linger on disk.
+                try:
+                    os.remove(path)
+                except OSError:
+                    pass
+                continue
+            try:
+                found.append({"role": role, "signature": sig, "name": name,
+                              "path": path, "size": os.path.getsize(path),
+                              "sha256": actual_sha,
+                              "build_date": build_date,
+                              "sent": 0, "pct": 0, "state": "pending"})
+            except OSError:
+                continue
+        if not found:
+            return
+        found.sort(key=lambda c: _ORDER.get(c["signature"], 9))
+        with self._lock:
+            # v1.5.4.5 FW-1/CONC-2 fix: 신규 upload/flash 가 이미 진행 중이면 recovery
+            # 결과는 stale — silent skip. 이전엔 background daemon thread 의 _recover_staging
+            # 가 disk scan 동안 사용자가 신규 upload 를 시작해도 _components/_state 를
+            # stale recovery 값으로 덮어써 의도하지 않은 firmware 가 flash 될 path 존재.
+            if self._state != "idle":
+                return
+            self._components = found
+            self._state = "staged"
+            self._set_phase("upload", "done", "recovered %d staged components" % len(found))
+            self._set_phase("verify", "done", "sha256 verified")
+            self._message = "recovered %d staged components from disk" % len(found)
+
+    def _reset_phases(self):
+        self._phase_state = {k: "pending" for k, _ in _PHASES}
+        self._phase_detail = {k: "" for k, _ in _PHASES}
+
+    def _set_phase(self, key, state, detail=None):
+        with self._lock:
+            self._phase_state[key] = state
+            if detail is not None:
+                self._phase_detail[key] = detail
+
+    @staticmethod
+    def _tier_for(state):
+        return {"done": "ok", "active": "warn", "error": "error"}.get(state, "na")
+
+    def _detect_slot(self):
+        """Best-effort active A/B slot from the rootfs device (p5=A, p6=B)."""
+        try:
+            with open("/proc/cmdline") as f:
+                cmd = f.read()
+            for tok in cmd.split():
+                if tok.startswith("root="):
+                    dev = tok.split("=", 1)[1]
+                    if dev.endswith("p5") or dev.endswith("5"):
+                        return "A"
+                    if dev.endswith("p6") or dev.endswith("6"):
+                        return "B"
+                    return dev.rsplit("/", 1)[-1]
+        except OSError:
+            pass
+        return "?"
+
+    # ---- status snapshot ------------------------------------------------
+    def status(self):
+        with self._lock:
+            sent = sum(c["sent"] for c in self._components)
+            total = sum(c["size"] for c in self._components)
+            pct = (sent * 100 // total) if total else (100 if self._state == "done" else 0)
+            elapsed = (_now() - self._t0) if self._t0 else 0
+            active_sig = next((c["signature"] for c in self._components
+                               if c["state"] == "active"), None)
+            phases = [{
+                "key": k, "label": label,
+                "state": self._phase_state[k],
+                "tier": self._tier_for(self._phase_state[k]),
+                "detail": self._phase_detail[k],
+            } for k, label in _PHASES]
+            components = [{
+                "role": c["role"], "signature": c["signature"], "name": c["name"],
+                "size": c["size"], "sha256": c["sha256"],
+                "build_date": c.get("build_date"),
+                "sent": c["sent"], "pct": c["pct"], "state": c["state"],
+            } for c in self._components]
+            return {
+                "state": self._state,
+                "phases": phases,
+                "components": components,
+                "overall": {"sent": sent, "total": total, "pct": pct,
+                            "elapsed_s": round(elapsed, 1)},
+                "active_signature": active_sig,
+                "backup": self._backup,
+                "slot": dict(self._slot),
+                "message": self._message,
+                "error": self._error,
+            }
+
+    # ---- staging --------------------------------------------------------
+    def stage_zip(self, zip_path):
+        """Extract a firmware ZIP, auto-identify components by extension, stage
+        them. Returns the ordered component list (with sha256). Resets state.
+
+        v1.5.2 B1 (H4 TOCTOU fix): claim 'staging' state under lock before the
+        long extraction begins so concurrent upload calls are blocked immediately.
+        """
+        with self._lock:
+            # #33 fix: also block during 'rebooting' and 'done' — an upload while
+            # the device is rebooting (or just completed) can race the in-flight
+            # flash/commit lifecycle and clobber staged state.
+            if self._state in ("flashing", "staging", "rebooting", "done"):
+                raise RuntimeError("a flash or stage is in progress — cannot stage new firmware")
+            self._state = "staging"  # claim under lock; concurrent callers blocked at this check
+        try:
+            sdir = self.cfg["staging_dir"]
+            staging.clear(sdir)
+            os.makedirs(sdir, exist_ok=True)
+            found = []
+            build_dates = {}
+            total_uncompressed = 0
+            seen = set()
+            with zipfile.ZipFile(zip_path) as zf:
+                for info in zf.infolist():
+                    if info.is_dir():
+                        continue
+                    name = os.path.basename(info.filename)
+                    ext = os.path.splitext(name)[1].lower()
+                    if ext not in _EXT_TO_ROLE:
+                        continue
+                    role, sig = _EXT_TO_ROLE[ext]
+                    # I-3 collision guard: two recognized entries sharing a basename
+                    # would cause the second to silently overwrite the first on disk
+                    # while both are appended to `found` with the first entry's now-stale
+                    # sha256 → wrong-image flash / brick risk. Reject the archive before
+                    # any colliding write occurs.
+                    if name in seen:
+                        raise ValueError(
+                            "duplicate component file name in archive: %r" % name)
+                    seen.add(name)
+                    # zip-bomb guard: reject by declared size, cap actual bytes written,
+                    # and confirm free space before extracting.
+                    if info.file_size > _MAX_FILE:
+                        raise ValueError("component '%s' too large (%d bytes)" % (name, info.file_size))
+                    total_uncompressed += info.file_size
+                    if total_uncompressed > _MAX_UNCOMPRESSED:
+                        raise ValueError("archive uncompressed size exceeds %d bytes" % _MAX_UNCOMPRESSED)
+                    staging.check_free_space(sdir, info.file_size)
+                    dest = os.path.join(sdir, name)
+                    written = 0
+                    try:
+                        with zf.open(info) as src, open(dest, "wb") as out:
+                            while True:
+                                chunk = src.read(_MB)
+                                if not chunk:
+                                    break
+                                written += len(chunk)
+                                if written > _MAX_FILE:
+                                    raise ValueError("component '%s' exceeds size cap during extraction" % name)
+                                out.write(chunk)
+                    except Exception:
+                        # Fix 1: delete the partial dest file before propagating so
+                        # a disk-full / write-error mid-extraction never leaves a
+                        # truncated component that _recover_staging could pick up and
+                        # flash as if it were valid.
+                        try:
+                            os.remove(dest)
+                        except OSError:
+                            pass
+                        raise
+                    bd = _zip_build_date(info)
+                    if bd:
+                        build_dates[name] = bd
+                    sha = staging.sha256_of(dest)
+                    found.append({"role": role, "signature": sig, "name": name,
+                                  "path": dest, "size": os.path.getsize(dest),
+                                  "sha256": sha,
+                                  "build_date": bd,
+                                  "sent": 0, "pct": 0, "state": "pending"})
+                    # Fix 2: persist sidecar incrementally so each successfully
+                    # extracted component has its metadata (sha256 + build_date)
+                    # on disk immediately.  A mid-loop failure therefore never
+                    # leaves already-extracted files with no sidecar entry; the
+                    # subsequent _recover_staging sha256 check will match them.
+                    _sidecar_entry = {"sha256": sha}
+                    if bd:
+                        _sidecar_entry["build_date"] = bd
+                    try:
+                        _sidecar_path = os.path.join(sdir, _SIDECAR)
+                        try:
+                            with open(_sidecar_path) as _sf:
+                                _cur = json.load(_sf)
+                        except (OSError, ValueError):
+                            _cur = {}
+                        _cur[name] = _sidecar_entry
+                        with open(_sidecar_path, "w") as _sf:
+                            json.dump(_cur, _sf)
+                    except OSError as _e:
+                        # #27 fix: don't swallow silently — a missing sidecar entry
+                        # makes _recover_staging reject this component on restart.
+                        sys.stderr.write(
+                            "[fw-stage] WARNING: sidecar write failed for %r: %s — "
+                            "this component may be rejected on restart\n" % (name, _e))
+            if not found:
+                raise ValueError("no recognized firmware components in archive "
+                                 "(.rom/.img/.ext4/.dtb)")
+            found.sort(key=lambda c: _ORDER.get(c["signature"], 9))
+            missing = [s for s in _ALL_SIGS if s not in [c["signature"] for c in found]]
+            with self._lock:
+                self._components = found
+                self._state = "staged"
+                self._error = None
+                self._backup = None
+                self._t0 = None
+                self._reset_phases()
+                self._set_phase("upload", "done", "%d MB received" % (
+                    sum(c["size"] for c in found) // _MB))
+                self._set_phase("verify", "done", "sha256 computed for %d components" % len(found))
+                self._message = "staged %d components%s" % (
+                    len(found),
+                    "" if not missing else " (missing: %s)" % ",".join(missing))
+            return found
+        except Exception:
+            with self._lock:
+                self._state = "idle"
+            raise
+
+    # ---- preflight ------------------------------------------------------
+    def preflight(self):
+        """Return a gated checklist. `ok` is True only if all CRITICAL checks pass."""
+        checks = []
+
+        def add(key, label, ok, detail, critical=True):
+            checks.append({"key": key, "label": label, "pass": bool(ok),
+                           "tier": "ok" if ok else ("error" if critical else "warn"),
+                           "critical": critical, "detail": detail})
+
+        with self._lock:
+            comps = list(self._components)
+        n = len(comps)
+        add("staging", "Components staged", n > 0,
+            ("%d components: %s" % (n, ", ".join(c["signature"] for c in comps)))
+            if n else "no firmware uploaded yet")
+
+        # free-space headroom. The components are ALREADY staged on this fs, so we
+        # must NOT re-require their size (that double-counts — the bytes are
+        # already on disk). dpworldapp buffers the transfer in /tmp (tmpfs), not
+        # here, so only modest /opt headroom is needed for the pre-flash config
+        # backup + incidental writes.
+        headroom = 128 * _MB
+        try:
+            free = shutil.disk_usage(self.cfg["staging_dir"]).free
+            staged = sum(c["size"] for c in comps)
+            ok_space = free >= headroom
+            detail = ("%d MB free (%d MB already staged)" % (free // _MB, staged // _MB)
+                      if comps else "%d MB free" % (free // _MB))
+            add("space", "Free space (headroom)", ok_space, detail)
+        except OSError as e:
+            add("space", "Free space (headroom)", False, str(e))
+
+        # dpworldapp FW port reachable
+        ok_port, detail = self._probe_port(self.cfg["fw_host"], self.cfg["fw_port"])
+        add("fw_port", "dpworldapp FW port %d" % self.cfg["fw_port"], ok_port, detail)
+
+        # config DB present (non-critical: flash works, restore-check needs it)
+        db_ok = os.path.isfile(self.cfg["db_path"])
+        add("db", "Config DB present", db_ok,
+            self.cfg["db_path"] if db_ok else "%s not found" % self.cfg["db_path"],
+            critical=False)
+
+        # active slot (informational)
+        slot = self._detect_slot()
+        add("slot", "Active slot", True, "system_%s" % slot.lower()
+            if slot in ("A", "B") else slot, critical=False)
+
+        ok = all(c["pass"] for c in checks if c["critical"])
+        with self._lock:
+            self._set_phase("preflight", "done" if ok else "error",
+                            "all checks pass" if ok else "blocked")
+        return {"ok": ok, "checks": checks}
+
+    @staticmethod
+    def _probe_port(host, port, timeout=2.0):
+        try:
+            with socket.create_connection((host, port), timeout=timeout):
+                return True, "reachable"
+        except OSError as e:
+            return False, "unreachable (%s)" % e.__class__.__name__
+
+    # ---- flash ----------------------------------------------------------
+    def _flash_worker(self, components):
+        try:
+            with self._lock:
+                self._t0 = _now()
+                self._state = "flashing"
+                self._message = "backing up config before flash"
+            self._set_phase("backup", "active", "backing up config")
+            backup = config_safety.backup_config(self.cfg["db_path"], [],
+                                                  self.cfg["backups_dir"])
+            with self._lock:
+                self._backup = {"path": backup, "when": _readable_dirname(backup)}
+            self._set_phase("backup", "done", "saved")
+
+            steps = [fw_client.FirmwareStep(c["signature"], c["path"],
+                                            protocol.TIMEOUTS_MS[c["signature"]])
+                     for c in components]
+            steps.append(fw_client.FirmwareStep(
+                protocol.COMMIT_SIGNATURE, None,
+                protocol.TIMEOUTS_MS["CPU"], is_message_only=True))
+
+            with self._lock:
+                self._message = "flashing"
+            self._set_phase("flash", "active", "transferring components")
+
+            def progress(sig, sent, total):
+                # send_message (CPU commit) never calls this — commit start is
+                # detected when the LAST file component reaches 100%.
+                with self._lock:
+                    comps = self._components
+                    for i, c in enumerate(comps):
+                        if c["signature"] != sig:
+                            continue
+                        c["sent"] = sent
+                        c["pct"] = (sent * 100 // total) if total else 100
+                        c["state"] = "done" if c["pct"] >= 100 else "active"
+                        # defensively mark earlier components done
+                        for prev in comps[:i]:
+                            if prev["state"] != "done":
+                                prev["state"], prev["sent"], prev["pct"] = "done", prev["size"], 100
+                        # last component fully sent → commit/write begins
+                        if i == len(comps) - 1 and c["pct"] >= 100:
+                            self._set_phase("flash", "done", "all components sent")
+                            self._set_phase("commit", "active", "device writing slot & committing")
+                        break
+
+            outcome = self._run_update(self.cfg["fw_host"], self.cfg["fw_port"],
+                                       steps, progress)
+            with self._lock:
+                for c in self._components:
+                    if outcome.ok:
+                        c["state"], c["sent"], c["pct"] = "done", c["size"], 100
+            if outcome.ok:
+                self._set_phase("commit", "done", "slot committed")
+                self._set_phase("reboot", "active", "device reboots in ~10s")
+                # firmware is now committed to the slot → free the staging space
+                freed = self._clear_staging()
+                with self._lock:
+                    self._state = "rebooting"
+                    self._set_phase("flash", "done",
+                                    "components sent · staging freed" if freed
+                                    else "components sent (staging cleanup failed — free /opt manually)")
+                    self._slot["after"] = "B" if self._slot["before"] == "A" else (
+                        "A" if self._slot["before"] == "B" else "?")
+                    self._message = ("flash OK — device reboots now. Reconnect after "
+                                     "~1 min, then run Config check.")
+            else:
+                self._set_phase("flash", "error", "failed at %s" % outcome.failed_step)
+                with self._lock:
+                    self._state = "failed"
+                    self._error = "flash FAILED at step %s" % outcome.failed_step
+                    self._message = self._error
+        except Exception as e:  # noqa: BLE001 — surface any failure to the UI
+            with self._lock:
+                self._state = "failed"
+                self._error = "%s: %s" % (e.__class__.__name__, e)
+                self._message = self._error
+                # mark whichever phase was active as errored
+                for k in ("backup", "flash", "commit"):
+                    if self._phase_state.get(k) == "active":
+                        self._phase_state[k] = "error"
+
+    def start_flash(self):
+        with self._lock:
+            if self._state in ('flashing', 'staging', 'rebooting', 'done'):
+                raise RuntimeError(
+                    "Cannot flash in state '%s'" % self._state)
+            comps = list(self._components)
+            if not comps:
+                raise RuntimeError("no staged components — upload a firmware ZIP first")
+            # #12 fix: reset phases so a retry after a prior failed attempt starts
+            # clean — residual 'error' phases from the previous run must not linger.
+            self._reset_phases()
+            self._state = "flashing"
+            self._error = None
+        self._thread = threading.Thread(target=self._flash_worker, args=(comps,),
+                                        daemon=True)
+        self._thread.start()
+
+    def _clear_staging(self):
+        """Remove staged firmware from disk to reclaim space after a successful
+        commit (the firmware is already written to the slot). Returns True on
+        success. Config backups (a separate dir) are intentionally kept."""
+        try:
+            staging.clear(self.cfg["staging_dir"])
+            return True
+        except OSError:
+            return False
+
+    # ---- post-reboot config restore ------------------------------------
+    def restore_check(self, restart=True):
+        self._set_phase("config", "active", "checking config")
+        try:
+            r = config_safety.detect_and_restore(self.cfg["db_path"],
+                                                 self.cfg["default_file"],
+                                                 self.cfg["backups_dir"])
+        except Exception as e:  # noqa: BLE001 — missing/locked/empty DB must not 500
+            reason = "config DB not readable: %s" % e
+            self._set_phase("config", "error", "DB unreadable")
+            return {"restored": False, "reason": reason,
+                    "dpworldapp_restarted": False, "error": reason}
+        result = {"restored": r.restored, "reason": r.reason,
+                  "dpworldapp_restarted": False}
+        if r.restored and restart:
+            try:
+                # v1.5.4.5 STAB-2 fix: check=True so non-zero returncode raises
+                # CalledProcessError → except branch sets restart_error. 이전 check=False
+                # 패턴은 systemctl restart dpworldapp 실패 (returncode != 0) 시에도 except
+                # 진입 안 함 → result["dpworldapp_restarted"]=True 로 silent lie 가능.
+                # 이제 어떤 실패 (CalledProcessError / TimeoutExpired / OSError) 든 except
+                # 통합 처리 후 restart_error 명시.
+                subprocess.run(self.cfg["restart_argv"], timeout=30,
+                               check=True, stdout=subprocess.DEVNULL,
+                               stderr=subprocess.DEVNULL)
+                result["dpworldapp_restarted"] = True
+            except Exception as e:  # noqa: BLE001
+                result["restart_error"] = str(e)
+        # #6 fix: if the restart command FAILED, the phase detail + _message must
+        # report the failure — never claim 'dpworldapp restarted'. The flash
+        # itself succeeded so state may still go 'done'; only the restart sub-step
+        # is reported failed (honesty: no green for an unverified restart).
+        restart_failed = bool(result.get("restart_error"))
+        with self._lock:
+            if r.restored and restart and restart_failed:
+                config_detail = ("config restored but dpworldapp restart FAILED: %s"
+                                 % result["restart_error"])
+            else:
+                config_detail = ("restored from backup" if r.restored
+                                 else "config preserved")
+            self._set_phase("config", "done", config_detail)
+            if self._state == "rebooting":
+                self._state = "done"
+                if r.restored and restart and restart_failed:
+                    self._message = ("config restored but dpworldapp restart FAILED: %s"
+                                     % result["restart_error"])
+                else:
+                    self._message = ("config restored & dpworldapp restarted"
+                                     if r.restored else "update complete — config preserved")
+        return result
+
+
+def _readable_dirname(path):
+    """Backup paths look like /opt/config_backups/20260601-190437 — return the stamp."""
+    base = os.path.basename(path.rstrip("/")) if path else ""
+    return base or path
diff --git a/src/firmware/fw_routes.py b/src/firmware/fw_routes.py
new file mode 100644
index 0000000..fbbd084
--- /dev/null
+++ b/src/firmware/fw_routes.py
@@ -0,0 +1,135 @@
+"""Firmware HTTP routes — thin glue between the web server and the controller.
+
+Kept transport-agnostic and side-effect-free except through the controller so the
+SAME class drives both `server_standalone.py` (now) and NEW_Web_Configurator's
+`server.py` (after merge). Each method returns a plain dict; the server is
+responsible for JSON encoding and status codes via RouteError.
+
+Merge target: fold these handlers into src/server.py's do_GET/do_POST routing.
+"""
+import os
+import shutil
+import sys
+import tempfile
+import traceback
+
+_MB = 1024 * 1024
+# 1.5 GB ceiling: the full firmware set is ~0.9 GB. The upload is buffered in
+# the caller-provided tmp_dir (must be a persistent disk filesystem such as /opt,
+# NEVER a RAM-backed tmpfs): the service runs under systemd MemoryMax=48M with
+# no swap, and tmpfs pages are unreclaimable shmem charged to the cgroup, so
+# buffering a multi-hundred-MB package on /tmp OOM-kills the service mid-upload.
+# Disk writes go through reclaimable page cache and do not trigger the OOM killer.
+_MAX_UPLOAD = 1536 * _MB
+_FREE_MARGIN = 64 * _MB  # headroom beyond the declared upload size
+
+
+class RouteError(Exception):
+    """Carries an HTTP status so the server can map it without guessing."""
+    def __init__(self, status, message):
+        super().__init__(message)
+        self.status = status
+        self.message = message
+
+
+class FirmwareRoutes:
+    def __init__(self, controller, tmp_dir=None):
+        self.fw = controller
+        self.tmp_dir = tmp_dir or tempfile.gettempdir()
+
+    # ---- GET -----------------------------------------------------------
+    def status(self):
+        return self.fw.status()
+
+    # ---- POST (no body) ------------------------------------------------
+    def preflight(self):
+        return self.fw.preflight()
+
+    def flash(self):
+        try:
+            self.fw.start_flash()
+        except RuntimeError as e:
+            raise RouteError(409, str(e))
+        return {"ok": True}
+
+    def restore_check(self):
+        return {"ok": True, "result": self.fw.restore_check()}
+
+    # ---- POST (streamed ZIP body) --------------------------------------
+    def upload(self, rfile, content_length):
+        """Stream the request body (a firmware ZIP) to a private temp file in
+        1 MB chunks, hand it to the controller for extraction, then delete it.
+
+        A per-request temp name (mkstemp) is required: ThreadingHTTPServer can
+        run uploads concurrently and a shared fixed filename would corrupt
+        in-flight transfers."""
+        try:
+            n = int(content_length)
+        except (TypeError, ValueError):
+            raise RouteError(400, "invalid or missing Content-Length")
+        if n <= 0:
+            raise RouteError(400, "empty upload")
+        if n > _MAX_UPLOAD:
+            raise RouteError(413, "upload too large (%d bytes, max %d)" % (n, _MAX_UPLOAD))
+        # The full ZIP must be buffered to tmp_dir before stage_zip can open it (a ZIP's
+        # central directory is at the end, so extraction needs the whole file). tmp_dir
+        # MUST be a disk-backed filesystem (e.g. /opt), NEVER tmpfs/RAM: the service runs
+        # under systemd MemoryMax=48M with no swap, and tmpfs pages are unreclaimable
+        # shmem charged to the cgroup, so buffering a multi-hundred-MB package on /tmp
+        # OOM-kills the service mid-upload. Disk writes go through reclaimable page cache.
+        try:
+            os.makedirs(self.tmp_dir, exist_ok=True)
+            free = shutil.disk_usage(self.tmp_dir).free
+        except OSError:
+            sys.stderr.write("[fw-routes] upload staging area unavailable:\n" + traceback.format_exc())
+            raise RouteError(507, "upload staging area is unavailable")
+        if free < n + _FREE_MARGIN:
+            # fail fast with a clean, path-free 507 instead of buffering then dying ENOSPC
+            raise RouteError(507, "not enough free space to buffer the upload "
+                                  "(need %d bytes, have %d)" % (n + _FREE_MARGIN, free))
+        fd, tmp = tempfile.mkstemp(dir=self.tmp_dir, prefix="dpw_fw_", suffix=".zip")
+        try:
+            f = os.fdopen(fd, "wb")     # f now owns the fd
+        except BaseException:
+            os.close(fd)               # fdopen failed → close the orphaned fd
+            try:
+                os.remove(tmp)
+            except OSError:
+                pass
+            raise
+        remaining = n
+        try:
+            try:
+                with f:
+                    while remaining > 0:
+                        chunk = rfile.read(min(_MB, remaining))
+                        if not chunk:
+                            break
+                        f.write(chunk)
+                        remaining -= len(chunk)
+            except OSError:
+                # disk-full / write error while buffering — sanitized, path-free 507.
+                sys.stderr.write("[fw-routes] upload buffering failed:\n" + traceback.format_exc())
+                raise RouteError(507, "not enough free space to buffer the upload")
+            if remaining > 0:
+                raise RouteError(400, "upload truncated (%d bytes missing)" % remaining)
+            try:
+                comps = self.fw.stage_zip(tmp)
+            except ValueError as e:
+                raise RouteError(400, str(e))
+            except RuntimeError as e:  # flash in progress
+                raise RouteError(409, str(e))
+            except OSError:            # e.g. insufficient space — message carries a path
+                sys.stderr.write("[fw-routes] staging failed:\n" + traceback.format_exc())
+                raise RouteError(507, "not enough free space to stage the firmware")
+            except Exception:          # bad zip / unexpected — never echo internals to client
+                sys.stderr.write("[fw-routes] stage_zip failed:\n" + traceback.format_exc())
+                raise RouteError(400, "could not process the firmware archive")
+        finally:
+            try:
+                os.remove(tmp)
+            except OSError:
+                pass
+        view = [{k: c.get(k) for k in ("role", "signature", "name", "size", "sha256", "build_date")}
+                for c in comps]
+        return {"ok": True, "components": view}
diff --git a/src/firmware/protocol.py b/src/firmware/protocol.py
new file mode 100644
index 0000000..81cf361
--- /dev/null
+++ b/src/firmware/protocol.py
@@ -0,0 +1,64 @@
+"""Pure wire protocol for the dpworldapp FW-MMI channel (port 8990).
+
+Frame = ASCII(signature) + 8-byte little-endian size + <size> payload bytes.
+A message-only step is the same frame with size 0 and no payload.
+
+ACK tokens confirmed from deployed firmware behavior:
+  success -> device sends exactly "SUCCESS"  (7 bytes)
+  failure -> device sends exactly "FW_FAIL"  (7 bytes)
+Wire framing confirmed: 3-byte ASCII signature + 8-byte little-endian size + body.
+COMPLETE_ACK is kept as a harmless legacy accept (never sent by the real device).
+"""
+import struct
+
+CHUNK = 8192
+
+# component name -> 3-char signature used on the wire (matches DPWMMI C# tool)
+SIGNATURES = {"bootloader": "BTL", "kernel": "KRN", "rootfs": "RTF", "dtb": "DTB"}
+COMMIT_SIGNATURE = "CPU"
+
+# per-step ACK timeouts in ms, identical to DPWMMI
+TIMEOUTS_MS = {"BTL": 20000, "KRN": 20000, "RTF": 20000, "DTB": 10000, "CPU": 120000}
+
+
+def build_file_header(signature, size):
+    if size < 0:
+        raise ValueError("size must be non-negative")
+    return signature.encode("ascii") + struct.pack("<q", size)
+
+
+def build_message_frame(message):
+    return message.encode("ascii") + struct.pack("<q", 0)
+
+
+_FAILURE_TOKENS = ("FAIL", "ERROR", "REJECT")
+
+
+def _contains_token(haystack, token):
+    """Whole-token match: token bounded by non-alphanumeric, non-underscore chars."""
+    i = 0
+    while True:
+        i = haystack.find(token, i)
+        if i < 0:
+            return False
+        left_ok = i == 0 or not (haystack[i - 1].isalnum() or haystack[i - 1] == "_")
+        end = i + len(token)
+        right_ok = end >= len(haystack) or not (haystack[end].isalnum() or haystack[end] == "_")
+        if left_ok and right_ok:
+            return True
+        i = end
+
+
+def classify_ack(text):
+    """Return 'success', 'failure', or 'unknown'.
+
+    Device (src/firmware_manager.c) sends exactly "SUCCESS" on success and
+    "FW_FAIL" on failure. We also keep generic fallbacks. Success is checked
+    first so a frame carrying both is treated as success.
+    """
+    upper = text.upper()
+    if "SUCCESS" in upper or "COMPLETE_ACK" in upper:
+        return "success"
+    if "FW_FAIL" in upper or any(_contains_token(upper, t) for t in _FAILURE_TOKENS):
+        return "failure"
+    return "unknown"
diff --git a/src/firmware/staging.py b/src/firmware/staging.py
new file mode 100644
index 0000000..78f74f4
--- /dev/null
+++ b/src/firmware/staging.py
@@ -0,0 +1,61 @@
+"""Stage firmware files to a persistent dir (e.g. /opt/fw_staging) with hashing."""
+import hashlib
+import os
+import shutil
+
+_MB = 1024 * 1024
+
+
+class StagedFile:
+    def __init__(self, path, size, sha256):
+        self.path = path
+        self.size = size
+        self.sha256 = sha256
+
+
+def sha256_of(path):
+    h = hashlib.sha256()
+    with open(path, "rb") as f:
+        for chunk in iter(lambda: f.read(_MB), b""):
+            h.update(chunk)
+    return h.hexdigest()
+
+
+def check_free_space(dest_dir, required_bytes, margin=64 * _MB):
+    os.makedirs(dest_dir, exist_ok=True)
+    free = shutil.disk_usage(dest_dir).free
+    if free < required_bytes + margin:
+        raise OSError(
+            "insufficient space in %s: need %d, have %d"
+            % (dest_dir, required_bytes + margin, free)
+        )
+
+
+def stage(component, src_path, dest_dir):
+    os.makedirs(dest_dir, exist_ok=True)
+    size = os.path.getsize(src_path)
+    check_free_space(dest_dir, size)
+    dest = os.path.join(dest_dir, component)
+    with open(src_path, "rb") as r, open(dest, "wb") as w:
+        for chunk in iter(lambda: r.read(_MB), b""):
+            w.write(chunk)
+    return StagedFile(dest, os.path.getsize(dest), sha256_of(dest))
+
+
+def clear(dest_dir):
+    """Empty the staging dir's CONTENTS, keeping the directory itself.
+
+    Removing/recreating dest_dir (the old shutil.rmtree(dest_dir)) requires WRITE
+    on its PARENT, which systemd ProtectSystem=strict denies: only dest_dir (the
+    leaf) is in ReadWritePaths, not its parent /opt → the rmtree raised
+    OSError(EROFS). Deleting only the entries inside dest_dir needs write on
+    dest_dir alone, which IS granted, and leaves the directory (and its RW
+    bind-mount) intact for the subsequent re-stage."""
+    if not os.path.isdir(dest_dir):
+        return
+    for name in os.listdir(dest_dir):
+        p = os.path.join(dest_dir, name)
+        if os.path.islink(p) or os.path.isfile(p):
+            os.remove(p)
+        elif os.path.isdir(p):
+            shutil.rmtree(p)
diff --git a/src/kernel_log.py b/src/kernel_log.py
new file mode 100644
index 0000000..c876f3e
--- /dev/null
+++ b/src/kernel_log.py
@@ -0,0 +1,285 @@
+"""Kernel log bundle — produces a .tar.gz of all kernel-related logs.
+
+Sources:
+  - systemd journal (kernel-only and full) exported as TEXT via journalctl
+  - /opt/log/kernel-follow.log, /opt/log/wifi-focus.log, /opt/log/.current_boot_id
+  - /opt/log/boot-history/ (recursive)
+  - /opt/log/pstore/ (recursive)
+
+The journald directory /opt/log/journal/ is read-only to this module: never
+delete or modify *.journal binary files; we export to text instead.
+
+v1.4.6.9 H14: Temp workspace uses /tmp (per-service PrivateTmp tmpfs slice — isolated +
+writable under ProtectSystem=strict, where /opt/log parent is NOT in ReadWritePaths).
+Previous "/opt/log default" caused PermissionError on hardened systemd. Override with
+KERNEL_BUNDLE_TEMP_PARENT env var if a disk-backed location is required.
+"""
+from __future__ import annotations
+
+import logging
+import os
+import shutil
+import socket
+import subprocess
+import tarfile
+import tempfile
+from datetime import datetime
+
+log = logging.getLogger(__name__)
+
+OPT_LOG_DIR = os.environ.get("OPT_LOG_DIR", "/opt/log")
+# v1.4.6.9 H14: same systemd ProtectSystem=strict + ReadWritePaths whitelist gap that
+# v1.4.6.6 fixed for log_manager._DOWNLOAD_TEMP_PARENT. /opt/log parent is NOT writable
+# from the python3 process — mkdtemp raises PermissionError. PrivateTmp=yes makes /tmp a
+# per-service tmpfs slice (~1.7GB on .56) — safe and isolated.
+TEMP_PARENT = os.environ.get("KERNEL_BUNDLE_TEMP_PARENT", "/tmp")
+EXPORT_BYTE_CAP = int(os.environ.get("KERNEL_BUNDLE_EXPORT_CAP", str(64 * 1024 * 1024)))
+TEMP_DIR_PREFIX = "kernel-bundle-"
+JOURNALCTL_CMD = os.environ.get("JOURNALCTL_CMD") or shutil.which("journalctl")
+
+
+def _tree_size(root: str) -> int:
+    total = 0
+    for dirpath, _dirs, files in os.walk(root):
+        for f in files:
+            try:
+                total += os.path.getsize(os.path.join(dirpath, f))
+            except OSError:
+                pass
+    return total
+
+
+def _copy_source(src_path: str, dest_parent: str):
+    """Copy src_path (file or dir) under dest_parent.
+
+    Returns (included: bool, size_bytes: int, reason_if_skipped: str).
+    """
+    if not os.path.exists(src_path):
+        return False, 0, "not found"
+    try:
+        if os.path.isdir(src_path):
+            target = os.path.join(dest_parent, os.path.basename(src_path.rstrip("/")))
+            shutil.copytree(src_path, target)
+            return True, _tree_size(target), ""
+        target = os.path.join(dest_parent, os.path.basename(src_path))
+        shutil.copy2(src_path, target)
+        return True, os.path.getsize(target), ""
+    except OSError as exc:
+        return False, 0, f"copy error: {exc}"
+
+
+_TRUNCATION_MARKER = "[TRUNCATED — exceeded {cap} bytes]\n"
+_ABSENT_MARKER = "[journalctl unavailable: {reason}]\n"
+
+
+def _run_journalctl(journalctl_cmd, args, dest_path: str, cap: int):
+    """Run journalctl with args, stream stdout to dest_path, halt at cap bytes.
+
+    Returns (success: bool, bytes_written: int, truncated: bool).
+    """
+    if not journalctl_cmd:
+        with open(dest_path, "w", encoding="utf-8") as f:
+            f.write(_ABSENT_MARKER.format(reason="journalctl not found"))
+        return False, 0, False
+    return _run_journalctl_with([journalctl_cmd] + list(args), dest_path, cap)
+
+
+def _run_journalctl_with(cmd_list, dest_path: str, cap: int):
+    """Launch cmd_list and stream stdout to dest_path, capped at `cap` bytes."""
+    try:
+        proc = subprocess.Popen(
+            cmd_list,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.DEVNULL,
+        )
+    except OSError as exc:
+        with open(dest_path, "w", encoding="utf-8") as f:
+            f.write(_ABSENT_MARKER.format(reason=f"spawn failed: {exc}"))
+        return False, 0, False
+
+    truncated = False
+    written = 0
+    try:
+        with open(dest_path, "wb") as out:
+            while True:
+                chunk = proc.stdout.read(64 * 1024)
+                if not chunk:
+                    break
+                remaining = cap - written
+                if remaining <= 0:
+                    truncated = True
+                    proc.kill()
+                    break
+                if len(chunk) > remaining:
+                    out.write(chunk[:remaining])
+                    written += remaining
+                    truncated = True
+                    proc.kill()
+                    break
+                out.write(chunk)
+                written += len(chunk)
+    except OSError as exc:
+        # #25 fix: only an I/O error in the stream loop is a real failure. (The
+        # proc.wait timeout below is handled separately so it cannot misreport a
+        # fully-written, closed file as failed.)
+        try:
+            proc.kill()
+        except Exception:
+            pass
+        try:
+            with open(dest_path, "a", encoding="utf-8") as f:
+                f.write(f"\n[journalctl stream error: {exc}]\n")
+        except OSError:
+            pass  # best-effort; don't let error-in-error escape
+        return False, written, truncated
+    finally:
+        # Ensure the stdout pipe FD is always released, regardless of exit path.
+        try:
+            proc.stdout.close()
+        except Exception:
+            pass
+
+    # #25 fix: reap the process in its OWN try/except. The output is already
+    # fully written and the dest file is closed, so a wait timeout here must NOT
+    # be reported as failure — just kill the lingering process and keep success.
+    try:
+        proc.wait(timeout=5)
+    except subprocess.TimeoutExpired:
+        try:
+            proc.kill()
+        except Exception:
+            pass
+        try:
+            proc.wait(timeout=1)
+        except Exception:
+            pass
+
+    if truncated:
+        with open(dest_path, "a", encoding="utf-8") as f:
+            f.write(_TRUNCATION_MARKER.format(cap=cap))
+
+    return True, written, truncated
+
+
+_KERNEL_LOG_NAME = "kernel.log"
+_FULL_JOURNAL_NAME = "full-journal.log"
+
+
+def _journalctl_version(journalctl_cmd) -> str:
+    if not journalctl_cmd:
+        return "unavailable"
+    try:
+        out = subprocess.run(
+            [journalctl_cmd, "--version"],
+            capture_output=True, text=True, timeout=5,
+        )
+        first = out.stdout.splitlines()[0] if out.stdout else ""
+        return first or "unknown"
+    except (OSError, subprocess.SubprocessError):
+        return "error"
+
+
+def _write_manifest(dest_path: str, entries, journalctl_version: str, hostname: str):
+    lines = [
+        "kernel-log-bundle manifest",
+        f"generated:           {datetime.utcnow().isoformat()}Z",
+        f"hostname:            {hostname}",
+        f"journalctl version:  {journalctl_version}",
+        "",
+        "Entries:",
+    ]
+    for e in entries:
+        status = "included" if e["included"] else f"skipped ({e['reason']})"
+        extra = " [TRUNCATED]" if e.get("truncated") else ""
+        lines.append(f"  - {e['name']:<22} {status}  size={e['size']}B{extra}")
+    with open(dest_path, "w", encoding="utf-8") as f:
+        f.write("\n".join(lines) + "\n")
+
+
+def build_kernel_bundle() -> str:
+    """Build the kernel-log .tar.gz; return absolute path.
+
+    Caller is responsible for removing the containing temp dir
+    (os.path.dirname(returned_path)) after streaming.
+    """
+    hostname = socket.gethostname()
+    ts = datetime.utcnow().strftime("%Y%m%d-%H%M%S")
+    os.makedirs(TEMP_PARENT, exist_ok=True)
+    workspace = tempfile.mkdtemp(prefix=TEMP_DIR_PREFIX, dir=TEMP_PARENT)
+    try:
+        staging = os.path.join(workspace, "staging")
+        os.makedirs(staging, exist_ok=True)
+
+        entries = []
+
+        # journalctl exports
+        for args, name in (
+            (["-k", "--no-pager"], _KERNEL_LOG_NAME),
+            (["--no-pager"],       _FULL_JOURNAL_NAME),
+        ):
+            dest = os.path.join(staging, name)
+            ok, _written, truncated = _run_journalctl(JOURNALCTL_CMD, args, dest, EXPORT_BYTE_CAP)
+            entries.append({
+                "name": name,
+                "included": True,  # the file is always written, even if it just contains the absent marker
+                "reason": "" if ok else "journalctl unavailable",
+                "size": os.path.getsize(dest) if os.path.exists(dest) else 0,
+                "truncated": truncated,
+            })
+
+        # Plain sources from OPT_LOG_DIR. Tuple is (src_name_in_opt_log, dest_name_in_bundle).
+        plain_sources = [
+            ("kernel-follow.log",  "kernel-follow.log"),
+            ("wifi-focus.log",     "wifi-focus.log"),
+            (".current_boot_id",   "current_boot_id.txt"),
+            ("boot-history",       "boot-history"),
+            ("pstore",             "pstore"),
+        ]
+        for src_name, dest_name in plain_sources:
+            src_path = os.path.join(OPT_LOG_DIR, src_name)
+            included, size, reason = _copy_source(src_path, staging)
+            if included and src_name != dest_name:
+                try:
+                    os.rename(os.path.join(staging, src_name), os.path.join(staging, dest_name))
+                except OSError as exc:
+                    reason = f"rename failed: {exc}"
+                    included = False
+            entries.append({
+                "name": dest_name, "included": included, "reason": reason,
+                "size": size, "truncated": False,
+            })
+
+        _write_manifest(
+            os.path.join(staging, "bundle-info.txt"),
+            entries, _journalctl_version(JOURNALCTL_CMD), hostname,
+        )
+
+        tar_name = f"kernel-logs_{hostname}_{ts}.tar.gz"
+        tar_path = os.path.join(workspace, tar_name)
+        with tarfile.open(tar_path, "w:gz") as tf:
+            for entry in sorted(os.listdir(staging)):
+                tf.add(os.path.join(staging, entry), arcname=entry)
+        shutil.rmtree(staging, ignore_errors=True)
+        return tar_path
+    except Exception:
+        shutil.rmtree(workspace, ignore_errors=True)
+        raise
+
+
+def sweep_stale_temp_dirs() -> int:
+    """Remove leftover kernel-bundle-* dirs under TEMP_PARENT. Returns count removed."""
+    if not os.path.isdir(TEMP_PARENT):
+        return 0
+    removed = 0
+    for name in os.listdir(TEMP_PARENT):
+        if not name.startswith(TEMP_DIR_PREFIX):
+            continue
+        path = os.path.join(TEMP_PARENT, name)
+        if not os.path.isdir(path):
+            continue
+        try:
+            shutil.rmtree(path)
+            removed += 1
+        except OSError as exc:
+            log.warning("sweep_stale_temp_dirs: failed to remove %s: %s", path, exc)
+    return removed
diff --git a/src/log_manager.py b/src/log_manager.py
new file mode 100644
index 0000000..35b4b41
--- /dev/null
+++ b/src/log_manager.py
@@ -0,0 +1,691 @@
+"""
+log_manager.py — Log File Management Module
+
+Provides log file listing, secure download archive creation,
+and automatic compression for /opt/log/dpworldapp.
+"""
+
+import os
+import re
+import tarfile
+import tempfile
+import time
+import shutil
+import threading
+import logging
+
+LOG_DIR = os.environ.get("LOG_DIR", "/opt/log/dpworldapp")
+# v1.4.6.6: systemd ProtectSystem=strict + ReadWritePaths 화이트리스트가 /opt/log 부재로
+# `/opt/log/log-download-*` mkdtemp 차단 (.56 라이브 OSError 30). PrivateTmp=yes 격리된
+# tmpfs /tmp로 default 변경. 운영자가 다른 경로 원하면 LOG_DOWNLOAD_TEMP_PARENT env로 override.
+_DOWNLOAD_TEMP_PARENT = os.environ.get("LOG_DOWNLOAD_TEMP_PARENT", "/tmp")
+_DOWNLOAD_TEMP_PREFIX = "log-download-"
+MAX_DOWNLOAD_SIZE = 100 * 1024 * 1024  # 100MB download limit
+ALLOWED_EXTENSIONS = frozenset({'.log', '.tar.gz', '.gz', '.txt'})
+# Uncompressed rotation suffixes produced by logrotate on devices without
+# the auto-compress daemon — e.g. dpworldapp_2026-05-25.log.0 / .log.1
+_ROTATION_SUFFIX_RE = re.compile(r'\.log\.\d+$')
+COMPRESS_CHECK_INTERVAL = 5 * 60  # 5 minutes
+
+# Log-management settings live in their own `log_config` board_config key —
+# NOT in `device_config`. The legacy Java app overwrites device_config with
+# its own model and silently drops these Python-only fields.
+LOG_CONFIG_KEYS = (
+    "log_auto_compress",
+    "log_auto_cleanup",
+    "log_cleanup_max_files",
+    "log_cleanup_max_size_mb",
+    # v1.4.6.7 C-1: Python 전용 compress threshold (Java schema 부재 → device_config에서 wipe 위험).
+    # .56 라이브 monitoring Phase 1에서 device_config로 잘못 진입 노출 (state.js convertNestedToFlat이
+    # 8개 log_* 키 모두 emit인데 LOG_CONFIG_KEYS가 4개만 분리 — 누락 2개).
+    "log_compress_size_mb",
+    "log_compress_age_days",
+)
+LOG_CONFIG_DEFAULTS = {
+    "log_auto_compress": "off",
+    "log_auto_cleanup": "off",
+    "log_cleanup_max_files": 50,
+    "log_cleanup_max_size_mb": 200,
+    # v1.4.6.7 C-1: state.js convertNestedToFlat과 default 일치
+    "log_compress_size_mb": 50,
+    "log_compress_age_days": 7,
+}
+
+logger = logging.getLogger(__name__)
+
+# Matches .log and rotated files like .log.0, .log.1, .log.2, etc.
+_LOG_FILE_RE = re.compile(r'\.log(\.\d+)?$')
+_compression_lock = threading.Lock()
+
+
+class CompressionAlreadyRunning(RuntimeError):
+    """Raised when a second compression request starts before the first finishes."""
+
+
+def _is_log_file(name):
+    """Check if filename is a log file (including rotated ones like .log.0, .log.1)."""
+    return bool(_LOG_FILE_RE.search(name))
+
+
+def _has_allowed_extension(name):
+    """True if `name`'s extension is in ALLOWED_EXTENSIONS, or matches a
+    logrotate numeric suffix like '.log.0' / '.log.1'."""
+    if any(name.endswith(ext) for ext in ALLOWED_EXTENSIONS):
+        return True
+    return bool(_ROTATION_SUFFIX_RE.search(name))
+
+
+def _make_tar_name(name, mtime):
+    """
+    Archive name for a log file: ``<original name>.<log-mtime>.tar.gz``.
+
+    The full original name is kept (so ``.log`` and rotated ``.log.N`` are
+    treated identically) and the log's mtime is embedded — making the name
+    unique, so a log filename reused over time never collides with a prior
+    archive. Example: ``dpworldapp_2026-05-21.log.20260521-164801.tar.gz``.
+    """
+    ts = time.strftime('%Y%m%d-%H%M%S', time.localtime(mtime))
+    return f"{name}.{ts}.tar.gz"
+
+
+def _verify_archive(tar_path, expected_name):
+    """Return True if tar_path is a valid .tar.gz holding exactly expected_name."""
+    try:
+        with tarfile.open(tar_path, 'r:gz') as tar:
+            members = tar.getmembers()
+        return len(members) == 1 and members[0].name == expected_name
+    except Exception:
+        return False
+
+
+def _safe_remove(path):
+    """Remove a file, ignoring any error."""
+    try:
+        os.remove(path)
+    except OSError:
+        pass
+
+
+def list_log_files():
+    """
+    List log files in LOG_DIR with metadata.
+    Returns dict: { files: [...], total_size: int }
+    """
+    if not os.path.isdir(LOG_DIR):
+        return {"files": [], "total_size": 0}
+
+    files = []
+    total_size = 0
+
+    try:
+        names = os.listdir(LOG_DIR)
+    except OSError as e:
+        raise RuntimeError(f"Failed to read log directory: {e}")
+
+    for name in names:
+        filepath = os.path.join(LOG_DIR, name)
+        try:
+            if not os.path.isfile(filepath):
+                continue
+            stat = os.stat(filepath)
+        except OSError:
+            # File disappeared between listdir and stat (compress daemon race).
+            continue
+        size = stat.st_size
+        mtime = stat.st_mtime
+
+        # Determine file type
+        if name.endswith('.tar.gz'):
+            ftype = 'tar.gz'
+        elif name.endswith('.gz'):
+            ftype = 'gz'
+        elif _is_log_file(name):
+            ftype = 'log'
+        elif name.endswith('.txt'):
+            ftype = 'txt'
+        else:
+            ftype = 'other'
+
+        files.append({
+            "name": name,
+            "size": size,
+            "modified": time.strftime("%Y-%m-%dT%H:%M:%S", time.localtime(mtime)),
+            "type": ftype,
+        })
+        total_size += size
+
+    # Sort by modified descending (newest first)
+    files.sort(key=lambda f: f["modified"], reverse=True)
+
+    return {"files": files, "total_size": total_size}
+
+
+def validate_filenames(filenames):
+    """
+    Validate a list of filenames for security.
+    Blocks path traversal, absolute paths, and missing files.
+    Returns (valid_paths, error_message).
+    """
+    if not filenames or not isinstance(filenames, list):
+        return None, "No files specified"
+
+    valid_paths = []
+
+    for name in filenames:
+        if not isinstance(name, str) or not name.strip():
+            return None, f"Invalid filename: empty or non-string"
+
+        # Block path traversal characters
+        if '..' in name or '/' in name or '\\' in name:
+            return None, f"Invalid filename: {name}"
+
+        # Extension whitelist — block .partial, .sh, etc.
+        # Also permit uncompressed logrotate suffixes: *.log.0, *.log.1, …
+        if not _has_allowed_extension(name):
+            return None, f"File extension not allowed: {name}"
+
+        # Resolve symlinks and verify it stays within LOG_DIR
+        filepath = os.path.realpath(os.path.join(LOG_DIR, name))
+        if not filepath.startswith(os.path.realpath(LOG_DIR) + os.sep):
+            return None, f"Invalid filename: {name}"
+
+        if not os.path.isfile(filepath):
+            return None, f"File not found: {name}"
+
+        valid_paths.append(filepath)
+
+    # Check total size limit
+    total = sum(os.path.getsize(p) for p in valid_paths)
+    if total > MAX_DOWNLOAD_SIZE:
+        return None, f"Total size exceeds {MAX_DOWNLOAD_SIZE // (1024*1024)}MB limit"
+
+    return valid_paths, None
+
+
+def create_download_archive(valid_paths):
+    """
+    Create a tar.gz archive on disk under _DOWNLOAD_TEMP_PARENT.
+    Returns the absolute archive path. Caller is responsible for removing
+    os.path.dirname(archive_path) after streaming.
+
+    Per-file FileNotFoundError is logged and skipped (resilient to the
+    auto-compress daemon renaming/deleting files during the request).
+
+    v1.4.6.5 L-D: If ALL files vanish before being added, the workspace is
+    cleaned up and FileNotFoundError is raised so the caller can return
+    HTTP 404 instead of an empty tar.gz with HTTP 200.
+    """
+    os.makedirs(_DOWNLOAD_TEMP_PARENT, exist_ok=True)
+    workspace = tempfile.mkdtemp(prefix=_DOWNLOAD_TEMP_PREFIX, dir=_DOWNLOAD_TEMP_PARENT)
+    try:
+        timestamp = time.strftime("%Y-%m-%d_%H%M%S")
+        archive_path = os.path.join(workspace, f"logs_{timestamp}.tar.gz")
+        added_count = 0
+        with tarfile.open(archive_path, mode='w:gz') as tar:
+            for filepath in valid_paths:
+                arcname = os.path.basename(filepath)
+                try:
+                    tar.add(filepath, arcname=arcname)
+                    added_count += 1
+                except FileNotFoundError:
+                    # Daemon may have renamed/deleted between validate and archive.
+                    # Skip; client just gets a smaller archive.
+                    continue
+        if added_count == 0:
+            shutil.rmtree(workspace, ignore_errors=True)
+            raise FileNotFoundError(
+                "All requested files disappeared between validation and archive"
+            )
+        return archive_path
+    except Exception:
+        shutil.rmtree(workspace, ignore_errors=True)
+        raise
+
+
+def sweep_stale_download_temp_dirs():
+    """Remove leftover log-download temp dirs from prior server crashes."""
+    if not os.path.isdir(_DOWNLOAD_TEMP_PARENT):
+        return 0
+    removed = 0
+    for name in os.listdir(_DOWNLOAD_TEMP_PARENT):
+        if not name.startswith(_DOWNLOAD_TEMP_PREFIX):
+            continue
+        path = os.path.join(_DOWNLOAD_TEMP_PARENT, name)
+        if not os.path.isdir(path):
+            continue
+        try:
+            shutil.rmtree(path)
+            removed += 1
+        except OSError:
+            pass
+    return removed
+
+
+def get_active_log_file():
+    """
+    Return the filename of the most recently modified log file (the active one).
+    DPWORLDAPP writes to one log file at a time; completed files should be compressed.
+    Considers .log and rotated .log.0, .log.1, etc.
+    Returns None if no log files exist.
+    """
+    if not os.path.isdir(LOG_DIR):
+        return None
+
+    latest_name = None
+    latest_mtime = 0
+
+    try:
+        for name in os.listdir(LOG_DIR):
+            if not _is_log_file(name):
+                continue
+            filepath = os.path.join(LOG_DIR, name)
+            if not os.path.isfile(filepath):
+                continue
+            mtime = os.stat(filepath).st_mtime
+            if mtime > latest_mtime:
+                latest_mtime = mtime
+                latest_name = name
+    except OSError:
+        pass
+
+    return latest_name
+
+
+def get_log_stats():
+    """
+    Return disk usage statistics for the log directory.
+    Returns dict with compressed/uncompressed counts, sizes, active file, total size,
+    and partition capacity (total/used/free bytes for the filesystem hosting LOG_DIR).
+    """
+    # Partition capacity — fall back to root if LOG_DIR is absent
+    try:
+        probe = LOG_DIR if os.path.isdir(LOG_DIR) else "/"
+        usage = shutil.disk_usage(probe)
+        partition_total = usage.total
+        partition_used = usage.used
+        partition_free = usage.free
+    except (OSError, AttributeError):
+        partition_total = partition_used = partition_free = 0
+
+    if not os.path.isdir(LOG_DIR):
+        return {
+            "total_size": 0,
+            "compressed_count": 0,
+            "compressed_size": 0,
+            "uncompressed_count": 0,
+            "uncompressed_size": 0,
+            "active_file": None,
+            "partition_total": partition_total,
+            "partition_used": partition_used,
+            "partition_free": partition_free,
+        }
+
+    active = get_active_log_file()
+    compressed_count = 0
+    compressed_size = 0
+    uncompressed_count = 0
+    uncompressed_size = 0
+    total_size = 0
+
+    try:
+        for name in os.listdir(LOG_DIR):
+            filepath = os.path.join(LOG_DIR, name)
+            if not os.path.isfile(filepath):
+                continue
+            size = os.stat(filepath).st_size
+            total_size += size
+
+            if name.endswith('.tar.gz') or name.endswith('.gz'):
+                compressed_count += 1
+                compressed_size += size
+            else:
+                uncompressed_count += 1
+                uncompressed_size += size
+    except OSError:
+        pass
+
+    return {
+        "total_size": total_size,
+        "compressed_count": compressed_count,
+        "compressed_size": compressed_size,
+        "uncompressed_count": uncompressed_count,
+        "uncompressed_size": uncompressed_size,
+        "active_file": active,
+        "partition_total": partition_total,
+        "partition_used": partition_used,
+        "partition_free": partition_free,
+    }
+
+
+def _compress_non_active_logs():
+    if not _compression_lock.acquire(blocking=False):
+        raise CompressionAlreadyRunning("Compression already running")
+    try:
+        return _compress_non_active_logs_unlocked()
+    finally:
+        _compression_lock.release()
+
+
+def _compress_non_active_logs_unlocked():
+    """
+    Compress every log file except the active (most recently modified) one.
+
+    Handles ``.log`` and rotated ``.log.0``, ``.log.1``, etc. Each archive is
+    named ``<logname>.<log-mtime>.tar.gz`` (see _make_tar_name) — unique, so a
+    reused log filename never collides with a prior, possibly stale, archive.
+    Archives are written to a ``.partial`` temp file and atomically renamed, so
+    an interrupted run never leaves a corrupt archive that shadows the log.
+    Returns the number of files compressed.
+    """
+    if not os.path.isdir(LOG_DIR):
+        return 0
+
+    try:
+        names = os.listdir(LOG_DIR)
+    except OSError as e:
+        logger.warning(f"Error listing log directory: {e}")
+        return 0
+
+    # Clear leftover .partial archives from any previously interrupted run.
+    for name in names:
+        if name.endswith('.tar.gz.partial'):
+            _safe_remove(os.path.join(LOG_DIR, name))
+
+    active = get_active_log_file()
+    compressed_count = 0
+
+    for name in names:
+        if not _is_log_file(name):
+            continue
+
+        # Skip the active file
+        if name == active:
+            continue
+
+        filepath = os.path.join(LOG_DIR, name)
+        if not os.path.isfile(filepath):
+            continue
+
+        try:
+            mtime = os.stat(filepath).st_mtime
+        except OSError:
+            continue
+
+        tar_name = _make_tar_name(name, mtime)
+        tar_path = os.path.join(LOG_DIR, tar_name)
+
+        # This exact version (same name + mtime) already archived?
+        if os.path.exists(tar_path):
+            if _verify_archive(tar_path, name):
+                # Archive is good — drop the now-redundant original.
+                _safe_remove(filepath)
+                continue
+            # Corrupt/partial archive at the final name — discard, recompress.
+            _safe_remove(tar_path)
+
+        tmp_path = tar_path + '.partial'
+        try:
+            with tarfile.open(tmp_path, 'w:gz') as tar:
+                tar.add(filepath, arcname=name)
+
+            if not _verify_archive(tmp_path, name):
+                _safe_remove(tmp_path)
+                logger.warning(f"Archive verification failed for {name}")
+                continue
+
+            os.rename(tmp_path, tar_path)   # atomic publish
+            os.remove(filepath)
+            compressed_count += 1
+            logger.info(f"Compressed: {name} -> {tar_name}")
+
+        except Exception as e:
+            logger.warning(f"Failed to compress {name}: {e}")
+            _safe_remove(tmp_path)
+
+    return compressed_count
+
+
+def _run_cleanup(max_files, max_size_mb):
+    """
+    Delete oldest compressed (.tar.gz / .gz) archives until both thresholds are met:
+      - file count <= max_files
+      - total compressed size <= max_size_mb (MB)
+    Uncompressed and active log files are never touched.
+    Returns the number of files deleted.
+    """
+    if not os.path.isdir(LOG_DIR):
+        return 0
+
+    # v1.11.8 B: defensive count floor — a corrupted/zero max_files from the DB
+    # must never delete EVERY archive. Keep at least one. (The size threshold is
+    # independent and can still bring the set down if the operator set it tiny.)
+    try:
+        max_files = max(1, int(max_files))
+    except (TypeError, ValueError):
+        max_files = 1
+
+    max_size_bytes = max_size_mb * 1024 * 1024
+    archives = []
+
+    try:
+        for name in os.listdir(LOG_DIR):
+            if not (name.endswith('.tar.gz') or name.endswith('.gz')):
+                continue
+            filepath = os.path.join(LOG_DIR, name)
+            if not os.path.isfile(filepath):
+                continue
+            try:
+                stat = os.stat(filepath)
+                archives.append((stat.st_mtime, stat.st_size, name, filepath))
+            except OSError:
+                continue
+    except OSError as e:
+        logger.warning(f"Cleanup: error listing log directory: {e}")
+        return 0
+
+    # Oldest first
+    archives.sort(key=lambda a: a[0])
+
+    deleted = 0
+    total_size = sum(a[1] for a in archives)
+
+    while archives and (len(archives) > max_files or total_size > max_size_bytes):
+        entry = archives.pop(0)
+        mtime, size, name, path = entry
+        try:
+            os.remove(path)
+            total_size -= size
+            deleted += 1
+            logger.info(
+                f"Auto-cleanup: deleted {name} (mtime={mtime:.0f}, size={size})"
+            )
+        except OSError as e:
+            # #24 fix: the file is still on disk — re-append it (so the count is
+            # honest) and stop. Continuing would drop it from `archives`, shrinking
+            # len(archives) toward the threshold and exiting the count-based loop
+            # one early while the file remains. We can't make progress past an
+            # un-removable oldest file, so break to avoid a no-progress spin.
+            logger.warning(f"Cleanup: failed to delete {name}: {e}")
+            archives.append(entry)
+            break
+
+    return deleted
+
+
+def migrate_log_config(db):
+    """
+    Ensure the `log_config` board_config key exists.
+
+    Log-management settings used to live in `device_config`, which the legacy
+    Java app overwrites with its own model — silently dropping them. They now
+    live in their own key. This seeds `log_config` once, from any values still
+    present in `device_config`, otherwise from defaults. Idempotent.
+    """
+    try:
+        if db.config_exists("log_config"):
+            return
+        device = db.get_config("device_config") or {}
+        seeded = {
+            key: device.get(key, LOG_CONFIG_DEFAULTS[key])
+            for key in LOG_CONFIG_KEYS
+        }
+        db.save_config("log_config", seeded)
+        logger.info("Migrated log-management settings into the log_config key")
+    except Exception as e:
+        logger.warning(f"log_config migration error: {e}")
+
+
+def run_auto_compression(db):
+    """
+    Compress ALL non-active .log files if auto_compress is enabled.
+    Reads settings from the log_config key in DB.
+    """
+    try:
+        config = db.get_config("log_config")
+        if not isinstance(config, dict) or not config:
+            return
+
+        # Check if auto compress is enabled
+        auto_compress = config.get("log_auto_compress", "off")
+        if auto_compress != "on":
+            return
+
+        try:
+            count = _compress_non_active_logs()
+            if count > 0:
+                logger.info(f"Auto-compressed {count} file(s)")
+        except CompressionAlreadyRunning:
+            logger.info("Auto compression skipped: compression already running")
+
+    except Exception as e:
+        logger.warning(f"Auto compression error: {e}")
+
+
+def run_auto_cleanup(db):
+    """
+    Delete oldest compressed log archives if log_auto_cleanup is enabled
+    and either threshold (max_files or max_size_mb) is exceeded.
+    Reads settings from the log_config key in DB. Uses safe defaults when keys missing.
+    """
+    try:
+        config = db.get_config("log_config")
+        if not isinstance(config, dict) or not config:
+            return
+
+        if config.get("log_auto_cleanup", "off") != "on":
+            return
+
+        try:
+            max_files = int(config.get("log_cleanup_max_files", 50))
+        except (TypeError, ValueError):
+            max_files = 50
+        try:
+            max_size_mb = int(config.get("log_cleanup_max_size_mb", 200))
+        except (TypeError, ValueError):
+            max_size_mb = 200
+
+        count = _run_cleanup(max_files, max_size_mb)
+        if count > 0:
+            logger.info(f"Auto-cleanup deleted {count} archive(s)")
+
+    except Exception as e:
+        logger.warning(f"Auto cleanup error: {e}")
+
+
+def run_manual_compression():
+    """
+    Manually compress ALL non-active .log files.
+    Always runs regardless of auto_compress setting.
+    Returns dict with result info.
+    """
+    try:
+        count = _compress_non_active_logs()
+        return {
+            "success": True,
+            "compressed": count,
+            "message": f"Compressed {count} file(s)" if count > 0 else "No files to compress",
+        }
+    except CompressionAlreadyRunning:
+        logger.info("Manual compression skipped: compression already running")
+        return {
+            "success": False,
+            "compressed": 0,
+            "message": "Compression already running",
+        }
+    except Exception as e:
+        logger.warning(f"Manual compression error: {e}")
+        return {
+            "success": False,
+            "compressed": 0,
+            "message": f"Compression failed: {str(e)}",
+        }
+
+
+def delete_log_files(filenames):
+    """
+    Delete specified log files with security validation.
+    Returns dict with result info.
+    """
+    if not filenames or not isinstance(filenames, list):
+        return {"success": False, "deleted": 0, "message": "No files specified"}
+
+    deleted = 0
+    errors = []
+
+    for name in filenames:
+        if not isinstance(name, str) or not name.strip():
+            errors.append(f"Invalid filename: empty or non-string")
+            continue
+
+        # Block path traversal
+        if '..' in name or '/' in name or '\\' in name:
+            errors.append(f"Invalid filename: {name}")
+            continue
+
+        filepath = os.path.realpath(os.path.join(LOG_DIR, name))
+        if not filepath.startswith(os.path.realpath(LOG_DIR) + os.sep):
+            errors.append(f"Invalid filename: {name}")
+            continue
+
+        # v1.3.1: enforce extension whitelist — same set used by validate_filenames
+        if not _has_allowed_extension(name):
+            errors.append(f"Unsupported extension: {name}")
+            continue
+
+        if not os.path.isfile(filepath):
+            errors.append(f"File not found: {name}")
+            continue
+
+        try:
+            os.remove(filepath)
+            deleted += 1
+            logger.info(f"Deleted log file: {name}")
+        except OSError as e:
+            errors.append(f"Failed to delete {name}: {e}")
+
+    message = f"Deleted {deleted} file(s)"
+    if errors:
+        message += f"; errors: {'; '.join(errors)}"
+
+    return {
+        "success": deleted > 0 or len(errors) == 0,
+        "deleted": deleted,
+        "message": message,
+    }
+
+
+def start_auto_compress_daemon(db):
+    """Start a daemon thread that runs auto-compression and auto-cleanup periodically."""
+    def _worker():
+        while True:
+            try:
+                run_auto_compression(db)
+                run_auto_cleanup(db)
+            except Exception as e:
+                logger.warning(f"Auto compress/cleanup daemon error: {e}")
+            time.sleep(COMPRESS_CHECK_INTERVAL)
+
+    thread = threading.Thread(target=_worker, daemon=True, name="log-auto-compress")
+    thread.start()
+    logger.info("Auto-compress/cleanup daemon started (interval: 5min)")
+    return thread
diff --git a/src/migrations.py b/src/migrations.py
new file mode 100644
index 0000000..ea5e909
--- /dev/null
+++ b/src/migrations.py
@@ -0,0 +1,208 @@
+"""One-shot startup migrations for the Python configurator.
+
+Migrations are gated by the `schema_meta` SQLite table (separate from
+`board_config` to avoid contention with the Java app)."""
+
+# v1.4.6.3 H1: Java CanSpeed Integer + Python enum integer set 정합
+# mapping값을 string→int로 (migration 후 DB에 string 잔존하던 type confusion 제거)
+_CAN_BAUDRATE_OLD_TO_NEW = {
+    "2500":  250,
+    "5000":  500,
+    "10000": 1000,
+    # "1000" left unmapped — ambiguous between old and new units;
+    # conservative policy in guide §6.3 keeps it as-is.
+}
+
+
+def migrate_can_baudrate_units(db) -> bool:
+    """Migrate device_config.can_baudrate from old units to new (5/22) units.
+    Returns True if the migration ran, False if previously applied."""
+    if db.get_schema_meta("can_baudrate_units_migrated") == "true":
+        return False
+
+    def _mut(cur):
+        cfg = dict(cur) if isinstance(cur, dict) else {}
+        new = _CAN_BAUDRATE_OLD_TO_NEW.get(cfg.get("can_baudrate"))
+        if new is not None:
+            cfg["can_baudrate"] = new
+        # Java schema stores can_baudrate as Integer. Any remaining clean
+        # digit-string value (e.g. the unmapped "1000") would otherwise drift
+        # from that contract → coerce to int. Non-digit/None left untouched.
+        v = cfg.get("can_baudrate")
+        if isinstance(v, str) and v.strip().isdigit():
+            cfg["can_baudrate"] = int(v.strip())
+        return cfg
+
+    db.update_config("device_config", _mut, default={})
+    db.set_schema_meta("can_baudrate_units_migrated", "true")
+    return True
+
+
+# v1.4.6.7 C-1: Python 전용 키가 device_config에 잘못 들어가 있던 .56 라이브 Phase 1 노출.
+# LOG_CONFIG_KEYS 확장과 함께 DB에 이미 잔존한 키를 log_config로 이동.
+_LOG_COMPRESS_KEYS = ("log_compress_size_mb", "log_compress_age_days")
+
+
+def migrate_log_compress_split(db) -> bool:
+    """Move `log_compress_size_mb` / `log_compress_age_days` out of `device_config`
+    into `log_config`. Existing values in `log_config` win (no overwrite)."""
+    if db.get_schema_meta("log_compress_split_migrated") == "true":
+        return False
+
+    # Snapshot the keys to move (these are Python-only keys dpworldapp doesn't
+    # write, so a brief read before the atomic updates is not a race surface;
+    # the race that mattered was clobbering OTHER device_config keys on write,
+    # which the atomic pop below now avoids).
+    dev = db.get_config("device_config") or {}
+    if not isinstance(dev, dict):
+        db.set_schema_meta("log_compress_split_migrated", "true")
+        return True
+
+    moved = {k: dev[k] for k in _LOG_COMPRESS_KEYS if k in dev}
+
+    if moved:
+        # v1.4.6.8 C4: write order — log_config FIRST (additive, no data loss).
+        # crash between log_config and device_config: log_config safe, device_config
+        # keys still present → next startup can re-migrate (idempotent: `if k not in cur`).
+        # v1.9.1 M-1: both writes are now atomic update_config RMW so concurrent
+        # writers to OTHER device_config keys are preserved.
+
+        # FIRST: additive write to log_config — existing keys win.
+        db.update_config(
+            "log_config",
+            lambda cur: {**(cur if isinstance(cur, dict) else {}),
+                         **{k: v for k, v in moved.items()
+                            if k not in (cur if isinstance(cur, dict) else {})}},
+            default={},
+        )
+
+        # THEN: atomically pop the log_compress_* keys from CURRENT device_config
+        # (reads fresh inside the transaction, so concurrent changes to other keys
+        # are preserved — only the two log_compress_* keys are removed).
+        db.update_config(
+            "device_config",
+            lambda cur: {k: v for k, v in (cur if isinstance(cur, dict) else {}).items()
+                         if k not in _LOG_COMPRESS_KEYS},
+            default={},
+        )
+
+    db.set_schema_meta("log_compress_split_migrated", "true")
+    return True
+
+
+# v1.4.6.7 C-2: frontend convertNestedToFlat 회귀로 ports가 string으로 저장된 .56 라이브 Phase 4 노출.
+# dha baseline ports 모두 Integer 확정 (verify-before-asserting). 운영 DB normalize.
+_PORT_KEYS = (
+    "protocol_server_port", "update_server_port", "rtcm_server_port",
+    "opc_ua_server_port",   "modbus_server_port", "lte_server_port",
+)
+
+
+def migrate_port_types(db) -> bool:
+    """Convert any string-typed port in `device_config` to Integer.
+    dha baseline confirms Java schema Integer (2026-06-04 verify)."""
+    if db.get_schema_meta("port_types_migrated") == "true":
+        return False
+
+    def _mut(cur):
+        cfg = dict(cur) if isinstance(cur, dict) else {}
+        for k in _PORT_KEYS:
+            v = cfg.get(k)
+            if isinstance(v, str) and v.strip().lstrip("-").isdigit():
+                cfg[k] = int(v)
+        return cfg
+
+    db.update_config("device_config", _mut, default={})
+    db.set_schema_meta("port_types_migrated", "true")
+    return True
+
+
+# v2 contract alignment migration
+def migrate_contract_canonical(db) -> bool:
+    """Rewrite existing DB values to v2 device config-reader contract canonical forms.
+
+    Idempotent (gated by schema_meta flag). Rewrites:
+    - device_config: rs485_parity "no" → "none"
+    - protocol_config: two_byte_order/four_byte_order "littleSwap"→"little swap",
+      "bigSwap"→"big swap"
+    - protocol_config OPC_UA/MODBUS/CAN arrays: per-entry idt "float64"→"float"
+
+    Returns True if ran, False if already applied.
+    """
+    if db.get_schema_meta("contract_canonical_migrated") == "true":
+        return False
+
+    # device_config: rs485_parity "no" → "none"
+    def _mut_device(cur):
+        cfg = dict(cur) if isinstance(cur, dict) else {}
+        if cfg.get("rs485_parity") == "no":
+            cfg["rs485_parity"] = "none"
+        return cfg
+
+    db.update_config("device_config", _mut_device, default={})
+
+    # protocol_config: byte_order camelCase → space + idt float64 → float
+    _BYTE_ORDER_MAP = {"littleSwap": "little swap", "bigSwap": "big swap"}
+
+    def _mut_protocol(cur):
+        cfg = dict(cur) if isinstance(cur, dict) else {}
+        for bo_key in ("two_byte_order", "four_byte_order"):
+            v = cfg.get(bo_key)
+            if v in _BYTE_ORDER_MAP:
+                cfg[bo_key] = _BYTE_ORDER_MAP[v]
+        # rewrite idt float64 → float in all register arrays
+        for arr_key in ("OPC_UA", "MODBUS", "CAN"):
+            arr = cfg.get(arr_key)
+            if not isinstance(arr, list):
+                continue
+            new_arr = []
+            for entry in arr:
+                if isinstance(entry, dict) and entry.get("idt") == "float64":
+                    entry = dict(entry)
+                    entry["idt"] = "float"
+                new_arr.append(entry)
+            cfg[arr_key] = new_arr
+        return cfg
+
+    db.update_config("protocol_config", _mut_protocol, default={})
+
+    db.set_schema_meta("contract_canonical_migrated", "true")
+    return True
+
+
+# AP: seed — begin
+def migrate_seed_ap_config(db) -> bool:
+    """ap_config 키 부재 시 기본값 1회 seed (spec §5.1). 존재하면 no-op."""
+    from network.ap_model import DEFAULT_AP_CONFIG
+    if db.get_config("ap_config") is not None:
+        return False
+    db.save_config("ap_config", dict(DEFAULT_AP_CONFIG))
+    return True
+# AP: seed — end
+
+_MIGRATIONS = (
+    ("can_baudrate_units",    migrate_can_baudrate_units),
+    ("log_compress_split",    migrate_log_compress_split),
+    ("port_types",            migrate_port_types),
+    ("seed_ap_config",        migrate_seed_ap_config),  # AP: seed
+    ("contract_canonical",    migrate_contract_canonical),  # v2
+)
+
+
+def apply_all_migrations(db) -> list:
+    """Run all pending migrations in order. Returns list of migration names
+    actually applied (for startup logging).
+
+    v1.4.6.9 H11: per-step 로깅 — partial-failure 시 어디서 멈췄는지 식별 가능.
+    이전에는 마지막 print 직전에 raise 시 어떤 migration이 적용됐는지 unknown.
+    Exception은 재전파 (caller server.py가 fail-soft wrap)."""
+    applied = []
+    for name, fn in _MIGRATIONS:
+        try:
+            if fn(db):
+                applied.append(name)
+                print(f"[migration] {name}: applied", flush=True)
+        except Exception:
+            print(f"[migration] {name}: failed (re-raise to caller)", flush=True)
+            raise
+    return applied
diff --git a/src/network/__init__.py b/src/network/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/src/network/ap_engine.py b/src/network/ap_engine.py
new file mode 100644
index 0000000..c465b90
--- /dev/null
+++ b/src/network/ap_engine.py
@@ -0,0 +1,151 @@
+# src/network/ap_engine.py
+"""AP apply 오케스트레이션 (spec §7/§8). 렌더 파일 작성 + dpworld-ap-apply.service 트리거 + 상태 persist."""
+import json, os, threading
+from network.ap_model import ap_intent_from_db
+from network.ap_validator import validate_ap
+from network.ap_renderer import render_hostapd, render_udhcpd
+
+def _default_runner(argv, timeout):
+    import subprocess
+    try:
+        p = subprocess.run(argv, capture_output=True, text=True, timeout=timeout)
+        return (p.returncode, (p.stdout or "") + (p.stderr or ""))
+    except (subprocess.SubprocessError, OSError) as e:  # _net_run 패리티 — 예외를 rc로 흡수
+        return (1, str(e))
+
+
+def parse_iw_link_channel(out):
+    """`iw dev wlan0 link` 출력의 freq → (channel, hw_mode). 미연결/파싱불가 → (None, None)."""
+    freq = None
+    for ln in (out or "").splitlines():
+        t = ln.strip()
+        if t.startswith("freq:"):
+            try:
+                freq = int(float(t.split(":", 1)[1].strip()))
+            except ValueError:
+                return (None, None)
+            break
+    if not freq:
+        return (None, None)
+    if 2412 <= freq <= 2472:
+        return ((freq - 2407) // 5, "g")
+    if freq == 2484:
+        return (14, "g")
+    if 5000 < freq < 6000:
+        return ((freq - 5000) // 5, "a")
+    return (None, None)
+
+
+# country 별 2.4GHz 기본 채널(MCC opt-in 시)
+_DEFAULT_2G = 6
+
+class ApEngine:
+    def __init__(self, ap_dir, state_path, runner=None,
+                 live_country=None, sta_channel=None, country_pending=None):
+        self.ap_dir = ap_dir
+        self.state_path = state_path
+        self.runner = runner or _default_runner
+        self._live_country = live_country or (lambda: "")
+        self._sta_channel = sta_channel or (lambda: (None, None))  # (channel, hw_mode) or (None,None)
+        self._country_pending = country_pending or (lambda: False)
+        self._lock = threading.Lock()   # serialize apply(): fixed tmp file + single service start
+
+    def resolve_channel(self, intent):
+        """§7: 기본 SCC(STA 채널 추종). MCC(2g/5g 명시)는 옵트인."""
+        sta_ch, sta_hw = self._sta_channel()
+        band = intent.get("ap_band", "auto")
+        if band == "auto":
+            if sta_ch:
+                return (sta_ch, sta_hw)            # SCC
+            return (_DEFAULT_2G, "g")              # STA 없음 → 2.4G 기본
+        # ap_channel 0(DEFAULT)=auto 센티넬 → 'or'가 기본/STA 채널을 채움(의도된 동작)
+        if band == "2g":
+            return (intent.get("ap_channel") or _DEFAULT_2G, "g")
+        return (intent.get("ap_channel") or (sta_ch or 36), "a")
+
+    def _persist(self, state, intent):
+        try:
+            with open(self.state_path, "w", encoding="utf-8") as f:
+                json.dump({"state": state, "ap_enabled": intent.get("ap_enabled", False)}, f)
+        except OSError:
+            pass
+
+    def _write(self, name, content):
+        os.makedirs(self.ap_dir, exist_ok=True)
+        try:
+            os.chmod(self.ap_dir, 0o700)   # 평문 PSK 보호 (네트워크 엔진 기조와 동일)
+        except OSError:
+            pass
+        tmp = os.path.join(self.ap_dir, name + ".tmp")
+        dst = os.path.join(self.ap_dir, name)
+        try:
+            with open(tmp, "w", encoding="utf-8") as f:  # non-ASCII SSID safe
+                f.write(content)
+            os.replace(tmp, dst)
+        except OSError:
+            try:
+                os.remove(tmp)   # don't leak a partial .tmp on write failure
+            except OSError:
+                pass
+            raise
+        try:
+            os.chmod(dst, 0o600)           # hostapd-ap0.conf 등 PSK 포함 → 소유자 전용
+        except OSError:
+            pass
+
+    def apply(self, ap_fields):
+        # Serialize: concurrent applies would race the fixed tmp file and
+        # double-start dpworld-ap-apply.service.
+        with self._lock:
+            intent = ap_intent_from_db(ap_fields)
+            errors = validate_ap(intent, self._live_country(), self._country_pending())
+            if errors:
+                self._persist("REJECTED", intent)
+                return {"state": "REJECTED", "errors": errors}
+            marker = os.path.join(self.ap_dir, "ap-enabled")
+            if intent["ap_enabled"]:
+                ch, hw = self.resolve_channel(intent)
+                self._write("hostapd-ap0.conf", render_hostapd(intent, ch, hw, self._live_country()))
+                self._write("udhcpd-ap0.conf", render_udhcpd(intent))
+                # Persist intent BEFORE marker so state reflects intent even if marker write fails.
+                self._persist("APPLYING", intent)
+                try:
+                    with open(marker, "w"):
+                        pass
+                except OSError as exc:
+                    self._persist("FAILED", intent)
+                    return {"state": "FAILED", "errors": [f"marker write failed: {exc}"]}
+            else:
+                # TOCTOU-safe: the marker may vanish between exists() and remove()
+                # (concurrent disable) — a successful disable must not 500.
+                try:
+                    os.remove(marker)
+                except FileNotFoundError:
+                    pass
+            rc, out = self.runner(["systemctl", "start", "dpworld-ap-apply.service"], 95)  # ≥ 유닛 TimeoutStartSec(90)
+            if rc != 0:
+                self._persist("FAILED", intent)
+                detail = (out or "").strip() or "dpworld-ap-apply.service failed"
+                return {"state": "FAILED", "errors": [detail]}
+            self._persist("COMMITTED", intent)
+            return {"state": "COMMITTED", "errors": []}
+
+    def status(self):
+        """라이브 AP 상태 종합 (spec §9.1). runner로 iw/systemctl 조회."""
+        marker = os.path.join(self.ap_dir, "ap-enabled")
+        ap_enabled = os.path.exists(marker)
+        rc_info, _ = self.runner(["iw", "dev", "ap0", "info"], 5)
+        ap0_up = (rc_info == 0)
+        _rc_h, out_h = self.runner(["systemctl", "is-active", "dpworld-hostapd-ap0.service"], 5)
+        hostapd_running = (out_h or "").strip() == "active"
+        clients = 0
+        rc_s, out_s = self.runner(["iw", "dev", "ap0", "station", "dump"], 5)
+        if rc_s == 0:
+            clients = sum(1 for ln in (out_s or "").splitlines() if ln.strip().startswith("Station "))
+        return {
+            "ap_enabled": ap_enabled,
+            "ap0_up": ap0_up,
+            "hostapd_running": hostapd_running,
+            "clients": clients,
+            "country_pending": bool(self._country_pending()),
+        }
diff --git a/src/network/ap_model.py b/src/network/ap_model.py
new file mode 100644
index 0000000..c627fe1
--- /dev/null
+++ b/src/network/ap_model.py
@@ -0,0 +1,55 @@
+# src/network/ap_model.py
+"""DB ap_config ↔ normalized intent (spec §5). 별도 board_config 키 — device_config 무관."""
+
+DEFAULT_AP_CONFIG = {
+    "ap_enabled": False, "ap_ssid": "", "ap_passphrase": "",
+    "ap_band": "auto", "ap_channel": 0, "ap_hidden": False,
+    "ap_ip": "192.168.50.1",
+    "dhcp_start": "192.168.50.50", "dhcp_end": "192.168.50.150", "dhcp_lease": 43200,
+}
+
+def _s(v):
+    return "" if v is None else str(v).strip()
+
+def _int(v, default):
+    try:
+        return int(str(v).strip())
+    except (ValueError, TypeError):
+        return default
+
+def _int_for_validation(v, default):
+    if v is None:
+        return None
+    try:
+        return int(str(v).strip())
+    except (ValueError, TypeError):
+        return _s(v)
+
+def _bool(v):
+    if isinstance(v, bool):
+        return v
+    return str(v).strip().lower() in ("1", "true", "yes", "on")
+
+def _field(c, key):
+    if isinstance(c, dict) and key in c:
+        return c[key]
+    return DEFAULT_AP_CONFIG[key]
+
+def _text_field(c, key):
+    v = _field(c, key)
+    return None if v is None else _s(v)
+
+def ap_intent_from_db(ap_config):
+    c = ap_config if isinstance(ap_config, dict) else {}
+    return {
+        "ap_enabled": _bool(_field(c, "ap_enabled")),
+        "ap_ssid": _text_field(c, "ap_ssid") or "",
+        "ap_passphrase": _text_field(c, "ap_passphrase") or "",
+        "ap_band": (_text_field(c, "ap_band") or "").lower(),
+        "ap_channel": _int_for_validation(_field(c, "ap_channel"), 0),
+        "ap_hidden": _bool(_field(c, "ap_hidden")),
+        "ap_ip": _text_field(c, "ap_ip"),
+        "dhcp_start": _text_field(c, "dhcp_start"),
+        "dhcp_end": _text_field(c, "dhcp_end"),
+        "dhcp_lease": _int(_field(c, "dhcp_lease"), 43200),
+    }
diff --git a/src/network/ap_renderer.py b/src/network/ap_renderer.py
new file mode 100644
index 0000000..56c25d4
--- /dev/null
+++ b/src/network/ap_renderer.py
@@ -0,0 +1,36 @@
+# src/network/ap_renderer.py
+"""intent → hostapd-ap0.conf / udhcpd-ap0.conf 렌더 (spec §6). 채널/country는 ap_engine 산정값 주입."""
+
+def render_hostapd(intent, channel, hw_mode, country):
+    hidden = 1 if intent.get("ap_hidden") else 0
+    return (
+        "interface=ap0\n"
+        "driver=nl80211\n"
+        f"ssid={intent['ap_ssid']}\n"
+        f"hw_mode={hw_mode}\n"
+        f"channel={channel}\n"
+        f"country_code={country}\n"
+        "ieee80211d=1\n"
+        "beacon_int=100\n"
+        "wmm_enabled=1\n"
+        "auth_algs=1\n"
+        "wpa=2\n"
+        "wpa_key_mgmt=WPA-PSK\n"
+        "rsn_pairwise=CCMP\n"
+        f"wpa_passphrase={intent['ap_passphrase']}\n"
+        f"ignore_broadcast_ssid={hidden}\n"
+        "ctrl_interface=/var/run/hostapd\n"
+    )
+
+def render_udhcpd(intent):
+    return (
+        "interface ap0\n"
+        f"start {intent['dhcp_start']}\n"
+        f"end {intent['dhcp_end']}\n"
+        "opt subnet 255.255.255.0\n"
+        f"opt router {intent['ap_ip']}\n"
+        f"opt lease {intent['dhcp_lease']}\n"
+        "opt dns 8.8.8.8\n"
+        "lease_file /run/udhcpd-ap0.leases\n"
+        "pidfile /run/udhcpd-ap0.pid\n"
+    )
diff --git a/src/network/ap_routes.py b/src/network/ap_routes.py
new file mode 100644
index 0000000..8fe7b7c
--- /dev/null
+++ b/src/network/ap_routes.py
@@ -0,0 +1,54 @@
+# src/network/ap_routes.py
+"""AP 라우트 글루 (spec §9). 네트워크 apply와 분리 — AP 필드 자체 화이트리스트."""
+from network.ap_model import DEFAULT_AP_CONFIG
+
+class RouteError(Exception):
+    def __init__(self, status, message):
+        super().__init__(message); self.status = status; self.message = message
+
+AP_FIELDS = frozenset(DEFAULT_AP_CONFIG.keys())
+
+class ApRoutes:
+    def __init__(self, engine, db):
+        self.engine = engine; self.db = db
+
+    def config(self, body):
+        if not isinstance(body, dict):
+            raise RouteError(400, "body must be an object")
+        unknown = sorted(k for k in body if k not in AP_FIELDS)
+        if unknown:
+            raise RouteError(400, "unknown AP field(s): " + ", ".join(unknown))
+        clean = {k: v for k, v in body.items() if k in AP_FIELDS}
+        # Text fields must be strings — a non-string (e.g. list) passphrase
+        # would corrupt the rendered hostapd conf (DoS).
+        for k in ("ap_ssid", "ap_passphrase", "ap_ip", "dhcp_start", "dhcp_end", "ap_band"):
+            if k in clean and not isinstance(clean[k], str):
+                raise RouteError(400, f"{k} must be a string")
+
+        def _merge(current):
+            cur = dict(current) if isinstance(current, dict) else {}
+            cur.update(clean)
+            return cur
+
+        self.db.update_config("ap_config", _merge, default={})
+        return {"ok": True, "saved": sorted(clean.keys())}
+
+    def apply(self, body):
+        if not isinstance(body, dict):
+            raise RouteError(400, "body must be an object")
+        cur = self.db.get_config("ap_config") or dict(DEFAULT_AP_CONFIG)
+        if body.get("dry_run"):
+            # Never leak the WPA2 PSK over the unauthenticated API (response only;
+            # storage keeps it — frontend treats a blank field as "keep existing").
+            safe = dict(cur)
+            safe.pop("ap_passphrase", None)
+            return {"ok": True, "dry_run": True, "config": safe}
+        return self.engine.apply(cur)
+
+    def status(self):
+        st = dict(self.engine.status())
+        cfg = {**DEFAULT_AP_CONFIG, **(self.db.get_config("ap_config") or {})}
+        # Strip the WPA2 PSK before returning (unauthenticated API).
+        cfg.pop("ap_passphrase", None)
+        st["config"] = cfg
+        return st
diff --git a/src/network/ap_validator.py b/src/network/ap_validator.py
new file mode 100644
index 0000000..a779222
--- /dev/null
+++ b/src/network/ap_validator.py
@@ -0,0 +1,71 @@
+# src/network/ap_validator.py
+"""AP hard-reject 규칙 (spec §5.1/§6/§7). 사용자 표시 메시지는 영어(웹 UI 일관성)."""
+import ipaddress
+
+AP_SSID_MAX = 32          # hostapd SSID 한계 (byte). STA(19, dpworldapp 버퍼)와 다름.
+PSK_MIN, PSK_MAX = 8, 63  # WPA2-PSK passphrase (byte)
+FORBIDDEN = ('"', "\\", "#")   # '#' starts an inline comment in hostapd conf
+AP_BANDS = frozenset({"auto", "2g", "5g"})
+CHANNELS_2G = frozenset(range(1, 14))
+CHANNELS_5G = frozenset({36, 40, 44, 48, 149, 153, 157, 161, 165})
+
+def _blen(s):
+    return len(s.encode("utf-8"))
+
+def _ip(s):
+    try:
+        return ipaddress.IPv4Address(s)
+    except (ValueError, TypeError):
+        return None
+
+def validate_ap(intent, live_country, country_pending):
+    e = []
+    if not intent.get("ap_enabled"):
+        return e  # 비활성이면 필드 검증 생략
+    ssid = str(intent.get("ap_ssid", ""))
+    if not ssid:
+        e.append("SSID is required.")
+    elif _blen(ssid) > AP_SSID_MAX:
+        e.append(f"SSID must be at most {AP_SSID_MAX} bytes.")
+    if any(c in ssid for c in FORBIDDEN):
+        e.append('SSID cannot contain ", \\, or #.')
+    psk = str(intent.get("ap_passphrase", ""))
+    if not (PSK_MIN <= _blen(psk) <= PSK_MAX):
+        e.append(f"Password must be {PSK_MIN}-{PSK_MAX} bytes.")
+    if any(c in psk for c in FORBIDDEN):   # '#' truncates the hostapd WPA key
+        e.append('Password cannot contain ", \\, or #.')
+    if any(ord(c) < 0x20 for c in (ssid + psk)):   # control chars (e.g. newline) → block hostapd conf injection
+        e.append("SSID/password cannot contain control characters (e.g. newline).")
+    band = str(intent.get("ap_band", "auto")).lower()
+    channel = intent.get("ap_channel", 0)
+    if band not in AP_BANDS:
+        e.append("AP band must be auto, 2g, or 5g.")
+    elif channel not in (0, None):
+        if band == "auto":
+            e.append("AP channel must be auto when AP band is auto.")
+        elif band == "2g" and channel not in CHANNELS_2G:
+            e.append("2.4 GHz AP channel is invalid.")
+        elif band == "5g" and channel not in CHANNELS_5G:
+            e.append("5 GHz AP channel is invalid.")
+    ap_ip = _ip(intent.get("ap_ip", ""))
+    s = _ip(intent.get("dhcp_start", "")); d = _ip(intent.get("dhcp_end", ""))
+    if not ap_ip:
+        e.append("AP IP address is invalid.")
+    if not s:
+        e.append("DHCP start address is invalid.")
+    if not d:
+        e.append("DHCP end address is invalid.")
+    if ap_ip and s and d:
+        net = ipaddress.IPv4Network(f"{ap_ip}/24", strict=False)
+        if s not in net or d not in net:
+            e.append("DHCP range is outside the AP subnet (/24).")
+        if int(s) > int(d):
+            e.append("DHCP start is greater than DHCP end.")
+        if s <= ap_ip <= d:
+            e.append("DHCP range overlaps the AP IP.")
+    lc = str(live_country or "").upper()
+    if country_pending:
+        e.append("Reboot required to apply the country code before enabling the AP.")
+    elif not (len(lc) == 2 and lc.isalpha()):
+        e.append("Cannot enable AP: no valid country regdomain.")
+    return e
diff --git a/src/network/apply_engine.py b/src/network/apply_engine.py
new file mode 100644
index 0000000..435a9d6
--- /dev/null
+++ b/src/network/apply_engine.py
@@ -0,0 +1,723 @@
+"""Apply 상태머신 (spec §5/§6). 단일 in-flight, 기준선=적용본(§1.2), DB-first 쓰기,
+엔진 자체 confirm TTL 타이머(§6.1), 크래시 복구, country deferred/즉시(전문가 §6.2)."""
+import json, os, threading, time
+
+from network import netmodel, renderer, snapshot, validator
+
+CONFIRM_TTL_S = 90       # §6.1
+APPLY_SERVICE_TIMEOUT = 75
+_ACTIVE = ("VALIDATING", "SNAPSHOT", "WRITING", "APPLYING", "VERIFYING", "ROLLING_BACK")
+
+def _read_file_default(path):
+    try:
+        with open(path, encoding="utf-8") as f:
+            return f.read()
+    except OSError:
+        return ""
+
+def _restrict(path, mode):
+    """#5/#10: best-effort 권한 제한 — apply_state.json 은 db_fields(wifi_passwd) 미포함이나
+    일관성·심층방어로 owner-only. Windows 에선 효과 제한적이나 raise 하지 않음."""
+    try:
+        os.chmod(path, mode)
+    except OSError:
+        pass
+
+def _default_timer_factory(delay, fn):
+    t = threading.Timer(delay, fn)
+    t.daemon = True   # minor: 미확정 confirm 타이머가 프로세스 종료를 막으면 안 됨
+    return t
+
+class ApplyEngine:
+    def __init__(self, db, net_dir, backups_dir, state_path, journal, runner,
+                 clock=time.monotonic, verify_fn=None, timer_factory=None,
+                 exists=None, read_file=None):
+        self.db = db; self.net_dir = net_dir; self.backups_dir = backups_dir
+        self.state_path = state_path; self.journal = journal
+        self.runner = runner; self.clock = clock
+        from network import verifier as _v
+        self.verify_fn = verify_fn or (lambda intent, ifaces, **k: _v.verify(intent, ifaces, runner=runner))
+        self.timer_factory = timer_factory or _default_timer_factory
+        self.exists = exists or os.path.exists
+        self.read_file = read_file or _read_file_default
+        self._lock = threading.Lock()
+        self._cur = None          # 진행 중/최근 apply 의 state dict
+        self._steps = []          # status 폴링용 [{phase,result,detail,t}]
+        self._confirm_timer = None
+        self._thread = None       # apply_async 의 작업 스레드
+        self._seq = 0             # minor: apply_id 동일 초 충돌 방지 (단조 증가, _lock 하 증가)
+        self._sleep = time.sleep  # I7: 주입 가능한 sleep — 테스트는 no-op 으로 교체
+        self._prior_country_pending = False   # I2: _begin 에서 직전 persist 값 보관
+        os.makedirs(backups_dir, exist_ok=True)
+
+    # ── helpers ──────────────────────────────────────────────
+    def _step(self, phase, result, detail="", apply_id=None):
+        self._steps.append({"phase": phase, "result": result, "detail": detail,
+                            "t": time.strftime("%H:%M:%S")})
+        self.journal.event("apply", phase=phase, action="step", result=result,
+                           apply_id=apply_id, detail={"detail": detail})
+
+    def _persist(self):
+        """C1: tmp 이름 per-call 고유 (worker/timer 동시 persist 충돌 방지) + fail-soft —
+        persist 실패가 apply 흐름/I9 finally 를 죽이면 안 됨 (저널 기록만)."""
+        tmp = self.state_path + f".tmp{os.getpid()}-{threading.get_ident()}"
+        try:
+            with open(tmp, "w", encoding="utf-8") as f:
+                json.dump(self._cur, f, ensure_ascii=False)
+            os.replace(tmp, self.state_path)
+            _restrict(self.state_path, 0o600)   # #5/#10: owner-only (심층방어)
+        except OSError as e:
+            self.journal.event("apply", phase=(self._cur or {}).get("state", "?"),
+                               action="persist_failed", result="fail",
+                               apply_id=(self._cur or {}).get("apply_id"),
+                               detail={"error": str(e)})
+
+    def _claim(self, from_states, to_state):
+        """C1: _lock 하 CAS 전이 — 현재 state 가 from_states 일 때만 to_state 로. 승자만 True.
+        confirm vs TTL 타이머처럼 같은 상태를 두 주체가 소비하는 race 의 단일 결정점."""
+        with self._lock:
+            if self._cur and self._cur["state"] in from_states:
+                self._cur["state"] = to_state
+                self._persist()
+                return True
+            return False
+
+    def _boot_id(self):
+        return self.read_file("/proc/sys/kernel/random/boot_id").strip() or "unknown"
+
+    def _baseline_intent(self):
+        """★ diff 기준선 = 적용본 network_config.json (§1.2). 부재/손상 → 전부-변경 취급.
+        DB vs DB 비교 금지 — Save 가 이미 DB 를 갱신하므로 Save→Apply 가 항상 NOOP 이 된다."""
+        try:
+            with open(os.path.join(self.net_dir, "network_config.json"), encoding="utf-8") as f:
+                return renderer.intent_from_persist(json.load(f))
+        except (OSError, ValueError):
+            return netmodel.intent_from_device({})
+
+    def _write_renders(self, intent, wpa_country=None):
+        # v1.9: wpa_country 지정 시 wpa conf 만 그 country 로 렌더(split-apply — country 변경을 다른
+        #   변경과 함께 적용할 때 wpa_cli reconfigure 가 새 regdomain 을 라이브로 새지 않게). 나머지
+        #   파일(wifi-country-code 마커·persist)은 intent(NEW) → country 는 reboot 시 firmware 적용.
+        wpa_it = intent
+        if wpa_country is not None:
+            wpa_it = {**intent, "wlan0": {**intent["wlan0"], "country_code": wpa_country}}
+        os.makedirs(self.net_dir, exist_ok=True)
+        for name, fn in renderer.RENDER_FILES.items():
+            body = fn(wpa_it if name == "wpa_supplicant-wlan0.conf" else intent)
+            dst = os.path.join(self.net_dir, name)
+            if name == "wifi-country-code" and body == "":
+                # I6: country 해제 — 기존 파일이 있으면 제거 (stale country 잔존 차단)
+                try:
+                    os.remove(dst)
+                except FileNotFoundError:
+                    pass
+                continue
+            tmp = dst + ".tmp"
+            with open(tmp, "w", encoding="utf-8", newline="") as f:
+                f.write(body)
+            os.replace(tmp, dst)
+
+    def _db_network_fields(self):
+        """I1: 스냅샷용 DB 필드 — 부재 키도 기록 (fmt 2). 롤백이 present 복원 + absent pop
+        하도록 하여, merge 복원이 '없던 키를 부활'시키는 결함을 차단.
+        v1.6.0 codex H1: 키 목록은 netmodel.NETWORK_DEV_KEYS 단일 출처에서 파생 —
+        net_routes write-allowlist 와 snapshot-keys 간 drift 차단 (정렬로 결정론적 출력)."""
+        dev = self.db.get_config("device_config") or {}
+        keys = sorted(netmodel.NETWORK_DEV_KEYS)
+        return {"fmt": 2,
+                "present": {k: dev[k] for k in keys if k in dev},
+                "absent": [k for k in keys if k not in dev]}
+
+    def _write_db(self, fields):
+        def mut(cur):
+            base = cur if isinstance(cur, dict) else {}
+            out = dict(base); out.update(fields)   # partial-merge (§4.1)
+            return out
+        self.db.update_config("device_config", mut, default={})
+
+    def _write_db_restore(self, present, absent):
+        """I1: 롤백 전용 — present 키 복원 + 스냅샷 시점 부재 키 pop."""
+        def mut(cur):
+            base = cur if isinstance(cur, dict) else {}
+            out = dict(base); out.update(present)
+            for k in absent:
+                out.pop(k, None)
+            return out
+        self.db.update_config("device_config", mut, default={})
+
+    def _run(self, argv, timeout, apply_id, must_ok=False):
+        t0 = self.clock()
+        rc, out = self.runner(argv, timeout)
+        self.journal.event("apply", phase="APPLYING", action=" ".join(argv[:3]),
+                           result="ok" if rc == 0 else "fail", apply_id=apply_id,
+                           duration_ms=int((self.clock() - t0) * 1000), detail={"rc": rc})
+        if must_ok and rc != 0:
+            raise RuntimeError(f"{argv[0]} rc={rc}")
+        return rc, out
+
+    def _cancel_timer(self):
+        if self._confirm_timer is not None:
+            try:
+                self._confirm_timer.cancel()
+            except Exception:   # noqa: BLE001
+                pass
+            self._confirm_timer = None
+
+    # AP: public accessor reused by ApEngine wiring (avoids calling _live_country directly)
+    def live_country(self, fast=False):
+        return self._live_country(fast=fast)
+
+    def _live_country(self, fast=False):
+        """라디오 실효 country (ground truth) — sysfs 모듈 파라미터 우선, iw reg 폴백.
+        ★ wpa_cli get country 는 wpa conf 렌더값일 뿐 라디오 실효값이 아님 → 사용 금지(거짓 양성).
+        하드닝 스크립트 live_country() 와 동일 출처. 미상이면 "" (게이팅 diff 폴백·country_now verify).
+        #9: fast=True → iw reg 단발(재시도 없음, hung 차단). 실 apply 경로는 fast=False 재시도."""
+        try:
+            if self.exists("/sys/module/wlan/parameters/country_code"):
+                s = (self.read_file("/sys/module/wlan/parameters/country_code") or "").strip().upper()
+                if len(s) == 2 and s.isalpha() and s != "00":
+                    return s
+        except Exception:   # noqa: BLE001 — fail-soft → iw reg 폴백
+            pass
+        attempts = 1 if fast else 3
+        for attempt in range(attempts):
+            rc, out = self.runner(["iw", "reg", "get"], 5)
+            if rc == 0:
+                for ln in (out or "").splitlines():
+                    t = ln.strip().upper()
+                    # "country XX:" — phy 실효 라인. global "country 00" 스킵.
+                    if t.startswith("COUNTRY ") and len(t) >= 10 and t[8:10].isalpha() and t[8:10] != "00":
+                        return t[8:10]
+            if attempt < attempts - 1:
+                self._sleep(2)
+        return ""
+
+    def _read_persisted_pending(self):
+        """I2: persist 된 country_pending 읽기 — fail-soft."""
+        try:
+            with open(self.state_path, encoding="utf-8") as f:
+                st = json.load(f)
+            return bool(st.get("country_pending")) if isinstance(st, dict) else False
+        except (OSError, ValueError):
+            return False
+
+    def _country_gate_errors(self, diff, new_it, country_now, prior_pending, fast=False):
+        """C2/§6.2 게이트 — _run_machine 과 dry_run 공용 (분기 분산 금지).
+        returns (errors, country_changed). 게이팅은 라이브 실효 변경 기준, live 미상이면 diff 폴백.
+        #9: fast 는 _live_country 로 전달 — dry_run(동기 HTTP)은 fast=True 단일 시도."""
+        errs = []
+        target_cc = new_it["wlan0"]["country_code"]
+        live_cc = self._live_country(fast=fast)
+        # v1.11.9 Fix 4: when live country is KNOWN, clearing it ('') is symmetric
+        # with setting it — any target != live (incl. an empty target) is a real
+        # change and must engage the wpa-restart/regdomain verify + country_pending.
+        # Previously `bool(target_cc) and ...` short-circuited a clear to False.
+        #   NOTE: the live-UNKNOWN fallback intentionally keeps `bool(target_cc) and`
+        #   so a CLEAR with no known live is NOT deferred (v1.9.1 FIX 2a decision;
+        #   guarded by test_country_gate_errors_clear_not_deferred and the
+        #   clear→wpa-reconfigure path in test_net_apply_engine).
+        if live_cc:
+            country_changed = target_cc != live_cc
+        else:
+            country_changed = bool(target_cc) and any(d["field"] == "wlan0.country_code" for d in diff)
+        if prior_pending and not country_now and diff:
+            # C2: 보류 country 가 있는 동안 추가 적용 동결 — deferral 분기로 새는 silent commit 차단
+            errs.append("country 변경이 재부팅 대기 중 (§6.2) — 추가 적용은 재부팅 후에, 또는 "
+                        "'country 지금 적용'(country_now) 동의로 보류분과 함께 적용")
+        # v1.9: mixed country+other (not country_now) 는 더이상 거절하지 않는다 — split-apply 로 처리 (호출측 split 판정).
+        return errs, country_changed
+
+    # ── public API ───────────────────────────────────────────
+    def dry_run(self, new_dev_fields, country_now=False):
+        cur = self._baseline_intent()
+        try:
+            cur_dev = self.db.get_config("device_config") or {}
+        except Exception:   # noqa: BLE001 — DB 읽기 실패 → 빈 기준 (500 누출 차단)
+            return {"diff": [], "errors": ["Cannot read device config"], "warnings": []}
+        new = netmodel.intent_from_device({**cur_dev, **new_dev_fields})
+        diff = netmodel.diff_intents(cur, new)
+        errs, warns = validator.validate(new)
+        errs = list(errs)
+        if diff:   # minor: 실 적용과 동일 게이트를 미리 노출 — dry_run OK 인데 apply 거절 divergence 방지
+            # #9: dry_run 은 동기 HTTP — fast=True 로 hung wpa_cli HTTP 블록(~19s) 차단
+            try:
+                gate_errs, country_changed_dr = self._country_gate_errors(diff, new, country_now,
+                                                                           self.country_pending(), fast=True)
+            except Exception:   # noqa: BLE001 — country gate 실패 → 안전 오류 메시지
+                gate_errs = ["Cannot evaluate country gate"]
+            errs.extend(gate_errs)
+        warnings = list(warns)
+        ifaces = netmodel.changed_interfaces(diff)
+        if "eth1" in ifaces: warnings.append("eth1_confirm")
+        # country_now=True forces a full wpa_supplicant restart for a country
+        # change too — surface the same wifi_disrupt warning (honesty).
+        if netmodel.wpa_relevant(diff) or (
+                country_now and any(d["field"] == "wlan0.country_code" for d in diff)):
+            warnings.append("wifi_disrupt")
+        if any(d["field"] == "wlan0.country_code" for d in diff): warnings.append("country_reboot_deferred")
+        split_country = (diff and any(d["field"] == "wlan0.country_code" for d in diff)
+                         and not country_now and len(diff) > 1 and not self.country_pending())
+        if split_country:
+            warnings.append("country_split_deferred")
+        if any(d["field"] in ("wlan0.dns1", "wlan0.dns2") for d in diff):
+            warnings.append("dns_saved_only")   # §12-3: dead field — 저장만 됨
+        if self.country_pending(): warnings.append("country_deferred_pending")   # §6.2 보류 동반적용 고지
+        return {"diff": diff, "errors": errs, "warnings": warnings}
+
+    def _begin(self, force, country_now):
+        with self._lock:
+            if self._cur and self._cur["state"] in _ACTIVE + ("CONFIRM_WAIT",):
+                return {"state": "BUSY", "apply_id": self._cur["apply_id"]}
+            # I2: 직전 persist 의 country_pending 보존 — NOOP/FAILED_VALIDATION persist 가 wipe 못 하게
+            self._prior_country_pending = self._read_persisted_pending()
+            self._seq += 1
+            apply_id = f"ap-{time.strftime('%Y%m%d-%H%M%S')}-{int(self.clock()) % 1000}-{self._seq}"
+            self._steps = []
+            self._cur = {"apply_id": apply_id, "state": "VALIDATING", "force": bool(force),
+                         "country_now": bool(country_now),
+                         "started_monotonic": self.clock(), "confirm_deadline_monotonic": None,
+                         "changed_ifaces": [], "wpa_changed": False, "country_changed": False,
+                         "country_pending": self._prior_country_pending,
+                         "snapshot_dir": None, "boot_id": self._boot_id()}
+            self._persist()
+            return {"state": "STARTED", "apply_id": apply_id}
+
+    def apply(self, new_dev_fields, force=False, country_now=False):
+        """동기 실행 — 단위테스트·내부용."""
+        pre = self._begin(force, country_now)
+        if pre["state"] == "BUSY":
+            return pre
+        return self._run_protected(new_dev_fields)
+
+    def apply_async(self, new_dev_fields, force=False, country_now=False):
+        """§1.6: apply_id 즉시 반환 후 데몬 스레드 실행 — eth1 IP 변경 시 구 연결로 응답 보장."""
+        pre = self._begin(force, country_now)
+        if pre["state"] == "BUSY":
+            return pre
+        self._thread = threading.Thread(target=self._run_protected, args=(new_dev_fields,),
+                                        daemon=True, name="net-apply")
+        self._thread.start()
+        return pre   # {"state": "STARTED", "apply_id": ...}
+
+    def _run_protected(self, new_dev_fields):
+        try:
+            try:
+                return self._run_machine(new_dev_fields)
+            except Exception as e:   # noqa: BLE001 — 예기치 못한 실패도 롤백 시도
+                aid = self._cur["apply_id"]
+                if self._cur.get("snapshot_dir") is None:
+                    # I3: 스냅샷 전 예외 = 라이브 무접촉 — 거짓 FAILED_CRITICAL/recover 유닛 금지
+                    with self._lock:
+                        self._cur["state"] = "ABORTED"
+                        self._persist()
+                    self.journal.event("apply", phase="ABORTED", action="aborted_pre_snapshot",
+                                       result="warn", apply_id=aid, detail={"error": str(e)})
+                    self._step("ABORTED", "warn", f"pre-snapshot: {e}", aid)
+                    return {"state": "ABORTED", "apply_id": aid, "reason": str(e)}
+                self._step("ROLLING_BACK", "fail", f"unexpected: {e}", aid)
+                claimed = self._claim(_ACTIVE, "ROLLING_BACK")   # C1
+                return self._rollback(reason=str(e), claimed=claimed)
+        finally:
+            # I9: 워커는 절대 active state 로 죽지 않는다 — terminal 보장 (persist 는 fail-soft)
+            with self._lock:
+                if self._cur and self._cur["state"] in _ACTIVE:
+                    self._cur["state"] = "FAILED_CRITICAL"
+                    self.journal.event("apply", phase="FAILED_CRITICAL",
+                                       action="worker_died_mid_state", result="fail",
+                                       apply_id=self._cur.get("apply_id"))
+                    self._persist()
+
+    def _run_machine(self, new_dev_fields):
+        cur_dev = self.db.get_config("device_config") or {}
+        cur_it = self._baseline_intent()                                   # ★ 적용본 기준 (§1.2)
+        new_it = netmodel.intent_from_device({**cur_dev, **new_dev_fields})
+        aid = self._cur["apply_id"]
+        country_now = self._cur["country_now"]
+        prior_pending = self._prior_country_pending                        # I2: _begin 에서 보관
+        # VALIDATING
+        diff = netmodel.diff_intents(cur_it, new_it)
+        if not diff:
+            self._cur["state"] = "NOOP"; self._persist()   # country_pending 은 prior 보존 (I2)
+            self._step("VALIDATING", "ok", "no change (적용본 == DB)", aid)
+            return {"state": "NOOP", "apply_id": aid}
+        errs, warns = validator.validate(new_it)
+        errs = list(errs)
+        # §6.2 게이팅은 "라이브 대비 실효 변경" 기준 — 캡처 확정: apply.service(dpworld-network-apply.sh)
+        # 가 country 변경 시 wlan 모듈을 리로드(10-20s 단절)하므로, 단절이 실제 발생할 때만 게이트.
+        # 첫 적용(baseline 부재)은 live==DB country 라 게이트 비발동. live 미상이면 diff 기준 보수 폴백.
+        # C2: 보류 country 동결 게이트 포함 — dry_run 과 공용 헬퍼 (분기 분산 금지).
+        gate_errs, country_changed = self._country_gate_errors(diff, new_it, country_now, prior_pending)
+        errs.extend(gate_errs)
+        if errs:
+            self._cur["state"] = "FAILED_VALIDATION"; self._persist()
+            self._step("VALIDATING", "fail", "; ".join(errs), aid)
+            return {"state": "FAILED_VALIDATION", "apply_id": aid, "errors": errs}
+        # v1.9: mixed country+other (not country_now, prior_pending 아님) → split-apply.
+        split_country = (country_changed and not country_now and len(diff) > 1
+                         and not prior_pending)
+        # I6: country 변경(해제 포함)은 wpa conf 헤더가 바뀌므로 wpa reconfigure 필요
+        wpa_changed = netmodel.wpa_relevant(diff) or any(d["field"] == "wlan0.country_code" for d in diff)
+        self._cur.update({"changed_ifaces": netmodel.changed_interfaces(diff),
+                          "wpa_changed": wpa_changed,
+                          "country_changed": country_changed,
+                          "country_target": new_it["wlan0"]["country_code"]})   # #7: 롤백 stuck 검증용
+        self._step("VALIDATING", "ok",
+                   f"{len(diff)} fields" + (" [force]" if self._cur["force"] else ""), aid)   # §5.3 force 명시
+        if any(d["field"] in ("wlan0.dns1", "wlan0.dns2") for d in diff):
+            self.journal.event("apply", phase="VALIDATING", action="dns_saved_only", result="warn",
+                               apply_id=aid, detail={"note": "dns1/dns2 는 현 펌웨어 미적용 (§12-3)"})
+        # SNAPSHOT
+        self._cur["state"] = "SNAPSHOT"; self._persist()
+        snap = snapshot.take(self.net_dir, self.backups_dir, aid, self._db_network_fields())
+        self._cur["snapshot_dir"] = snap; self._persist()
+        self._step("SNAPSHOT", "ok", snap, aid)
+        # WRITING — DB-first (§4.1)
+        self._cur["state"] = "WRITING"; self._persist()
+        self._write_db(new_dev_fields)
+        if split_country:
+            # wpa conf 는 적용본(OLD) country 로 — 비country 적용 시 regdomain 라이브 누출 방지.
+            self._write_renders(new_it, wpa_country=cur_it["wlan0"]["country_code"])
+            self._cur["country_pending"] = True
+        else:
+            self._write_renders(new_it)
+        self._step("WRITING", "ok", "db+json+renders" + (" [split]" if split_country else ""), aid)
+        # country-only + 미지정 → deferred (§6.2): apply.service 미기동
+        # C2: deferral 은 diff 가 정확히 country 단독일 때만 — 다른 필드가 이 분기로 새어
+        # "COMMITTED 인데 미적용" 이 되는 lockout hole 차단 (혼합은 위 게이트에서 이미 거절)
+        if country_changed and not country_now \
+                and len(diff) == 1 and diff[0]["field"] == "wlan0.country_code":
+            self._cur.update({"state": "COMMITTED", "country_pending": True}); self._persist()
+            self._lkg_bookkeeping(aid)
+            self._step("COMMITTED", "ok", "country deferred — reboot required", aid)
+            return {"state": "COMMITTED", "apply_id": aid, "country_pending": True}
+        # APPLYING (§5 ①②③)
+        self._cur["state"] = "APPLYING"; self._persist()
+        # DEF-2a: apply.service 는 best-effort — Requires=dpworld-network-seed.service (boot-only
+        # oneshot) のため再부팅 후 온디맨드 호출 시 "Dependency failed" rc=1 (.56 실측).
+        # 우리의 render 쓰기 + networkctl reload/reconfigure 가 실제 적용 수단이므로 apply.service
+        # 실패는 WARN 기록 후 계속. VERIFY 가 실 게이트 — 진짜 실패 시 verify fail → 롤백.
+        rc_apply, _ = self._run(["systemctl", "start", "dpworld-network-apply.service"],
+                                APPLY_SERVICE_TIMEOUT, aid, must_ok=False)
+        if rc_apply != 0:
+            self.journal.event("apply", phase="APPLYING", action="apply_service_degraded",
+                               result="warn", apply_id=aid,
+                               detail={"rc": rc_apply, "note": "seed dependency — non-fatal, networkctl handles apply"})
+        self._run(["networkctl", "reload"], 15, aid)
+        for ifc in self._cur["changed_ifaces"]:
+            if ifc in ("wlan0", "eth0", "eth1"):
+                self._run(["networkctl", "reconfigure", ifc], 15, aid)
+        if self._cur["wpa_changed"]:
+            rc, _ = self._run(["wpa_cli", "-i", "wlan0", "reconfigure"], 10, aid)
+            if rc != 0:
+                self._run(["systemctl", "try-restart", "wpa_supplicant@wlan0.service"], 30, aid)
+        if country_changed and country_now:
+            # §6.2 전문가 즉시 적용: apply.service 가 modprobe.d 갱신+모듈 리로드 수행 (캡처 확정)
+            # → wpa 재기동(conf 헤더 country) 후 강화 검증 사다리
+            self._run(["systemctl", "restart", "wpa_supplicant@wlan0.service"], 30, aid)
+            target = new_it["wlan0"]["country_code"]
+            if not self.exists("/sys/module/wlan"):
+                return self._rollback_from(("APPLYING",), "country_now: /sys/module/wlan 부재 (§6.2)")
+            if not self.exists("/sys/class/net/wlan0"):
+                return self._rollback_from(("APPLYING",), "country_now: wlan0 netdev 부재 (§6.2)")
+            live = self._live_country()   # iw reg / sysfs — 라디오 실효 regdomain (v1.9.1: wpa_cli 아님)
+            if live != target:
+                return self._rollback_from(("APPLYING",),
+                                           f"country_now: live {live!r} != 목표 {target!r} (§6.2)")
+            # C2: 보류분 동반 적용 확인 — pending 해소 (이후 _persist 들이 False 를 기록)
+            self._cur["country_pending"] = False
+        self._step("APPLYING", "ok", "", aid)
+        # VERIFYING
+        self._cur["state"] = "VERIFYING"; self._persist()
+        _deferred_cc = cur_it["wlan0"]["country_code"] if split_country else None
+        vres = self.verify_fn(new_it, self._cur["changed_ifaces"], deferred_country=_deferred_cc)
+        self._step("VERIFYING", vres["result"], json.dumps(vres["checks"], ensure_ascii=False)[:500], aid)
+        if vres["result"] == "fail":
+            if not self._cur["force"]:
+                return self._rollback_from(("VERIFYING",), "verify failed")   # C1: claim 후 본문
+            self.journal.event("apply", phase="VERIFYING", action="force_commit", result="warn",
+                               apply_id=aid, detail={"note": "verify fail 을 force 로 무시 (§5.3)"})
+        # eth1 → CONFIRM_WAIT (§6.1) — 엔진 자체 타이머가 1차 만료 보장
+        if "eth1" in self._cur["changed_ifaces"]:
+            self._cur.update({"state": "CONFIRM_WAIT",
+                              "confirm_deadline_monotonic": self.clock() + CONFIRM_TTL_S})
+            self._persist()
+            self._confirm_timer = self.timer_factory(CONFIRM_TTL_S + 1, self.tick)
+            self._confirm_timer.start()
+            self._step("CONFIRM_WAIT", "ok", f"TTL {CONFIRM_TTL_S}s", aid)
+            return {"state": "CONFIRM_WAIT", "apply_id": aid}
+        return self._commit()
+
+    def _commit(self):
+        aid = self._cur["apply_id"]
+        self._cancel_timer()
+        self._cur.update({"state": "COMMITTED", "confirm_deadline_monotonic": None}); self._persist()
+        self._lkg_bookkeeping(aid)   # I4: fail-soft — 북키핑 실패가 COMMITTED 를 못 뒤집게
+        self._step("COMMITTED", "ok", "", aid)
+        return {"state": "COMMITTED", "apply_id": aid,
+                "country_pending": self._cur.get("country_pending", False)}
+
+    def _lkg_bookkeeping(self, aid):
+        """I4: LKG 마킹/prune 은 부가 북키핑 — 실패해도 COMMITTED 유지, 저널 warn 만."""
+        try:
+            snapshot.mark_last_known_good(self.backups_dir, aid)
+            snapshot.prune(self.backups_dir)
+        except Exception as e:   # noqa: BLE001
+            self.journal.event("apply", phase="COMMITTED", action="lkg_bookkeeping_failed",
+                               result="warn", apply_id=aid, detail={"error": str(e)})
+
+    def _rollback_from(self, from_states, reason):
+        """C1: from_states→ROLLING_BACK 선점(claim) 후 본문 — 선점 실패여도 본문 자체 가드가 멱등 보장."""
+        claimed = self._claim(from_states, "ROLLING_BACK")
+        return self._rollback(reason=reason, claimed=claimed)
+
+    def _rollback(self, reason="", claimed=False):
+        with self._lock:
+            aid = self._cur["apply_id"]
+            # C1: 멱등 가드 — 이미 종결된 apply 에 재진입 금지 (double-rollback/commit 후 rollback 차단)
+            if self._cur["state"] in ("ROLLED_BACK", "FAILED_CRITICAL", "COMMITTED"):
+                return {"state": self._cur["state"], "apply_id": aid}
+            if not claimed:
+                self._cur["state"] = "ROLLING_BACK"; self._persist()
+        self._cancel_timer()
+        self._step("ROLLING_BACK", "warn", reason, aid)
+        try:
+            try:
+                snap = self._cur.get("snapshot_dir")
+                if not snap or not snapshot.verify(snap):
+                    raise RuntimeError("snapshot missing/corrupt")
+                with open(os.path.join(snap, "db_fields.json"), encoding="utf-8") as _f:
+                    db_snap = json.load(_f)
+                # I1: fmt 2 — present 복원 + absent pop. fmt-less 구형 스냅샷은 전체를 present 로 취급
+                if isinstance(db_snap, dict) and db_snap.get("fmt") == 2:
+                    present = db_snap.get("present") or {}
+                    absent = db_snap.get("absent") or []
+                else:
+                    present, absent = (db_snap if isinstance(db_snap, dict) else {}), []
+                self._write_db_restore(present, absent)         # DB-first (§4.1)
+                # #4: 빈 baseline 스냅샷(fresh-flash) 감지 — restore_files 가 적용본을 유지하므로
+                # FAILED_CRITICAL 로 에스컬레이트하지 않는다 (운영자 연결 유지가 안전). 저널 warn.
+                try:
+                    with open(os.path.join(snap, "manifest.json"), encoding="utf-8") as _f:
+                        _man = json.load(_f)
+                    _empty_baseline = not _man.get("files")
+                except (OSError, ValueError):
+                    _empty_baseline = False
+                if _empty_baseline:
+                    self.journal.event("apply", phase="ROLLING_BACK",
+                                       action="rollback_empty_baseline_kept_renders", result="warn",
+                                       apply_id=aid,
+                                       detail={"note": "빈 baseline 스냅샷 — 적용본 렌더 유지 (eth1 lockout 방지)"})
+                snapshot.restore_files(snap, self.net_dir)
+                # 재적용 — rollback re-apply: apply.service 는 best-effort (DEF-2a 동일 이유).
+                # rollback re-verify 가 실 게이트 — verify fail → FAILED_CRITICAL (올바른 동작).
+                rc_rb_apply, _ = self._run(["systemctl", "start", "dpworld-network-apply.service"],
+                                           APPLY_SERVICE_TIMEOUT, aid, must_ok=False)
+                if rc_rb_apply != 0:
+                    self.journal.event("apply", phase="ROLLING_BACK", action="apply_service_degraded",
+                                       result="warn", apply_id=aid,
+                                       detail={"rc": rc_rb_apply, "note": "rollback re-apply best-effort"})
+                self._run(["networkctl", "reload"], 15, aid)
+                for ifc in self._cur["changed_ifaces"]:
+                    if ifc in ("wlan0", "eth0", "eth1"):
+                        self._run(["networkctl", "reconfigure", ifc], 15, aid)
+                if self._cur["wpa_changed"]:
+                    self._run(["wpa_cli", "-i", "wlan0", "reconfigure"], 10, aid)
+                # 재검증 — §5: 복원이 실제로 살아났는지 확인.
+                # A-3 결함 2 fix: 기준 = 복원된 persist. Save-then-Apply drift flow 에선 DB 가
+                # apply 전에 이미 변경 → 스냅샷 db_fields = NEW 값 → 그 기준 재검증은 복원된
+                # 라이브(OLD)와 영원히 불일치 → 가짜 FAILED_CRITICAL. persist 판독 불가 시에만 폴백.
+                try:
+                    with open(os.path.join(self.net_dir, "network_config.json"),
+                              encoding="utf-8") as f:
+                        restored_it = renderer.intent_from_persist(json.load(f))
+                except (OSError, ValueError):
+                    restored_it = netmodel.intent_from_device(present)
+                rres = self.verify_fn(restored_it, self._cur["changed_ifaces"])
+                if rres["result"] == "fail":
+                    raise RuntimeError(f"rollback re-verify failed: {json.dumps(rres['checks'])[:200]}")
+                # #7: country 변경 apply 의 롤백은 라디오 실효 country 도 검증해야 한다.
+                # verify_fn 은 country 를 보지 않으므로, wlan 모듈 리로드 실패(apply.service
+                # best-effort rc unchecked) 시 라디오가 NEW(target) country 에 갇힌 채 ROLLED_BACK
+                # 로 거짓 보고될 수 있다. 라이브가 (복원된 OLD 가 아닌) 이번에 적용 시도한 NEW
+                # target 그대로면 라디오가 되돌아가지 못한 것 → FAILED_CRITICAL 로 에스컬레이트
+                # (forward country_now 경로의 대칭). NEW==restored 인 deferred-미적용 케이스는
+                # 라디오가 NEW 를 잡은 적이 없으므로 false positive 회피.
+                if self._cur.get("country_changed"):
+                    restored_cc = (restored_it.get("wlan0") or {}).get("country_code", "")
+                    target_cc = self._cur.get("country_target", "")
+                    if restored_cc and target_cc and target_cc != restored_cc:
+                        live_cc = self._live_country()
+                        if live_cc == target_cc:
+                            raise RuntimeError(
+                                f"rollback: radio country stuck at {live_cc} != restored {restored_cc}")
+                # v1.9: split-apply 의 speculative country_pending 을 롤백 시 원복 — 롤백은 country 를
+                #   커밋하지 않았으므로(파일=OLD 복원) pending 은 이 시도 이전 값으로 되돌린다. 안 하면
+                #   stale country_pending=True 가 freeze 게이트를 영구 발동(reboot 없는데도) → deadlock.
+                self._cur["country_pending"] = self._prior_country_pending
+                self._cur["state"] = "ROLLED_BACK"; self._persist()
+                # 의도된 UX: DB 는 스냅샷(=user-saved) 값 그대로 — persist 와 다르면 실패한 변경이
+                # drift 로 남아 재시도 가능. 저널로 명시 고지 (fail-soft — 롤백 결과 불변).
+                try:
+                    db_it = netmodel.intent_from_device(self.db.get_config("device_config") or {})
+                    drift = netmodel.diff_intents(restored_it, db_it)
+                    if drift:
+                        self.journal.event("apply", phase="ROLLED_BACK", action="rollback_left_drift",
+                                           result="warn", apply_id=aid,
+                                           detail={"fields": [d["field"] for d in drift],
+                                                   "note": "user-saved 변경이 drift 로 남음 — 재시도 가능"})
+                except Exception:   # noqa: BLE001
+                    pass
+                self._step("ROLLED_BACK", "ok", "", aid)
+                return {"state": "ROLLED_BACK", "apply_id": aid, "reason": reason}
+            except Exception as e:   # noqa: BLE001
+                # 마지막 사다리 (§6.2/§7): recover 유닛 1회 — 그래도 안 되면 CRITICAL
+                try:
+                    self._run(["systemctl", "start", "dpworld-net-recover.service"], 60, aid)
+                except Exception:   # noqa: BLE001
+                    pass
+                self._cur["state"] = "FAILED_CRITICAL"; self._persist()
+                self._step("FAILED_CRITICAL", "fail", str(e), aid)
+                return {"state": "FAILED_CRITICAL", "apply_id": aid, "reason": f"{reason}; rollback: {e}"}
+        finally:
+            # v1.6.0 Task 3.3: 포렌식 번들 — ROLLED_BACK / FAILED_CRITICAL 모두 수집
+            try:
+                from network.journal import forensic_bundle
+                forensic_bundle(self.backups_dir, aid, lambda a, t=15: self.runner(a, t),
+                                render_dir=self.net_dir)
+            except Exception:   # noqa: BLE001 — 포렌식 실패가 롤백 결과를 바꾸면 안 됨
+                pass
+
+    def confirm(self, apply_id):
+        with self._lock:
+            if not self._cur or self._cur["apply_id"] != apply_id \
+                    or self._cur["state"] != "CONFIRM_WAIT":
+                return {"state": "INVALID", "error": "no matching CONFIRM_WAIT apply"}
+            return self._commit()
+
+    def tick(self):
+        """CONFIRM_WAIT TTL 검사 — 엔진 타이머(1차)·watchdog·status 폴링(안전망) 공용 (§6.1).
+        C1: claim(CAS) 승자만 롤백 본문 실행 — confirm 과의 race 에서 이중 소비 차단."""
+        with self._lock:
+            if not (self._cur and self._cur["state"] == "CONFIRM_WAIT"):
+                return
+            dl = self._cur.get("confirm_deadline_monotonic")
+            if dl is None or self.clock() < dl:
+                return
+        if not self._claim(("CONFIRM_WAIT",), "ROLLING_BACK"):
+            return   # confirm 이 먼저 소비 (또는 타 tick 선점)
+        self._rollback(reason="confirm TTL expired", claimed=True)
+
+    def is_busy(self):
+        return bool(self._cur and self._cur["state"] in _ACTIVE)
+
+    def is_busy_or_confirming(self):
+        """I1a: watchdog 억제용 — CONFIRM_WAIT 중 복구 사다리가 eth1 확인 대기를 침범 금지 (§6.1/§8)."""
+        return bool(self._cur and self._cur["state"] in _ACTIVE + ("CONFIRM_WAIT",))
+
+    def rollback_to_lkg(self):
+        """수동 rollback API (§5.1) — last-known-good 스냅샷으로.
+        C3: in-flight apply/CONFIRM_WAIT 중엔 BUSY — 진행 중 apply 의 _cur 강탈 금지."""
+        with self._lock:
+            if self._cur and self._cur["state"] in _ACTIVE + ("CONFIRM_WAIT",):
+                return {"state": "BUSY", "apply_id": self._cur["apply_id"]}
+            lkg = snapshot.last_known_good(self.backups_dir)
+            if not lkg:
+                return {"state": "INVALID", "error": "no last-known-good"}
+            self._cur = {"apply_id": f"rb-{lkg}", "state": "ROLLING_BACK", "force": False,
+                         "country_now": False,
+                         "started_monotonic": self.clock(), "confirm_deadline_monotonic": None,
+                         "changed_ifaces": ["wlan0", "eth0", "eth1"], "wpa_changed": True,
+                         "country_changed": False, "country_pending": False,
+                         "snapshot_dir": os.path.join(self.backups_dir, lkg),
+                         "boot_id": self._boot_id()}
+            # v1.11.10 Fix 2: a manual LKG rollback never went through _begin(), so
+            #   self._prior_country_pending may carry a stale True from an earlier
+            #   apply. _rollback() restores _cur["country_pending"] from it (§v1.9
+            #   split-apply unwind) → a stale True permanently jams the freeze gate.
+            #   Reset it here (inside the lock, mirroring _begin's establishment).
+            self._prior_country_pending = False
+            self._persist()
+        return self._rollback(reason="manual rollback to LKG", claimed=True)
+
+    def status(self, apply_id=None):
+        # C4: _lock 하 스냅샷 — _begin()/_run_machine() 이 _cur 을 교체하는 것과의 race 차단.
+        # watchdog tick_once 가 apply_id 를 읽어 streak 리셋 여부를 판단하므로
+        # 일관된 스냅샷이 필요하다. _lock 은 재진입 불가이나 status() 내부에서 _lock 을
+        # 다시 잡는 호출(country_pending → _read_persisted_pending → open)은 없으므로 안전.
+        with self._lock:
+            cur_snap = dict(self._cur) if self._cur is not None else None
+            steps_snap = list(self._steps)
+        # minor: 다른 apply_id 조회는 UNKNOWN — 현재 apply 의 상태를 남의 id 로 오인 금지
+        if apply_id and cur_snap and apply_id != cur_snap.get("apply_id"):
+            return {"apply_id": apply_id, "state": "UNKNOWN", "steps": [],
+                    "confirm_remaining_s": None, "country_pending": self.country_pending()}
+        cur = cur_snap or {"state": "IDLE", "apply_id": None}
+        remaining = None
+        if cur.get("state") == "CONFIRM_WAIT" and cur.get("confirm_deadline_monotonic"):
+            remaining = max(0, int(cur["confirm_deadline_monotonic"] - self.clock()))
+        return {"apply_id": cur.get("apply_id"), "state": cur.get("state", "IDLE"),
+                "steps": steps_snap, "confirm_remaining_s": remaining,
+                "country_pending": self.country_pending()}
+
+    def country_pending(self):
+        if self._cur is not None:
+            return bool(self._cur.get("country_pending"))
+        return self._read_persisted_pending()
+
+    def recover_on_startup(self, block=False):
+        """server 시작 시: ① country_pending 해소 검사 ② 미완료 apply 복구 (§5 크래시 안전).
+
+        #1/#3 HIGH: 느린 _rollback(subprocess — apply.service 75s + wpa 45s + recover 60s +
+        forensic) 을 동기로 돌리면 HTTP bind/serve_forever 를 분 단위로 막아 운영자 lockout.
+        fw_controller 의 startup recovery 데몬 스레드 비대칭을 미러링 — 빠른 판정(파일 read)만
+        인라인, 느린 롤백은 데몬 스레드로 띄우고 즉시 True 반환(복구 INITIATED).
+        block=True (테스트) → _rollback 을 인라인 실행해 terminal state 를 동기 검증 가능."""
+        try:
+            with open(self.state_path, encoding="utf-8") as _f:
+                st = json.load(_f)
+        except (OSError, ValueError):
+            return False
+        if not isinstance(st, dict):   # minor: 손상/이형 state 파일 내성
+            return False
+        try:
+            # ① 재부팅으로 country 가 실제 적용됐으면 pending 해제 — watchdog 영구 억제 방지 (§8)
+            #    #9: fast=True — hung iw reg 가 startup 을 블록하지 못하게 (단일 시도)
+            if st.get("country_pending"):
+                target = self._baseline_intent()["wlan0"].get("country_code", "")
+                live = self._live_country(fast=True)
+                # deferred country 적용 확인: 비움(clear)은 live 가 default(빈/00)로 떨어지면 충족.
+                if (target and live == target) or (not target and (not live or live == "00")):
+                    st["country_pending"] = False
+                    self._cur = st; self._persist()
+                    self.journal.event("apply", phase="RECOVER", action="country_pending_cleared",
+                                       result="ok", apply_id=st.get("apply_id"),
+                                       detail={"country": target})
+            # ② 미완료 apply
+            state = st.get("state")
+            if state in ("VALIDATING", "SNAPSHOT"):
+                # 파일·DB 무접촉 단계의 크래시 — 변경 0. 거짓 FAILED_CRITICAL 금지, ABORTED 마킹만
+                # (subprocess 없음 — 인라인 유지)
+                st["state"] = "ABORTED"
+                self._cur = st; self._persist()
+                self.journal.event("apply", phase="RECOVER", action="aborted_no_change", result="warn",
+                                   apply_id=st.get("apply_id"), detail={"from": state})
+                return True
+            if state in ("WRITING", "APPLYING", "VERIFYING", "CONFIRM_WAIT", "ROLLING_BACK"):
+                self.journal.event("apply", phase="RECOVER", action="startup_found_unfinished",
+                                   result="warn", apply_id=st.get("apply_id"),
+                                   detail={"state": state, "stale_boot": st.get("boot_id") != self._boot_id()})
+                self._cur = st
+                self._persist()   # transient marker — _cur 세팅을 즉시 영속화
+                if block:
+                    # 테스트/동기 경로: 인라인 롤백 → terminal state 동기 검증
+                    self._rollback(reason=f"startup recovery from {state}")
+                    return True
+                # #1/#3: 느린 롤백을 데몬 스레드로 — HTTP bind 즉시 가능. True=복구 INITIATED.
+                self._thread = threading.Thread(
+                    target=lambda: self._rollback(reason=f"startup recovery from {state}"),
+                    daemon=True, name="net-startup-recover")
+                self._thread.start()
+                return True
+            return False
+        except (TypeError, AttributeError):   # minor: 이형 st 필드로 인한 crash 방지
+            return False
diff --git a/src/network/journal.py b/src/network/journal.py
new file mode 100644
index 0000000..fe25e69
--- /dev/null
+++ b/src/network/journal.py
@@ -0,0 +1,159 @@
+# src/network/journal.py
+"""JSONL 네트워크 이벤트 저널 (spec §9). 1줄 1이벤트, 5MB×3 로테이션, psk/password 마스킹.
+v1.6.0 Task 3.3: forensic_bundle() 추가 (적용 실패/롤백/CRITICAL 시 증거 tar.gz 수집)."""
+import io, json, os, re, tarfile, threading, time
+
+_MASK_KEYS = frozenset({"password", "psk", "wifi_passwd"})
+
+def _restrict(path, mode):
+    """#5/#10: best-effort 권한 제한 — 저널은 마스킹되지만 detail 잔여 민감정보 방어.
+    Windows 에선 효과 제한적이나 raise 하지 않음."""
+    try:
+        os.chmod(path, mode)
+    except OSError:
+        pass
+
+def _boot_id():
+    try:
+        with open("/proc/sys/kernel/random/boot_id") as f:
+            return f.read().strip()
+    except OSError:
+        return "unknown"
+
+def _uptime():
+    try:
+        with open("/proc/uptime") as f:
+            return float(f.read().split()[0])
+    except (OSError, ValueError):
+        return -1.0
+
+def _mask(obj):
+    if isinstance(obj, dict):
+        return {k: ("***" if k in _MASK_KEYS else _mask(v)) for k, v in obj.items()}
+    if isinstance(obj, (list, tuple)):  # M1: recurse into tuples too
+        return [_mask(v) for v in obj]
+    return obj
+
+class Journal:
+    def __init__(self, path, max_bytes=5 * 1024 * 1024, keep=3):
+        self.path = path; self.max_bytes = max_bytes; self.keep = keep
+        self._lock = threading.Lock()
+        self.last_error = None  # I6: stores last OSError message, None if no error
+        os.makedirs(os.path.dirname(path) or ".", exist_ok=True)
+
+    def event(self, category, phase, action, result, apply_id=None, duration_ms=None, detail=None):
+        """I6: must never raise — OSError during rotate/write is caught, stored in last_error."""
+        line = {"ts": time.strftime("%Y-%m-%dT%H:%M:%S%z"), "uptime": _uptime(), "boot_id": _boot_id(),
+                "apply_id": apply_id, "category": category, "phase": phase, "action": action,
+                "result": result, "duration_ms": duration_ms, "detail": _mask(detail or {})}
+        data = json.dumps(line, ensure_ascii=False) + "\n"
+        try:
+            with self._lock:
+                self._rotate_if_needed(len(data))
+                with open(self.path, "a", encoding="utf-8") as f:
+                    f.write(data)
+                _restrict(self.path, 0o600)   # #5/#10: owner-only (생성·append 매 회 best-effort)
+        except OSError as e:
+            self.last_error = str(e)
+            return
+
+    def _rotate_if_needed(self, incoming):
+        try:
+            size = os.path.getsize(self.path)
+        except OSError:
+            return
+        if size + incoming <= self.max_bytes:
+            return
+        for i in range(self.keep, 0, -1):
+            src = self.path if i == 1 else f"{self.path}.{i-1}"
+            dst = f"{self.path}.{i}"
+            if os.path.exists(src):
+                os.replace(src, dst)
+                _restrict(dst, 0o600)   # #5/#10: 로테이션 파일도 owner-only
+
+    def tail(self, n):
+        # M2: intentionally reads WITHOUT the lock — diagnostic; torn line tolerated, json.loads skips it.
+        # Collect lines from live file + rotated files (newest first) until we have n
+        all_lines = []
+        paths = [self.path] + [f"{self.path}.{i}" for i in range(1, self.keep + 1)]
+        for p in paths:
+            try:
+                with open(p, encoding="utf-8") as f:
+                    all_lines = f.readlines() + all_lines
+            except OSError:
+                pass
+            if len(all_lines) >= n:
+                break
+        out = []
+        for ln in all_lines[-n:]:
+            try:
+                out.append(json.loads(ln))
+            except ValueError:
+                continue
+        return out
+
+
+def forensic_bundle(out_dir, apply_id, runner, render_dir=None,
+                    max_bytes=2 * 1024 * 1024, keep=5,
+                    clock=time.monotonic, max_wall_s=40):
+    """apply 실패/롤백/CRITICAL 시 증거 수집 (spec §9). tar.gz, 개당 ≤2MB, 최근 5개.
+
+    #13 LOW: 5 외부 cmd × 15s = ~75s 동기 — startup-recovery 블록을 부풀린다.
+    per-command timeout 을 8s 로 줄이고, 전체 wall budget(max_wall_s, 기본 40s)을 둔다.
+    각 source cmd 전에 경과(clock()-start)가 예산 초과면 수집을 멈추고 partial 노트를 남긴다."""
+    os.makedirs(out_dir, exist_ok=True)
+    sources = {
+        "dmesg.txt": ["sh", "-c", "dmesg | grep -iE 'wlan|cnss|pci' | tail -200"],
+        "units.txt": ["journalctl", "-u", "wpa_supplicant@wlan0", "-u", "systemd-networkd",
+                       "-u", "dpworld-network-apply", "-u", "dpworld-net-recover",
+                       "--since", "-10 min", "--no-pager"],
+        "networkctl.txt": ["networkctl", "status", "--no-pager"],
+        "wpa_status.txt": ["wpa_cli", "-i", "wlan0", "status"],
+        "ip.txt": ["sh", "-c", "ip addr; ip route"],
+    }
+    path = os.path.join(out_dir, f"forensic_{apply_id}.tar.gz")
+    budget = max_bytes
+    start = clock()
+    budget_exceeded = False
+    with tarfile.open(path, "w:gz") as tar:
+        def add(name, data):
+            nonlocal budget
+            b = data.encode("utf-8", errors="replace")[:max(0, budget)]
+            budget -= len(b)
+            info = tarfile.TarInfo(name); info.size = len(b)
+            tar.addfile(info, io.BytesIO(b))
+        for name, argv in sources.items():
+            if budget <= 0:
+                break
+            if clock() - start >= max_wall_s:   # #13: wall budget 초과 — 부분 수집 후 중단
+                budget_exceeded = True
+                break
+            _, out = runner(argv, 8)
+            add(name, out)
+        if budget_exceeded:
+            add("budget_note.txt", "budget exceeded, partial bundle\n")
+        if render_dir and os.path.isdir(render_dir) and budget > 0:
+            for f in sorted(os.listdir(render_dir)):
+                if budget <= 0:
+                    break
+                try:
+                    with open(os.path.join(render_dir, f), encoding="utf-8", errors="replace") as _rf:
+                        body = _rf.read()
+                except OSError:
+                    continue
+                # C1: 비밀 전수 마스킹 — wpa conf 인용 psk + persist JSON
+                # password/psk/wifi_passwd + 비인용 64-hex psk (wpa_passphrase 출력형)
+                # M-E: use (?:[^"\\]|\\.)*  so JSON-escaped quotes inside a secret don't
+                # truncate the match and leak the trailing fragment.
+                body = re.sub(r'psk="(?:[^"\\]|\\.)*"', 'psk="***"', body)
+                body = re.sub(r'("(?:password|psk|wifi_passwd)"\s*:\s*)"(?:[^"\\]|\\.)*"',
+                              r'\1"***"', body)
+                # wpa_supplicant psk= line: mask to end-of-line so an inner quote can't stop it
+                body = re.sub(r'(?m)^(\s*psk=).*$', r'\1***', body)
+                add(f"renders/{f}", body)
+    bundles = sorted((f for f in os.listdir(out_dir) if f.startswith("forensic_")),
+                     key=lambda f: os.path.getmtime(os.path.join(out_dir, f)), reverse=True)
+    for f in bundles[keep:]:
+        try: os.remove(os.path.join(out_dir, f))
+        except OSError: pass
+    return path
diff --git a/src/network/net_routes.py b/src/network/net_routes.py
new file mode 100644
index 0000000..1bb3e94
--- /dev/null
+++ b/src/network/net_routes.py
@@ -0,0 +1,151 @@
+"""HTTP 라우팅 글루 (spec §5.1) — fw_routes.py 전례. 서버 독립적·dict in/out."""
+
+from network import netmodel
+
+
+class RouteError(Exception):
+    def __init__(self, status, message):
+        super().__init__(message); self.status = status; self.message = message
+
+
+def _req_bool(body, name):
+    """v1.6.0 codex H2: 엄격 bool 파서 — JSON 문자열 "false" 가 Python truthiness 로 True 가 되어
+    force/country_now 가 잘못 활성화되는 결함 차단. None=미지정(False), 진짜 bool 만 수용."""
+    v = body.get(name)
+    if v is None:
+        return False
+    if isinstance(v, bool):
+        return v
+    raise RouteError(400, f"{name} must be a boolean")
+
+
+_WATCHDOG_DEFAULTS = {"watchdog_enabled": "on", "watchdog_auto_recover": "on",
+                      "watchdog_interval_s": 30}
+
+
+class NetworkRoutes:
+    def __init__(self, engine, journal, watchdog, drift_fn, live_fn):
+        self.engine = engine; self.journal = journal; self.watchdog = watchdog
+        self.drift_fn = drift_fn; self.live_fn = live_fn
+
+    def apply(self, body):
+        fields = body.get("fields", {})
+        if not isinstance(fields, dict):
+            raise RouteError(400, "fields must be an object")
+        # v1.6.0 codex H1: 네트워크 키 화이트리스트 — apply 가 임의 device_config 키를 쓰면
+        # 스냅샷(20 네트워크 키)이 못 잡아 롤백으로도 제거 불가. /setting/device 검증을
+        # 우회하는 side-door 차단. dry_run·real apply 양쪽 동일 (divergence 방지).
+        unknown = sorted(k for k in fields if k not in netmodel.NETWORK_DEV_KEYS)
+        if unknown:
+            raise RouteError(400, f"unknown network field(s): {', '.join(unknown)}")
+        # v1.11.10 Fix 3: coerce '*_port' string values to int — the legacy app /
+        # dpworldapp require Integer ports; the unauthenticated apply path would
+        # otherwise persist them as String and break the shared board_config contract.
+        for k, v in list(fields.items()):
+            if k.endswith("_port") and isinstance(v, str) and v != "":
+                try:
+                    fields[k] = int(v)
+                except ValueError:
+                    raise RouteError(400, f"{k} must be numeric (got {v!r})")
+        if _req_bool(body, "dry_run"):   # H2: 엄격 bool
+            country_now = _req_bool(body, "country_now")
+            return {"ok": True, **self.engine.dry_run(fields, country_now=country_now)}
+        # §1.6 비동기: STARTED + apply_id 즉시 반환 — 검증/적용 결과는 status 폴링.
+        # (eth1 IP 변경 시 networkctl 이후엔 구 연결로 응답 불가하므로 동기 실행 금지)
+        res = self.engine.apply_async(fields, force=_req_bool(body, "force"),
+                                      country_now=_req_bool(body, "country_now"))
+        if res["state"] == "BUSY":
+            raise RouteError(409, f"apply in flight: {res['apply_id']}")
+        return {"ok": True, **res}
+
+    def status(self, apply_id):
+        self.engine.tick()   # TTL 검사 — 폴링이 자연 타이머 역할 (§6.1)
+        return self.engine.status(apply_id)
+
+    def confirm(self, body):
+        aid = body.get("apply_id") or ""
+        res = self.engine.confirm(aid)
+        if res["state"] == "INVALID":
+            raise RouteError(409, res.get("error", "invalid confirm"))
+        return {"ok": True, **res}
+
+    def rollback(self):
+        res = self.engine.rollback_to_lkg()
+        if res.get("state") == "BUSY":
+            raise RouteError(409, res.get("error", "apply in flight — cannot rollback now"))
+        if res.get("state") == "INVALID":
+            raise RouteError(409, res.get("error", "no LKG"))
+        return {"ok": True, **res}
+
+    def drift(self):
+        # v1.7.0: 경량 미적용(drift) 전용 — drift_fn() (DB read + 파일 read) 만, subprocess 0.
+        # 전역 배지가 저빈도 폴링할 수 있게 무거운 state() 와 분리.
+        return self.drift_fn()
+
+    def state(self):
+        self.engine.tick()
+        return {**self.live_fn(), "drift": self.drift_fn(),
+                "watchdog": self.watchdog.snapshot() if self.watchdog else {},
+                "last_apply": self.engine.status(None),
+                "country_pending": self.engine.country_pending()}
+
+    def journal_tail(self, limit):
+        try:
+            n = int(limit or 50)
+        except (TypeError, ValueError):   # M1: 파싱 불가 limit → 50 폴백 (500 error 금지)
+            n = 50
+        return {"events": self.journal.tail(max(1, min(n, 500)))}
+
+    # ── #2: watchdog kill-switch (net_config write path) ─────
+    def _current_config(self):
+        """효과적 net_config — DB 값에 기본값 merge (operator 미설정 키도 노출)."""
+        try:
+            cur = self.engine.db.get_config("net_config") or {}
+        except Exception:   # noqa: BLE001 — DB 조회 실패가 GET 을 500 시키면 안 됨
+            cur = {}
+        if not isinstance(cur, dict):
+            cur = {}
+        return {**_WATCHDOG_DEFAULTS, **cur}
+
+    def get_config(self):
+        return {"net_config": self._current_config()}
+
+    def config(self, body):
+        """#2 운영자 kill-switch: net_config 의 watchdog 키만 쓰기 허용 + critical 재무장.
+        엄격 화이트리스트 — 미지 키/이상치는 RouteError(400) 로 즉시 거절."""
+        if not isinstance(body, dict):
+            raise RouteError(400, "request body must be a JSON object")
+        if body.get("reset_watchdog_critical") is True:
+            # critical 재무장 — 다른 키와 동시 전송 금지 (단일 의도)
+            extra = [k for k in body if k != "reset_watchdog_critical"]
+            if extra:
+                raise RouteError(400, f"reset_watchdog_critical must be sent alone (got {extra})")
+            if self.watchdog is not None:
+                self.watchdog.reset_critical()
+            return {"ok": True, "net_config": self._current_config()}
+        validated = {}
+        for k, v in body.items():
+            if k in ("watchdog_enabled", "watchdog_auto_recover"):
+                if v not in ("on", "off"):
+                    raise RouteError(400, f"{k} must be 'on' or 'off'")
+                validated[k] = v
+            elif k == "watchdog_interval_s":
+                # v1.6.0 codex M2: int(v) 는 float 10.9 를 10 으로 silently truncate — 엄격 거절.
+                # bool 은 int 서브클래스이므로 명시 차단.
+                if isinstance(v, bool) or not isinstance(v, int):
+                    raise RouteError(400, "watchdog_interval_s must be an integer")
+                iv = v
+                if not (10 <= iv <= 300):
+                    raise RouteError(400, "watchdog_interval_s must be within [10, 300]")
+                validated[k] = iv
+            else:
+                raise RouteError(400, f"unknown key: {k}")
+        if not validated:
+            raise RouteError(400, "no valid keys to write")
+
+        def _mut(cur):
+            base = cur if isinstance(cur, dict) else {}
+            out = dict(base); out.update(validated)   # partial-merge (§4.1 전례)
+            return out
+        self.engine.db.update_config("net_config", _mut, default={})
+        return {"ok": True, "net_config": self._current_config()}
diff --git a/src/network/netmodel.py b/src/network/netmodel.py
new file mode 100644
index 0000000..ba31a9e
--- /dev/null
+++ b/src/network/netmodel.py
@@ -0,0 +1,140 @@
+# src/network/netmodel.py
+"""22항목 집합 (spec §3.4): DB device_config ↔ intent ↔ persist JSON 매핑 + 비교 의미론.
+비교는 dpworldapp 의 네트워크-필드 비교(32-bit (u32) IP 비교) 정합 — §1.2 계약 참조."""
+
+METRICS = {"wlan0": 100, "eth0": 200, "eth1": 300}
+MAX_PROFILES = 5
+
+# v1.6.0 codex H1: apply 가 device_config 에 쓸 수 있는 네트워크 키의 단일 출처(single source).
+# net_routes.apply() write-allowlist 와 apply_engine 스냅샷 키가 이 집합에서 파생 — drift 차단.
+# 비-네트워크 키(예: rs485_databits)는 apply 경로로 device_config 를 변형할 수 없다.
+NETWORK_DEV_KEYS = frozenset({
+    "wifi_static", "wifi_ip", "wifi_netmask", "wifi_gateway", "wifi_dns1", "wifi_dns2",
+    "wifi_country_code", "WIFI_SSID", "eth_ip", "eth_netmask", "eth_gateway",
+    "lte_ip", "lte_netmask", "lte_gateway", "lte_server_ip", "lte_server_port",
+    "opc_ua_server_ip", "opc_ua_server_port", "modbus_server_ip", "modbus_server_port",
+})
+
+def _s(v):
+    return "" if v is None else str(v).strip()
+
+def _norm_country(v):
+    s = _s(v).upper()
+    return s if (len(s) == 2 and s.isalpha()) else ("" if not s else s)
+
+def _ip_u32(s):
+    """strict dotted-quad → u32. strict dotted-quad 의미론: 선행 0/8진/빈 octet 거부.
+    '' 은 0 (zero-동치 §1.2). 파싱 불가 → None (호출측이 원문 비교 폴백).
+    unicode digits (e.g. '²', '١') are rejected — ASCII-only check."""
+    s = _s(s)
+    if s == "":
+        return 0
+    parts = s.split(".")
+    if len(parts) != 4:
+        return None
+    val = 0
+    for p in parts:
+        # I1: must be ASCII digits only — unicode digits like '²' or '١' rejected
+        if not (p.isascii() and p.isdigit()) or (len(p) > 1 and p[0] == "0") or int(p) > 255:
+            return None
+        val = (val << 8) | int(p)
+    return val
+
+def _norm_security(v):
+    s = _s(v).lower()
+    return "none" if s == "open" else (s or "wpa/wpa2")   # legacy 'Open' tolerant read (§1.2)
+
+def intent_from_device(dev):
+    """device_config dict → intent (§1.1). 누락 키는 빈 값으로 — KeyError 금지."""
+    g = dev.get
+    profiles = [{"ssid": _s(e.get("wifi_ssid")), "password": _s(e.get("wifi_passwd")),
+                 "security": _norm_security(e.get("wifi_security"))}
+                for e in (g("WIFI_SSID") or [])[:MAX_PROFILES]]   # RAW 보존 — gap 은 validator 가 검출
+    wifi_static = _s(g("wifi_static")) == "on"
+    # I2: _ip_u32==0 (empty/"0.0.0.0") → dhcp; _ip_u32==None (unparseable) → static
+    # (raw ip preserved so validator rejects it with a clear error)
+    eth0_static = _ip_u32(g("lte_ip")) != 0
+    eth1_static = _ip_u32(g("eth_ip")) != 0
+    def net(static, ip, mask, gw):
+        # §1.2 dhcp zero-out: dpworldapp 은 dhcp 모드 필드를 파싱하지 않음 — DB 잔존값 무시
+        if not static:
+            return {"mode": "dhcp", "ip": "", "netmask": "", "gateway": ""}
+        return {"mode": "static", "ip": _s(g(ip)), "netmask": _s(g(mask)), "gateway": _s(g(gw))}
+    wlan = net(wifi_static, "wifi_ip", "wifi_netmask", "wifi_gateway")
+    wlan.update({"dns1": _s(g("wifi_dns1")) if wifi_static else "",
+                 "dns2": _s(g("wifi_dns2")) if wifi_static else "",
+                 "country_code": _norm_country(g("wifi_country_code")), "profiles": profiles})
+    eth0 = net(eth0_static, "lte_ip", "lte_netmask", "lte_gateway")
+    eth0.update({"server_ip": _s(g("lte_server_ip")), "server_port": g("lte_server_port", "")})
+    eth1 = net(eth1_static, "eth_ip", "eth_netmask", "eth_gateway")
+    eth1.update({"opc_ua_server_ip": _s(g("opc_ua_server_ip")), "opc_ua_server_port": g("opc_ua_server_port", ""),
+                 "modbus_server_ip": _s(g("modbus_server_ip")), "modbus_server_port": g("modbus_server_port", "")})
+    return {"wlan0": wlan, "eth0": eth0, "eth1": eth1}
+
+def effective_profiles(intent):
+    """dpworldapp 렌더 의미론: 첫 빈 SSID 에서 절단 (§3.4). 렌더·비교·wpa 판정 공용."""
+    out = []
+    for p in intent["wlan0"].get("profiles", []):
+        if not p["ssid"]:
+            break
+        out.append(p)
+    return out
+
+def gateway_set(c):
+    """[Route] 생성 판정 — u32 != 0 (§3.2: gateway==0 이면 [Route] 생략. '0.0.0.0' 포함)."""
+    return _ip_u32(c.get("gateway")) not in (0, None)
+
+def _canon(field, v):
+    """비교용 정규화 — §1.2 의미론."""
+    leaf = field.rsplit(".", 1)[-1]
+    s = _s(v)
+    if leaf in ("ip", "netmask", "gateway", "dns1", "dns2", "server_ip",
+                "opc_ua_server_ip", "modbus_server_ip"):
+        u = _ip_u32(s)
+        return ("u32", u) if u is not None else ("raw", s)
+    if leaf in ("server_port", "opc_ua_server_port", "modbus_server_port"):
+        return s  # "20111" == 20111
+    if leaf == "country_code":
+        return _norm_country(s)
+    return s
+
+_SCALARS = [  # 비교·diff 대상 평면 목록 (profiles 는 별도)
+    "wlan0.mode", "wlan0.ip", "wlan0.netmask", "wlan0.gateway", "wlan0.dns1", "wlan0.dns2",
+    "wlan0.country_code",
+    "eth0.mode", "eth0.ip", "eth0.netmask", "eth0.gateway", "eth0.server_ip", "eth0.server_port",
+    "eth1.mode", "eth1.ip", "eth1.netmask", "eth1.gateway",
+    "eth1.opc_ua_server_ip", "eth1.opc_ua_server_port",
+    "eth1.modbus_server_ip", "eth1.modbus_server_port",
+]
+
+def _get(intent, path):
+    iface, leaf = path.split(".", 1)
+    return intent.get(iface, {}).get(leaf, "")
+
+def diff_intents(a, b):
+    """변경 필드 목록 [{field, old, new}] — UI diff 미리보기·drift 뱃지 공용.
+    profiles 는 effective(절단) 기준 비교 — 빈 trailing 행은 변경 아님."""
+    out = []
+    for p in _SCALARS:
+        va, vb = _get(a, p), _get(b, p)
+        if _canon(p, va) != _canon(p, vb):
+            out.append({"field": p, "old": _s(va), "new": _s(vb)})
+    pa = [(x["ssid"], x["password"], x["security"]) for x in effective_profiles(a)]
+    pb = [(x["ssid"], x["password"], x["security"]) for x in effective_profiles(b)]
+    if pa != pb:
+        def _profile_descriptor(tuples):
+            return ", ".join(f"{ssid}({sec})" for ssid, _pw, sec in tuples) or "0 profiles"
+        old_desc = _profile_descriptor(pa)
+        new_desc = _profile_descriptor(pb)
+        # password-only change: ssid+security identical but tuples differ → append visible marker
+        if old_desc == new_desc:
+            new_desc += " (자격증명 변경)"
+        out.append({"field": "wlan0.profiles", "old": old_desc, "new": new_desc})
+    return out
+
+def changed_interfaces(diff):
+    return sorted({d["field"].split(".", 1)[0] for d in diff})
+
+def wpa_relevant(diff):
+    """wpa reconfigure 필요 판정 (§5 APPLYING-③): 프로파일 변경."""
+    return any(d["field"] == "wlan0.profiles" for d in diff)
diff --git a/src/network/renderer.py b/src/network/renderer.py
new file mode 100644
index 0000000..0c5d20a
--- /dev/null
+++ b/src/network/renderer.py
@@ -0,0 +1,105 @@
+# src/network/renderer.py
+"""intent → dpworldapp byte-호환 렌더 (spec §3.2/§3.4/§4.1).
+캡처(golden)와 1바이트라도 다르면 본 모듈 상수를 캡처에 맞춘다 — 안정성 요건."""
+import ipaddress, json
+from network.netmodel import METRICS, _s, effective_profiles, gateway_set
+
+def _prefix(netmask):
+    return ipaddress.IPv4Network(f"0.0.0.0/{netmask}").prefixlen
+
+def _in_subnet(ip, net_ip, netmask):
+    try:
+        return ipaddress.IPv4Address(ip) in ipaddress.IPv4Network(f"{net_ip}/{_prefix(netmask)}", strict=False)
+    except ValueError:
+        return True  # 판정 불가 시 host route 미생성 (보수)
+
+def render_network_file(intent, iface):
+    c = intent[iface]; m = METRICS[iface]
+    out = f"[Match]\nName={iface}\n\n[Network]\n"
+    if c["mode"] == "dhcp":
+        out += f"DHCP=ipv4\n\n[DHCPv4]\nRouteMetric={m}\n"
+        return out
+    out += f"Address={c['ip']}/{_prefix(c['netmask'])}\n"
+    # gateway_set: u32==0 ('', '0.0.0.0') 은 unset — dpworldapp @6840 과 동일하게 [Route] 생략 (§3.2)
+    if gateway_set(c):
+        out += f"\n[Route]\nDestination=0.0.0.0/0\nGateway={c['gateway']}\nMetric={m}\n"
+    if iface == "eth0":
+        sip = _s(c.get("server_ip"))
+        if sip and gateway_set(c) and c["mode"] == "static" \
+                and not _in_subnet(sip, c["ip"], c["netmask"]):
+            out += f"\n[Route]\nDestination={sip}/32\nGateway={c['gateway']}\n"
+    return out
+
+def render_wpa_conf(intent):
+    w = intent["wlan0"]
+    out = "ctrl_interface=/var/run/wpa_supplicant\nupdate_config=1\n"
+    if w.get("country_code"):
+        out += f"country={w['country_code']}\n"
+    for i, p in enumerate(effective_profiles(intent)[:5]):
+        out += f'\nnetwork={{\n    ssid="{p["ssid"]}"\n'
+        if p["security"] == "none":
+            out += "    key_mgmt=NONE\n"
+        else:
+            out += f'    psk="{p["password"]}"\n    key_mgmt=WPA-PSK\n'
+        out += f"    priority={5 - i}\n}}\n"
+    return out
+
+def render_country_file(intent):
+    cc = intent["wlan0"].get("country_code", "")
+    return cc   # 캡처 확정 (Phase 0): 정확히 2바이트, trailing newline 없음
+
+def _port_num(v):
+    """캡처 확정: dpworldapp cJSON 은 port 를 JSON number 로 기록 — String DB 값도 캐스팅.
+    숫자 아닌 값은 원형 보존 (validator 가 사전 차단)."""
+    s = _s(v)
+    return int(s) if s.isdigit() else s
+
+def render_persist_json(intent):
+    """network_config.json — 값·타입 정확성 요구, 서식 무관 (§1.3/§4.1)."""
+    w, e0, e1 = intent["wlan0"], intent["eth0"], intent["eth1"]
+    doc = {
+        "wlan0": {"mode": w["mode"], "ip": w["ip"], "netmask": w["netmask"], "gateway": w["gateway"],
+                  "dns1": w["dns1"], "dns2": w["dns2"], "country_code": w["country_code"],
+                  "saved_wifi_list": [{"ssid": p["ssid"], "password": p["password"],
+                                       "security": p["security"]} for p in effective_profiles(intent)]},
+        "eth0": {"role": "lte_uplink", "mode": e0["mode"], "ip": e0["ip"], "netmask": e0["netmask"],
+                 "gateway": e0["gateway"], "server_ip": e0["server_ip"],
+                 "server_port": _port_num(e0["server_port"])},
+        "eth1": {"role": "local_ethernet", "mode": e1["mode"], "ip": e1["ip"], "netmask": e1["netmask"],
+                 "gateway": e1["gateway"],
+                 "opc_ua_server_ip": e1["opc_ua_server_ip"], "opc_ua_server_port": _port_num(e1["opc_ua_server_port"]),
+                 "modbus_server_ip": e1["modbus_server_ip"], "modbus_server_port": _port_num(e1["modbus_server_port"])},
+    }
+    return json.dumps(doc, indent=2, ensure_ascii=False) + "\n"
+
+def intent_from_persist(doc):
+    """network_config.json → intent (watchdog 판정 기준 §8 + golden 역변환).
+    I5: null/non-dict tolerant — (doc.get("iface") or {}) for all three ifaces;
+    saved_wifi_list entries that are not dicts are filtered out."""
+    w = (doc.get("wlan0") or {}); e0 = (doc.get("eth0") or {}); e1 = (doc.get("eth1") or {})
+    return {
+        "wlan0": {"mode": _s(w.get("mode")) or "dhcp", "ip": _s(w.get("ip")),
+                  "netmask": _s(w.get("netmask")), "gateway": _s(w.get("gateway")),
+                  "dns1": _s(w.get("dns1")), "dns2": _s(w.get("dns2")),
+                  "country_code": _s(w.get("country_code")).upper(),
+                  "profiles": [{"ssid": _s(p.get("ssid")), "password": _s(p.get("password")),
+                                "security": _s(p.get("security")) or "wpa/wpa2"}
+                               for p in (w.get("saved_wifi_list") or [])
+                               if isinstance(p, dict) and _s(p.get("ssid"))]},
+        "eth0": {"mode": _s(e0.get("mode")) or "dhcp", "ip": _s(e0.get("ip")),
+                 "netmask": _s(e0.get("netmask")), "gateway": _s(e0.get("gateway")),
+                 "server_ip": _s(e0.get("server_ip")), "server_port": e0.get("server_port", "")},
+        "eth1": {"mode": _s(e1.get("mode")) or "dhcp", "ip": _s(e1.get("ip")),
+                 "netmask": _s(e1.get("netmask")), "gateway": _s(e1.get("gateway")),
+                 "opc_ua_server_ip": _s(e1.get("opc_ua_server_ip")), "opc_ua_server_port": e1.get("opc_ua_server_port", ""),
+                 "modbus_server_ip": _s(e1.get("modbus_server_ip")), "modbus_server_port": e1.get("modbus_server_port", "")},
+    }
+
+RENDER_FILES = {  # 파일명 → 렌더 함수 (apply_engine/snapshot 공용 상수)
+    "network_config.json": render_persist_json,
+    "10-wlan0.network": lambda it: render_network_file(it, "wlan0"),
+    "10-eth0.network": lambda it: render_network_file(it, "eth0"),
+    "10-eth1.network": lambda it: render_network_file(it, "eth1"),
+    "wpa_supplicant-wlan0.conf": render_wpa_conf,
+    "wifi-country-code": render_country_file,
+}
diff --git a/src/network/snapshot.py b/src/network/snapshot.py
new file mode 100644
index 0000000..8bda78c
--- /dev/null
+++ b/src/network/snapshot.py
@@ -0,0 +1,128 @@
+"""apply 전 백업 + manifest 해시 검증 + 복원 (spec §5 SNAPSHOT/§6.3).
+스냅샷 = /home/root/network/* 전체 + DB 네트워크 필드(22항목 집합의 원본 dict)."""
+import hashlib, json, os, shutil, time
+
+LKG = "last_known_good"   # 파일 내용 = apply_id
+
+def _restrict(path, mode):
+    """#5/#10: best-effort 권한 제한 — psk/password 평문이 world-readable 되지 않도록.
+    Windows 에선 os.chmod 가 read-only 비트만 토글하므로 효과 제한적이나 raise 하지 않음."""
+    try:
+        os.chmod(path, mode)
+    except OSError:
+        pass
+
+def _sha(path):
+    h = hashlib.sha256()
+    with open(path, "rb") as f:
+        for chunk in iter(lambda: f.read(65536), b""):
+            h.update(chunk)
+    return h.hexdigest()
+
+def take(net_dir, backups_dir, apply_id, db_fields):
+    dest = os.path.join(backups_dir, apply_id)
+    os.makedirs(dest, exist_ok=True)
+    _restrict(dest, 0o700)   # #5/#10: psk 평문 복사본 디렉토리 — owner-only
+    files = {}
+    if os.path.isdir(net_dir):
+        for name in sorted(os.listdir(net_dir)):
+            if os.sep in name or "/" in name or ".." in name:
+                continue   # 방어: 경로 탈출성 이름 무시 (정상 listdir 결과면 미발동)
+            src = os.path.join(net_dir, name)
+            if not os.path.isfile(src):
+                continue
+            dst = os.path.join(dest, name)
+            shutil.copy2(src, dst)
+            _restrict(dst, 0o600)   # #5/#10: wpa conf(psk)/persist(password) 복사본 — owner-only
+            files[name] = _sha(dst)
+    dbp = os.path.join(dest, "db_fields.json")
+    with open(dbp, "w", encoding="utf-8") as f:
+        json.dump(db_fields, f, ensure_ascii=False, indent=2)
+    _restrict(dbp, 0o600)   # #5/#10: wifi_passwd 평문 — owner-only
+    manifest = {"apply_id": apply_id, "taken_at": time.strftime("%Y-%m-%dT%H:%M:%S%z"),
+                "files": files, "db_fields_sha": _sha(dbp)}
+    tmp = os.path.join(dest, "manifest.json.tmp")
+    with open(tmp, "w", encoding="utf-8") as f:
+        json.dump(manifest, f, ensure_ascii=False, indent=2)
+    man_path = os.path.join(dest, "manifest.json")
+    os.replace(tmp, man_path)
+    _restrict(man_path, 0o600)   # #5/#10: 일관성 — owner-only
+    if not verify(dest):
+        raise RuntimeError(f"snapshot self-verify failed: {dest}")
+    return dest
+
+def verify(snap_dir):
+    try:
+        with open(os.path.join(snap_dir, "manifest.json"), encoding="utf-8") as f:
+            man = json.load(f)
+    except (OSError, ValueError):
+        return False
+    for name, sha in man.get("files", {}).items():
+        p = os.path.join(snap_dir, name)
+        if not os.path.isfile(p) or _sha(p) != sha:
+            return False
+    dbp = os.path.join(snap_dir, "db_fields.json")
+    return os.path.isfile(dbp) and _sha(dbp) == man.get("db_fields_sha")
+
+def restore_files(snap_dir, net_dir, on_empty_keep=True):
+    """렌더/JSON 파일 복원 (per-file tmp+rename) + 저장된 DB 필드 dict 반환.
+    호출측(apply_engine)이 DB-first 원칙에 따라 DB 복원을 먼저 수행한 뒤 본 함수를 부른다.
+
+    #4 MEDIUM: 스냅샷이 0개 파일을 캡처했다면(fresh-flash: dpworldapp 미시드로 net_dir 가
+    비어있던 baseline) "아무것도 없음" 으로 롤백하는 것이 적용본 유지보다 위험하다 —
+    10-eth1.network 가 사라지면 eth1 이 lockout. on_empty_keep=True(기본) 일 때 빈 스냅샷이면
+    삭제 루프를 돌리지 않아 적용된 렌더를 그대로 둔다(운영자 연결 유지)."""
+    with open(os.path.join(snap_dir, "manifest.json"), encoding="utf-8") as f:
+        man = json.load(f)
+    os.makedirs(net_dir, exist_ok=True)
+    current = set(os.listdir(net_dir)) if os.path.isdir(net_dir) else set()
+    for name in man["files"]:
+        if not isinstance(name, str) or os.sep in name or "/" in name or ".." in name:
+            continue   # 변조 manifest 의 경로 탈출 차단 — net_dir 밖 쓰기 금지
+        src = os.path.join(snap_dir, name); dst = os.path.join(net_dir, name)
+        tmp = dst + ".tmp"
+        shutil.copy2(src, tmp); os.replace(tmp, dst)
+        current.discard(name)
+    # 스냅샷 시점에 없던 (apply 가 새로 만든) 파일 제거 — 단 우리 계약 파일만.
+    # #4: 빈 스냅샷(man["files"] 비어있음)이면 삭제 루프 생략 — 적용본 유지가 안전.
+    if man["files"] or not on_empty_keep:
+        from network.renderer import RENDER_FILES
+        for name in current:
+            if name in RENDER_FILES:
+                try: os.remove(os.path.join(net_dir, name))
+                except OSError: pass
+    with open(os.path.join(snap_dir, "db_fields.json"), encoding="utf-8") as f:
+        return json.load(f)
+
+def mark_last_known_good(backups_dir, apply_id):
+    os.makedirs(backups_dir, exist_ok=True)
+    tmp = os.path.join(backups_dir, LKG + ".tmp")
+    with open(tmp, "w") as f:
+        f.write(apply_id)
+    os.replace(tmp, os.path.join(backups_dir, LKG))
+
+def last_known_good(backups_dir):
+    try:
+        with open(os.path.join(backups_dir, LKG)) as f:
+            return f.read().strip()
+    except OSError:
+        return None
+
+def prune(backups_dir, keep=5):
+    lkg = last_known_good(backups_dir)
+    entries = []   # I4: per-dir fail-soft — listdir↔getmtime 사이 소멸한 디렉토리 무시
+    for d in os.listdir(backups_dir):
+        p = os.path.join(backups_dir, d)
+        try:
+            if os.path.isdir(p) and not d.startswith("forensic"):
+                entries.append((os.path.getmtime(p), d))
+        except (FileNotFoundError, OSError):
+            continue
+    entries.sort(reverse=True)
+    for _, d in entries[keep:]:
+        if d == lkg:
+            continue  # LKG 는 보존
+        try:
+            shutil.rmtree(os.path.join(backups_dir, d), ignore_errors=True)
+        except (FileNotFoundError, OSError):
+            continue
diff --git a/src/network/validator.py b/src/network/validator.py
new file mode 100644
index 0000000..ea133e0
--- /dev/null
+++ b/src/network/validator.py
@@ -0,0 +1,141 @@
+# src/network/validator.py
+"""§5.2 hard rule — dpworldapp 파서/렌더 한계를 데이터로 위반하지 않기."""
+import ipaddress
+from . import netmodel  # v1.11.8 D: shared strict IPv4 (_ip_u32) — device/apply 경로 정합
+
+ALLOWED_SECURITY = ("wpa/wpa2", "none")
+MAX_SSID = 19          # 20byte 버퍼 snprintf 절단 — 바이트 기준 (§5.2)
+PSK_MIN, PSK_MAX = 8, 19  # wpa 버퍼 — 바이트 기준
+MAX_PROFILES = 5
+FORBIDDEN_SSID_CHARS = ('"', "\\")  # wpa 렌더 escaping 없음
+
+def _ip_ok(s):
+    try:
+        ipaddress.IPv4Address(s); return True
+    except ValueError:
+        return False
+
+def _netmask_contiguous(netmask):
+    """True iff netmask is a valid contiguous IPv4 netmask (e.g. 255.255.255.0)."""
+    try:
+        ipaddress.IPv4Network(f"0.0.0.0/{netmask}")
+        return True
+    except ValueError:
+        return False
+
+def _has_forbidden_char(s):
+    """True if string contains '"', '\\', or any control char (ord < 0x20)."""
+    return any(ch == '"' or ch == '\\' or ord(ch) < 0x20 for ch in s)
+
+def _port_ok(value):
+    """'' allowed; otherwise must be ASCII digits and 1 <= int <= 65535."""
+    s = str(value) if value != "" else ""
+    if s == "":
+        return True
+    if not (s.isascii() and s.isdigit()):
+        return False
+    n = int(s)
+    return 1 <= n <= 65535
+
+def validate(intent):
+    """returns (errors:list[str], warnings:list[str]). errors 가 있으면 적용 거부."""
+    errs, warns = [], []
+    w = intent["wlan0"]
+    profs = w.get("profiles", [])
+    if len(profs) > MAX_PROFILES:
+        errs.append(f"wlan0.profiles: 최대 {MAX_PROFILES}개 (현재 {len(profs)})")
+    # gap 검출 (§5.2): 첫 빈 SSID 이후의 비어있지 않은 프로파일은 렌더에서 침묵 탈락 → 거부.
+    # trailing 빈 슬롯(UI 빈 행)은 허용.
+    first_empty = next((i for i, p in enumerate(profs) if not p["ssid"]), None)
+    if first_empty is not None:
+        for j in range(first_empty + 1, len(profs)):
+            if profs[j]["ssid"]:
+                errs.append(f"wlan0.profiles[{j}]: gap 금지 — 빈 슬롯[{first_empty}] 뒤 프로파일은 적용되지 않음 (압축 저장 필요)")
+    for i, p in enumerate(profs):
+        tag = f"wlan0.profiles[{i}]"
+        if not p["ssid"]:
+            continue   # 빈 슬롯 자체는 gap 검사에서 처리
+        ssid_bytes = len(p["ssid"].encode("utf-8"))
+        if ssid_bytes > MAX_SSID:
+            errs.append(f"{tag}: SSID {ssid_bytes}바이트 > {MAX_SSID} (펌웨어 절단)")
+        # C2: SSID 에 ", \, 또는 제어문자 금지 (wpa 렌더 escaping 없음 + injection 방지)
+        if _has_forbidden_char(p["ssid"]):
+            errs.append(f"{tag}: SSID 에 \", \\\\, 또는 제어문자 금지 (wpa 렌더 escaping 없음)")
+        if p["security"] not in ALLOWED_SECURITY:
+            errs.append(f"{tag}: security={p['security']!r} 불가 — {ALLOWED_SECURITY} 만 (그 외는 펌웨어가 프로파일 삭제)")
+        elif p["security"] == "none":
+            if p["password"]:
+                errs.append(f"{tag}: security=none 이면 password 는 빈 값 강제")
+        else:
+            pw_bytes = len(p["password"].encode("utf-8"))
+            if not (PSK_MIN <= pw_bytes <= PSK_MAX):
+                errs.append(f"{tag}: password {pw_bytes}바이트 — {PSK_MIN}-{PSK_MAX}바이트 필요")
+            # C2: password 에 ", \, 또는 제어문자 금지
+            if _has_forbidden_char(p["password"]):
+                errs.append(f"{tag}: password 에 \", \\\\, 또는 제어문자 금지 (wpa 렌더 escaping 없음)")
+    cc = w.get("country_code", "")
+    if cc and not (len(cc) == 2 and cc.isalpha() and cc.isupper()):
+        errs.append(f"wlan0.country_code={cc!r}: 2자리 대문자 알파벳")
+    for iface in ("wlan0", "eth0", "eth1"):
+        c = intent[iface]
+        if c["mode"] != "static":
+            continue
+        if not _ip_ok(c["ip"]):
+            errs.append(f"{iface}: static 인데 IP 없음/형식 오류 ({c['ip']!r})")
+            continue
+        # C1: netmask must be contiguous (also subsumes the format check — a
+        # contiguous netmask is necessarily a valid IPv4 address; v1.11.10 Fix 38
+        # removed the unreachable _ip_ok(netmask) follow-up block).
+        if not _netmask_contiguous(c["netmask"]):
+            errs.append(f"{iface}: netmask 비연속/형식 오류 ({c['netmask']!r})")
+            continue
+        gw = c.get("gateway", "")
+        if gw:  # 빈 gateway 는 허용 — [Route] 생략 (§5.2/§12-2)
+            if not _ip_ok(gw):
+                errs.append(f"{iface}: gateway 형식 오류 ({gw!r})")
+            else:
+                try:
+                    net = ipaddress.IPv4Network(f"{c['ip']}/{c['netmask']}", strict=False)
+                    if ipaddress.IPv4Address(gw) not in net:
+                        warns.append(f"{iface}: gateway {gw} 가 subnet {net} 밖 — 확인 필요")
+                except ValueError:
+                    pass
+    # I3: port rules — eth0.server_port, eth1.opc_ua_server_port, eth1.modbus_server_port
+    port_checks = [
+        ("eth0", "server_port"),
+        ("eth1", "opc_ua_server_port"),
+        ("eth1", "modbus_server_port"),
+    ]
+    for iface, field in port_checks:
+        val = intent[iface].get(field, "")
+        if not _port_ok(val):
+            errs.append(f"{iface}.{field}: 포트 범위 오류 ({val!r}) — 빈 값 또는 1-65535 정수")
+    # v1.11.8 D: server_ip / dns IPv4 format reject (이전엔 비교만 하고 형식 미검증).
+    # 빈 값 = clear(허용). netmodel._ip_u32 공유 검증기 사용 — 0=빈값, None=형식오류
+    # (device_config 경로 _is_valid_ip 와 동일한 leading-zero strict 규칙).
+    ip_format_checks = [
+        ("eth0", "server_ip"),
+        ("eth1", "opc_ua_server_ip"),
+        ("eth1", "modbus_server_ip"),
+        ("wlan0", "dns1"),
+        ("wlan0", "dns2"),
+    ]
+    for iface, field in ip_format_checks:
+        val = intent[iface].get(field, "")
+        if val in ("", None):
+            continue   # 빈 값 = clear (허용)
+        if netmodel._ip_u32(val) is None:
+            errs.append(f"{iface}.{field}: IP 형식 오류 ({val!r})")
+    # C1: subnet-overlap loop — wrap each pair in try/except ValueError to never throw
+    statics = [(i, intent[i]) for i in ("wlan0", "eth0", "eth1") if intent[i]["mode"] == "static"
+               and _ip_ok(intent[i]["ip"]) and _netmask_contiguous(intent[i].get("netmask", ""))]
+    for a in range(len(statics)):
+        for b in range(a + 1, len(statics)):
+            try:
+                na = ipaddress.IPv4Network(f"{statics[a][1]['ip']}/{statics[a][1]['netmask']}", strict=False)
+                nb = ipaddress.IPv4Network(f"{statics[b][1]['ip']}/{statics[b][1]['netmask']}", strict=False)
+                if na.overlaps(nb):
+                    warns.append(f"{statics[a][0]}/{statics[b][0]}: 서브넷 중복 ({na} ↔ {nb})")
+            except ValueError:
+                continue
+    return errs, warns
diff --git a/src/network/verifier.py b/src/network/verifier.py
new file mode 100644
index 0000000..5cc9383
--- /dev/null
+++ b/src/network/verifier.py
@@ -0,0 +1,177 @@
+"""사후 검증 (spec §5 VERIFYING): 존재→carrier→주소·라우트→wpa_state→gateway ping.
+carrier 없음 = 'config staged' WARN (§5.3). 모든 외부호출 runner 주입."""
+import os as _os, subprocess, time
+
+from network import netmodel
+
+def _default_runner(argv, timeout=10):
+    try:
+        p = subprocess.run(argv, capture_output=True, text=True, timeout=timeout)
+        return p.returncode, p.stdout or ""
+    except (subprocess.SubprocessError, OSError) as e:
+        return 1, str(e)
+
+def _ip_brief(runner):
+    """I8: (table, ok) — ip 명령 실패를 빈 테이블(=전부 staged WARN)로 위장하지 않는다."""
+    rc, out = runner(["ip", "-br", "addr", "show"], 5)
+    table = {}
+    for ln in out.splitlines():
+        parts = ln.split()
+        if len(parts) >= 2:
+            addrs = [t.split("/")[0] for t in parts[2:] if "." in t]
+            table[parts[0].split("@")[0]] = {"state": parts[1], "addrs": addrs}
+    return table, rc == 0
+
+def verify(intent, changed_ifaces, runner=None, exists=None, wpa_wait_s=45, clock=None,
+           settle_s=15, deferred_country=None):
+    runner = runner or _default_runner
+    exists = exists or _os.path.exists
+    clock = clock or time.monotonic
+    checks, worst = [], "ok"
+    def add(name, result, detail=""):
+        nonlocal worst
+        checks.append({"name": name, "result": result, "detail": detail})
+        order = {"ok": 0, "warn": 1, "fail": 2}
+        if order[result] > order[worst]:
+            worst = result
+    live, ip_ok = _ip_brief(runner)
+    routes_rc, routes = runner(["ip", "route", "show"], 5)
+    if not ip_ok:
+        # I8: ip 실패 = 라이브 상태 미상 → 명시적 fail + per-iface 라이브 검증 생략
+        add("verifier.ip", "fail", "ip -br addr show 실패 — 라이브 상태 미상 (per-iface 검증 생략)")
+        return {"result": worst, "checks": checks}
+    if routes_rc != 0:
+        add("verifier.ip_route", "fail", "ip route show 실패 — 라우트 검증 불가")
+        routes = ""
+    for iface in changed_ifaces:
+        if iface == "country":   # reboot-deferred 변경엔 라이브 검증 없음
+            continue
+        c = intent.get(iface, {})
+        if not exists(f"/sys/class/net/{iface}"):
+            add(f"{iface}.exists", "fail", "netdev 부재"); continue
+        add(f"{iface}.exists", "ok")
+        # DEF-1: wlan0 with effective profiles — wpa_state wait loop is the gate regardless of
+        # momentary carrier state (wrong password makes wpa drop → carrier DOWN before wpa settles).
+        # eth0/eth1 and wlan0 without profiles keep the existing staged-warn short-circuit.
+        # I5: effective_profiles 기준 — raw 빈 SSID 행으로 wpa 검증 오발동 금지
+        wlan_gated = (iface == "wlan0" and bool(netmodel.effective_profiles(intent)))
+        st = live.get(iface, {}).get("state", "")
+        carrier_up = st not in ("NO-CARRIER", "DOWN", "")
+        if not carrier_up:
+            if wlan_gated:
+                # carrier momentarily down during association — fall through to wpa wait loop.
+                # do NOT run static address/route settle (no carrier yet).
+                # carrier check is deferred: emitted ok/warn AFTER wpa result is known.
+                pass   # fall through (do NOT continue, do NOT add carrier check yet)
+            else:
+                add(f"{iface}.carrier", "warn", "carrier 없음 — config staged (§5.3)")
+                continue   # 라이브 검증 생략
+        else:
+            add(f"{iface}.carrier", "ok", st)
+            # A-3 결함 1 fix: networkctl reconfigure 는 비동기 — networkd 가 주소/라우트를
+            # 내렸다 다시 올리는 과도기에 1회 샘플링하면 거짓 fail → settle-retry (≈2s 간격
+            # 재조회, settle_s deadline). wpa 대기 루프와 동일한 주입 clock 패턴 (결정론 테스트).
+            if c.get("mode") == "static":
+                gw = c.get("gateway", "")
+                deadline = clock() + settle_s
+                # L1: 방어적 반복 cap — 고정 fake clock(deadline 불도달)에서도 무한회전 금지.
+                # 프로덕션(time.monotonic) 은 deadline 이 항상 먼저 이김 (cap 미도달). cap≥1 보장.
+                addr_ok = c["ip"] in live.get(iface, {}).get("addrs", [])
+                route_ok = (not gw) or (f"default via {gw} dev {iface}" in routes)
+                for _ in range(max(1, settle_s // 2 + 8)):
+                    addr_ok = c["ip"] in live.get(iface, {}).get("addrs", [])
+                    route_ok = (not gw) or (f"default via {gw} dev {iface}" in routes)
+                    if (addr_ok and route_ok) or clock() >= deadline:
+                        break
+                    time.sleep(0 if clock is not time.monotonic else 2)
+                    live2, ok2 = _ip_brief(runner)
+                    if ok2:
+                        live = live2   # 재조회 실패 시 직전 관측 유지 (일시 오류 내성)
+                    rc2, out2 = runner(["ip", "route", "show"], 5)
+                    if rc2 == 0:
+                        routes = out2
+                if addr_ok:
+                    add(f"{iface}.address", "ok", c["ip"])
+                else:
+                    add(f"{iface}.address", "fail",
+                        f"기대 {c['ip']} / 실제 {live.get(iface, {}).get('addrs')} (settle {settle_s}s)")
+                if gw:
+                    if route_ok:
+                        add(f"{iface}.route", "ok", gw)
+                    else:
+                        add(f"{iface}.route", "fail",
+                            f"default via {gw} dev {iface} 부재 (settle {settle_s}s)")
+        if wlan_gated:
+            deadline = clock() + wpa_wait_s
+            state = ""
+            # L1: 방어적 반복 cap — 고정 fake clock 에서도 무한회전 금지 (프로덕션은 deadline 우선).
+            for _ in range(max(1, wpa_wait_s // 2 + 8)):
+                _, out = runner(["wpa_cli", "-i", "wlan0", "status"], 5)
+                state = next((l.split("=", 1)[1] for l in out.splitlines()
+                              if l.startswith("wpa_state=")), "")
+                if state == "COMPLETED" or clock() >= deadline:
+                    break
+                time.sleep(0 if clock is not time.monotonic else 2)
+            if state == "COMPLETED":
+                # deferred carrier check: association succeeded → emit ok
+                if not carrier_up:
+                    add(f"{iface}.carrier", "ok", "association completed")
+                add("wlan0.wpa", "ok")
+                # carrier was down before wpa; re-check address now that association succeeded
+                if not carrier_up and c.get("mode") == "static":
+                    live2, ok2 = _ip_brief(runner)
+                    if ok2:
+                        live = live2
+                    addr_ok = c["ip"] in live.get(iface, {}).get("addrs", [])
+                    if addr_ok:
+                        add(f"{iface}.address", "ok", c["ip"])
+                    else:
+                        add(f"{iface}.address", "fail",
+                            f"기대 {c['ip']} / 실제 {live.get(iface, {}).get('addrs')} (post-wpa)")
+                    # Fix #14: when carrier was initially down, the route was never
+                    # verified (the carrier-up settle branch above was skipped).
+                    # Re-fetch routes and check the default route (mirror ~98-103).
+                    gw = c.get("gateway", "")
+                    if gw:
+                        rc_rt, out_rt = runner(["ip", "route", "show"], 5)
+                        if rc_rt == 0:
+                            routes = out_rt
+                        if f"default via {gw} dev {iface}" in routes:
+                            add(f"{iface}.route", "ok", gw)
+                        else:
+                            add(f"{iface}.route", "fail",
+                                f"default via {gw} dev {iface} 부재 (post-wpa)")
+            else:
+                # deferred carrier check: wpa failed → emit warn for the carrier state we saw
+                if not carrier_up:
+                    add(f"{iface}.carrier", "warn", "association 진행 중 — wpa_state 대기")
+                add("wlan0.wpa", "fail", f"wpa_state={state or 'unknown'} (wait {wpa_wait_s}s)")
+        gw = c.get("gateway", "")
+        # minor: ping skip 은 per-iface — 다른 iface 의 fail 이 이 iface 의 ping 을 막지 않는다
+        iface_failed = any(k["result"] == "fail" and k["name"].startswith(iface + ".") for k in checks)
+        if gw and c.get("mode") == "static" and not iface_failed:
+            ok = False
+            for _ in range(3):
+                rc, _o = runner(["ping", "-c", "1", "-W", "2", gw], 5)
+                if rc == 0:
+                    ok = True; break
+            add(f"{iface}.gw_ping", "ok" if ok else "warn", gw if ok else f"{gw} 무응답 (WARN — AP측 원인 가능)")
+    # v1.9: split-apply 시 country 는 deferred — 라이브 regdomain 이 절대 NEW 로 새지 않았음을 단언.
+    #   ground truth = iw reg get (wpa_cli get country 는 렌더값일 뿐, firmware 주석대로 거짓양성).
+    #   positive 누출(live==NEW≠OLD)만 fail→롤백; 판독불가/모호는 warn(정상 apply 를 롤백시키지 않음).
+    if deferred_country is not None:
+        new_cc = netmodel._norm_country(intent.get("wlan0", {}).get("country_code", ""))
+        old_cc = netmodel._norm_country(deferred_country)
+        rc, out = runner(["iw", "reg", "get"], 5)
+        live_cc = ""
+        for ln in out.splitlines():
+            s = ln.strip()
+            if s.startswith("country ") and len(s) >= 10 and s[8:10].isalpha():
+                live_cc = s[8:10].upper(); break
+        if rc != 0 or not live_cc:
+            add("country.deferred", "warn", "regdomain 판독 불가 — deferred 미확인 (non-fatal)")
+        elif live_cc == new_cc and new_cc != old_cc:
+            add("country.deferred", "fail", f"deferred country 가 라이브로 누출: {live_cc} (기대 {old_cc})")
+        else:
+            add("country.deferred", "ok", f"regdomain {live_cc} 유지 (NEW {new_cc} 는 reboot 후)")
+    return {"result": worst, "checks": checks}
diff --git a/src/network/watchdog.py b/src/network/watchdog.py
new file mode 100644
index 0000000..78dcdd0
--- /dev/null
+++ b/src/network/watchdog.py
@@ -0,0 +1,336 @@
+"""상시 감시·자가복구 (spec §8). 판정 기준 = network_config.json (적용본).
+틱 30s(튜너블 10-300), 히스테리시스 2, cooldown 5분, 시간당 4회 한도.
+억제: apply busy·CONFIRM_WAIT/seed·apply.service active → 전체 스킵, country-pending →
+apply.service 에스컬레이션"만" 금지 (전면 정지 금지 — 자가복구 목표 약화). engine.tick() 은
+무조건 호출. 정상 틱은 디스크 무기록(RAM 카운터 + 1h heartbeat).
+gateway ping 은 2틱마다 (interval×2) WARN 로그만."""
+import hashlib, json, os, subprocess, threading, time
+
+GRACE_S = 120
+COOLDOWN_S = 300
+HOURLY_MAX = 4
+HEARTBEAT_S = 3600
+APPLY_SERVICE = "dpworld-network-apply.service"
+COMPAT_DPWORLDAPP_MD5 = ("a66c515be8de867e276aa7683c5582f1",)   # §9 렌더 계약 검증된 빌드
+
+# 복구 사다리: 체크 이름 → [단계1, 단계2, ...], 각 단계 = argv 목록 (§8 표)
+_LADDERS = {
+    "wlan_module": [[["systemctl", "start", "dpworld-net-recover.service"]]],
+    "wpa_state": [[["wpa_cli", "-i", "wlan0", "reconfigure"]],
+                  [["systemctl", "restart", "wpa_supplicant@wlan0.service"]]],
+    # §3.3-5: apply.service 단독은 gateway/metric-only 변경 침묵 누락 → reload 동반 필수
+    "addr_route": [[["networkctl", "reconfigure", "wlan0"]],
+                   [["systemctl", "start", APPLY_SERVICE], ["networkctl", "reload"]]],
+}
+
+
+def _addrs_in(ip_brief_out):
+    """M2: `ip -br addr show` 출력 → 정확한 주소 목록 (prefix 제거) — substring 오탐 차단
+    (예: 설정 192.168.55.5 가 라이브 192.168.55.54/24 에 substring 매칭되던 결함)."""
+    addrs = []
+    for ln in ip_brief_out.splitlines():
+        parts = ln.split()
+        addrs.extend(t.split("/")[0] for t in parts[2:])
+    return addrs
+
+
+def _ladder_for(name):
+    if name in ("eth0", "eth1"):
+        return [[["networkctl", "reconfigure", name]]]   # 실패한 iface 그 자체 (§8)
+    return _LADDERS.get(name, [[["systemctl", "start", "dpworld-net-recover.service"]]])
+
+
+class NetworkWatchdog:
+    def __init__(self, db, engine, journal, net_dir, clock=time.monotonic, runner=None):
+        self.db = db; self.engine = engine; self.journal = journal
+        self.net_dir = net_dir; self.clock = clock
+        self.runner = runner or (lambda argv, t=20: _run(argv, t))
+        self._fail_streak = {}          # check name → 연속 실패 수
+        self._last_recover = {}         # check name → monotonic
+        self._recover_times = []        # 최근 1h 발동 시각
+        self._critical = False
+        self._grace_until = None        # start() 시 설정
+        self._last_heartbeat = 0.0
+        self._last_results = {}
+        self._tick_count = 0
+        self._carrier_state = {}        # iface → bool (transition WARN 용)
+        self._ping_state = {}           # iface → bool (transition WARN 용)
+        self._down_drift_state = {}     # M1: iface → bool (DOWN+주소drift transition WARN 용)
+        self._wpa_query_state = None    # C3: wpa_cli 쿼리 성공 여부 (transition WARN 용)
+        self._last_apply_id = None      # I1b: 마지막으로 본 apply_id — 변경 시 streak 리셋
+        self._thread = None
+        # Fix #32: guard _critical / _recover_times — reset_critical() (config route
+        # thread) races the watchdog loop thread that mutates the recovery rate-limit.
+        self._lock = threading.Lock()
+
+    # ── config (net_config DB key, log_config 전례) ─────────
+    def _cfg(self):
+        cfg = {}
+        try:
+            cfg = self.db.get_config("net_config") or {}
+        except Exception:   # noqa: BLE001
+            pass
+        cfg = cfg if isinstance(cfg, dict) else {}   # I2: list 등 이형 → 기본값 (thread 사망 금지)
+        try:
+            interval = max(10, min(300, int(cfg.get("watchdog_interval_s", 30))))
+        except (TypeError, ValueError):
+            interval = 30
+        return {"enabled": cfg.get("watchdog_enabled", "on") == "on",
+                "auto_recover": cfg.get("watchdog_auto_recover", "on") == "on",
+                "interval_s": interval}   # §8 튜너블 3종
+
+    # ── 판정 입력 ────────────────────────────────────────────
+    def _intent(self):
+        try:
+            from network import renderer
+            with open(os.path.join(self.net_dir, "network_config.json"), encoding="utf-8") as f:
+                return renderer.intent_from_persist(json.load(f))
+        except (OSError, ValueError):
+            return None
+
+    def _note_carrier(self, ifc, up):
+        prev = self._carrier_state.get(ifc)
+        self._carrier_state[ifc] = up
+        if prev is not False and not up:   # transition → WARN 1회 (§8: 복구 대상 아님)
+            self.journal.event("watchdog", phase="detect", action=f"{ifc}_no_carrier",
+                               result="warn", detail={"note": "케이블 미연결 — 복구 안 함"})
+
+    def _note_wpa_query(self, ok):
+        """C3: wpa_cli 쿼리 실패 transition WARN 1회 — _note_carrier 패턴."""
+        prev = self._wpa_query_state
+        self._wpa_query_state = ok
+        if prev is not False and not ok:
+            self.journal.event("watchdog", phase="detect", action="wpa_query_failed",
+                               result="warn",
+                               detail={"note": "wpa_cli 무응답 — UNKNOWN 처리, 복구 안 함 (C3)"})
+
+    def _collect_checks(self):
+        """name → bool(healthy). 이름 = wlan_module/wpa_state/addr_route/eth0/eth1.
+        테스트에서 통째 주입."""
+        it = self._intent()
+        if it is None:
+            return {}
+        out = {}
+        from network import netmodel
+        wifi_configured = bool(netmodel.effective_profiles(it))
+        if wifi_configured:
+            out["wlan_module"] = os.path.isdir("/sys/module/wlan") and \
+                os.path.exists("/sys/class/net/wlan0")
+            rc, txt = self.runner(["wpa_cli", "-i", "wlan0", "status"], 5)
+            if rc == 0:
+                self._note_wpa_query(True)
+                out["wpa_state"] = "wpa_state=COMPLETED" in txt
+            else:
+                # C3: 쿼리 실패 = UNKNOWN — 키 생략 (unhealthy 오판 → production wpa flap 금지.
+                # 부팅 순서 race: wpa_supplicant 제어 소켓 준비 전 watchdog 선기동)
+                self._note_wpa_query(False)
+            if it["wlan0"]["mode"] == "static":
+                rc2, addrs = self.runner(["ip", "-br", "addr", "show", "wlan0"], 5)
+                if rc2 != 0:
+                    # M-D: transient ip(8) failure → UNKNOWN, omit key (mirror wpa_state C3 pattern)
+                    pass
+                else:
+                    ok = it["wlan0"]["ip"] in _addrs_in(addrs)   # M2: 정확 일치
+                    if ok and netmodel.gateway_set(it["wlan0"]):   # §8: IP + 기본라우트 일치
+                        # Fix #13: gate on rc — a transient `ip route show` failure
+                        # must not register as route-missing (mirror C3 rc-omit at
+                        # ~125). On rc!=0 leave `ok` as the address-only result.
+                        rc_rt, routes = self.runner(["ip", "route", "show"], 5)
+                        if rc_rt == 0:
+                            ok = f"default via {it['wlan0']['gateway']} dev wlan0" in routes
+                    out["addr_route"] = ok
+        for ifc in ("eth0", "eth1"):
+            if it[ifc]["mode"] == "static" and it[ifc]["ip"]:
+                rc3, addrs3 = self.runner(["ip", "-br", "addr", "show", ifc], 5)
+                # 케이블 미연결/링크 다운은 복구 대상 아님 (§8). .56 실측: 케이블 없는 eth0 은
+                # NO-CARRIER 가 아니라 state=DOWN 으로 나옴 — 가드 누락 시 5분마다 무의미
+                # reconfigure → 시간당 4회 한도 도달 → watchdog CRITICAL 자멸.
+                tokens3 = addrs3.split()
+                state3 = tokens3[1] if len(tokens3) >= 2 else ""
+                if "NO-CARRIER" in addrs3 or state3 == "DOWN":
+                    self._note_carrier(ifc, False)
+                    # v1.6.0 codex M1: 복구는 여전히 보류(자멸 방지)하되, DOWN iface 가 stale/wrong
+                    # IP 를 들고 있으면(intent IP 부재) 가시성만 추가 — transition-only WARN.
+                    present = _addrs_in(addrs3)
+                    drift = bool(present) and it[ifc]["ip"] not in present
+                    prev = self._down_drift_state.get(ifc)
+                    self._down_drift_state[ifc] = drift
+                    if drift and not prev:
+                        self.journal.event("watchdog", phase="detect",
+                                           action=f"{ifc}_down_addr_drift", result="warn",
+                                           detail={"expected": it[ifc]["ip"], "actual": present,
+                                                   "state": state3,
+                                                   "note": "link DOWN + 주소 불일치 — 복구 보류(케이블/링크 점검)"})
+                    self._fail_streak[ifc] = 0   # M3: carrier 부재 — streak 동결 아닌 리셋
+                    continue
+                self._note_carrier(ifc, True)
+                out[ifc] = it[ifc]["ip"] in _addrs_in(addrs3)   # per-iface 키 + M2 정확 일치
+        return out
+
+    def _ping_targets(self):
+        """gateway ping 대상 — 테스트 주입점."""
+        it = self._intent()
+        if it is None:
+            return []
+        from network import netmodel
+        return [(ifc, it[ifc]["gateway"]) for ifc in ("wlan0", "eth0", "eth1")
+                if it[ifc]["mode"] == "static" and netmodel.gateway_set(it[ifc])]
+
+    def _gateway_ping_warn(self):
+        """§8 체크 4: 2틱마다 (interval×2) ping — WARN 로그만, 자동복구 절대 금지 (auth-loop 이력 교훈)."""
+        for ifc, gw in self._ping_targets():
+            rc, _ = self.runner(["ping", "-c", "1", "-W", "2", "-I", ifc, gw], 5)
+            ok = rc == 0
+            prev = self._ping_state.get(ifc)
+            self._ping_state[ifc] = ok
+            if prev is not False and not ok:   # transition 시에만 기록 (스팸 방지)
+                self.journal.event("watchdog", phase="detect", action="gw_ping", result="warn",
+                                   detail={"iface": ifc, "gateway": gw, "note": "자동복구 없음 (§8)"})
+
+    def _service_active(self, unit):
+        rc, _ = self.runner(["systemctl", "is-active", "--quiet", unit], 5)
+        return rc == 0
+
+    def _do_recover(self, name, ladder_idx):
+        ladder = _ladder_for(name)
+        step = ladder[min(ladder_idx, len(ladder) - 1)]
+        for argv in step:
+            # §8 억제 5: country deferred 보류 중엔 apply.service 에스컬레이션만 금지
+            if self.engine.country_pending() and APPLY_SERVICE in argv:
+                self.journal.event("watchdog", phase="recover", action="skip_apply_service",
+                                   result="warn", detail={"check": name, "reason": "country_pending (§8)"})
+                continue
+            rc, out = self.runner(argv, 30)
+            self.journal.event("watchdog", phase="recover", action=" ".join(argv),
+                               result="ok" if rc == 0 else "fail", detail={"check": name, "rc": rc})
+
+    # ── 틱 ──────────────────────────────────────────────────
+    def reset_critical(self):
+        """#6: 수동 재무장 — #2 config 라우트의 reset_watchdog_critical 가 호출.
+        critical 잠금 + 1h 발동 이력을 비워 자가복구를 즉시 되살린다."""
+        with self._lock:   # Fix #32: serialize with the watchdog loop's tick mutations
+            self._critical = False
+            self._recover_times = []
+        self.journal.event("watchdog", phase="reset", action="critical_reset_manual",
+                           result="ok", detail={})
+
+    def tick_once(self):
+        self.engine.tick()   # confirm TTL 안전망 — 억제조건·enabled 와 무관하게 항상 (§6.1)
+        cfg = self._cfg()
+        now = self.clock()
+        # #6: 자동 재무장 — 시간당 한도(HOURLY_MAX)로 _critical 잠긴 뒤 1h 창이 비면 스스로 해제.
+        # early-return 전에 평가해야 critical 잠금 상태에서도 재무장이 동작한다.
+        with self._lock:   # Fix #32: serialize rate-limit state with reset_critical()
+            self._recover_times = [t for t in self._recover_times if now - t < 3600]
+            rearmed = self._critical and not self._recover_times
+            if rearmed:
+                self._critical = False
+        if rearmed:
+            self.journal.event("watchdog", phase="rate_limit", action="critical_auto_rearmed",
+                               result="ok", detail={})
+        if not cfg["enabled"] or self._critical:
+            return
+        if self._grace_until is None:
+            self._grace_until = now + GRACE_S
+        if now < self._grace_until:
+            return
+        # I1a: CONFIRM_WAIT 포함 억제 — eth1 확인 대기 중 복구 사다리 침범 금지
+        # (is_busy_or_confirming 부재 FakeEngine 호환: is_busy 폴백)
+        if getattr(self.engine, "is_busy_or_confirming", self.engine.is_busy)():
+            return   # apply 진행/확인 대기 중 일시정지 (§8)
+        if self._service_active(APPLY_SERVICE) or \
+                self._service_active("dpworld-network-seed.service"):
+            return   # dpworldapp 재시작 직후 정당한 재적용과 경합 금지 (§3.3-4)
+        # I1b: 새 apply 가 지나가면 구 구성 기준의 streak/transition 상태는 무효 — 리셋
+        status_fn = getattr(self.engine, "status", None)
+        if status_fn is not None:
+            try:
+                aid = status_fn().get("apply_id")
+            except Exception:   # noqa: BLE001 — status 실패가 watchdog 틱을 막으면 안 됨
+                aid = self._last_apply_id
+            if aid != self._last_apply_id:
+                self._last_apply_id = aid
+                self._fail_streak.clear()
+                self._ping_state.clear()
+                self._carrier_state.clear()
+                self._down_drift_state.clear()   # Fix #18: else a stale DOWN+drift
+                #   warning is silenced for the watchdog's lifetime (transition gate)
+        self._tick_count += 1
+        results = self._collect_checks()
+        self._last_results = results
+        for name, healthy in results.items():
+            if healthy:
+                self._fail_streak[name] = 0
+                continue
+            self._fail_streak[name] = self._fail_streak.get(name, 0) + 1
+            if self._fail_streak[name] < 2:        # 히스테리시스 (§8)
+                continue
+            if not cfg["auto_recover"]:
+                self.journal.event("watchdog", phase="detect", action=name, result="warn",
+                                   detail={"auto_recover": False})
+                continue
+            if now - self._last_recover.get(name, -1e9) < COOLDOWN_S:
+                continue
+            with self._lock:   # Fix #32: serialize rate-limit state with reset_critical()
+                self._recover_times = [t for t in self._recover_times if now - t < 3600]
+                tripped = len(self._recover_times) >= HOURLY_MAX
+                if tripped:
+                    self._critical = True
+                    recoveries = len(self._recover_times)
+            if tripped:
+                self.journal.event("watchdog", phase="rate_limit", action="critical_stop",
+                                   result="fail", detail={"recoveries_last_hour": recoveries})
+                return
+            ladder_idx = max(0, self._fail_streak[name] - 2)
+            self._do_recover(name, ladder_idx)
+            self._last_recover[name] = now
+            with self._lock:   # Fix #32: serialize rate-limit state with reset_critical()
+                self._recover_times.append(now)
+        if self._tick_count % 2 == 0:
+            self._gateway_ping_warn()   # 2틱마다 = interval×2 (§8 체크 4)
+        if now - self._last_heartbeat >= HEARTBEAT_S:
+            self._last_heartbeat = now
+            self.journal.event("watchdog", phase="heartbeat", action="tick", result="ok",
+                               detail={"checks": {k: bool(v) for k, v in results.items()}})
+
+    def _check_fw_md5(self):
+        """§9 펌웨어 drift 감시 — 시작 시 1회: 렌더 계약 검증된 dpworldapp 빌드인지.
+        I6: 1MB 청크 read — MemoryMax=48M 하에서 수십 MB 바이너리 전체 read 금지."""
+        try:
+            h = hashlib.md5()
+            with open("/usr/bin/dpworldapp", "rb") as f:
+                for chunk in iter(lambda: f.read(1024 * 1024), b""):
+                    h.update(chunk)
+            md5 = h.hexdigest()
+        except OSError:
+            return
+        if md5 not in COMPAT_DPWORLDAPP_MD5:
+            self.journal.event("watchdog", phase="startup", action="fw_md5_drift", result="warn",
+                               detail={"md5": md5, "note": "렌더 계약 미검증 펌웨어 — golden 재캡처 필요 (§9)"})
+
+    def snapshot(self):
+        return {"enabled": self._cfg()["enabled"], "critical": self._critical,
+                "fail_streak": dict(self._fail_streak), "last_results": dict(self._last_results)}
+
+    def start(self):
+        if self._thread:
+            return
+        self._grace_until = self.clock() + GRACE_S
+        self._check_fw_md5()
+        def loop():
+            while True:
+                try:
+                    self.tick_once()
+                    time.sleep(self._cfg()["interval_s"])
+                except Exception:   # noqa: BLE001 — watchdog 은 절대 죽지 않는다
+                    time.sleep(30)   # I2: sleep 도 try 안 — _cfg 예외로 thread 사망/tight-loop 금지
+        self._thread = threading.Thread(target=loop, daemon=True, name="net-watchdog")
+        self._thread.start()
+
+
+def _run(argv, timeout):
+    try:
+        p = subprocess.run(argv, capture_output=True, text=True, timeout=timeout)
+        return p.returncode, p.stdout or ""
+    except (subprocess.SubprocessError, OSError) as e:
+        return 1, str(e)
diff --git a/src/server.py b/src/server.py
new file mode 100644
index 0000000..60362a0
--- /dev/null
+++ b/src/server.py
@@ -0,0 +1,1291 @@
+"""
+server.py — Python HTTP Server for IoT Web Configurator
+
+Replaces the Java Spring Boot backend with a Python stdlib-only HTTP server.
+Serves the same 4 REST API endpoints as the original Java application:
+  - GET  /setting/get-device
+  - POST /setting/device
+  - GET  /setting/get-protocol
+  - POST /setting/protocol
+
+Also serves static files (HTML/CSS/JS) for standalone operation.
+
+Memory usage: ~10-30MB (vs Java's 436MB)
+Dependencies: Python stdlib only (http.server, sqlite3, json, os, urllib)
+"""
+
+import gzip
+import json
+import os
+import shutil
+import socket
+import sqlite3
+import sys
+import time
+import mimetypes
+import traceback
+import logging
+from http.server import HTTPServer, BaseHTTPRequestHandler
+from socketserver import ThreadingMixIn
+from urllib.parse import urlparse
+
+# Add src directory to path for imports
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+from db_manager import DBManager
+from migrations import apply_all_migrations
+from config_validator import (
+    strip_none_values,
+    normalize_device_port_types,
+    validate_device_port_types_hard,
+    process_protocol_config,
+    ensure_meid_string,
+    validate_device_config,
+    validate_protocol_config,
+    validate_device_enums,
+    validate_protocol_enums,
+    validate_wifi_country_code,
+    validate_odo_field,
+    validate_super_relay_keys,   # NEW v1.4.4
+    validate_rs485_integers,     # NEW v1.4.5
+    validate_register_entries,        # NEW v1.11.8 A
+    validate_log_config_hard,         # NEW v1.11.8 B
+    validate_wifi_ssid_profiles,      # NEW v1.11.8 C
+    validate_device_ip_fields_hard,   # NEW v1.11.8 D
+)
+from enum_normalizer import normalize_device_input, normalize_protocol_input  # v1.4.0.3
+import kernel_log
+from log_manager import (
+    list_log_files,
+    validate_filenames,
+    create_download_archive,
+    sweep_stale_download_temp_dirs,
+    start_auto_compress_daemon,
+    get_log_stats,
+    run_manual_compression,
+    delete_log_files,
+    migrate_log_config,
+    LOG_CONFIG_KEYS,
+)
+# v1.6.0 M8: set_network_apply_provider 를 단일 import 로 통합 (중복 라인 제거)
+from system_status import (
+    get_system_status,
+    test_connections,
+    restart_dpworldapp,
+    set_network_apply_provider,
+)
+from support_bundle import build_support_bundle
+from firmware.fw_controller import FirmwareController
+from firmware.fw_routes import FirmwareRoutes, RouteError
+
+# Configuration
+HOST = os.environ.get("HOST", "0.0.0.0")
+PORT = int(os.environ.get("PORT", "8080"))
+STATIC_DIR = os.path.join(os.path.dirname(os.path.abspath(__file__)), "static")
+
+# v1.5.4: MIME prefixes eligible for gzip compression.
+# Excludes already-compressed formats: .woff2, .gz, images (PNG/JPG/etc).
+_COMPRESSIBLE_MIME = (
+    "text/",
+    "application/javascript",
+    "application/json",
+    "image/svg+xml",
+)
+
+# DB path (also used by FirmwareController)
+DB_PATH = os.environ.get("DB_PATH", os.path.join(os.path.expanduser("~"), "db", "dynamic_data.db"))
+
+# Initialize DB manager
+db = DBManager()
+
+# Firmware OTA subsystem (v1.5.0 Phase 4a)
+# v1.5.2 B2 (H19): default_file is NOT overridden here — FirmwareController uses its own
+# default (/var/www/html/config_device.json), the correct dpworldapp seed file.
+_FW = FirmwareRoutes(
+    FirmwareController(
+        fw_host=os.environ.get("FW_HOST", "127.0.0.1"),
+        fw_port=int(os.environ.get("FW_PORT", "8990")),
+        staging_dir=os.environ.get("FW_STAGING_DIR", "/opt/fw_staging"),
+        backups_dir=os.environ.get("FW_BACKUPS_DIR", "/opt/config_backups"),
+        db_path=DB_PATH,
+    ),
+    # v1.10.2: buffer the streamed firmware ZIP on the persistent /opt eMMC partition,
+    # NOT the default /tmp tmpfs — under MemoryMax=48M with no swap, buffering a
+    # multi-hundred-MB package on RAM-backed tmpfs OOM-kills the service mid-upload.
+    # `or` (not the 2-arg default): an empty FW_UPLOAD_TMP must still resolve to /opt,
+    # never fall through FirmwareRoutes' `tmp_dir or gettempdir()` back to /tmp.
+    tmp_dir=os.environ.get("FW_UPLOAD_TMP") or "/opt/fw_upload",
+)
+
+# v1.6.0: Network apply subsystem — import-time 경로 생성 실패 시 503 fallback (Windows dev box 안전)
+_NET_INIT_ERROR = None
+_NET = None
+_NET_ENGINE = None
+_NET_WATCHDOG = None
+
+
+def _net_run(argv, timeout=10):
+    import subprocess
+    try:
+        p = subprocess.run(argv, capture_output=True, text=True, timeout=timeout)
+        return p.returncode, (p.stdout or "") + (p.stderr or "")
+    except (subprocess.SubprocessError, OSError) as e:
+        return 1, str(e)
+
+
+def _net_drift():
+    """DB ↔ network_config.json 22항목 drift (§5.1 state)."""
+    try:
+        from network import netmodel as _netmodel, renderer as _renderer
+        import json as _json
+        dev = db.get_config("device_config") or {}
+        with open(os.path.join(os.environ.get("NET_DIR", "/home/root/network"),
+                               "network_config.json"), encoding="utf-8") as f:
+            persist = _renderer.intent_from_persist(_json.load(f))
+        diff = _netmodel.diff_intents(persist, _netmodel.intent_from_device(dev))
+        return {"dirty": bool(diff), "fields": [d["field"] for d in diff]}
+    except (OSError, ValueError):
+        # #21 fix: an unreadable config is UNKNOWN drift, not 'no drift'. Returning
+        # dirty:False here was a false 'no drift'; dirty:None signals unknown so the
+        # UI does not zero the count or render a green 'no drift'.
+        return {"dirty": None, "error": "network_config.json unreadable", "fields": []}
+
+
+def _net_live():
+    # I3: _ip_brief 는 (table, ok) 튜플 — interfaces 는 map 유지 (Phase 4 UI 가 object 소비)
+    from network.verifier import _ip_brief
+    table, ok = _ip_brief(lambda a, t=5: _net_run(a, t))
+    return {"interfaces": table, "interfaces_ok": ok}
+
+
+try:
+    from network.apply_engine import ApplyEngine
+    from network.journal import Journal as _NetJournal
+    from network.net_routes import NetworkRoutes, RouteError as NetRouteError
+    from network.watchdog import NetworkWatchdog
+
+    _NET_JOURNAL = _NetJournal(os.path.join(os.environ.get("LOG_DIR", "/opt/log/dpworldapp"),
+                                             "network_journal.jsonl"))
+    _NET_ENGINE = ApplyEngine(
+        db=db, net_dir=os.environ.get("NET_DIR", "/home/root/network"),
+        backups_dir=os.environ.get("NET_BACKUPS_DIR", "/opt/config_backups/network"),
+        state_path=os.environ.get("NET_STATE_PATH",
+                                  "/opt/config_backups/network/apply_state.json"),
+        journal=_NET_JOURNAL,
+        runner=_net_run)
+    _NET_WATCHDOG = NetworkWatchdog(db=db, engine=_NET_ENGINE, journal=_NET_JOURNAL,
+                                    net_dir=os.environ.get("NET_DIR", "/home/root/network"))
+    _NET = NetworkRoutes(_NET_ENGINE, _NET_JOURNAL, _NET_WATCHDOG, _net_drift, _net_live)
+except Exception as _e:   # noqa: BLE001 — server must never fail to import due to network subsystem
+    _NET_INIT_ERROR = str(_e)
+    print(f"[startup] WARNING: network subsystem unavailable: {_NET_INIT_ERROR}", flush=True)
+
+    class _RouteErrorStub(Exception):
+        def __init__(self, status, message):
+            super().__init__(message); self.status = status; self.message = message
+
+    NetRouteError = _RouteErrorStub
+
+
+# AP: subsystem init — begin
+_AP = None
+_AP_INIT_ERROR = None
+try:
+    from network.ap_engine import ApEngine, parse_iw_link_channel
+    from network.ap_routes import ApRoutes, RouteError as ApRouteError
+    _AP_ENGINE = ApEngine(
+        ap_dir=os.environ.get("AP_DIR", "/home/root/network/ap"),
+        state_path=os.environ.get("AP_STATE_PATH", "/opt/dpworld-network/ap_apply_state.json"),
+        runner=_net_run,
+        live_country=(lambda: _NET_ENGINE.live_country()) if _NET_ENGINE else (lambda: ""),
+        sta_channel=lambda: parse_iw_link_channel(_net_run(["iw", "dev", "wlan0", "link"], 5)[1]),
+        country_pending=(lambda: _NET_ENGINE.country_pending()) if _NET_ENGINE else (lambda: False))
+    _AP = ApRoutes(engine=_AP_ENGINE, db=db)
+except Exception as _ape:
+    _AP_INIT_ERROR = str(_ape)
+    print(f"[startup] WARNING: AP subsystem unavailable: {_AP_INIT_ERROR}", flush=True)
+# AP: subsystem init — end
+
+
+def _network_apply_provider():
+    """v1.6.0 I4: system_status 용 network_apply provider — 절대 raise 금지 (fail-soft).
+    snapshot() 1회 호출을 watchdog/interfaces 두 키가 공유."""
+    try:
+        snap = _NET_WATCHDOG.snapshot()
+        return {
+            "watchdog": snap,
+            "drift": _net_drift(),
+            "country_pending": _NET_ENGINE.country_pending(),
+            "interfaces": {name: ("ok" if healthy else "fail")
+                           for name, healthy in snap["last_results"].items()},
+        }
+    except Exception as e:   # noqa: BLE001 — provider 실패가 system-status 전체를 죽이면 안 됨
+        return {"error": str(e)}
+
+
+class ConfigHandler(BaseHTTPRequestHandler):
+    """HTTP request handler for the Web Configurator API."""
+
+    # Suppress default logging per-request (we log manually)
+    def log_message(self, format, *args):
+        print(f"[{self.log_date_time_string()}] {format % args}")
+
+    # ─── CORS ────────────────────────────────────────────────────────────
+    def _send_cors_headers(self):
+        """Add CORS headers matching Java CorsConfig (allow all)."""
+        self.send_header("Access-Control-Allow-Origin", "*")
+        self.send_header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
+        self.send_header("Access-Control-Allow-Headers", "*")
+        self.send_header("Access-Control-Max-Age", "3600")
+
+    # ─── Response Helpers ────────────────────────────────────────────────
+    def _send_json_response(self, data, status=200):
+        """Send a JSON response."""
+        body = json.dumps(data, ensure_ascii=False, indent=2).encode("utf-8")
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json; charset=utf-8")
+        self.send_header("Content-Length", str(len(body)))
+        self._send_cors_headers()
+        self.end_headers()
+        self.wfile.write(body)
+
+    def _send_text_response(self, text, status=200):
+        """Send a plain text response."""
+        body = text.encode("utf-8")
+        self.send_response(status)
+        self.send_header("Content-Type", "text/plain; charset=utf-8")
+        self.send_header("Content-Length", str(len(body)))
+        self._send_cors_headers()
+        self.end_headers()
+        self.wfile.write(body)
+
+    def _send_no_content(self):
+        """Send 204 No Content response."""
+        self.send_response(204)
+        self._send_cors_headers()
+        self.end_headers()
+
+    def _send_error_response(self, message, status=500):
+        """Send an error response as JSON."""
+        self._send_json_response({"error": message}, status)
+
+    def _send_binary_response(self, data, content_type, filename, status=200):
+        """Send a binary file download response."""
+        self.send_response(status)
+        self.send_header("Content-Type", content_type)
+        self.send_header("Content-Length", str(len(data)))
+        self.send_header("Content-Disposition", f'attachment; filename="{filename}"')
+        self._send_cors_headers()
+        self.end_headers()
+        self.wfile.write(data)
+
+    MAX_BODY_SIZE = 1 * 1024 * 1024  # 1MB
+
+    def _read_request_body(self):
+        """Read and parse JSON request body.
+
+        Returns:
+            dict on success, or None if an error response was already sent
+            (caller should just `return` without sending another response).
+        """
+        try:
+            content_length = int(self.headers.get("Content-Length", 0))
+        except (ValueError, TypeError):
+            self._send_error_response("Invalid Content-Length", 400)
+            return None
+        if content_length < 0:
+            self._send_error_response("Invalid Content-Length", 400)
+            return None
+        if content_length > self.MAX_BODY_SIZE:
+            self._send_error_response("Payload Too Large", 413)
+            return None
+        if content_length == 0:
+            self._send_error_response("Empty request body", 400)
+            return None
+        body = self.rfile.read(content_length)
+        try:
+            return json.loads(body.decode("utf-8"))
+        except UnicodeDecodeError:
+            self._send_error_response("Invalid UTF-8 encoding", 400)
+            return None
+        except json.JSONDecodeError as e:
+            self._send_error_response(f"Invalid JSON: {e}", 400)
+            return None
+
+    # ─── Static File Serving ─────────────────────────────────────────────
+
+    def _is_compressible(self, mime):
+        """Return True if this MIME type should be gzip-compressed."""
+        return any(mime.startswith(p) for p in _COMPRESSIBLE_MIME)
+
+    def _accepts_gzip(self, accept_encoding):
+        """Parse Accept-Encoding for gzip with q-value support.
+
+        Returns True if client accepts gzip with q > 0.
+        Handles 'gzip;q=0' (explicit reject) correctly — plain 'in' check misses this.
+        v1.5.4.2 L1 fix.
+        """
+        if not accept_encoding:
+            return False
+        for part in accept_encoding.split(','):
+            tok = part.strip().split(';')
+            name = tok[0].strip().lower()
+            if name in ('gzip', 'x-gzip'):
+                q = 1.0
+                for p in tok[1:]:
+                    p = p.strip()
+                    if p.startswith('q='):
+                        try:
+                            q = float(p[2:])
+                        except (ValueError, TypeError):
+                            pass
+                return q > 0
+        return False
+
+    def _serve_static_file(self, path):
+        """Serve a static file from the static directory.
+
+        v1.5.4 enhancements:
+        - gzip compression for compressible MIME types when client accepts it
+        - ETag (weak, mtime+size) + If-None-Match → 304 Not Modified
+        - Cache-Control: HTML → no-cache; JS/CSS → no-cache (v1.5.4.2); fonts/images → max-age=86400
+        """
+        # Default to index.html
+        if path == "/" or path == "":
+            path = "/index.html"
+
+        # Security: prevent path traversal and symlink attacks
+        file_path = os.path.realpath(os.path.join(STATIC_DIR, path.lstrip("/")))
+        if not file_path.startswith(os.path.realpath(STATIC_DIR) + os.sep):
+            self._send_error_response("Forbidden", 403)
+            return
+
+        if not os.path.isfile(file_path):
+            # SPA fallback: serve index.html for unknown routes
+            file_path = os.path.join(STATIC_DIR, "index.html")
+            if not os.path.isfile(file_path):
+                self._send_error_response("Not Found", 404)
+                return
+
+        # Determine content type
+        content_type, _ = mimetypes.guess_type(file_path)
+        if content_type is None:
+            content_type = "application/octet-stream"
+
+        try:
+            # v1.5.4.3 B2 fix: open + os.fstat 결합 — stat()↔open() 사이의 TOCTOU 제거.
+            # 이전 패턴(os.stat → open)은 deploy.ps1 atomic-swap 윈도우 사이에 mtime/size가
+            # 갱신될 수 있어 ETag와 body가 서로 다른 파일 표현이 될 위험이 있었다.
+            with open(file_path, "rb") as f:
+                content = f.read()
+                stat = os.fstat(f.fileno())
+            etag_raw_suffix = f'{int(stat.st_mtime)}-{stat.st_size}'
+
+            # v1.5.4.3 B1 fix: Cache-Control 정책을 304 분기 전에 계산해 304 응답에도 포함.
+            # RFC 7232 §4.1 — 304는 200에서 보낼 Cache-Control 등 freshness 헤더를 포함해야 한다.
+            if content_type.startswith("text/html"):
+                cache_control = "no-cache, must-revalidate"
+            elif (content_type.startswith("font/") or
+                  content_type.startswith("image/") or
+                  file_path.endswith(".woff2")):
+                cache_control = "public, max-age=86400"
+            else:
+                # v1.5.4.2 H1+M2 fix: JS/CSS use no-cache (always revalidate via ETag).
+                # 304 Not Modified with gzip is essentially 0-byte body — perf almost
+                # identical to max-age, but deploy propagation is immediate (no 5-min
+                # stale window where deployed HTML+old JS coexist).
+                cache_control = "no-cache, must-revalidate"
+
+            # v1.5.4: gzip compression for compressible types (>256 bytes) when
+            # client sends Accept-Encoding: gzip.  .woff2/images are excluded via
+            # _is_compressible().
+            # v1.5.4.3 B4 fix: gzip 표현과 비압축 표현을 서로 다른 ETag로 구분.
+            accepts = self.headers.get("Accept-Encoding") or ""
+            wants_gzip = (self._accepts_gzip(accepts)
+                          and self._is_compressible(content_type)
+                          and len(content) > 256)
+            content_encoding = None
+            etag = f'W/"{etag_raw_suffix}{"-gz" if wants_gzip else ""}"'
+
+            # v1.5.4: Conditional GET — If-None-Match → 304 Not Modified
+            # v1.5.4.3 B1+B5 fix: 304 응답에도 Cache-Control + Vary 포함 (compressible MIME일 때).
+            if_none_match = self.headers.get("If-None-Match") or ""
+            if if_none_match == etag:
+                self.send_response(304)
+                self.send_header("ETag", etag)
+                self.send_header("Cache-Control", cache_control)
+                if self._is_compressible(content_type):
+                    self.send_header("Vary", "Accept-Encoding")
+                self._send_cors_headers()
+                self.end_headers()
+                return
+
+            if wants_gzip:
+                content = gzip.compress(content, compresslevel=6)
+                content_encoding = "gzip"
+
+            self.send_response(200)
+            self.send_header("Content-Type", content_type)
+            self.send_header("Content-Length", str(len(content)))
+            self.send_header("Cache-Control", cache_control)
+            self.send_header("ETag", etag)
+            # v1.5.4.3 B5 fix: 압축 가능 MIME이면 비압축 응답에도 Vary 포함 (proxy 캐시 안전).
+            if self._is_compressible(content_type):
+                self.send_header("Vary", "Accept-Encoding")
+            if content_encoding:
+                self.send_header("Content-Encoding", content_encoding)
+            self.send_header("X-Content-Type-Options", "nosniff")
+            self.send_header("X-Frame-Options", "DENY")
+            self._send_cors_headers()
+            self.end_headers()
+            self.wfile.write(content)
+        except IOError:
+            self._send_error_response("Internal Server Error", 500)
+
+    # ─── OPTIONS (CORS Preflight) ────────────────────────────────────────
+    def do_OPTIONS(self):
+        """Handle CORS preflight requests."""
+        self.send_response(204)
+        self._send_cors_headers()
+        self.end_headers()
+
+    # ─── GET Handlers ────────────────────────────────────────────────────
+    def do_GET(self):
+        """Route GET requests."""
+        parsed = urlparse(self.path)
+        path = parsed.path
+
+        if path == "/setting/get-device":
+            self._handle_get_device()
+        elif path == "/setting/get-protocol":
+            self._handle_get_protocol()
+        elif path == "/setting/log-files":
+            self._handle_get_log_files()
+        elif path == "/setting/kernel-bundle":
+            self._handle_get_kernel_bundle()
+        elif path == "/setting/log-stats":
+            self._handle_get_log_stats()
+        elif path == "/api/mac":
+            self._handle_get_mac()
+        elif path == "/api/health":
+            self._handle_health()
+        elif path == "/api/system-status":
+            self._handle_system_status()
+        elif path == "/api/support-bundle":
+            self._handle_support_bundle()
+        elif path == "/api/firmware/status":
+            self._handle_firmware_status()
+        elif path == "/api/network/state":
+            self._net_json(lambda: _NET.state())
+        elif path == "/api/network/drift":
+            # v1.7.0: 경량 전역 미적용 카운트 — drift 만 (subprocess 0)
+            self._net_json(lambda: _NET.drift())
+        elif path == "/api/network/apply/status":
+            from urllib.parse import parse_qs
+            q = parse_qs(parsed.query)
+            aid = (q.get("id") or [None])[0]
+            self._net_json(lambda: _NET.status(aid))
+        elif path == "/api/network/journal":
+            from urllib.parse import parse_qs
+            q = parse_qs(parsed.query)
+            lim = (q.get("limit") or ["50"])[0]
+            self._net_json(lambda: _NET.journal_tail(lim))
+        elif path == "/api/network/config":
+            # #2: watchdog kill-switch — 현재 net_config (효과적 기본값 merge) 조회
+            self._net_json(lambda: _NET.get_config())
+        # AP: status route
+        elif path == "/api/network/ap/status":
+            self._ap_json(lambda: _AP.status())
+        elif path.startswith("/setting/") or path.startswith("/api/"):
+            # v1.5.0: /api/ prefix guard — unknown API routes return 404 instead
+            # of falling through to _serve_static_file (which would serve
+            # index.html via SPA fallback, masking client typos in API URLs).
+            self._send_error_response("Not Found", 404)
+        else:
+            self._serve_static_file(path)
+
+    def _handle_get_device(self):
+        """GET /setting/get-device — Retrieve device configuration.
+
+        Log-management settings are stored separately in `log_config` (out of
+        reach of the legacy Java app); they are merged into the response so the
+        client still sees one combined device config.
+        """
+        try:
+            if not db.config_exists("device_config"):
+                self._send_no_content()
+                return
+            config = db.get_config("device_config")
+            if isinstance(config, dict) and db.config_exists("log_config"):
+                log_config = db.get_config("log_config")
+                if isinstance(log_config, dict):
+                    config.update(log_config)
+            self._send_json_response(config)
+        except Exception:
+            traceback.print_exc()
+            self._send_error_response("Failed to read device_config")
+
+    def _handle_get_protocol(self):
+        """GET /setting/get-protocol — Retrieve protocol configuration."""
+        try:
+            if not db.config_exists("protocol_config"):
+                self._send_no_content()
+                return
+            config = db.get_config("protocol_config")
+            self._send_json_response(config)
+        except Exception:
+            traceback.print_exc()
+            self._send_error_response("Failed to read protocol_config")
+
+    # #30 fix: uptime must use a monotonic clock so RTC skew / NTP jumps do not
+    # corrupt it. main() overwrites this at runtime (just before serve_forever).
+    _server_start_time = time.monotonic()
+
+    def _handle_health(self):
+        """GET /api/health — Server health check with uptime and status."""
+        uptime = time.monotonic() - self._server_start_time
+        # #30 fix: probe the DB instead of reporting db_ok from a mere path bool.
+        try:
+            db.config_exists("device_config")
+            db_ok = True
+        except Exception:  # noqa: BLE001 — any probe failure means not-ok
+            db_ok = False
+        # Unauthenticated endpoint: do NOT leak the absolute db path or pid.
+        # Expose only a boolean readiness flag.
+        self._send_json_response({
+            "status": "healthy",
+            "uptime_sec": round(uptime, 2),
+            "db_backend": getattr(db, "_backend", "unknown"),
+            "db_ok": db_ok,
+        })
+
+    def _handle_get_mac(self):
+        """GET /api/mac — Return WiFi MAC address for device identification."""
+        try:
+            with open("/sys/class/net/wlan0/address", "r") as f:
+                mac = f.read().strip()
+            self._send_json_response({"mac": mac})
+        except (FileNotFoundError, IOError):
+            # wlan0 not available (e.g., dev PC) — return null gracefully
+            self._send_json_response({"mac": None})
+
+    # ─── Dashboard / Status Handlers ─────────────────────────────
+
+    def _handle_system_status(self):
+        """GET /api/system-status — Aggregated device health snapshot."""
+        try:
+            self._send_json_response(get_system_status(db))
+        except Exception as e:
+            traceback.print_exc()
+            self._send_json_response(
+                {"error": f"Failed to gather status: {str(e)}"}, 500)
+
+    def _handle_support_bundle(self):
+        """GET /api/support-bundle — Diagnostics zip download."""
+        try:
+            data = build_support_bundle(db)
+            timestamp = time.strftime("%Y-%m-%d_%H%M%S")
+            self._send_binary_response(
+                data, "application/zip", f"support-bundle_{timestamp}.zip")
+        except Exception:
+            traceback.print_exc()
+            # Don't leak internal fs paths / exception detail to the client.
+            self._send_json_response(
+                {"error": "Failed to build bundle"}, 500)
+
+    def _handle_test_connections(self):
+        """POST /api/action/test-connections — TCP probe configured servers."""
+        try:
+            self._send_json_response({"results": test_connections(db)})
+        except Exception as e:
+            traceback.print_exc()
+            self._send_json_response(
+                {"error": f"Connection test failed: {str(e)}"}, 500)
+
+    def _handle_restart_dpworldapp(self):
+        """POST /api/action/restart-dpworldapp — Restart the dpworldapp unit."""
+        try:
+            self._send_json_response(restart_dpworldapp())
+        except Exception as e:
+            traceback.print_exc()
+            self._send_json_response(
+                {"restarted": False, "running": False,
+                 "error": f"Restart failed: {str(e)}"}, 500)
+
+    # ─── POST Handlers ───────────────────────────────────────────────────
+    def do_POST(self):
+        """Route POST requests."""
+        parsed = urlparse(self.path)
+        path = parsed.path
+
+        if path == "/setting/device":
+            self._handle_post_device()
+        elif path == "/setting/protocol":
+            self._handle_post_protocol()
+        elif path == "/setting/log-download":
+            self._handle_post_log_download()
+        elif path == "/setting/log-compress":
+            self._handle_post_log_compress()
+        elif path == "/setting/log-delete":
+            self._handle_post_log_delete()
+        elif path == "/api/action/test-connections":
+            self._handle_test_connections()
+        elif path == "/api/action/restart-dpworldapp":
+            self._handle_restart_dpworldapp()
+        elif path == "/api/firmware/preflight":
+            self._handle_firmware_preflight()
+        elif path == "/api/firmware/upload":
+            # #36 fix: a coarse per-read socket timeout (was settimeout(None),
+            # which let a slow-trickle client pin a worker thread forever →
+            # thread exhaustion). 120s/read is generous for large firmware ZIPs
+            # (each rfile.read() only needs to make progress within the window).
+            self.connection.settimeout(_FW_UPLOAD_READ_TIMEOUT_S)
+            try:
+                self._handle_firmware_upload()
+            finally:
+                self.connection.settimeout(None)
+        elif path == "/api/firmware/flash":
+            self._handle_firmware_flash()
+        elif path == "/api/firmware/restore-check":
+            self._handle_firmware_restore_check()
+        elif path == "/api/network/apply":
+            data = self._read_request_body()
+            if data is None:
+                return
+            # v1.6.0 I5 (v1.4.6.3 C1 패턴): JSON array/scalar → 400, {} coerce 금지
+            if not isinstance(data, dict):
+                self._send_json_response(
+                    {"ok": False, "error": "request body must be a JSON object"}, 400)
+                return
+            self._net_json(lambda: _NET.apply(data))
+        elif path == "/api/network/apply/confirm":
+            data = self._read_request_body()
+            if data is None:
+                return
+            # v1.6.0 I5 (v1.4.6.3 C1 패턴): JSON array/scalar → 400, {} coerce 금지
+            if not isinstance(data, dict):
+                self._send_json_response(
+                    {"ok": False, "error": "request body must be a JSON object"}, 400)
+                return
+            self._net_json(lambda: _NET.confirm(data))
+        elif path == "/api/network/rollback":
+            self._net_json(lambda: _NET.rollback())
+        elif path == "/api/network/config":
+            # #2: watchdog kill-switch write — net_config 의 watchdog 키 + critical 재무장
+            data = self._read_request_body()
+            if data is None:
+                return
+            if not isinstance(data, dict):
+                self._send_json_response(
+                    {"ok": False, "error": "request body must be a JSON object"}, 400)
+                return
+            self._net_json(lambda: _NET.config(data))
+        # AP: config + apply routes
+        elif path == "/api/network/ap/config":
+            data = self._read_request_body()
+            if data is None:
+                return
+            if not isinstance(data, dict):
+                self._send_json_response({"ok": False, "error": "request body must be a JSON object"}, 400)
+                return
+            self._ap_json(lambda: _AP.config(data))
+        elif path == "/api/network/ap/apply":
+            data = self._read_request_body()
+            if data is None:
+                return
+            if not isinstance(data, dict):
+                self._send_json_response({"ok": False, "error": "request body must be a JSON object"}, 400)
+                return
+            self._ap_json(lambda: _AP.apply(data))
+        else:
+            self._send_error_response("Not Found", 404)
+
+    # ─── Firmware OTA Handlers (v1.5.0 Phase 4a) ────────────────────────
+    def _handle_firmware_status(self):
+        """GET /api/firmware/status — Current OTA status snapshot."""
+        try:
+            self._send_json_response(_FW.status())
+        except Exception as e:
+            traceback.print_exc()
+            self._send_json_response({"error": str(e)}, 500)
+
+    def _handle_firmware_preflight(self):
+        """POST /api/firmware/preflight — Verify device readiness before flashing."""
+        try:
+            self._send_json_response(_FW.preflight())
+        except RouteError as e:
+            self._send_json_response({"error": e.message}, e.status)
+        except Exception as e:
+            traceback.print_exc()
+            self._send_json_response({"error": str(e)}, 500)
+
+    def _handle_firmware_upload(self):
+        """POST /api/firmware/upload — Stream firmware ZIP to staging area."""
+        try:
+            cl = self.headers.get("Content-Length")
+            result = _FW.upload(self.rfile, cl)
+            self._send_json_response(result)
+        except RouteError as e:
+            self._send_json_response({"error": e.message}, e.status)
+        except Exception as e:
+            traceback.print_exc()
+            self._send_json_response({"error": str(e)}, 500)
+
+    def _handle_firmware_flash(self):
+        """POST /api/firmware/flash — Start flashing staged firmware."""
+        try:
+            self._send_json_response(_FW.flash())
+        except RouteError as e:
+            self._send_json_response({"error": e.message}, e.status)
+        except Exception as e:
+            traceback.print_exc()
+            self._send_json_response({"error": str(e)}, 500)
+
+    def _handle_firmware_restore_check(self):
+        """POST /api/firmware/restore-check — Verify backup config integrity."""
+        try:
+            self._send_json_response(_FW.restore_check())
+        except RouteError as e:
+            self._send_json_response({"error": e.message}, e.status)
+        except Exception as e:
+            traceback.print_exc()
+            self._send_json_response({"error": str(e)}, 500)
+
+    # ─── Network Apply Handlers (v1.6.0) ────────────────────────────────────
+    def _net_json(self, fn):
+        """Common helper for /api/network/* — 503 when subsystem unavailable."""
+        if _NET is None:
+            self._send_json_response(
+                {"ok": False, "error": f"network subsystem unavailable: {_NET_INIT_ERROR}"}, 503)
+            return
+        try:
+            self._send_json_response(fn())
+        except NetRouteError as e:
+            self._send_json_response({"ok": False, "error": e.message}, e.status)
+        except OSError:
+            traceback.print_exc()
+            # v1.11.5: sanitize — do not leak internal fs paths from OSError str()
+            self._send_json_response({"ok": False, "error": "Network configuration write failed"}, 500)
+        except Exception:
+            traceback.print_exc()
+            # Don't leak internal exception details to clients
+            self._send_json_response({"ok": False, "error": "Network request failed"}, 500)
+
+    # AP: routes json helper
+    def _ap_json(self, fn):
+        if _AP is None:
+            self._send_json_response(
+                {"ok": False, "error": f"AP subsystem unavailable: {_AP_INIT_ERROR}"}, 503)
+            return
+        try:
+            self._send_json_response(fn())
+        except ApRouteError as e:
+            self._send_json_response({"ok": False, "error": e.message}, e.status)
+        except OSError:
+            traceback.print_exc()
+            # v1.11.5: sanitize — do not leak internal fs paths from OSError str()
+            self._send_json_response({"ok": False, "error": "AP configuration write failed"}, 500)
+        except Exception:
+            traceback.print_exc()
+            # Don't leak internal exception details to clients
+            self._send_json_response({"ok": False, "error": "AP request failed"}, 500)
+
+    def _handle_post_device(self):
+        """POST /setting/device — Save device configuration."""
+        try:
+            data = self._read_request_body()
+            if data is None:
+                return  # Error response already sent
+
+            # v1.4.0.2: reject empty body (was: silently replaced device_config with {})
+            if not data:
+                self._send_json_response({"ok": False, "errors": ["empty body — no fields to save"]}, 400)
+                return
+
+            # v1.4.6.3 C1: JSON array/scalar 등 non-dict 차단
+            if not isinstance(data, dict):
+                self._send_json_response({"ok": False, "errors": ["request body must be a JSON object"]}, 400)
+                return
+
+            # v1.4.0.3: case-only alias normalization (e.g. "ON"→"on", "WPA/WPA2"→"wpa/wpa2")
+            # must run before enum validation so aliases pass validation correctly
+            data = normalize_device_input(data)
+
+            # v1.4.4: Super_Relay 소유 키 strict reject (silent passthrough 방지)
+            sr_errors = validate_super_relay_keys(data, "device")
+            if sr_errors:
+                self._send_json_response({"ok": False, "errors": sr_errors}, 400)
+                return
+
+            # Strict enum validation — reject unknown values immediately (blocking)
+            enum_errors = validate_device_enums(data)
+            if enum_errors:
+                self._send_json_response({"ok": False, "errors": enum_errors}, 400)
+                return
+
+            # v1.4.2 I2: wifi_country_code hard-reject via dedicated function (string-match 제거)
+            cc_error = validate_wifi_country_code(data.get("wifi_country_code"))
+            if cc_error:
+                self._send_json_response({"ok": False, "errors": [cc_error]}, 400)
+                return
+
+            # v1.4.5 fix-1: rs485 integer 타입 hard-reject (sibling pattern with v1.4.1 wifi_country_code / v1.4.3 odo_field fix-1)
+            rs485_errors = validate_rs485_integers(data)
+            if rs485_errors:
+                self._send_json_response({"ok": False, "errors": rs485_errors}, 400)
+                return
+
+            # v1.11.8 D: IP/netmask/gateway/dns/server_ip 형식 hard-reject
+            # (validate_device_config 가 soft-warn 만 하던 것 → blocking 400).
+            # 잘못된 IP 가 device_config 에 잔존 → Java/dpworldapp 파싱 실패 wipe 방지.
+            ip_errors = validate_device_ip_fields_hard(data)
+            if ip_errors:
+                self._send_json_response({"ok": False, "errors": ip_errors}, 400)
+                return
+
+            # v1.11.8 C: WIFI_SSID 프로파일 hard-reject (network/validator 규칙 재사용).
+            # 펌웨어 wpa 렌더 한계 위반(절단/escaping 없음/gap)을 save 경로에서 차단.
+            ssid_errors = validate_wifi_ssid_profiles(data)
+            if ssid_errors:
+                self._send_json_response({"ok": False, "errors": ssid_errors}, 400)
+                return
+
+            # v1.11.8 B: log-config 파괴값 hard-reject (auto_cleanup 이 전부 삭제하는 것 방지).
+            # log_* split/write 이전에 실행 (validate_device_config soft-warn 보강).
+            log_errors = validate_log_config_hard(data)
+            if log_errors:
+                self._send_json_response({"ok": False, "errors": log_errors}, 400)
+                return
+
+            # Validate (다른 errors는 soft-warn 그대로)
+            errors = validate_device_config(data)
+            if errors:
+                print(f"[WARN] Device config validation: {errors}")
+                # Return validation errors to client (non-blocking: save proceeds but client is informed)
+
+            # Strip None values (legacy app omits null-valued keys on save)
+            cleaned = strip_none_values(data)
+
+            # v1.4.6.9 H5: ports type/range hard-reject — soft-warn에서 invalid port가 device_config에
+            # string으로 잔존 → 정수 parse fail → wipe path 발생하던 결함 차단.
+            # validate_rs485_integers / validate_wifi_country_code sibling pattern.
+            port_errors = validate_device_port_types_hard(cleaned)
+            if port_errors:
+                self._send_json_response({"ok": False, "errors": port_errors}, 400)
+                return
+
+            # v1.4.6.7 C-2: backend port type normalize (defense in depth — frontend fix와 sibling).
+            # 외부 도구가 string port 보내도 dha + Java Integer schema 정합 보장.
+            normalize_device_port_types(cleaned)
+
+            # Split log-management settings into their own `log_config` key —
+            # `device_config` is overwritten by the legacy Java app, which
+            # would drop these Python-only fields.
+            log_part = {k: cleaned.pop(k) for k in LOG_CONFIG_KEYS if k in cleaned}
+
+            # v1.5.1 T2: atomic RMW via update_config (H1/H2/H6 race fix).
+            # Replaces the get_config + merge + save_config triple with a single
+            # atomic BEGIN IMMEDIATE transaction so concurrent POSTs cannot lose
+            # each other's updates.
+            _cleaned_device = cleaned  # closure capture
+
+            def _merge_device(current):
+                base = current if isinstance(current, dict) else {}
+                return {**base, **_cleaned_device}
+
+            merged_device = db.update_config("device_config", _merge_device, default={})
+
+            if log_part:
+                _log_part = log_part  # closure capture
+
+                def _merge_log(current):
+                    base = current if isinstance(current, dict) else {}
+                    return {**base, **_log_part}
+
+                merged_log = db.update_config("log_config", _merge_log, default={})
+            else:
+                merged_log = db.get_config("log_config") or {}
+
+            # Response with structured result + v1.4.0.2 diagnostic fields
+            self._send_json_response({
+                "success": True,
+                "message": "Device config saved",
+                "warnings": errors or [],
+                "merged_keys": sorted(list(cleaned.keys()) + list(log_part.keys())),
+                "preserved_keys_count": max(0, len(merged_device) - len(cleaned)),
+            })
+
+        except Exception as e:
+            traceback.print_exc()
+            # Don't leak internal exception details to clients
+            self._send_json_response({"success": False, "message": "Save failed"}, 500)
+
+    def _handle_post_protocol(self):
+        """POST /setting/protocol — Save protocol configuration."""
+        try:
+            data = self._read_request_body()
+            if data is None:
+                return  # Error response already sent
+
+            # v1.4.0.2: empty body guard
+            if not data:
+                self._send_json_response({"ok": False, "errors": ["empty body"]}, 400)
+                return
+
+            # v1.4.6.3 C1: JSON array/scalar 등 non-dict 차단
+            if not isinstance(data, dict):
+                self._send_json_response({"ok": False, "errors": ["request body must be a JSON object"]}, 400)
+                return
+
+            # v1.4.0.3: case-only alias normalization (e.g. can_input "ON"→"on")
+            data = normalize_protocol_input(data)
+
+            # v1.4.4: Super_Relay 소유 키 strict reject (silent passthrough 방지)
+            sr_errors = validate_super_relay_keys(data, "protocol")
+            if sr_errors:
+                self._send_json_response({"ok": False, "errors": sr_errors}, 400)
+                return
+
+            # Strict enum validation — reject unknown values immediately (blocking)
+            enum_errors = validate_protocol_enums(data)
+            if enum_errors:
+                self._send_json_response({"ok": False, "errors": enum_errors}, 400)
+                return
+
+            # v1.4.3 fix-1: nested odo_field hard-reject
+            # validate_protocol_config also calls validate_odo_field but soft-warn only —
+            # server.py must hard-reject explicitly (sibling pattern with v1.4.1 wifi_country_code fix-1)
+            odo_errors = []
+            odo_errors.extend(validate_odo_field(data.get("odo_speed"), "odo_speed"))
+            odo_errors.extend(validate_odo_field(data.get("odo_direction"), "odo_direction"))
+            if odo_errors:
+                self._send_json_response({"ok": False, "errors": odo_errors}, 400)
+                return
+
+            # v1.11.8 A: register-entry hard-reject (MODBUS/OPC_UA/CAN per-entry
+            # expr/shift/mask/id/dv/idt/odt + structural: non-list, >1000 cap,
+            # required field/addr/id). validate_protocol_config soft-warn 보강 →
+            # blocking 400 (sibling pattern with validate_odo_field fix-1 above).
+            #
+            # v1.11.9 Fix 3: gate the CAN array on the EFFECTIVE can_input. A
+            # partial POST may carry a CAN array but omit can_input while the DB
+            # already has it 'on' — compute the prospective merged protocol_config
+            # (current DB ∪ incoming) so the gate uses the effective value and the
+            # expr injection guard is not silently skipped.
+            try:
+                _db_proto = db.get_config("protocol_config")
+            except Exception:
+                _db_proto = None
+            _merged_proto = {**(_db_proto if isinstance(_db_proto, dict) else {}), **data}
+            register_errors = validate_register_entries(data, merged_data=_merged_proto)
+            if register_errors:
+                self._send_json_response({"ok": False, "errors": register_errors}, 400)
+                return
+
+            # Ensure MEID is string
+            data = ensure_meid_string(data)
+
+            # Validate
+            errors = validate_protocol_config(data)
+            if errors:
+                print(f"[WARN] Protocol config validation warnings: {errors}")
+
+            # Strip None values
+            cleaned = strip_none_values(data)
+
+            # v1.5.1 T2: atomic RMW via update_config (H1/H2/H6 race fix).
+            # Replaces the get_config + merge + save_config triple with a single
+            # atomic BEGIN IMMEDIATE transaction so concurrent POSTs cannot lose
+            # each other's updates. process_protocol_config + odo_on pop run
+            # inside the mutator so the full transformation is atomic.
+            _cleaned_protocol = cleaned  # closure capture
+
+            def _merge_protocol(current):
+                base = current if isinstance(current, dict) else {}
+                if not isinstance(base, dict):
+                    print(f"[WARN] non-dict protocol_config detected (type={type(base).__name__}), falling back to empty")
+                    base = {}
+                result = {**base, **_cleaned_protocol}
+                # v1.4.6.8 C1: partial-merge AFTER process_protocol_config to preserve arrays
+                result = process_protocol_config(result)
+                # v1.4.6.2 F5: odo_on=off 시 nested odo objects 명시 제거
+                if result.get("odo_on") == "off":
+                    result.pop("odo_speed", None)
+                    result.pop("odo_direction", None)
+                return result
+
+            merged = db.update_config("protocol_config", _merge_protocol, default={})
+
+            self._send_json_response({
+                "success": True,
+                "message": "Protocol config saved",
+                "warnings": errors or [],
+                "merged_keys": sorted(cleaned.keys()),
+                "preserved_keys_count": max(0, len(merged) - len(cleaned)),
+            }, 200)
+
+        except Exception as e:
+            traceback.print_exc()
+            # v1.4.6.9 H3: twin _handle_post_device (line 461)과 일관된 JSON 응답.
+            # 이전 text/plain은 frontend api.js의 response.json() 호출 시 SyntaxError 발생 →
+            # 사용자에게 actionable error UI 표시 못 함.
+            self._send_json_response({"success": False, "message": "Save failed"}, 500)
+
+
+    # ─── Log Management Handlers ────────────────────────────────
+
+    def _handle_get_log_files(self):
+        """GET /setting/log-files — List log files with metadata."""
+        try:
+            result = list_log_files()
+            self._send_json_response(result)
+        except Exception:
+            traceback.print_exc()
+            # Don't leak internal fs paths / exception detail to the client.
+            self._send_json_response(
+                {"error": "Failed to list log files"}, 500
+            )
+
+    def _handle_get_kernel_bundle(self):
+        """GET /setting/kernel-bundle — Download kernel log bundle as tar.gz."""
+        tar_path = None
+        headers_sent = False
+        try:
+            tar_path = kernel_log.build_kernel_bundle()
+            size = os.path.getsize(tar_path)
+            fname = os.path.basename(tar_path)
+            self.send_response(200)
+            self.send_header("Content-Type", "application/gzip")
+            self.send_header("Content-Length", str(size))
+            self.send_header("Content-Disposition", f'attachment; filename="{fname}"')
+            self._send_cors_headers()
+            self.end_headers()
+            headers_sent = True
+            with open(tar_path, "rb") as f:
+                shutil.copyfileobj(f, self.wfile)
+        except Exception:
+            traceback.print_exc()
+            if not headers_sent:
+                # Safe to emit a 500 — nothing has been written to the socket yet.
+                # Don't leak internal fs paths / exception detail to the client.
+                try:
+                    self._send_json_response(
+                        {"error": "Failed to build kernel bundle"}, 500
+                    )
+                except Exception:
+                    pass
+            # else: headers already committed; cannot change status. Just close.
+        finally:
+            if tar_path:
+                shutil.rmtree(os.path.dirname(tar_path), ignore_errors=True)
+
+    def _handle_post_log_download(self):
+        """POST /setting/log-download — Download selected log files as tar.gz."""
+        archive_path = None
+        headers_sent = False
+        try:
+            data = self._read_request_body()
+            if data is None:
+                return  # body-parse error already responded
+
+            if not isinstance(data, dict):
+                self._send_json_response({"error": "Request body must be a JSON object"}, 400)
+                return
+
+            filenames = data.get("files", [])
+            valid_paths, error = validate_filenames(filenames)
+            if error:
+                status = 404 if "not found" in error.lower() else 400
+                self._send_json_response({"error": error}, status)
+                return
+
+            try:
+                archive_path = create_download_archive(valid_paths)
+            except FileNotFoundError as exc:
+                # v1.4.6.5 L-D: 모든 file이 race로 사라진 경우 → 404 (empty archive 200 응답 차단)
+                self._send_json_response({"error": str(exc)}, 404)
+                return
+            size = os.path.getsize(archive_path)
+            timestamp = time.strftime("%Y-%m-%d_%H%M%S")
+            filename = f"logs_{timestamp}.tar.gz"
+            self.send_response(200)
+            self.send_header("Content-Type", "application/gzip")
+            self.send_header("Content-Length", str(size))
+            self.send_header("Content-Disposition", f'attachment; filename="{filename}"')
+            self._send_cors_headers()
+            self.end_headers()
+            headers_sent = True
+            with open(archive_path, "rb") as f:
+                shutil.copyfileobj(f, self.wfile)
+        except Exception:
+            traceback.print_exc()
+            if not headers_sent:
+                try:
+                    self._send_json_response({"error": "Download failed"}, 500)
+                except Exception:
+                    pass
+        finally:
+            if archive_path:
+                shutil.rmtree(os.path.dirname(archive_path), ignore_errors=True)
+
+
+    def _handle_get_log_stats(self):
+        """GET /setting/log-stats — Return log directory disk usage stats."""
+        try:
+            stats = get_log_stats()
+            self._send_json_response(stats)
+        except Exception as e:
+            traceback.print_exc()
+            self._send_json_response(
+                {"error": f"Failed to get log stats: {str(e)}"}, 500
+            )
+
+    def _handle_post_log_compress(self):
+        """POST /setting/log-compress — Manually compress non-active log files."""
+        try:
+            result = run_manual_compression()
+            self._send_json_response(result)
+        except Exception as e:
+            traceback.print_exc()
+            self._send_json_response(
+                {"success": False, "message": f"Compression failed: {str(e)}"}, 500
+            )
+
+    def _handle_post_log_delete(self):
+        """POST /setting/log-delete — Delete selected log files."""
+        try:
+            data = self._read_request_body()
+            if data is None:
+                return  # Error response already sent
+
+            if not isinstance(data, dict):
+                self._send_json_response(
+                    {"success": False, "message": "Request body must be a JSON object"}, 400
+                )
+                return
+
+            filenames = data.get("files", [])
+            if not filenames:
+                self._send_json_response(
+                    {"success": False, "deleted": 0, "message": "No files specified"}, 400
+                )
+                return
+
+            result = delete_log_files(filenames)
+            self._send_json_response(result)
+        except Exception as e:
+            traceback.print_exc()
+            self._send_json_response(
+                {"success": False, "message": "Delete failed"}, 500
+            )
+
+
+# v1.5.1 H4 slowloris hardening: bound socket/request read timeout to 30s.
+# Prevents pathological clients from holding connections open indefinitely
+# (slowloris: send headers byte-by-byte, never complete the request).
+_SOCKET_TIMEOUT_S = 30.0
+# #36: firmware upload reads use a more generous per-read timeout than the 30s
+# slowloris bound (large ZIPs stream in MB chunks), but still finite so a
+# slow-trickle client cannot pin a worker thread forever.
+_FW_UPLOAD_READ_TIMEOUT_S = 120.0
+
+
+class ThreadedHTTPServer(ThreadingMixIn, HTTPServer):
+    """Handle requests in separate threads for concurrent access."""
+    daemon_threads = True
+    # Per-connection timeout (seconds): applied when the server calls
+    # get_request() — each accepted socket inherits setdefaulttimeout value,
+    # limiting how long a slow/malicious client can stall a handler thread.
+    timeout = _SOCKET_TIMEOUT_S
+
+
+def main():
+    """Start the HTTP server."""
+    # Route module logging (log_manager auto-compress daemon, etc.) to
+    # stdout/stderr so systemd's journald captures it.
+    logging.basicConfig(
+        level=logging.INFO,
+        format="%(asctime)s [%(levelname)s] %(name)s: %(message)s",
+    )
+
+    # Ensure DB tables exist (safe for production — uses IF NOT EXISTS)
+    db.ensure_tables()
+
+    # Migrate log-management settings into their own key (one-time, idempotent)
+    migrate_log_config(db)
+
+    # Run all pending schema/data migrations (one-time, idempotent)
+    try:
+        _applied = apply_all_migrations(db)
+        if _applied:
+            print(f"[startup] applied migrations: {', '.join(_applied)}", flush=True)
+    except sqlite3.OperationalError as exc:
+        print(
+            f"[startup] WARNING: migrations deferred due to DB lock: {exc!r}. "
+            "Will retry on next service restart.",
+            flush=True,
+        )
+    except (sqlite3.DatabaseError, json.JSONDecodeError, ValueError) as exc:
+        # v1.4.6.9 H11: corrupt board_config JSON / schema_meta race 등 비-lock 에러도
+        # fail-soft (server 시작 가능). 운영자가 dashboard로 진단/복구할 수 있는 상태 유지.
+        # 다음 service restart에서 재시도.
+        print(
+            f"[startup] WARNING: migration data error (skipped, will retry): {exc!r}",
+            flush=True,
+        )
+
+    # Remove leftover temp dirs from prior server crashes
+    kernel_log.sweep_stale_temp_dirs()
+    sweep_stale_download_temp_dirs()
+
+    # Start log auto-compression daemon thread
+    start_auto_compress_daemon(db)
+
+    # v1.6.0: Network apply engine startup tasks (guarded — subsystem may be unavailable on dev box)
+    if _NET_ENGINE is not None:
+        if _NET_ENGINE.recover_on_startup():
+            print("[startup] network apply recovery: rolled back unfinished apply", flush=True)
+    if _NET_WATCHDOG is not None:
+        _NET_WATCHDOG.start()
+
+    # v1.6.0: wire network_apply provider into system_status (import 순환 회피)
+    # I4: 모듈 레벨 fail-soft provider — try/except + snapshot() 1회 공유
+    # v1.11.5: always wire a provider — when _NET is None the network subsystem failed
+    # to init; install a fault provider so system_status returns network_apply with an
+    # error key rather than None, preventing the dashboard from showing green.
+    if _NET is not None:
+        set_network_apply_provider(_network_apply_provider)
+    else:
+        _init_error_msg = _NET_INIT_ERROR or "network subsystem unavailable"
+
+        def _network_apply_fault_provider():
+            return {"error": _init_error_msg}
+
+        set_network_apply_provider(_network_apply_fault_provider)
+
+    # v1.5.1 H4: apply default socket timeout so all new sockets (including
+    # accepted client sockets) block at most _SOCKET_TIMEOUT_S per read.
+    socket.setdefaulttimeout(_SOCKET_TIMEOUT_S)
+
+    server = ThreadedHTTPServer((HOST, PORT), ConfigHandler)
+    print(f"=" * 60)
+    print(f"  IoT Web Configurator Server")
+    print(f"  Listening on http://{HOST}:{PORT}")
+    print(f"  DB: {db.db_path}")
+    print(f"  Static: {STATIC_DIR}")
+    print(f"=" * 60)
+
+    # Set the server start time at runtime (not class-parse time) so uptime is
+    # accurate even on a device whose RTC was skewed during import. #30: monotonic
+    # so wall-clock skew / NTP jumps never corrupt the uptime delta.
+    ConfigHandler._server_start_time = time.monotonic()
+
+    try:
+        server.serve_forever()
+    except KeyboardInterrupt:
+        print("\nShutting down server...")
+        server.server_close()
+
+
+if __name__ == "__main__":
+    main()
diff --git a/src/static/css/style.css b/src/static/css/style.css
new file mode 100644
index 0000000..ce8a898
--- /dev/null
+++ b/src/static/css/style.css
@@ -0,0 +1,3033 @@
+/* ═══════════════════════════════════════════════════════════════
+   IoT Web Configurator — Design System & Styles
+   ═══════════════════════════════════════════════════════════════ */
+
+/*
+ * v1.5.1.1: 로컬 폰트 self-host (Inter 5 weight + JetBrains Mono 2 weight).
+ * LAN 전용 IoT — 외부 CDN 의존 0. Latin subset .woff2 (각 ~20-40 KB).
+ */
+@font-face {
+    font-family: 'Inter'; font-style: normal; font-weight: 300;
+    font-display: swap; src: url('../fonts/Inter-Light.woff2') format('woff2');
+}
+@font-face {
+    font-family: 'Inter'; font-style: normal; font-weight: 400;
+    font-display: swap; src: url('../fonts/Inter-Regular.woff2') format('woff2');
+}
+@font-face {
+    font-family: 'Inter'; font-style: normal; font-weight: 500;
+    font-display: swap; src: url('../fonts/Inter-Medium.woff2') format('woff2');
+}
+@font-face {
+    font-family: 'Inter'; font-style: normal; font-weight: 600;
+    font-display: swap; src: url('../fonts/Inter-SemiBold.woff2') format('woff2');
+}
+@font-face {
+    font-family: 'Inter'; font-style: normal; font-weight: 700;
+    font-display: swap; src: url('../fonts/Inter-Bold.woff2') format('woff2');
+}
+@font-face {
+    font-family: 'JetBrains Mono'; font-style: normal; font-weight: 400;
+    font-display: swap; src: url('../fonts/JetBrainsMono-Regular.woff2') format('woff2');
+}
+@font-face {
+    font-family: 'JetBrains Mono'; font-style: normal; font-weight: 500;
+    font-display: swap; src: url('../fonts/JetBrainsMono-Medium.woff2') format('woff2');
+}
+
+/* ─── CSS Custom Properties ─────────────────────────────────── */
+:root {
+  /* Colors — Dark Mode (Default) */
+  --bg-body: #0F172A;
+  --bg-sidebar: rgba(15, 23, 42, 0.85);
+  --bg-card: #1E293B;
+  --bg-card-hover: #263548;
+  --bg-input: #0F172A;
+  --bg-input-focus: #1a2744;
+  --bg-table-header: #162032;
+  --bg-table-row-hover: rgba(99, 102, 241, 0.08);
+
+  --border-default: #334155;
+  --border-focus: #6366F1;
+  --border-error: #EF4444;
+  --border-card: rgba(99, 102, 241, 0.15);
+  /* v1.7.1 Task 7: seal the legacy bare `--border` alias to the canonical
+     `--border-default` token. Naming convention is `--{category}-{variant}`;
+     bare aliases like this exist only for backward compatibility and must
+     always point at a defined token (audited by scripts/audit_css_tokens.py).
+     Because --border-default is redefined per theme, --border stays theme-aware. */
+  --border: var(--border-default);
+
+  --text-primary: #F1F5F9;
+  --text-secondary: #94A3B8;
+  --text-muted: #64748B;
+  --text-inverse: #0F172A;
+
+  --accent: #6366F1;
+  --accent-hover: #818CF8;
+  --accent-subtle: rgba(99, 102, 241, 0.15);
+  --accent-gradient: linear-gradient(135deg, #6366F1 0%, #818CF8 100%);
+
+  --success: #10B981;
+  --success-bg: rgba(16, 185, 129, 0.15);
+  --error: #EF4444;
+  --error-bg: rgba(239, 68, 68, 0.15);
+  --warning: #F59E0B;
+  --warning-bg: rgba(245, 158, 11, 0.15);
+  --info: #3B82F6;
+  --info-bg: rgba(59, 130, 246, 0.15);
+
+  /* Spacing */
+  --space-xs: 4px;
+  --space-sm: 8px;
+  --space-md: 16px;
+  --space-lg: 24px;
+  --space-xl: 32px;
+  --space-2xl: 48px;
+
+  /* Typography */
+  --font-family: 'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
+  --font-mono: 'JetBrains Mono', 'Fira Code', monospace;
+  --font-size-xs: 11px;
+  --font-size-sm: 12px;
+  --font-size-base: 14px;
+  --font-size-md: 16px;
+  --font-size-lg: 20px;
+  --font-size-xl: 24px;
+
+  /* Border Radius */
+  --radius-sm: 6px;
+  --radius-md: 8px;
+  --radius-lg: 12px;
+  --radius-xl: 16px;
+  --radius-full: 50%;
+
+  /* Shadows */
+  --shadow-sm: 0 1px 2px rgba(0, 0, 0, 0.3);
+  --shadow-md: 0 4px 12px rgba(0, 0, 0, 0.25);
+  --shadow-lg: 0 8px 24px rgba(0, 0, 0, 0.3);
+  --shadow-glow: 0 0 20px rgba(99, 102, 241, 0.15);
+
+  /* Transitions */
+  --transition-fast: 0.15s ease;
+  --transition-base: 0.25s ease;
+  --transition-slow: 0.35s ease;
+
+  /* Layout */
+  --sidebar-width: 240px;
+  --sidebar-collapsed: 64px;
+  --header-height: 60px;
+}
+
+/* ─── Light Mode ────────────────────────────────────────────── */
+[data-theme="light"] {
+  --bg-body: #F1F5F9;
+  --bg-sidebar: rgba(255, 255, 255, 0.9);
+  --bg-card: #FFFFFF;
+  --bg-card-hover: #F8FAFC;
+  --bg-input: #F8FAFC;
+  --bg-input-focus: #FFFFFF;
+  --bg-table-header: #F1F5F9;
+  --bg-table-row-hover: rgba(99, 102, 241, 0.06);
+
+  --border-default: #E2E8F0;
+  --border-card: rgba(99, 102, 241, 0.1);
+
+  --text-primary: #1E293B;
+  --text-secondary: #64748B;
+  --text-muted: #94A3B8;
+
+  --accent: #4F46E5;
+  --accent-hover: #6366F1;
+  --accent-gradient: linear-gradient(135deg, #4F46E5 0%, #6366F1 100%);
+
+  --shadow-sm: 0 1px 3px rgba(0, 0, 0, 0.08);
+  --shadow-md: 0 4px 12px rgba(0, 0, 0, 0.08);
+  --shadow-lg: 0 8px 24px rgba(0, 0, 0, 0.1);
+  --shadow-glow: 0 0 20px rgba(79, 70, 229, 0.08);
+}
+
+/* ─── Reset & Base ──────────────────────────────────────────── */
+*,
+*::before,
+*::after {
+  box-sizing: border-box;
+  margin: 0;
+  padding: 0;
+}
+
+html {
+  font-size: 14px;
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+}
+
+body {
+  font-family: var(--font-family);
+  background: var(--bg-body);
+  color: var(--text-primary);
+  min-height: 100vh;
+  display: flex;
+  overflow-x: hidden;
+  transition: background var(--transition-base), color var(--transition-base);
+}
+
+a {
+  color: var(--accent);
+  text-decoration: none;
+}
+
+a:hover {
+  color: var(--accent-hover);
+}
+
+/* ─── Scrollbar ─────────────────────────────────────────────── */
+::-webkit-scrollbar {
+  width: 6px;
+  height: 6px;
+}
+
+::-webkit-scrollbar-track {
+  background: transparent;
+}
+
+::-webkit-scrollbar-thumb {
+  background: var(--border-default);
+  border-radius: var(--radius-full);
+}
+
+::-webkit-scrollbar-thumb:hover {
+  background: var(--text-muted);
+}
+
+/* ═══════════════════════════════════════════════════════════════
+   SIDEBAR
+   ═══════════════════════════════════════════════════════════════ */
+.sidebar {
+  position: fixed;
+  left: 0;
+  top: 0;
+  bottom: 0;
+  width: var(--sidebar-width);
+  background: var(--bg-sidebar);
+  backdrop-filter: blur(20px);
+  -webkit-backdrop-filter: blur(20px);
+  border-right: 1px solid var(--border-card);
+  display: flex;
+  flex-direction: column;
+  z-index: 100;
+  transition: transform var(--transition-base);
+}
+
+.sidebar__header {
+  padding: var(--space-lg);
+  border-bottom: 1px solid var(--border-card);
+}
+
+.sidebar__logo {
+  display: flex;
+  align-items: center;
+  gap: var(--space-sm);
+}
+
+.sidebar__logo-icon {
+  font-size: 24px;
+}
+
+.sidebar__logo-text {
+  font-weight: 700;
+  font-size: var(--font-size-md);
+  background: var(--accent-gradient);
+  -webkit-background-clip: text;
+  -webkit-text-fill-color: transparent;
+  background-clip: text;
+}
+
+/* Nav */
+.sidebar__nav {
+  flex: 1;
+  padding: var(--space-md) var(--space-sm);
+  overflow-y: auto;
+}
+
+.nav-item {
+  display: flex;
+  align-items: center;
+  gap: var(--space-md);
+  padding: var(--space-md) var(--space-md);
+  margin-bottom: 2px;
+  border-radius: var(--radius-md);
+  color: var(--text-secondary);
+  font-size: var(--font-size-base);
+  font-weight: 500;
+  transition: all var(--transition-fast);
+  position: relative;
+  text-decoration: none;
+}
+
+.nav-item:hover {
+  background: var(--accent-subtle);
+  color: var(--text-primary);
+}
+
+.nav-item.active {
+  background: var(--accent-subtle);
+  color: var(--accent);
+}
+
+.nav-item.active::before {
+  content: '';
+  position: absolute;
+  left: 0;
+  top: 8px;
+  bottom: 8px;
+  width: 3px;
+  background: var(--accent-gradient);
+  border-radius: 0 var(--radius-sm) var(--radius-sm) 0;
+}
+
+.nav-item.disabled {
+  opacity: 0.35;
+  pointer-events: none;
+}
+
+.nav-item--error::after {
+    content: '';
+    position: absolute;
+    right: 12px;
+    top: 50%;
+    transform: translateY(-50%);
+    width: 8px;
+    height: 8px;
+    background: var(--error);
+    border-radius: var(--radius-full);
+    box-shadow: 0 0 6px var(--error-bg);
+}
+
+.nav-item__icon {
+  font-size: 18px;
+  width: 24px;
+  text-align: center;
+}
+
+/* Footer */
+.sidebar__footer {
+  padding: var(--space-md) var(--space-md) var(--space-lg);
+  border-top: 1px solid var(--border-card);
+}
+
+.sidebar__actions {
+  display: flex;
+  gap: var(--space-sm);
+  margin-top: var(--space-sm);
+}
+
+.sidebar__version {
+  text-align: center;
+  margin-top: var(--space-md);
+  font-size: var(--font-size-xs);
+  color: var(--text-muted);
+}
+
+.sidebar__version-name {
+  display: block;
+  font-weight: 500;
+}
+
+.sidebar__version-num {
+  display: block;
+  opacity: 0.7;
+}
+
+/* ═══════════════════════════════════════════════════════════════
+   v1.8.0 — Two Faces (User vs Advanced/Debug view)
+   ═══════════════════════════════════════════════════════════════ */
+
+/* Advanced/Debug 보기 토글 (사이드바 footer). 보안 경계 아님 — 표시 스위치. */
+.view-toggle {
+  display: grid;
+  grid-template-columns: auto 1fr;
+  grid-template-rows: auto auto;
+  column-gap: var(--space-sm);
+  align-items: center;
+  margin-top: var(--space-md);
+  cursor: pointer;
+  user-select: none;
+}
+.view-toggle__input {
+  grid-row: 1 / span 2;
+  margin: 0;
+  cursor: pointer;
+}
+.view-toggle__label {
+  font-size: var(--font-size-sm);
+  color: var(--text-secondary, var(--text-muted));
+  font-weight: 500;
+}
+.view-toggle__hint {
+  font-size: var(--font-size-xs);
+  color: var(--text-muted);
+  line-height: 1.3;
+}
+
+/* 모드 종속 표시 규칙 (User=기본 / body.advanced=고급).
+   v1.8.1 (review): User 전용 콘텐츠는 전용 CSS 클래스가 아니라 JS isAdvanced() 분기로
+   게이팅한다(home.js networkApplyRows / pending.js 섹션). 따라서 advanced-only 만 CSS 로
+   구동한다(소비자 없던 user-only 규칙은 제거). JS 가 body.advanced 를 토글(app.js reflectAdvancedClass). */
+.advanced-only { display: none !important; }
+body.advanced .advanced-only { display: revert !important; }
+
+/* ═══════════════════════════════════════════════════════════════
+   MOBILE HEADER
+   ═══════════════════════════════════════════════════════════════ */
+.mobile-header {
+  display: none;
+  position: fixed;
+  top: 0;
+  left: 0;
+  right: 0;
+  height: var(--header-height);
+  background: var(--bg-sidebar);
+  backdrop-filter: blur(20px);
+  border-bottom: 1px solid var(--border-card);
+  padding: 0 var(--space-md);
+  align-items: center;
+  justify-content: space-between;
+  z-index: 90;
+}
+
+.mobile-header__menu {
+  background: none;
+  border: none;
+  color: var(--text-primary);
+  font-size: 24px;
+  cursor: pointer;
+  padding: var(--space-sm);
+}
+
+.mobile-header__title {
+  font-weight: 600;
+  font-size: var(--font-size-md);
+  background: var(--accent-gradient);
+  -webkit-background-clip: text;
+  -webkit-text-fill-color: transparent;
+  background-clip: text;
+}
+
+.sidebar-overlay {
+  display: none;
+  position: fixed;
+  inset: 0;
+  background: rgba(0, 0, 0, 0.5);
+  z-index: 99;
+}
+
+.sidebar-overlay.show {
+  display: block;
+}
+
+/* ═══════════════════════════════════════════════════════════════
+   MAIN CONTENT
+   ═══════════════════════════════════════════════════════════════ */
+.main {
+  flex: 1;
+  margin-left: var(--sidebar-width);
+  padding: var(--space-xl) var(--space-2xl);
+  min-height: 100vh;
+  transition: margin-left var(--transition-base);
+}
+
+.page-container {
+  max-width: 900px;
+  margin: 0 auto;
+  animation: fadeIn var(--transition-base) ease;
+}
+
+@keyframes fadeIn {
+  from {
+    opacity: 0;
+    transform: translateY(8px);
+  }
+
+  to {
+    opacity: 1;
+    transform: translateY(0);
+  }
+}
+
+/* Page Header */
+.page-header {
+  margin-bottom: var(--space-xl);
+}
+
+.page-header__title {
+  font-size: var(--font-size-xl);
+  font-weight: 700;
+  margin-bottom: var(--space-xs);
+}
+
+.page-header__desc {
+  color: var(--text-secondary);
+  font-size: var(--font-size-base);
+}
+
+/* ═══════════════════════════════════════════════════════════════
+   CARDS
+   ═══════════════════════════════════════════════════════════════ */
+.card {
+  background: var(--bg-card);
+  border: 1px solid var(--border-card);
+  border-radius: var(--radius-lg);
+  padding: var(--space-lg);
+  margin-bottom: var(--space-lg);
+  box-shadow: var(--shadow-sm);
+  transition: box-shadow var(--transition-base), border-color var(--transition-base);
+}
+
+.card:hover {
+  box-shadow: var(--shadow-md);
+  border-color: rgba(99, 102, 241, 0.25);
+}
+
+.card__header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  margin-bottom: var(--space-lg);
+  padding-bottom: var(--space-md);
+  border-bottom: 1px solid var(--border-card);
+}
+
+.card__title {
+  font-size: var(--font-size-md);
+  font-weight: 600;
+  display: flex;
+  align-items: center;
+  gap: var(--space-sm);
+}
+
+.card__title-icon {
+  font-size: 18px;
+}
+
+/* ═══════════════════════════════════════════════════════════════
+   FORM ELEMENTS
+   ═══════════════════════════════════════════════════════════════ */
+.form-group {
+  margin-bottom: var(--space-md);
+}
+
+.form-row {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(280px, 1fr));
+  gap: var(--space-md);
+}
+
+.form-row--2col {
+  grid-template-columns: 1fr 1fr;
+}
+
+.form-label {
+  display: block;
+  font-size: var(--font-size-sm);
+  font-weight: 500;
+  color: var(--text-secondary);
+  margin-bottom: var(--space-xs);
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+}
+
+.form-input,
+.form-select {
+  width: 100%;
+  padding: 10px 14px;
+  background: var(--bg-input);
+  border: 1px solid var(--border-default);
+  border-radius: var(--radius-md);
+  color: var(--text-primary);
+  font-family: var(--font-family);
+  font-size: var(--font-size-base);
+  transition: all var(--transition-fast);
+  outline: none;
+}
+
+.form-input:focus,
+.form-select:focus {
+  background: var(--bg-input-focus);
+  border-color: var(--border-focus);
+  box-shadow: 0 0 0 3px var(--accent-subtle);
+}
+
+.form-input:disabled,
+.form-select:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+  background: var(--bg-card);
+}
+
+.form-input.error {
+  border-color: var(--border-error);
+  box-shadow: 0 0 0 3px var(--error-bg);
+}
+
+.form-input--mono {
+  font-family: var(--font-mono);
+  font-size: 13px;
+}
+
+.form-hint {
+  font-size: var(--font-size-xs);
+  color: var(--text-muted);
+  margin-top: var(--space-xs);
+}
+
+.form-error {
+  font-size: var(--font-size-xs);
+  color: var(--error);
+  margin-top: var(--space-xs);
+}
+
+/* Inline field validation error (generated by validator.js) */
+.field-error {
+  display: block;
+  font-size: var(--font-size-xs);
+  color: var(--error);
+  margin-top: var(--space-xs);
+  font-weight: 500;
+  letter-spacing: 0.02em;
+}
+
+/* IP Octet Input Group */
+.ip-input-group {
+  display: flex;
+  align-items: center;
+  gap: 2px;
+  max-width: 280px;
+  margin: 0 auto;
+}
+
+.ip-input-group .ip-octet {
+  width: 56px;
+  text-align: center;
+  padding: 6px 4px;
+  font-family: var(--font-mono);
+  font-size: 13px;
+}
+
+.ip-input-group .ip-dot {
+  color: var(--text-muted);
+  font-weight: 700;
+  font-size: 16px;
+  user-select: none;
+  flex-shrink: 0;
+}
+
+/* Checkbox Toggle (AI/DI ports) */
+.checkbox-toggle {
+  appearance: none;
+  width: 36px;
+  height: 20px;
+  background: var(--border-default);
+  border-radius: var(--radius-full);
+  position: relative;
+  cursor: pointer;
+  transition: all var(--transition-fast);
+  border: none;
+  outline: none;
+  flex-shrink: 0;
+}
+
+.checkbox-toggle::after {
+  content: '';
+  position: absolute;
+  top: 2px;
+  left: 2px;
+  width: 16px;
+  height: 16px;
+  background: white;
+  border-radius: var(--radius-full);
+  transition: transform var(--transition-fast);
+}
+
+.checkbox-toggle:checked {
+  background: var(--accent);
+}
+
+.checkbox-toggle:checked::after {
+  transform: translateX(16px);
+}
+
+/* v1.5.3.1: Sensor I/O port row + analog/digital input visual layout */
+.form-row--ports {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(280px, 1fr));
+  gap: 0.75rem;
+  margin-top: 0.75rem;
+}
+
+.port-row {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 0.75rem 1rem;
+  background: var(--bg-input, #0F172A);
+  border: 1px solid var(--border-default);
+  border-radius: 6px;
+}
+
+.port-row__label {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  cursor: pointer;
+  flex: 1;
+}
+
+.port-row__name {
+  font-weight: 600;
+  color: var(--text-primary);
+}
+
+.port-row__hint {
+  font-size: 11px;
+  color: var(--text-muted);
+  margin-left: 0.25rem;
+}
+
+.card__desc {
+  margin: 0.25rem 0 0.75rem;
+  color: var(--text-secondary);
+  font-size: 13px;
+}
+
+/* Error shake animation */
+@keyframes shake {
+
+  0%,
+  100% {
+    transform: translateX(0);
+  }
+
+  20%,
+  60% {
+    transform: translateX(-4px);
+  }
+
+  40%,
+  80% {
+    transform: translateX(4px);
+  }
+}
+
+.form-input--error {
+  border-color: var(--error) !important;
+  box-shadow: 0 0 0 3px var(--error-bg) !important;
+  animation: shake 0.4s ease;
+}
+
+/* Password wrapper */
+.input-password {
+  position: relative;
+}
+
+.input-password .form-input {
+  padding-right: 40px;
+}
+
+.input-password__toggle {
+  position: absolute;
+  right: 8px;
+  top: 50%;
+  transform: translateY(-50%);
+  background: none;
+  border: none;
+  color: var(--text-muted);
+  cursor: pointer;
+  font-size: 16px;
+  padding: 4px;
+}
+
+.input-password__toggle:hover {
+  color: var(--text-primary);
+}
+
+/* Radio Group */
+.radio-group {
+  display: flex;
+  gap: var(--space-lg);
+  align-items: center;
+}
+
+.radio-label {
+  display: flex;
+  align-items: center;
+  gap: var(--space-sm);
+  cursor: pointer;
+  font-size: var(--font-size-base);
+  color: var(--text-primary);
+}
+
+.radio-label input[type="radio"] {
+  appearance: none;
+  width: 18px;
+  height: 18px;
+  border: 2px solid var(--border-default);
+  border-radius: var(--radius-full);
+  transition: all var(--transition-fast);
+  position: relative;
+}
+
+.radio-label input[type="radio"]:checked {
+  border-color: var(--accent);
+}
+
+.radio-label input[type="radio"]:checked::after {
+  content: '';
+  position: absolute;
+  top: 3px;
+  left: 3px;
+  width: 8px;
+  height: 8px;
+  background: var(--accent);
+  border-radius: var(--radius-full);
+}
+
+/* Toggle */
+.toggle-group {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: var(--space-sm) 0;
+}
+
+.toggle-group__label {
+  font-size: var(--font-size-base);
+  color: var(--text-primary);
+}
+
+/* ═══════════════════════════════════════════════════════════════
+   BUTTONS
+   ═══════════════════════════════════════════════════════════════ */
+.btn {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: var(--space-sm);
+  padding: 10px 20px;
+  border: 1px solid transparent;
+  border-radius: var(--radius-md);
+  font-family: var(--font-family);
+  font-size: var(--font-size-base);
+  font-weight: 500;
+  cursor: pointer;
+  transition: all var(--transition-fast);
+  outline: none;
+  white-space: nowrap;
+}
+
+/* v1.11.2: explicit disabled styling — greys the button and suppresses hover
+   lift / clicks (e.g. the upload-step NEXT button while a firmware upload is in
+   flight). Don't rely on browser UA defaults for the grey-out. */
+.btn:disabled,
+.btn[disabled] {
+  opacity: 0.45;
+  cursor: not-allowed;
+  pointer-events: none;
+  box-shadow: none;
+  transform: none;
+}
+
+.btn--primary {
+  background: var(--accent-gradient);
+  color: white;
+  border-color: transparent;
+  box-shadow: 0 2px 8px rgba(99, 102, 241, 0.3);
+}
+
+.btn--primary:hover {
+  box-shadow: 0 4px 16px rgba(99, 102, 241, 0.4);
+  transform: translateY(-1px);
+}
+
+.btn--primary:active {
+  transform: translateY(0);
+}
+
+.btn--outline {
+  background: transparent;
+  color: var(--accent);
+  border-color: var(--accent);
+}
+
+.btn--outline:hover {
+  background: var(--accent-subtle);
+}
+
+.btn--danger {
+  background: transparent;
+  color: var(--error);
+  border-color: var(--error);
+}
+
+.btn--danger:hover {
+  background: var(--error-bg);
+}
+
+.btn--ghost {
+  background: transparent;
+  color: var(--text-secondary);
+  border: none;
+  padding: 6px 10px;
+}
+
+.btn--ghost:hover {
+  color: var(--error);
+  background: var(--error-bg);
+}
+
+.btn--sm {
+  padding: 6px 14px;
+  font-size: var(--font-size-sm);
+}
+
+.btn--full {
+  width: 100%;
+}
+
+.btn--icon {
+  width: 32px;
+  height: 32px;
+  padding: 0;
+  border-radius: var(--radius-full);
+  font-size: 16px;
+}
+
+/* ═══════════════════════════════════════════════════════════════
+   DATA TABLE (Protocol Mappings)
+   ═══════════════════════════════════════════════════════════════ */
+.data-table-wrapper {
+  overflow-x: auto;
+  border-radius: var(--radius-md);
+  border: 1px solid var(--border-default);
+}
+
+.data-table {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: var(--font-size-sm);
+}
+
+.data-table th {
+  background: var(--bg-table-header);
+  padding: 10px 12px;
+  text-align: left;
+  font-weight: 600;
+  font-size: var(--font-size-xs);
+  text-transform: uppercase;
+  letter-spacing: 0.06em;
+  color: var(--text-secondary);
+  border-bottom: 1px solid var(--border-default);
+  white-space: nowrap;
+}
+
+.data-table td {
+  padding: 6px 8px;
+  border-bottom: 1px solid rgba(51, 65, 85, 0.3);
+  vertical-align: middle;
+}
+
+.data-table tr:hover td {
+  background: var(--bg-table-row-hover);
+}
+
+.data-table tr:last-child td {
+  border-bottom: none;
+}
+
+.data-table .form-input,
+.data-table .form-select {
+  padding: 6px 10px;
+  font-size: 13px;
+  font-family: var(--font-mono);
+  border-radius: var(--radius-sm);
+}
+
+.data-table .col-action {
+  width: 40px;
+  text-align: center;
+}
+
+/* ═══════════════════════════════════════════════════════════════
+   GRID LAYOUT
+   ═══════════════════════════════════════════════════════════════ */
+.grid-2col {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: var(--space-lg);
+}
+
+.grid-4col {
+  display: grid;
+  grid-template-columns: repeat(4, 1fr);
+  gap: var(--space-md);
+}
+
+/* ═══════════════════════════════════════════════════════════════
+   LOADING
+   ═══════════════════════════════════════════════════════════════ */
+.loading {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  min-height: 60vh;
+  gap: var(--space-md);
+  color: var(--text-secondary);
+}
+
+.loading__spinner {
+  width: 40px;
+  height: 40px;
+  border: 3px solid var(--border-default);
+  border-top-color: var(--accent);
+  border-radius: var(--radius-full);
+  animation: spin 0.8s linear infinite;
+}
+
+@keyframes spin {
+  to {
+    transform: rotate(360deg);
+  }
+}
+
+/* ═══════════════════════════════════════════════════════════════
+   TOAST
+   ═══════════════════════════════════════════════════════════════ */
+.toast-container {
+  position: fixed;
+  top: var(--space-lg);
+  right: var(--space-lg);
+  z-index: 1000;
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-sm);
+}
+
+.toast {
+  display: flex;
+  align-items: center;
+  gap: var(--space-md);
+  padding: var(--space-md) var(--space-lg);
+  border-radius: var(--radius-md);
+  background: var(--bg-card);
+  border: 1px solid var(--border-card);
+  box-shadow: var(--shadow-lg);
+  backdrop-filter: blur(10px);
+  min-width: 300px;
+  animation: toastIn var(--transition-base) ease;
+  font-size: var(--font-size-base);
+}
+
+.toast--success {
+  border-left: 3px solid var(--success);
+}
+
+.toast--error {
+  border-left: 3px solid var(--error);
+}
+
+.toast--warning {
+  border-left: 3px solid var(--warning);
+}
+
+.toast--info {
+  border-left: 3px solid var(--info);
+}
+
+.toast__icon {
+  font-size: 18px;
+}
+
+.toast__message {
+  flex: 1;
+}
+
+.toast__close {
+  background: none;
+  border: none;
+  color: var(--text-muted);
+  cursor: pointer;
+  font-size: 16px;
+  padding: 2px;
+}
+
+/* v1.7.1 Task 5: actionable toast CTA (Save → Apply needed). */
+.toast__action {
+  background: none;
+  border: 1px solid currentColor;
+  border-radius: var(--radius-sm, 4px);
+  color: inherit;
+  cursor: pointer;
+  font: inherit;
+  font-size: 12px;
+  font-weight: 600;
+  padding: 2px 8px;
+  white-space: nowrap;
+}
+.toast__action:hover { text-decoration: underline; }
+
+@keyframes toastIn {
+  from {
+    opacity: 0;
+    transform: translateX(40px);
+  }
+
+  to {
+    opacity: 1;
+    transform: translateX(0);
+  }
+}
+
+.toast.removing {
+  animation: toastOut var(--transition-fast) ease forwards;
+}
+
+@keyframes toastOut {
+  to {
+    opacity: 0;
+    transform: translateX(40px);
+  }
+}
+
+/* ═══════════════════════════════════════════════════════════════
+   THEME TOGGLE
+   ═══════════════════════════════════════════════════════════════ */
+.theme-toggle {
+  position: fixed;
+  bottom: var(--space-lg);
+  right: var(--space-lg);
+  width: 44px;
+  height: 44px;
+  border-radius: var(--radius-full);
+  background: var(--bg-card);
+  border: 1px solid var(--border-card);
+  box-shadow: var(--shadow-md);
+  cursor: pointer;
+  font-size: 20px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  z-index: 50;
+  transition: all var(--transition-fast);
+}
+
+.theme-toggle:hover {
+  box-shadow: var(--shadow-glow);
+  transform: scale(1.1);
+}
+
+/* ═══════════════════════════════════════════════════════════════
+   INFO BANNER
+   ═══════════════════════════════════════════════════════════════ */
+.info-banner {
+  display: flex;
+  align-items: center;
+  gap: var(--space-md);
+  padding: var(--space-md) var(--space-lg);
+  border-radius: var(--radius-md);
+  background: var(--info-bg);
+  border: 1px solid rgba(59, 130, 246, 0.2);
+  margin-bottom: var(--space-lg);
+  font-size: var(--font-size-sm);
+  color: var(--info);
+}
+
+.info-banner--warning {
+  background: var(--warning-bg);
+  border-color: rgba(245, 158, 11, 0.2);
+  color: var(--warning);
+}
+
+/* ═══════════════════════════════════════════════════════════════
+   RESPONSIVE
+   ═══════════════════════════════════════════════════════════════ */
+@media (max-width: 1024px) {
+  .grid-2col {
+    grid-template-columns: 1fr;
+  }
+
+  .grid-4col {
+    grid-template-columns: repeat(2, 1fr);
+  }
+
+  .main {
+    padding: var(--space-lg);
+  }
+}
+
+@media (max-width: 768px) {
+  .sidebar {
+    transform: translateX(-100%);
+  }
+
+  .sidebar.open {
+    transform: translateX(0);
+  }
+
+  .mobile-header {
+    display: flex;
+  }
+
+  .main {
+    margin-left: 0;
+    padding: var(--space-md);
+    padding-top: calc(var(--header-height) + var(--space-md));
+  }
+
+  .grid-4col {
+    grid-template-columns: 1fr 1fr;
+  }
+
+  .form-row {
+    grid-template-columns: 1fr;
+  }
+
+  .form-row--2col {
+    grid-template-columns: 1fr;
+  }
+
+  .card {
+    padding: var(--space-md);
+  }
+
+  .toast-container {
+    left: var(--space-md);
+    right: var(--space-md);
+  }
+
+  .toast {
+    min-width: auto;
+  }
+
+  .theme-toggle {
+    bottom: var(--space-md);
+    right: var(--space-md);
+  }
+}
+
+/* ═══════════════════════════════════════════════════════════════
+   UTILITIES
+   ═══════════════════════════════════════════════════════════════ */
+.mt-sm {
+  margin-top: var(--space-sm);
+}
+
+.mt-md {
+  margin-top: var(--space-md);
+}
+
+.mt-lg {
+  margin-top: var(--space-lg);
+}
+
+.mb-md {
+  margin-bottom: var(--space-md);
+}
+
+.text-mono {
+  font-family: var(--font-mono);
+}
+
+.text-muted {
+  color: var(--text-muted);
+}
+
+.text-center {
+  text-align: center;
+}
+
+.flex-between {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+}
+
+/* ═══════════════════════════════════════════════════════════════
+   INFO & COLLAPSIBLE CARDS
+   ═══════════════════════════════════════════════════════════════ */
+.card--info {
+  background: var(--info-bg);
+  border-color: rgba(59, 130, 246, 0.2);
+  color: var(--info);
+}
+
+.card--info p {
+  font-size: var(--font-size-sm);
+}
+
+.card--collapsible .card__header--clickable {
+  cursor: pointer;
+  user-select: none;
+}
+
+.card--collapsible .card__header--clickable:hover {
+  opacity: 0.8;
+}
+
+.card__collapse-icon {
+  font-size: var(--font-size-sm);
+  color: var(--text-muted);
+  transition: transform var(--transition-fast);
+}
+
+/* ═══════════════════════════════════════════════════════════════
+   LEGEND GRID
+   ═══════════════════════════════════════════════════════════════ */
+.legend-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(300px, 1fr));
+  gap: var(--space-sm) var(--space-lg);
+  font-size: var(--font-size-sm);
+  color: var(--text-secondary);
+}
+
+.legend-grid strong {
+  font-family: var(--font-mono);
+  color: var(--text-primary);
+}
+
+/* ═══════════════════════════════════════════════════════════════
+   SMALL SELECT (for tables)
+   ═══════════════════════════════════════════════════════════════ */
+.form-select--sm {
+  padding: 6px 10px;
+  font-size: 13px;
+  font-family: var(--font-mono);
+  border-radius: var(--radius-sm);
+}
+
+/* ═══════════════════════════════════════════════════════════════
+   FIELD VALIDATION ERROR (border/box-shadow + shake in base styles)
+   ═══════════════════════════════════════════════════════════════ */
+
+.field-error {
+  display: block;
+  font-size: var(--font-size-xs);
+  color: var(--error);
+  margin-top: var(--space-xs);
+}
+
+/* ═══════════════════════════════════════════════════════════════
+   LOG MANAGEMENT
+   ═══════════════════════════════════════════════════════════════ */
+
+/* Section divider between settings and file list */
+.log-section-divider {
+  border: none;
+  border-top: 1px solid var(--border-default);
+  margin: var(--space-lg) 0;
+}
+
+/* Action bar above log files table */
+.log-action-bar {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: var(--space-sm) var(--space-md);
+  background: var(--bg-table-header);
+  border: 1px solid var(--border-default);
+  border-bottom: none;
+  border-radius: var(--radius-md) var(--radius-md) 0 0;
+  gap: var(--space-md);
+}
+
+.log-action-bar__left {
+  display: flex;
+  gap: var(--space-sm);
+  align-items: center;
+}
+
+.log-action-bar__summary {
+  font-size: var(--font-size-sm);
+  white-space: nowrap;
+}
+
+/* Merge action bar with table below */
+.log-action-bar + .data-table-wrapper {
+  border-top-left-radius: 0;
+  border-top-right-radius: 0;
+}
+
+/* Log type badges */
+.log-type-badge {
+  display: inline-block;
+  padding: 2px 8px;
+  border-radius: var(--radius-sm);
+  font-size: var(--font-size-xs);
+  font-weight: 600;
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+}
+
+.log-type-badge--log {
+  background: var(--info-bg);
+  color: var(--info);
+}
+
+.log-type-badge--archive {
+  background: var(--success-bg);
+  color: var(--success);
+}
+
+/* Placeholder states (loading, empty, error) */
+.log-files-placeholder {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  gap: var(--space-sm);
+  padding: var(--space-xl) var(--space-md);
+  border: 1px dashed var(--border-default);
+  border-radius: var(--radius-md);
+  text-align: center;
+}
+
+.log-files-placeholder--error {
+  border-color: var(--error);
+  color: var(--error);
+}
+
+/* Log files table checkbox styling */
+.log-files-table input[type="checkbox"] {
+  width: 16px;
+  height: 16px;
+  cursor: pointer;
+  accent-color: var(--accent);
+}
+
+/* ═══════════════════════════════════════════════════════════════
+   LOG STATS DASHBOARD
+   ═══════════════════════════════════════════════════════════════ */
+
+.log-stats-grid {
+  display: grid;
+  grid-template-columns: repeat(4, 1fr);
+  gap: var(--space-md);
+}
+
+.log-stat-card {
+  background: var(--bg-input);
+  border: 1px solid var(--border-default);
+  border-radius: var(--radius-md);
+  padding: var(--space-md);
+  text-align: center;
+}
+
+.log-stat-card__value {
+  font-size: var(--font-size-lg);
+  font-weight: 700;
+  color: var(--text-primary);
+  margin-bottom: var(--space-xs);
+}
+
+.log-stat-card__label {
+  font-size: var(--font-size-xs);
+  color: var(--text-muted);
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+}
+
+.log-stat-card--success {
+  border-color: rgba(16, 185, 129, 0.3);
+}
+
+.log-stat-card--success .log-stat-card__value {
+  color: var(--success);
+}
+
+.log-stat-card--info {
+  border-color: rgba(59, 130, 246, 0.3);
+}
+
+.log-stat-card--info .log-stat-card__value {
+  color: var(--info);
+}
+
+.log-stat-card--warning {
+  border-color: rgba(245, 158, 11, 0.3);
+}
+
+.log-stat-card--warning .log-stat-card__value {
+  color: var(--warning);
+}
+
+@media (max-width: 1024px) {
+  .log-stats-grid {
+    grid-template-columns: repeat(2, 1fr);
+  }
+}
+
+@media (max-width: 768px) {
+  .log-stats-grid {
+    grid-template-columns: 1fr 1fr;
+  }
+}
+
+/* ─── Landing Dashboard ─────────────────────────────────────── */
+.sidebar__logo-img { height: 26px; width: auto; display: block; }
+.sidebar__logo-cap {
+    /* v1.4.6.10 ②: --color-text-muted 미정의 → --text-muted (light/dark 양쪽 정의됨) */
+    font-size: 9px; letter-spacing: .16em; color: var(--text-muted, #7B8AA0);
+    font-family: 'JetBrains Mono', monospace; margin-top: 3px;
+}
+[data-theme="dark"] .sidebar__logo-img { filter: brightness(0) invert(1); }
+
+/* v1.10: Dashboard V2 — 3-column grid.
+   Column layout: [Network large | right compact col | right compact col]
+   Row 0 (auto): dash-header-summary spans all 3 columns.
+   Row 1 (large): dash-card--network spans rows 1-2 in column 1;
+                  dpworldapp / GNSS / Equipment stack in columns 2-3.
+   Row 2 (bottom): Server Uplink / System / Current Issues span all 3 cols each.
+*/
+.page-container--dashboard {
+    max-width: 1100px;
+}
+.dash-grid {
+    display: grid;
+    grid-template-columns: minmax(360px, 2fr) minmax(0, 1fr) minmax(0, 1fr);
+    grid-template-rows: auto;
+    gap: var(--space-md, 1rem);
+    min-width: 0;
+    margin-bottom: var(--space-md, 1rem);
+}
+@media (max-width: 720px) { .dash-grid { grid-template-columns: 1fr; } }
+
+/* v1.4.6.10 ②: --color-* 변수가 :root에 정의되지 않아 항상 하드코딩 다크 fallback이 적용,
+   라이트 모드에서도 카드만 검게 남던 버그. 실제 디자인 토큰(--bg-card / --text-primary /
+   --text-secondary / --bg-input / --border-default)으로 통일하면 라이트/다크 양쪽 정상. */
+.dash-card {
+    min-width: 0;
+    background: var(--bg-card, #1A2436);
+    border: 1px solid var(--border-default, #29354A);
+    border-radius: 8px; padding: 1rem 1.1rem;
+}
+.dash-card__title {
+    font-size: .95rem; font-weight: 600; margin: 0 0 .8rem;
+    color: var(--text-primary, #F1F5F9);
+}
+.dash-card__title--sr {
+    position: absolute;
+    width: 1px;
+    height: 1px;
+    padding: 0;
+    margin: -1px;
+    overflow: hidden;
+    clip: rect(0, 0, 0, 0);
+    white-space: nowrap;
+    border: 0;
+}
+.dash-card__sub {
+    color: var(--text-muted, #64748B);
+    font-size: 12px;
+    margin: -.35rem 0 .85rem;
+}
+.dash-panel--wide { grid-column: 1 / -1; }
+/* v1.10: Health Overview / KPI / Operating Mode panel classes removed —
+   renderHealthOverview + renderOperatingMode are not called by renderCards()
+   in the V2 redesign. Dead CSS removed to keep the stylesheet lean. */
+.dash-path__state,
+.dash-issue__detail {
+    color: var(--text-muted, #64748B);
+    font-size: 12px;
+}
+.dash-path {
+    display: grid;
+    grid-template-columns: repeat(4, minmax(0, 1fr));
+    gap: .7rem;
+}
+.dash-path__node {
+    min-width: 0;
+    border: 1px solid var(--border-default, #29354A);
+    border-radius: 6px;
+    padding: .75rem;
+    background: var(--bg-input, #0E1726);
+}
+.dash-path__node--ok { border-color: rgba(16, 185, 129, .35); background: var(--success-bg); }
+.dash-path__node--warn { border-color: rgba(245, 158, 11, .4); background: var(--warning-bg); }
+.dash-path__node--error { border-color: rgba(239, 68, 68, .45); background: var(--error-bg); }
+.dash-path__state {
+    display: flex;
+    align-items: center;
+    gap: .45rem;
+    margin-bottom: .55rem;
+}
+.dash-path__label {
+    color: var(--text-primary, #E2E8F0);
+    font-size: 13px;
+    font-weight: 600;
+}
+.dash-path__value {
+    color: var(--text-secondary, #94A3B8);
+    font-family: 'JetBrains Mono', monospace;
+    font-size: 12px;
+    margin-top: .2rem;
+    overflow-wrap: anywhere;
+}
+.dash-issues__list {
+    display: grid;
+    gap: .4rem;
+}
+.dash-issues {
+    padding-block: .8rem;
+}
+.dash-issues .dash-card__title {
+    margin-bottom: .55rem;
+}
+.dash-issue {
+    display: flex;
+    align-items: flex-start;
+    gap: .6rem;
+    border: 1px solid var(--border-default, #29354A);
+    border-radius: 6px;
+    background: var(--bg-input, #0E1726);
+    padding: .5rem .65rem;
+}
+.dash-issue--ok {
+    border-color: rgba(16, 185, 129, .26);
+    background: var(--bg-input, #0E1726);
+    box-shadow: inset 3px 0 0 var(--success, #10B981);
+}
+.dash-issue--warn {
+    border-color: rgba(245, 158, 11, .3);
+    background: var(--bg-input, #0E1726);
+    box-shadow: inset 3px 0 0 var(--warning, #F59E0B);
+}
+.dash-issue--error {
+    border-color: rgba(239, 68, 68, .32);
+    background: var(--bg-input, #0E1726);
+    box-shadow: inset 3px 0 0 var(--error, #EF4444);
+}
+.dash-issue__body { min-width: 0; }
+.dash-issue__text {
+    color: var(--text-primary, #E2E8F0);
+    font-size: 12.5px;
+    font-weight: 600;
+    overflow-wrap: anywhere;
+}
+.dash-issue__detail {
+    margin-top: .15rem;
+    overflow-wrap: anywhere;
+}
+.dash-issue__action {
+    color: var(--text-secondary, #94A3B8);
+    font-size: 12px;
+    margin-top: .25rem;
+    overflow-wrap: anywhere;
+}
+/* v1.7.1 Task 2: issue action rendered as a clickable deep-link. */
+button.dash-issue__action--link {
+    display: inline-flex;
+    align-items: center;
+    gap: .25rem;
+    width: 100%;
+    text-align: left;
+    background: none;
+    border: none;
+    color: var(--accent, #6366F1);
+    cursor: pointer;
+    font: inherit;
+    font-size: 12px;
+}
+button.dash-issue__action--link:hover { text-decoration: underline; }
+/* v1.7.1 Task 1: stale / connection-lost banner (zombie dashboard guard). */
+.dash-stale {
+    display: flex;
+    align-items: flex-start;
+    gap: .6rem;
+    border-color: var(--warning);
+    background: var(--warning-bg, rgba(245, 158, 11, .12));
+}
+.dash-stale__title { font-weight: 600; }
+.dash-stale__detail {
+    margin-top: .15rem;
+    color: var(--text-secondary, #94A3B8);
+    font-size: 13px;
+    overflow-wrap: anywhere;
+}
+/* When stale, dim the live cards so the operator does not trust them. */
+.dash-grid[data-dash-stale="true"] .dash-card:not(.dash-stale) { opacity: .6; }
+/* ─── Dashboard V2 — Network card layout (Task 7) ─────────── */
+/* dash-card--network: large left card spans rows 1..N of the right column
+   (dpworldapp / GNSS / Equipment stack beside it). */
+.dash-card--network {
+    grid-column: 1;
+    grid-row: span 2;
+}
+/* v1.10 V2 responsive: mobile collapses to single column.
+   Port diagram collapses to vertical interface list (net-ports wraps to column).
+   Order: header → Network → Current Issues → dpworldapp → GNSS → Equipment →
+          Server Uplink → System (controlled by order cards appear in renderCards). */
+@media (max-width: 720px) {
+    .dash-panel--wide { grid-column: auto; }
+    .dash-path { grid-template-columns: 1fr; }
+    .dash-card--network { grid-column: auto; grid-row: auto; }
+    .net-ports { grid-template-columns: 1fr; gap: .4rem; }
+    .net-port {
+        flex-direction: row;
+        justify-content: flex-start;
+        gap: .5rem;
+        min-height: 52px;
+        padding: .45rem .6rem;
+    }
+    .net-port__icon { width: 30px; height: 24px; }
+    .net-port__signal { margin-left: auto; }
+    .net-iface-row {
+        grid-template-columns: 1fr;
+        align-items: start;
+    }
+    .net-iface-row__item {
+        justify-content: flex-start;
+        flex-wrap: wrap;
+        gap: .4rem;
+    }
+    .net-iface-row__value {
+        white-space: normal;
+        overflow: visible;
+        overflow-wrap: anywhere;
+        text-align: left;
+    }
+}
+.dash-row {
+    display: flex; align-items: baseline; gap: .5rem;
+    margin-bottom: .5rem; font-size: 13px;
+}
+.dash-row__lbl { color: var(--text-secondary, #94A3B8); min-width: 96px; }
+.dash-row__val { color: var(--text-primary, #E2E8F0); font-family: 'JetBrains Mono', monospace; }
+.dash-row__val--dim { color: var(--text-muted, #64748B); font-size: 12px; }
+.dash-row--section {
+    color: var(--text-muted, #888);
+    font-size: 0.85em;
+    border-top: 1px solid var(--border-default, #2a2a2a);
+    padding-top: 6px;
+    margin-top: 6px;
+    display: block;
+}
+
+/* v1.5.5.2: per-interface 세부 row (IP/MAC 표시).
+   header row 다음에 들여쓰기 + 작은 텍스트로 보조 정보 표시.
+   ── eth0   Down
+       IP    192.168.1.1
+       MAC   92:d4:78:cd:59:7b
+*/
+.dash-status-hero {
+    display: flex;
+    align-items: center;
+    gap: .65rem;
+    min-width: 0;
+    margin-bottom: .65rem;
+    padding: .55rem .65rem;
+    border: 1px solid rgba(148, 163, 184, .16);
+    border-radius: 6px;
+    background: rgba(15, 23, 42, .18);
+}
+.dash-status-hero__icon {
+    width: 34px;
+    height: 34px;
+    flex: 0 0 34px;
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    border-radius: 6px;
+    color: var(--text-muted, #64748B);
+    background: var(--bg-input, #0E1726);
+    border: 1px solid var(--border-default, #29354A);
+}
+.dash-status-hero__copy {
+    display: flex;
+    flex-direction: column;
+    min-width: 0;
+    line-height: 1.25;
+}
+.dash-status-hero__eyebrow {
+    color: var(--text-muted, #64748B);
+    font-size: 11px;
+    font-weight: 700;
+    text-transform: uppercase;
+}
+.dash-status-hero__value {
+    color: var(--text-primary, #E2E8F0);
+    font-size: 14px;
+    font-weight: 700;
+    overflow-wrap: anywhere;
+}
+.dash-status-hero__detail {
+    color: var(--text-secondary, #94A3B8);
+    font-size: 12px;
+    overflow-wrap: anywhere;
+}
+.dash-status-hero--ok { border-color: rgba(148, 163, 184, .18); box-shadow: inset 3px 0 0 var(--success, #10B981); }
+.dash-status-hero--warn { border-color: rgba(148, 163, 184, .18); box-shadow: inset 3px 0 0 var(--warning, #F59E0B); }
+.dash-status-hero--error { border-color: rgba(148, 163, 184, .18); box-shadow: inset 3px 0 0 var(--error, #EF4444); }
+.dash-status-hero__icon--ok { color: var(--success, #10B981); border-color: rgba(16, 185, 129, .32); }
+.dash-status-hero__icon--warn { color: var(--warning, #F59E0B); border-color: rgba(245, 158, 11, .35); }
+.dash-status-hero__icon--error { color: var(--error, #EF4444); border-color: rgba(239, 68, 68, .38); }
+
+.dash-row--header { margin-bottom: 2px; }
+.dash-row--sub {
+    margin-bottom: 2px; padding-left: 20px; font-size: 12px;
+    color: var(--text-muted);
+}
+.dash-row__lbl--sub { min-width: 36px; color: var(--text-muted); }
+
+/* v1.5.4.3 U11 fix: 9→10px (WCAG 1.4.11 non-text contrast 가시성 향상) + CSS 변수.
+   하드코딩 hex를 테마 토큰 --success/--warning/--error/--border-default로 교체. */
+.dash-glyph {
+    width: 10px; height: 10px; border-radius: 50%;
+    display: inline-block; flex-shrink: 0;
+}
+.dash-glyph--ok    { background: var(--success); box-shadow: 0 0 0 3px var(--success-bg); }
+.dash-glyph--warn  { background: var(--warning); box-shadow: 0 0 0 3px var(--warning-bg); }
+.dash-glyph--error { background: var(--error);   box-shadow: 0 0 0 3px var(--error-bg); }
+.dash-glyph--na    { background: transparent; border: 1.5px solid var(--border-default); }
+
+/* v1.5.5.1: drift badge — configurator 측 view vs dpworldapp 측 실측값 mismatch 시 표시.
+   inline 으로 .dash-row__val 안에 들어가는 작은 yellow warning icon + tooltip.
+   click 안 함 — 단순 시각 신호 + title hover 로 양쪽 값 보임. */
+.drift-warn {
+    display: inline-flex; align-items: center; vertical-align: middle;
+    margin-left: 0.4rem; color: var(--warning); cursor: help;
+}
+.drift-warn svg { stroke: var(--warning); }
+
+.dash-disk { margin-bottom: .7rem; }
+.dash-disk__head {
+    display: flex; justify-content: space-between;
+    font-size: 12px; margin-bottom: 3px;
+}
+.dash-disk__bar {
+    /* v1.4.6.10 ②: --color-bg-secondary / --color-border 미정의 → 실제 토큰 사용 */
+    height: 11px; background: var(--bg-input, #0E1726);
+    border: 1px solid var(--border-default, #2D3A52);
+    border-radius: 4px; overflow: hidden;
+}
+.dash-disk__fill { height: 100%; transition: width .3s; background: var(--success); }
+/* v1.5.4.3 U4 fix: tier별 색상 — 인라인 hex 제거, 테마 토큰 적용. */
+.dash-disk__fill--ok    { background: var(--success); }
+.dash-disk__fill--warn  { background: var(--warning); }
+.dash-disk__fill--error { background: var(--error); }
+
+
+/* ─── Dashboard V2 — Header summary bar (Task 7) ─────────── */
+/* Spans full grid width; one-line equipment | iface | mode | uplink.
+   Rendered by renderHeaderSummary() → .dash-header-summary element. */
+.dash-header-summary {
+    grid-column: 1 / -1;
+    display: flex;
+    align-items: center;
+    flex-wrap: wrap;
+    gap: .4rem .8rem;
+    min-width: 0;
+    background: var(--bg-input, #0E1726);
+    border: 1px solid var(--border-default, #29354A);
+    border-radius: 8px;
+    padding: .6rem 1rem;
+    font-size: 13px;
+}
+.dash-header__part {
+    display: inline-flex;
+    align-items: center;
+    gap: .3rem;
+    color: var(--text-secondary, #94A3B8);
+    padding: .15rem .45rem;
+    border-radius: 4px;
+    background: var(--bg-card, #1A2436);
+    border: 1px solid var(--border-default, #29354A);
+    white-space: nowrap;
+}
+.dash-header__icon {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    width: 18px;
+    height: 18px;
+    flex: 0 0 18px;
+    color: var(--text-muted, #64748B);
+}
+.dash-header__icon--ok { color: var(--success, #10B981); }
+.dash-header__icon--warn { color: var(--warning, #F59E0B); }
+.dash-header__icon--error { color: var(--error, #EF4444); }
+.dash-header__label {
+    color: var(--text-muted, #64748B);
+    font-size: 11px;
+    font-weight: 600;
+    text-transform: uppercase;
+}
+.dash-header__value {
+    min-width: 0;
+    overflow-wrap: anywhere;
+}
+.dash-header__part--ok { border-color: rgba(16, 185, 129, .28); }
+.dash-header__part--warn { border-color: rgba(245, 158, 11, .34); }
+.dash-header__part--error { border-color: rgba(239, 68, 68, .38); }
+.dash-header__equipment {
+    font-weight: 600;
+    color: var(--text-primary, #E2E8F0);
+}
+.dash-header__iface {
+    font-family: 'JetBrains Mono', monospace;
+}
+.dash-header__uplink {
+    margin-left: auto;
+    font-family: 'JetBrains Mono', monospace;
+    font-size: 12px;
+}
+
+/* ─── Dashboard V2 — Overall status chip (v1.11.0) ────────── */
+.dash-status-chip { display: inline-flex; align-items: center; gap: 6px; padding: 2px 9px; border-radius: var(--radius-sm); font-size: var(--font-size-sm); font-weight: 600; white-space: nowrap; }
+.dash-status-chip--ok { background: var(--success-bg); color: var(--success); }
+.dash-status-chip--warn { background: var(--warning-bg); color: var(--warning); }
+.dash-status-chip--error { background: var(--error-bg); color: var(--error); }
+
+/* ─── Dashboard V2 — Hardware Modules card (v1.11.0) ──────── */
+.hw-module + .hw-module { margin-top: var(--space-md); padding-top: var(--space-md); border-top: 1px solid var(--border-default); }
+.hw-module__head { display: flex; align-items: center; gap: 8px; margin-bottom: 8px; }
+.hw-module__name { font-size: var(--font-size-sm); font-weight: 600; color: var(--text-primary); flex: 1; }
+.hw-module__state { font-size: 12px; color: var(--text-secondary); }
+
+/* ─── Dashboard V2 — In-card action row (v1.11.0) ─────────── */
+.dash-card__action { margin-top: var(--space-md); padding-top: var(--space-md); border-top: 1px solid var(--border-default); }
+
+/* ─── Dashboard V2 — Port slots (Task 7) ──────────────────── */
+/* Rendered by renderNetworkCard → net-port-panel / net-ports / net-port boxes. */
+.net-port-panel {
+    border: 1px solid var(--border-default, #29354A);
+    border-radius: 8px;
+    background: var(--bg-input, #0E1726);
+    padding: .65rem;
+    margin-bottom: .85rem;
+}
+.net-ports {
+    display: grid;
+    grid-template-columns: repeat(3, minmax(0, 1fr));
+    gap: .5rem;
+}
+.net-port {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+    gap: .25rem;
+    min-width: 0;
+    min-height: 76px;
+    padding: .55rem .45rem;
+    border: 1.5px solid var(--border-default, #29354A);
+    border-radius: 6px;
+    background: var(--bg-card, #1A2436);
+    text-align: center;
+}
+.net-port__icon {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    width: 38px;
+    height: 30px;
+    color: var(--text-muted, #64748B);
+}
+.net-port__svg {
+    width: 100%;
+    height: 100%;
+}
+.net-port__signal {
+    min-height: 14px;
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+}
+/* Tier colour modifiers — border + subtle bg tint */
+.net-port--ok {
+    border-color: rgba(16, 185, 129, .38);
+    background: var(--bg-card, #1A2436);
+    box-shadow: inset 0 -2px 0 rgba(16, 185, 129, .42);
+}
+.net-port--ok .net-port__icon { color: var(--success, #10B981); }
+.net-port--warn {
+    border-color: rgba(245, 158, 11, .42);
+    background: var(--bg-card, #1A2436);
+    box-shadow: inset 0 -2px 0 rgba(245, 158, 11, .44);
+}
+.net-port--warn .net-port__icon { color: var(--warning, #F59E0B); }
+.net-port--error {
+    border-color: rgba(239, 68, 68, .48);
+    background: var(--bg-card, #1A2436);
+    box-shadow: inset 0 -2px 0 rgba(239, 68, 68, .46);
+}
+.net-port--error .net-port__icon { color: var(--error, #EF4444); }
+.net-port--na {
+    border-color: var(--border-default, #29354A);
+    background: var(--bg-input, #0E1726);
+    opacity: .65;
+}
+.net-port--wired .net-port__icon { transform: translateY(1px); }
+.net-port--wifi .net-port__icon { width: 34px; }
+.net-port__name {
+    font-family: 'JetBrains Mono', monospace;
+    font-size: 11px;
+    font-weight: 600;
+    color: var(--text-primary, #E2E8F0);
+    letter-spacing: 0;
+}
+.net-port__label {
+    font-size: 11px;
+    color: var(--text-secondary, #94A3B8);
+    line-height: 1.2;
+}
+
+.net-iface-list {
+    display: grid;
+    gap: .35rem;
+    margin-bottom: .7rem;
+}
+.net-iface-row {
+    display: grid;
+    grid-template-columns: 28px minmax(78px, .7fr) minmax(0, 1.3fr);
+    align-items: center;
+    gap: .25rem .65rem;
+    min-width: 0;
+    border: 1px solid rgba(148, 163, 184, .14);
+    border-radius: 6px;
+    background: rgba(15, 23, 42, .18);
+    padding: .42rem .55rem;
+    font-size: 12px;
+}
+.net-iface-row__icon {
+    width: 24px;
+    height: 24px;
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    border-radius: 5px;
+    color: var(--text-muted, #64748B);
+    background: var(--bg-input, #0E1726);
+}
+.net-iface-row--advanced .net-iface-row__icon {
+    grid-row: 1 / span 2;
+}
+.net-iface-row__icon--ok { color: var(--success, #10B981); }
+.net-iface-row__icon--warn { color: var(--warning, #F59E0B); }
+.net-iface-row__icon--error { color: var(--error, #EF4444); }
+.net-iface-row__state,
+.net-iface-row__item {
+    display: inline-flex;
+    align-items: center;
+    min-width: 0;
+    gap: .35rem;
+}
+.net-iface-row__state {
+    grid-column: 2;
+}
+.net-iface-row--advanced .net-iface-row__state {
+    grid-row: 1 / span 2;
+}
+.net-iface-row__item {
+    grid-column: 3;
+    justify-content: flex-start;
+}
+.net-iface-row__name {
+    color: var(--text-primary, #E2E8F0);
+    font-family: 'JetBrains Mono', monospace;
+    font-weight: 600;
+}
+.net-iface-row__link,
+.net-iface-row__label {
+    color: var(--text-muted, #64748B);
+    font-size: 11px;
+}
+.net-iface-row__value {
+    color: var(--text-secondary, #94A3B8);
+    font-family: 'JetBrains Mono', monospace;
+    overflow: visible;
+    overflow-wrap: anywhere;
+    text-overflow: clip;
+    white-space: normal;
+}
+
+@media (max-width: 720px) {
+    .page-container--dashboard {
+        width: calc(100vw - 2rem);
+        max-width: calc(100vw - 2rem);
+        margin-inline: 0;
+    }
+    .dash-header-summary {
+        align-items: stretch;
+    }
+    .dash-header__part {
+        flex-wrap: wrap;
+        max-width: 100%;
+        min-width: 0;
+        overflow-wrap: anywhere;
+        white-space: normal;
+    }
+    .dash-header__uplink .dash-header__value {
+        flex: 1 1 100%;
+    }
+    .dash-header__uplink {
+        flex: 1 1 100%;
+        margin-left: 0;
+    }
+    .net-ports {
+        grid-template-columns: 1fr;
+        gap: .4rem;
+    }
+    .net-port {
+        flex-direction: row;
+        justify-content: flex-start;
+        gap: .5rem;
+        min-height: 52px;
+        padding: .45rem .6rem;
+    }
+    .net-port__icon {
+        width: 30px;
+        height: 24px;
+    }
+    .net-port__signal {
+        margin-left: auto;
+    }
+    .net-iface-row {
+        grid-template-columns: 28px 1fr;
+        align-items: start;
+    }
+    .net-iface-row--user .net-iface-row__icon {
+        grid-row: 1 / span 2;
+    }
+    .net-iface-row--advanced .net-iface-row__icon {
+        grid-row: 1 / span 3;
+    }
+    .net-iface-row__state {
+        grid-column: 2;
+        grid-row: auto;
+    }
+    .net-iface-row__item {
+        grid-column: 2;
+        justify-content: flex-start;
+        flex-wrap: wrap;
+        gap: .4rem;
+    }
+    .net-iface-row__value {
+        white-space: normal;
+        overflow: visible;
+        overflow-wrap: anywhere;
+        text-align: left;
+    }
+}
+
+/* ─── Dashboard V2 — RSSI bars (Task 7) ───────────────────── */
+/* SVG wrapper + individual rect bars rendered by _rssiBarsSvg(). */
+.rssi-bars {
+    display: inline-block;
+    vertical-align: middle;
+    flex-shrink: 0;
+    margin-left: .35rem;
+}
+.rssi-bar {
+    /* base rect — individual tiers override fill */
+}
+.rssi-bar--ok    { fill: var(--success, #10B981); }
+.rssi-bar--warn  { fill: var(--warning, #F59E0B); }
+.rssi-bar--error { fill: var(--error, #EF4444); }
+.rssi-bar--empty { fill: var(--border-default, #29354A); }
+
+/* ═══════════════════════════════════════════════════════════════
+   v1.4.6.10 — Accessibility (WCAG)
+   ═══════════════════════════════════════════════════════════════ */
+
+/* v1.4.6.10 ③: 키보드 포커스 표시 복원. 이전 .btn류에 outline:none만 적용되어 키보드 탭
+   이동 시 현재 위치 안 보이던 결함. :focus-visible은 키보드 trigger에만 작동 (마우스 click은
+   영향 없음 — 디자인 깨끗 유지). WCAG 2.1 SC 2.4.7 (Focus Visible). */
+.btn:focus-visible,
+.nav-item:focus-visible,
+.theme-toggle:focus-visible,
+.input-password__toggle:focus-visible,
+.log-file-check:focus-visible,
+.log-action-bar__left button:focus-visible,
+.checkbox-toggle:focus-visible {  /* v1.5.4.2 L2 — AI/DI toggle keyboard focus (WCAG 2.4.7) */
+    outline: 2px solid var(--accent, #6366F1);
+    outline-offset: 2px;
+}
+
+/* v1.4.6.10 bonus: 모션 민감 사용자 보호 (WCAG 2.1 SC 2.3.3). prefers-reduced-motion 설정 시
+   모든 animation/transition을 사실상 즉시 완료 (0.01ms — 0이 아닌 이유는 일부 JS가
+   transitionend 이벤트에 의존). */
+@media (prefers-reduced-motion: reduce) {
+    *, *::before, *::after {
+        animation-duration: 0.01ms !important;
+        animation-iteration-count: 1 !important;
+        transition-duration: 0.01ms !important;
+        scroll-behavior: auto !important;
+    }
+}
+
+/* ═══════════════════════════════════════════════════════════════
+   v1.5.0 Phase 1 — Lucide SVG icons + Sidebar nested + Accessibility
+   ═══════════════════════════════════════════════════════════════ */
+
+/* v1.5.0 P1: Lucide SVG inline icons.
+   inline-block + currentColor stroke → theme 토글 시 자동 색 적용.
+   vertical-align: middle → font-size 무관 robust 정렬. */
+.icon {
+    display: inline-block;
+    vertical-align: middle;
+    flex-shrink: 0;
+    line-height: 0;
+}
+/* Pointer events: icon 안 button click을 button click과 같이 처리 */
+button .icon, a .icon, label .icon { pointer-events: none; }
+
+/* v1.5.0 P1: Skip-to-content link (WCAG 2.4.1). 화면 밖 배치 + focus 시 노출. */
+.skip-link {
+    position: absolute;
+    top: -40px;
+    left: 0;
+    background: var(--accent, #6366F1);
+    color: var(--text-inverse, #fff);
+    padding: 0.5rem 1rem;
+    z-index: 9999;
+    text-decoration: none;
+    border-radius: 0 0 4px 0;
+}
+.skip-link:focus { top: 0; }
+
+/* v1.5.0 P1: Sidebar nested nav — group + leaf accordion */
+.nav-group {
+    display: block;
+    margin: 0 0 0.25rem 0;
+}
+.nav-group__toggle {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+    width: 100%;
+    padding: 0.5rem 0.75rem;
+    background: transparent;
+    color: var(--text-primary, #F1F5F9);
+    border: none;
+    cursor: pointer;
+    font: inherit;
+    font-weight: 500;
+    text-align: left;
+    border-radius: 4px;
+}
+.nav-group__toggle:hover { background: var(--bg-card-hover, #263548); }
+.nav-group__icon { display: inline-flex; }
+.nav-group__label { flex: 1; }
+.nav-group__chevron {
+    display: inline-flex;
+    transition: transform 0.2s ease;
+}
+.nav-group__toggle[aria-expanded="false"] .nav-group__chevron {
+    transform: rotate(-90deg);
+}
+.nav-group__leaves {
+    list-style: none;
+    margin: 0;
+    padding: 0 0 0 1.5rem;
+    overflow: hidden;
+    max-height: 1000px;
+    transition: max-height 0.25s ease;
+}
+.nav-group__toggle[aria-expanded="false"] + .nav-group__leaves {
+    max-height: 0;
+}
+.nav-item--leaf {
+    padding-left: 0.5rem;
+}
+
+/* v1.5.0 P1: page-dirty dot. state.pageDirty matrix 값에 따라 표시.
+   JS에서 .has-dirty 클래스 토글. */
+.nav-item__dirty {
+    display: none;
+    width: 8px;
+    height: 8px;
+    border-radius: 50%;
+    background: var(--warning, #F59E0B);
+    box-shadow: 0 0 6px var(--warning-bg);
+    margin-left: auto;
+}
+.nav-item.has-dirty .nav-item__dirty {
+    display: inline-block;
+}
+.nav-item.nav-item--error .nav-item__dirty {
+    display: none;
+}
+
+/* v1.5.0 P1: Disabled leaf (Firmware placeholder) */
+.nav-item--disabled {
+    opacity: 0.55;
+    pointer-events: none;
+}
+.nav-item__badge {
+    margin-left: auto;
+    font-size: 9px;
+    padding: 2px 6px;
+    border-radius: 8px;
+    background: var(--bg-input, #0F172A);
+    color: var(--text-muted, #94A3B8);
+    letter-spacing: 0.04em;
+}
+
+/* v1.5.0 P1: Sidebar overflow safeguard (workflow risk R8) */
+.sidebar__nav {
+    overflow-y: auto;
+    max-height: calc(100vh - 120px); /* header + theme toggle 영역 제외 */
+}
+
+/* v1.5.0 P1: prefers-reduced-motion — accordion + chevron 즉시 */
+@media (prefers-reduced-motion: reduce) {
+    .nav-group__chevron,
+    .nav-group__leaves {
+        transition: none !important;
+    }
+}
+
+/* v1.5.0 P1: nav-guard modal */
+.nav-guard__backdrop {
+    position: fixed; inset: 0;
+    background: rgba(0, 0, 0, 0.5);
+    display: flex; align-items: center; justify-content: center;
+    z-index: 9000;
+}
+.nav-guard__modal {
+    background: var(--bg-card, #1E293B);
+    color: var(--text-primary, #F1F5F9);
+    padding: 1.5rem;
+    border-radius: 8px;
+    max-width: 480px;
+    width: 90%;
+    box-shadow: 0 10px 40px rgba(0,0,0,0.35);
+}
+.nav-guard__title { margin: 0 0 0.5rem; }
+.nav-guard__desc { margin: 0 0 1.25rem; }
+.nav-guard__actions {
+    display: flex; gap: 0.5rem; justify-content: flex-end;
+}/* ═══════════════════════════════════════════════════════════════
+   FIRMWARE UPDATE PAGE — graphical status components
+   Built on the existing design tokens (style.css). Merge block:
+   append verbatim to src/static/css/style.css.
+   ═══════════════════════════════════════════════════════════════ */
+
+/* ═══════════════════════════════════════════════════════════════
+   COMPACT LAYOUT (scoped to .fw-page) — minimise scrolling
+   ═══════════════════════════════════════════════════════════════ */
+.fw-page .page-header { margin-bottom: var(--space-sm); }
+.fw-page .page-header__title { font-size: var(--font-size-lg); margin-bottom: 0; }
+.fw-page .page-header__desc { font-size: var(--font-size-xs); }
+.fw-page .card { padding: var(--space-md); margin-bottom: var(--space-sm); }
+.fw-page .card__header { margin-bottom: var(--space-sm); padding-bottom: var(--space-sm); }
+.fw-page .card__title { font-size: var(--font-size-base); }
+.fw-page .info-banner { padding: 6px var(--space-md); margin-bottom: var(--space-sm); font-size: var(--font-size-xs); }
+
+/* two-column row: upload + pre-flight sit side by side (pre-flash) */
+.fw-grid2 { display: grid; grid-template-columns: 1fr 1fr; gap: var(--space-sm); align-items: start; margin-bottom: var(--space-sm); }
+.fw-grid2--wide-left { grid-template-columns: 1.4fr 1fr; }
+.fw-grid2 .card { margin-bottom: 0; }
+@media (max-width: 860px) {
+  .fw-grid2, .fw-grid2--wide-left { grid-template-columns: 1fr; }
+}
+
+/* smaller stepper */
+.fw-page .fw-stepper { margin: 2px 0 var(--space-sm); }
+.fw-page .fw-step { min-width: 58px; }
+.fw-page .fw-step__dot { width: 24px; height: 24px; font-size: 11px; }
+.fw-page .fw-step:not(:first-child)::before { top: 11px; }
+.fw-page .fw-step__label { font-size: 10px; }
+.fw-page .fw-step__detail { display: none; }   /* drop sub-detail to save height */
+
+/* smaller live bar + slot row */
+.fw-page .fw-live { margin-top: 6px; }
+.fw-page .fw-live__row { margin-bottom: 4px; }
+.fw-page .fw-bar { height: 9px; }
+.fw-page .fw-live .flex-between { margin-top: 6px !important; }
+
+/* tighter drop zone */
+.fw-page .fw-drop { padding: var(--space-md); }
+.fw-page .fw-drop__icon { font-size: 24px; margin-bottom: 4px; }
+.fw-page .fw-drop__main { font-size: var(--font-size-sm); }
+.fw-page .fw-drop__sub { font-size: 10px; margin-top: 2px; }
+
+/* tighter rows */
+.fw-page .fw-comp { padding: 4px 0; }
+.fw-page .fw-check { padding: 5px 0; }
+.fw-page .fw-check__label { font-size: var(--font-size-xs); min-width: 140px; }
+.fw-page .fw-check__detail { font-size: 10px; }
+
+/* compact flash actions + overall */
+.fw-page .fw-actions { margin-bottom: var(--space-sm); }
+.fw-page .fw-overall__pct { font-size: var(--font-size-md); }
+
+/* compact log */
+.fw-page .fw-log { max-height: 140px; font-size: 11px; padding: var(--space-sm); }
+
+/* ─── Sticky progress header (always-visible) ───────────────── */
+.fw-sticky-card {
+  position: sticky;
+  top: var(--space-md);
+  z-index: 40;
+  box-shadow: var(--shadow-md);
+}
+.fw-live { margin-top: var(--space-sm); }
+.fw-live__row {
+  display: flex;
+  justify-content: space-between;
+  align-items: baseline;
+  margin-bottom: 6px;
+  gap: var(--space-md);
+}
+.fw-live__state { font-size: var(--font-size-sm); font-weight: 600; color: var(--text-primary); }
+.fw-live__state--active { color: var(--accent); }
+.fw-live__state--done { color: var(--success); }
+.fw-live__state--error { color: var(--error); }
+.fw-live__pct { font-family: var(--font-mono); font-size: var(--font-size-sm); color: var(--text-secondary); white-space: nowrap; }
+
+/* ─── Collapsible done sections ─────────────────────────────── */
+.card--collapsed > :not(.card__header) { display: none; }
+.card--collapsed .card__header {
+  margin-bottom: 0;
+  padding-bottom: 0;
+  border-bottom: none;
+}
+.card__summary {
+  font-size: var(--font-size-xs);
+  color: var(--success);
+  font-weight: 500;
+  margin-left: var(--space-sm);
+}
+.card__header--clickable { cursor: pointer; user-select: none; }
+.card__header--clickable:hover { opacity: 0.85; }
+
+@media (max-width: 768px) {
+  .fw-sticky-card { top: calc(var(--header-height) + var(--space-sm)); }
+}
+
+/* ═══════════════════════════════════════════════════════════════
+   WIZARD (installer-style, one step at a time)
+   ═══════════════════════════════════════════════════════════════ */
+/* generic hide utility (not defined in the base style.css) */
+.hidden { display: none !important; }
+
+.fw-page .fw-wizard-body { margin-bottom: var(--space-sm); }
+.fw-step-panel { min-height: 160px; }
+
+.fw-wizard-nav {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: var(--space-md);
+  padding: var(--space-sm) var(--space-md);
+  background: var(--bg-card);
+  border: 1px solid var(--border-card);
+  border-radius: var(--radius-md);
+  margin-bottom: var(--space-sm);
+  position: sticky;
+  bottom: var(--space-sm);
+  box-shadow: var(--shadow-md);
+}
+.fw-wizard-nav .btn { min-width: 120px; }
+.fw-nav__hint { font-size: var(--font-size-sm); color: var(--text-muted); }
+.fw-nav__hint--error { color: var(--error); font-weight: 600; }
+@media (max-width: 768px) {
+  .fw-wizard-nav .btn { min-width: 96px; }
+}
+
+/* ─── Accessibility helpers ─────────────────────────────────── */
+/* v1.7.1 Task 4: generic screen-reader-only utility (mirrors .fw-sr-only). */
+.sr-only {
+  position: absolute;
+  width: 1px;
+  height: 1px;
+  padding: 0;
+  margin: -1px;
+  overflow: hidden;
+  clip: rect(0 0 0 0);
+  white-space: nowrap;
+  border: 0;
+}
+.fw-sr-only {
+  position: absolute;
+  width: 1px;
+  height: 1px;
+  padding: 0;
+  margin: -1px;
+  overflow: hidden;
+  clip: rect(0 0 0 0);
+  white-space: nowrap;
+  border: 0;
+}
+.fw-drop:focus-visible {
+  outline: 2px solid var(--accent);
+  outline-offset: 2px;
+  border-color: var(--accent);
+}
+.fw-reboot__elapsed--overdue { color: var(--warning); font-weight: 600; }
+
+/* ─── Stepper (lifecycle phase tracker) ─────────────────────── */
+.fw-stepper {
+  display: flex;
+  align-items: flex-start;
+  gap: 0;
+  margin: var(--space-sm) 0 var(--space-md);
+  overflow-x: auto;
+  padding-bottom: var(--space-xs);
+}
+.fw-step {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  flex: 1 1 0;
+  min-width: 76px;
+  position: relative;
+}
+/* connector line between dots */
+.fw-step:not(:first-child)::before {
+  content: '';
+  position: absolute;
+  top: 15px;
+  right: 50%;
+  width: 100%;
+  height: 2px;
+  background: var(--border-default);
+  z-index: 0;
+}
+.fw-step--done:not(:first-child)::before,
+.fw-step--active:not(:first-child)::before {
+  background: var(--accent);
+}
+.fw-step__dot {
+  width: 32px;
+  height: 32px;
+  border-radius: var(--radius-full);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-size: 13px;
+  font-weight: 700;
+  background: var(--bg-card);
+  border: 2px solid var(--border-default);
+  color: var(--text-muted);
+  z-index: 1;
+  transition: all var(--transition-base);
+}
+.fw-step__label {
+  margin-top: var(--space-xs);
+  font-size: var(--font-size-xs);
+  color: var(--text-muted);
+  text-align: center;
+  letter-spacing: 0.02em;
+}
+.fw-step__detail {
+  font-size: 10px;
+  color: var(--text-muted);
+  opacity: 0.7;
+  text-align: center;
+  margin-top: 1px;
+  max-width: 92px;
+  line-height: 1.2;
+}
+.fw-step--done .fw-step__dot {
+  background: var(--success);
+  border-color: var(--success);
+  color: #fff;
+}
+.fw-step--done .fw-step__label { color: var(--text-secondary); }
+.fw-step--active .fw-step__dot {
+  background: var(--accent);
+  border-color: var(--accent);
+  color: #fff;
+  box-shadow: 0 0 0 4px var(--accent-subtle);
+  animation: fwPulse 1.4s ease-in-out infinite;
+}
+.fw-step--active .fw-step__label { color: var(--accent); font-weight: 600; }
+.fw-step--error .fw-step__dot {
+  background: var(--error);
+  border-color: var(--error);
+  color: #fff;
+}
+.fw-step--error .fw-step__label { color: var(--error); }
+@keyframes fwPulse {
+  0%, 100% { box-shadow: 0 0 0 4px var(--accent-subtle); }
+  50% { box-shadow: 0 0 0 7px var(--accent-subtle); }
+}
+
+/* ─── Drop zone ─────────────────────────────────────────────── */
+.fw-drop {
+  border: 2px dashed var(--border-default);
+  border-radius: var(--radius-lg);
+  padding: var(--space-xl) var(--space-lg);
+  text-align: center;
+  cursor: pointer;
+  transition: all var(--transition-fast);
+  background: var(--bg-input);
+}
+.fw-drop:hover { border-color: var(--accent); background: var(--bg-input-focus); }
+.fw-drop--over {
+  border-color: var(--accent);
+  background: var(--accent-subtle);
+  transform: scale(1.005);
+}
+.fw-drop__icon { font-size: 32px; display: block; margin-bottom: var(--space-sm); }
+.fw-drop__main { font-size: var(--font-size-base); color: var(--text-primary); font-weight: 500; }
+.fw-drop__sub { font-size: var(--font-size-xs); color: var(--text-muted); margin-top: var(--space-xs); }
+.fw-drop__name { color: var(--accent); font-family: var(--font-mono); }
+
+/* ─── Overall progress ──────────────────────────────────────── */
+.fw-overall { margin-bottom: var(--space-md); }
+.fw-overall__head {
+  display: flex;
+  justify-content: space-between;
+  align-items: baseline;
+  margin-bottom: var(--space-xs);
+}
+.fw-overall__pct { font-size: var(--font-size-lg); font-weight: 700; color: var(--text-primary); }
+.fw-overall__meta { font-size: var(--font-size-xs); color: var(--text-muted); font-family: var(--font-mono); }
+.fw-bar {
+  height: 12px;
+  background: var(--bg-input);
+  border: 1px solid var(--border-default);
+  border-radius: var(--radius-sm);
+  overflow: hidden;
+}
+.fw-bar__fill {
+  height: 100%;
+  width: 0;
+  background: var(--accent-gradient);
+  transition: width var(--transition-base);
+}
+.fw-bar__fill--done { background: var(--success); }
+.fw-bar__fill--error { background: var(--error); }
+/* device-side commit/write in progress — animated stripes signal "still working" */
+.fw-bar__fill--busy {
+  background-image: linear-gradient(45deg,
+    rgba(255, 255, 255, 0.18) 25%, transparent 25%, transparent 50%,
+    rgba(255, 255, 255, 0.18) 50%, rgba(255, 255, 255, 0.18) 75%, transparent 75%);
+  background-size: 28px 28px;
+  animation: fwBusyStripes 0.8s linear infinite;
+}
+@keyframes fwBusyStripes {
+  from { background-position: 0 0; }
+  to { background-position: 28px 0; }
+}
+
+/* ─── Per-component rows ────────────────────────────────────── */
+.fw-comp {
+  display: grid;
+  grid-template-columns: 28px 110px 1fr 64px;
+  align-items: center;
+  gap: var(--space-sm);
+  padding: var(--space-sm) 0;
+  border-bottom: 1px solid rgba(51, 65, 85, 0.3);
+}
+.fw-comp:last-child { border-bottom: none; }
+.fw-comp__sig {
+  font-family: var(--font-mono);
+  font-size: var(--font-size-xs);
+  font-weight: 700;
+  padding: 2px 6px;
+  border-radius: var(--radius-sm);
+  background: var(--accent-subtle);
+  color: var(--accent);
+  text-align: center;
+  justify-self: start;
+}
+.fw-comp__name {
+  display: flex;
+  flex-direction: column;
+  gap: 3px;
+  min-width: 0;
+}
+.fw-comp__role { font-size: var(--font-size-sm); color: var(--text-primary); }
+.fw-comp__role small { color: var(--text-muted); font-family: var(--font-mono); }
+.fw-comp__track {
+  height: 7px;
+  background: var(--bg-input);
+  border-radius: var(--radius-full);
+  overflow: hidden;
+}
+.fw-comp__fill {
+  height: 100%;
+  width: 0;
+  background: var(--accent);
+  transition: width var(--transition-fast);
+}
+.fw-comp--done .fw-comp__fill { background: var(--success); width: 100%; }
+.fw-comp--active .fw-comp__fill { background: var(--accent); }
+.fw-comp--error .fw-comp__fill { background: var(--error); }
+.fw-comp__pct {
+  font-family: var(--font-mono);
+  font-size: var(--font-size-xs);
+  color: var(--text-secondary);
+  text-align: right;
+}
+.fw-comp__state-icon { font-size: 14px; text-align: center; }
+.fw-comp__hash {
+  font-family: var(--font-mono);
+  font-size: 10px;
+  color: var(--text-muted);
+}
+
+/* ─── Inline component row (upload list — one file per row) ──── */
+.fw-comp--inline {
+  display: flex;
+  align-items: center;
+  gap: var(--space-sm);
+}
+.fw-comp--inline .fw-comp__state-icon { color: var(--success); }
+.fw-comp--inline .fw-comp__fname {
+  font-family: var(--font-mono);
+  font-size: var(--font-size-sm);
+  color: var(--text-primary);
+  flex: 1;
+  min-width: 0;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+.fw-comp--inline .fw-comp__role2 {
+  font-size: var(--font-size-xs);
+  color: var(--text-secondary);
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  white-space: nowrap;
+}
+.fw-comp--inline .fw-comp__hash { font-size: 10px; white-space: nowrap; }
+.fw-comp--inline .fw-comp__size {
+  font-family: var(--font-mono);
+  font-size: var(--font-size-xs);
+  color: var(--text-secondary);
+  white-space: nowrap;
+  min-width: 60px;
+  text-align: right;
+}
+@media (max-width: 768px) {
+  .fw-comp--inline .fw-comp__role2,
+  .fw-comp--inline .fw-comp__hash { display: none; }
+}
+
+/* ─── Firmware build date line ──────────────────────────────── */
+.fw-builddate {
+  margin-top: var(--space-sm);
+  font-size: var(--font-size-xs);
+  color: var(--text-secondary);
+}
+.fw-builddate strong { color: var(--text-primary); font-family: var(--font-mono); }
+
+/* ─── Pre-flight checklist ──────────────────────────────────── */
+.fw-check {
+  display: flex;
+  align-items: center;
+  gap: var(--space-md);
+  padding: var(--space-sm) 0;
+  border-bottom: 1px solid rgba(51, 65, 85, 0.25);
+}
+.fw-check:last-child { border-bottom: none; }
+.fw-check__label { font-size: var(--font-size-sm); color: var(--text-primary); min-width: 200px; }
+.fw-check__detail { font-size: var(--font-size-xs); color: var(--text-muted); font-family: var(--font-mono); flex: 1; }
+.fw-check__opt { font-size: 10px; color: var(--text-muted); text-transform: uppercase; letter-spacing: 0.06em; }
+
+/* ─── Slot before→after badge ───────────────────────────────── */
+.fw-slot { display: inline-flex; align-items: center; gap: var(--space-xs); font-size: var(--font-size-sm); }
+.fw-slot__pill {
+  font-family: var(--font-mono);
+  font-weight: 700;
+  padding: 2px 9px;
+  border-radius: var(--radius-sm);
+  background: var(--bg-input);
+  border: 1px solid var(--border-default);
+  color: var(--text-secondary);
+}
+.fw-slot__pill--next { background: var(--accent-subtle); border-color: var(--accent); color: var(--accent); }
+.fw-slot__arrow { color: var(--text-muted); }
+
+/* ─── Reboot watchdog ───────────────────────────────────────── */
+.fw-reboot {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: var(--space-md);
+  padding: var(--space-xl) var(--space-md);
+  text-align: center;
+}
+.fw-reboot__title { font-size: var(--font-size-md); font-weight: 600; color: var(--warning); }
+.fw-reboot__sub { font-size: var(--font-size-sm); color: var(--text-secondary); max-width: 420px; }
+.fw-reboot__elapsed { font-family: var(--font-mono); font-size: var(--font-size-sm); color: var(--text-muted); }
+
+/* ─── Result banner (config preserved / restored) ───────────── */
+.fw-result {
+  display: flex;
+  align-items: center;
+  gap: var(--space-md);
+  padding: var(--space-md) var(--space-lg);
+  border-radius: var(--radius-md);
+  font-size: var(--font-size-sm);
+}
+.fw-result--ok { background: var(--success-bg); color: var(--success); border: 1px solid rgba(16,185,129,0.25); }
+.fw-result--warn { background: var(--warning-bg); color: var(--warning); border: 1px solid rgba(245,158,11,0.25); }
+.fw-result__icon { font-size: 20px; }
+
+/* ─── Log console (collapsible) ─────────────────────────────── */
+/* v1.5.4.3 U5 fix: 하드코딩 hex → 테마 토큰. 라이트 테마에서도 가독성 유지.
+   터미널 외관을 의도적으로 유지하려면 별도 클래스(.fw-log--terminal)로 분리할 것. */
+.fw-log {
+  background: var(--bg-input);
+  color: var(--text-primary);
+  font-family: var(--font-mono);
+  font-size: var(--font-size-xs);
+  padding: var(--space-md);
+  border-radius: var(--radius-md);
+  max-height: 220px;
+  overflow-y: auto;
+  white-space: pre-wrap;
+  line-height: 1.6;
+  border: 1px solid var(--border-default);
+}
+
+/* ─── Drop zone disabled (during flash) ─────────────────────── */
+.fw-drop--disabled {
+  opacity: 0.45;
+  pointer-events: none;
+  cursor: not-allowed;
+  border-style: solid;
+}
+
+/* ─── Flash done / rebooted summary ─────────────────────────── */
+.fw-done {
+  display: flex;
+  align-items: center;
+  gap: var(--space-md);
+  padding: var(--space-md) var(--space-sm);
+}
+.fw-done__icon { font-size: 28px; flex-shrink: 0; }
+.fw-done__title { font-size: var(--font-size-md); font-weight: 600; }
+.fw-done--ok .fw-done__title { color: var(--success); }
+.fw-done--reboot .fw-done__title { color: var(--accent); }
+.fw-done__sub { font-size: var(--font-size-sm); color: var(--text-secondary); margin-top: 2px; }
+
+/* ─── Power-loss danger banner (during flash/reboot) ────────── */
+.fw-danger {
+  display: flex;
+  align-items: center;
+  gap: var(--space-sm);
+  padding: var(--space-sm) var(--space-md);
+  border-radius: var(--radius-md);
+  background: var(--error-bg);
+  border: 1px solid rgba(239, 68, 68, 0.35);
+  color: var(--error);
+  font-size: var(--font-size-sm);
+  font-weight: 600;
+  margin-bottom: var(--space-sm);
+  animation: fwDangerPulse 1.6s ease-in-out infinite;
+}
+@keyframes fwDangerPulse {
+  0%, 100% { border-color: rgba(239, 68, 68, 0.35); }
+  50% { border-color: rgba(239, 68, 68, 0.8); }
+}
+
+/* ─── Completion report ─────────────────────────────────────── */
+.fw-report { font-size: var(--font-size-sm); }
+.fw-report__row {
+  display: flex;
+  justify-content: space-between;
+  gap: var(--space-md);
+  padding: 4px 0;
+  border-bottom: 1px solid rgba(51, 65, 85, 0.22);
+}
+.fw-report__row:last-child { border-bottom: none; }
+.fw-report__row span:first-child { color: var(--text-secondary); white-space: nowrap; }
+.fw-report__row span:last-child {
+  font-family: var(--font-mono);
+  color: var(--text-primary);
+  text-align: right;
+  word-break: break-all;
+}
+
+/* ─── Confirm modal ─────────────────────────────────────────── */
+.fw-modal-overlay {
+  position: fixed;
+  inset: 0;
+  background: rgba(0, 0, 0, 0.55);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  z-index: 1100;
+  padding: var(--space-md);
+  backdrop-filter: blur(2px);
+  animation: fadeIn var(--transition-fast) ease;
+}
+.fw-modal {
+  background: var(--bg-card);
+  border: 1px solid var(--border-card);
+  border-radius: var(--radius-lg);
+  box-shadow: var(--shadow-lg);
+  max-width: 480px;
+  width: 100%;
+  padding: var(--space-lg);
+}
+.fw-modal__title {
+  font-size: var(--font-size-md);
+  font-weight: 600;
+  margin-bottom: var(--space-sm);
+  display: flex;
+  align-items: center;
+  gap: var(--space-sm);
+}
+.fw-modal__body { font-size: var(--font-size-sm); color: var(--text-secondary); }
+.fw-modal__list { margin: var(--space-md) 0; }
+.fw-modal__row {
+  display: flex;
+  justify-content: space-between;
+  font-size: var(--font-size-sm);
+  padding: 4px 0;
+  border-bottom: 1px solid rgba(51, 65, 85, 0.25);
+}
+.fw-modal__row:last-child { border-bottom: none; }
+.fw-modal__row span:first-child { font-family: var(--font-mono); color: var(--text-primary); }
+.fw-modal__row span:last-child { font-family: var(--font-mono); color: var(--text-secondary); }
+.fw-modal__slot { margin: var(--space-md) 0; display: flex; align-items: center; gap: var(--space-sm); }
+.fw-modal__actions {
+  display: flex;
+  justify-content: flex-end;
+  gap: var(--space-sm);
+  margin-top: var(--space-lg);
+}
+
+/* ─── Action row ────────────────────────────────────────────── */
+.fw-actions { display: flex; gap: var(--space-sm); flex-wrap: wrap; align-items: center; }
+.fw-actions__spacer { flex: 1; }
+
+/* ─── Responsive ────────────────────────────────────────────── */
+@media (max-width: 768px) {
+  .fw-comp { grid-template-columns: 24px 64px 1fr 48px; }
+  .fw-check__label { min-width: 130px; }
+  .fw-step { min-width: 64px; }
+}
+
+/* ─── v1.5.0 P4b: log.js 3 horizontal tabs ──────────────────── */
+.log-tabs {
+    display: flex;
+    gap: 0.25rem;
+    border-bottom: 1px solid var(--border-default);
+    margin-bottom: 1rem;
+}
+.log-tab {
+    padding: 0.5rem 1rem;
+    background: transparent;
+    border: none;
+    color: var(--text-secondary);
+    cursor: pointer;
+    font: inherit;
+    display: inline-flex;
+    align-items: center;
+    gap: 0.4rem;
+    border-bottom: 2px solid transparent;
+    transition: color 0.15s, border-color 0.15s;
+}
+.log-tab:hover { color: var(--text-primary); }
+.log-tab--active {
+    color: var(--accent);
+    border-bottom-color: var(--accent);
+}
+.log-tab:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+.log-tab-panel[hidden] { display: none; }
+@media (prefers-reduced-motion: reduce) {
+    .log-tab { transition: none; }
+}
+
+/* ─── v1.6.0 Network Apply badge ──────────────────────────── */
+.net-badge {
+    display: inline-block;
+    padding: 1px 6px;
+    border-radius: 4px;
+    font-size: var(--font-size-xs);
+    font-family: var(--font-mono);
+    font-weight: 600;
+}
+.net-badge--ok   { background: var(--success-bg); color: var(--success); }
+.net-badge--warn { background: var(--warning-bg); color: var(--warning); }
+.net-badge--fail { background: var(--error-bg);   color: var(--error);   }
+.net-badge--na   { background: rgba(100,116,139,.15); color: var(--text-muted); }
+
+/* ═══════════════════════════════════════════════════════════════
+   v1.7.0 — Pending Changes (미저장/미적용 배지 + 패널)
+   기존 토큰(--warning/--info/--bg-card/--text-primary/--border) 재사용.
+   ═══════════════════════════════════════════════════════════════ */
+.pending-badge {
+    display: flex; align-items: center; gap: 0.4rem;
+    width: 100%; justify-content: center;
+    margin-bottom: var(--space-sm, 8px);
+    padding: 5px 8px;
+    border: 1px solid var(--border, rgba(148,163,184,.3));
+    border-radius: 6px;
+    background: var(--bg-card, #1E293B);
+    color: var(--text-primary, #F1F5F9);
+    font-size: var(--font-size-xs, 12px);
+    cursor: pointer;
+}
+.pending-badge.hidden { display: none; }
+/* v1.7.1 Task 5: emphasis after a Save that leaves unapplied changes. */
+.pending-badge--flash {
+    animation: pendingFlash 0.6s ease-in-out 0s 3;
+    border-color: var(--warning, #F59E0B);
+}
+@keyframes pendingFlash {
+    0%, 100% { box-shadow: 0 0 0 0 rgba(245, 158, 11, 0); }
+    50%      { box-shadow: 0 0 0 3px rgba(245, 158, 11, .45); }
+}
+@media (prefers-reduced-motion: reduce) {
+    .pending-badge--flash { animation: none; }
+}
+/* Mobile header badge: compact — no full-width stretch, no bottom margin */
+.mobile-header .pending-badge {
+    width: auto;
+    margin-bottom: 0;
+}
+.pending-badge__count { display: inline-flex; align-items: center; gap: 0.3rem; white-space: nowrap; }
+.pending-badge__sep { opacity: 0.5; margin: 0 0.2rem; }
+.pending-badge__dot { width: 8px; height: 8px; border-radius: 50%; display: inline-block; }
+.pending-badge__count--unsaved   .pending-badge__dot { background: var(--warning, #F59E0B); }
+.pending-badge__count--unapplied  .pending-badge__dot { background: var(--info, #3B82F6); }
+
+/* Panel — nav-guard__backdrop/modal 스타일 흡수 + 자체 헤더/섹션 */
+.pending-panel__backdrop {
+    position: fixed; inset: 0;
+    background: rgba(0, 0, 0, 0.5);
+    display: flex; align-items: center; justify-content: center;
+    z-index: 9100;
+}
+.pending-panel__modal {
+    max-width: 640px; width: 92%;
+    max-height: 82vh; overflow-y: auto;
+}
+.pending-panel__header { display: flex; align-items: center; justify-content: space-between; margin-bottom: 0.75rem; }
+.pending-panel__title { margin: 0; font-size: var(--font-size-lg, 18px); }
+.pending-panel__close {
+    background: none; border: none; cursor: pointer;
+    font-size: 1.4rem; line-height: 1; color: var(--text-muted, #94A3B8);
+}
+.pending-section { margin-bottom: 1.25rem; }
+.pending-section__title { font-size: var(--font-size-base, 14px); margin: 0 0 0.5rem; }
+.pending-section--unapplied .pending-section__title { color: var(--info, #3B82F6); }
+.pending-section__actions { display: flex; gap: 0.5rem; justify-content: flex-end; margin-top: 0.5rem; }
+.pending-empty { color: var(--text-muted, #94A3B8); margin: 0; }
+.pending-block {
+    border: 1px solid var(--border, rgba(148,163,184,.25));
+    border-radius: 6px; padding: 0.6rem 0.75rem; margin-bottom: 0.6rem;
+}
+.pending-block__head { display: flex; align-items: center; justify-content: space-between; margin-bottom: 0.4rem; }
+.pending-block__title { margin: 0; font-size: var(--font-size-sm, 13px); }
+.pending-diff { width: 100%; border-collapse: collapse; font-size: var(--font-size-xs, 12px); }
+.pending-diff th, .pending-diff td { text-align: left; padding: 2px 6px; vertical-align: top; }
+.pending-diff th { color: var(--text-muted, #94A3B8); font-weight: 600; }
+.pending-diff__field { font-family: var(--font-mono); }
+.pending-diff__old { color: var(--text-muted, #94A3B8); text-decoration: line-through; }
+.pending-diff__arrow { color: var(--text-muted, #94A3B8); }
+.pending-diff__new { color: var(--warning, #F59E0B); font-weight: 600; }
+.pending-unapplied__desc { color: var(--text-muted, #94A3B8); font-size: var(--font-size-xs, 12px); margin: 0 0 0.4rem; }
+.pending-unapplied__list { margin: 0 0 0.5rem; padding-left: 1.1rem; }
+.pending-unapplied__item { font-family: var(--font-mono); font-size: var(--font-size-xs, 12px); }
diff --git a/src/static/fonts/Inter-Bold.woff2 b/src/static/fonts/Inter-Bold.woff2
new file mode 100644
index 0000000000000000000000000000000000000000..a68fb101cd9224aa7bb6ca80356b5132c40c6f3f
GIT binary patch
literal 24356
zcmZU)1FSGS5G8tT+qP}nwr$(CZQHhO+qS-IWB<)=UUv7LHfb``Owvx9wr8g9@?uN?
zfB^qNp9BEmzXlMD0{}p8@PEnvr~Lm0R-giQV7&v*ssoq-zp{#;iWWd98zKZ$U@t&m
zfj@Kv8~`925D9Ps1_%LYhyr*a2n;wj@)P@l<Fzj6^G;iAfkHV9xr3dukDHWzpAn4T
zm1Q%c+B~u4?&ja0zuFRpv2D05cmQSA54dPsV$qgYk<p2YC{*oQZ-3+4-j`z?=a`3n
zd*W)a_8x1~5c47FJMj)@YJ7s^nH^JD5|UV#T1N?#ni6#`2d-NxkIM-8iYPc`4+@nq
zr3%HZOJq$DIo52;yGswXiw=9W1{8>70!bPH1riEXmu-am8kf~Qh&}{*wW*23gH%^r
z#;GwU;ivcHR>hyazbz;6v3eGLGQ7V8>A(7EzlN6PN$uMEjAz6C9V!MlUXfLea=qU}
z|Ni$|=kvY~x(JUk_4DPCBnu<O$PfyxS>i%Z6xdlGzr6bG{I9+2(HV>w#t@8c6X`Tw
z+gCShNz7L^!m!3TQ`ke|7D&l#pTgJrJ~lAg<PxRJKP1|w5)wfD*0J^Js+v1Zwd;cb
z7HDAvJOJ7T5|s+S97S&^LBQpe`-a)yP8IaI*}BXC2#5%k$cU6Ei4=l}qNAD|x|l7U
z%xt=)OzrEVI^EK0H}$`({rKNgZ)+tv9*3%ef-@iYSq?NTK(c-$(AMp*%<uwAA(iL_
zmcrxw`5%AV`k8LsRFgA#Pn4k|N1%8Vi<ki~g#~j(a}rWYO|?S@U%WPaHmym8Fk*?L
zaJSyNcnHwn{J-dZzUIB}Bp4|Qd4dKZIfAjSY%c1GxNBt<(8_=YzCn(^&yRob43*j*
zTH@)c?5i8gIE_(r%he3!jCNBqj5*4D@@GqrGzaj9(kGccTy)LS^r#!4DuJp4%7C~A
zx3<$#8;%p3n;wiOrq6(nJo8##;U5hV+DNr-pJw+95+;xIwsQMRel*U_zvys^?UA4m
z1SS57B$%ITm_VhLIZDZEH5}SR#qdcql4@lI0l&b2NZB$N-s>&)CpRIE!14iOQ(0wZ
z`|`5iO%D@te~M9us4njS4-=3lPSdkbV#O(CAC|Jk&qd5jsfT&RlH#=t<>)7n0;mrN
zC>R(58U;15FZu}l1r-ig$<CXVfZ%nczh9^HU*=gJk?>6-os=X>r4A8-gp@cEJwunQ
zN;mpnnQZm`O#GCK^ufZu00mY)Nwa3>O`Fnz3K`1n_!j{JXrUlYxu0s6pIFMKc122W
z%5u~)o)^8Az}Gjxhh~}%Oba#u9-158kuIiInRd>Mqq=#c+o|Mx**OV}d`V8D&CJ~+
zb8u-IG#w$_JAfzH8O#LxfF0dPgU6KsIl%i}5^Lhq%>?_Lc{Kk{VkY^%bjXxWr<5tZ
zeM{h*Bm`;j`u6Kr{SjobBhz2QmuSSy)NTlg6niSeNosAQ?t9#vmU~p*1>V_mgr3Hq
zE+^N|&H+D{WU|gg3<8EB4-WpUU*_a~KXOaSp%Y3qQK+B}pF+ElNG0E_+b+lZs!;5x
z=lMDg#ENjCECV3QHI3C36yS;!Fm5eK$CvVywSXxmn3_O0h~F2wN%hY`pO^4NK1(GM
z2n5r<w6Oht{#3pq03b~?f?x!LA|!~9kP#6fg)xS5_DeZ76^6k-zIWtL9AS1@(4FH#
zB`zoYmkn*W&=T7LQ=x9ZW_G5f4QDTg>`>F`-z2U6LW2x}?#W`9WFSjapi5?*C!p;K
zgv|*3XM_zQfKdV^0*na23Nj?X6s|f7UG9ZAi$k{}kgG=Y3#n8?xsD_%jN`(&{`piu
zX9?}PFspRGD&%?%VL#EXghbw#$%YFv9GDo8hv<~k8SRqEgco=T34$9icPK&~dhCGF
zH}nuh!GZrs%L%;&{if0ig6JrS0k9<x1VAfJ@nGUUFZ^3XH0Wh@{p)`Pc-!s%w>2ej
zWRS!j?hJq;;E!%#aZ?D%W{&~C34}aB01bpiAaDW}BY2|A5D>y%5Qap95zvrQ2sGrt
zgo|)hp@?vWuSGymsucn-0qly*S%CFyA&U_qMpa)lRUK2#&-zihG|&-M#fwVhbF7Sa
z7v`kb+-0*WK>ox;wYx;KdZfc`8ZAa-!^s%W%AD6C72EHzA#A4CHP7Q>zH^w}XY(78
z?K}4px>};T@1U}_w*&<#@UlixzKoZ=0cw?0Z7oV;Y3Qtrl|5Fvu6eS-vEt<t)N1&Y
zwLLXUH?=HBCP>=Q1(`o>&rs<j`R-xAvQaFOCQ-)5|Fyl8!dymYn;Tb3L^>(2CbC`}
zmE50mB7(drysT?lxnlbL4dT-phDXF39ih9DbmCVgn&1BkLl(;ACzCP+1x(Hl*5Lol
z4jTvUbZy8gHdv7=p>tb>_PtoC7>p&JLY=f`VV(yw>2f0?I`h0saPo=fW5i>l;$d+X
zbFow+)m({jUiiL6j9<01!CR7)$U~Ai;+U2}0Th@0_Js><=GC*bA6?`_QX#;m6=Tq2
z)@@@@SbDX5=*n$uZ)iBNjK<^Use>8C;)!+hOl%{5f=i?%8xbPH&#8CMChk6t#ceI(
zemi|5i`D^XcLVVrVG0FEnTCdYXA=<$78mZEy3L3bi$+Jubt)nXa~r>diar}bO#^l2
zL04zP1Sdv8v;t}0I2VQlgd7xXW}dd%HeV4bi(_njr6CWBHUCi^Qp_=axAb-DMu2yL
zuARa4yuvrztWXN-|7~>hC3`P$fxc}CLJsE`G{sA$+OxjvPnCloJ9WlT+Ld7=xP>B9
z0`J&bzqE3+HN&n)0w$W4?Cn<@nWJJy)n+}vm;`C|ZZOn>Kr10xlT3+9d&PM0HTVdT
z7FFNGeL~Hj?d2vPtN%XRz5-9dP7mf?A_dfSwBO6(J>onPysAv^^ENEs&%`Y-`|_k(
zP<2mL6y>9yvS=B8Tm_#1*l=e=6*h!ySM;6Gave%JO=45UwLqVf2JB{Wg2GHi{fOyg
z*C+By=?IzT4*$}NHPtF4!dk~g3%y<eo60(XNU6U-#N%cs8K%w@HI*p}pW42HdK{>m
zcXd?ge8%9!mZCn`33L7UH9*+STT70%@O=@F>r<cgJw5%Y^y{RS?muGI<FioK%jw@^
z8+Opjeh%I%Zh9aS^1}I6wafV&rTy`9KFW93Jct77J-=_@kou;?<wB`VapadFQHZDj
z7n~fn*#3j3_V>ph(8v;%Gg9H%51-lwdl!VK3;>=syzzyey7iMGY!Shg)WccPlKq1o
z3<CqaAq|%cq`Wla$<!bk_!5;Wp<bm^CPnMCrI(w1cRA<aZGN&+?M43!0%%Q<dtjm+
z&AP`tK@@;`dXA1axIIijuCo4RfuZ?6=)Z}SF|d)03aGZRW%yt~-Tk3I%Ce^ARK8_4
z+pGu~%ls83LH#S^V~t9TdME|eomxed(qj-`47I?%ZX>*ZD)K|rX2I^N0+tENDPd00
z^U+#SvXd3HJ*e2JY!AQ%xceQQ9*V0b%~9t}!=FTbtcj0PR&k1~LGS7K3R$94G3-zO
z<tWr}uQfLZxyr5tSRY5VilzG<MXeo+tBlZfT|vC8l1!cT976eVl|W}k(~>T|=`uHR
zw#(@Me1b9MrLGIhlGGc{74RB&B7v0zY@1p?2IG%O*%y#uEGo9vH~>kZ3-DtMrg-j{
zCPfGIN@RYW<nZwL_QN0R^SLGz(`bI%)oM<mbH`>t7C)Tr)aQ!J;NMeNtG|u;5IP_H
zy#7FC6rQMRa8zYn$d}qLeTf?Tb$9Pl=H-fh$0Zq8Z<&@1-**S^4Aj0Hl0uwRRF1i3
zS?5#l(Zz}z+1oujeu2FxK_-frds*^NQ&G+c48;Q$Yp)HNFHhBEAX&(zpe*phGBPo)
zWZ5?+6SUi;X<Vu?Hl1awrz{g)P*OYc%bHtK`mtQLo;M~Ft&(6mWU853Rt}Dp(oQ#b
z%DH|!k!LHmtxcWp#acU9v@e!x{S{9C@p|R_UA8;X|0xf3Bj_!3sDpITg}czy&pZTB
zjYA<0AS^M!%VZ!9N<$K`*8*~Dl2t`B#B`D>g_WoYaY{{NI<yHnvG>F&K}pW&jL6J-
z)FyYrbCSUR&^FbKPskR15w7rC6otSmuw4>W1hW>Qid3j_KV(tNHa>^qHW|B;B4mqR
zZc&NGYzBd%BDBVEbQ^^V5s?%!m8J%za0x7t?s!5(L{rE#p2F#*4*Y~%7m$c5MGIWC
zPNE6bd<k?1&9$XNindk?3wJFkPNJ_^>C$72_Mb{cm`vY<az7UnZir0S)qc+>Y>3yP
zDaNLP-WCf3<<O<lMA6XFrf%Ow1Y8trY!sGNC44kaO;31e=;60c4zW|yJ6$@nRg;lD
zoBH#QQnI&UOW&@zE!2uaG`|j#)MhX$ju;kfE(=y=+_z;6MG``RP%6~wuo5`+qo8Lz
z6n0HX_$UeR@aO;;aJd|Qq*{trDxN8il*Wn$+eaSj$`@L{HH1+Jz$>=buHMx`nPtg!
zDxc<I&0HdlTm<b7*ANsTjv@l8B%yr~^(gLE&5q%@?!u7$L7V*8+P>hwIQYdw&D}=J
zf1fAr#*c+?=D<$|z}x9ZB1{T<oP<R*GKKUo?Os4Ha=10MPhA^}!n;s4Tg<Sxw?gj}
zDGmYPTnq?!91K}Lg&y?7LjYS)1g{VWCsnGHsiyPyZlS-fH8s-6t4H<O1we)jcR5%M
z<Bl$y-?v>tkcc9y+YKY_^5WGsgCs=6^=Pdzs?5|)ofXU!E((c8tyw!oTm}Y#!{t~)
z6q5RQ@|PnPa$=eqtSvnbT%8S}$%oKd5@-bUC}M^ya4ZGt_1H^mhe?A%5I7ipW^J}Y
zjf<W5p%PYx?w|lNNsygZK{vM{YKjN4ad`2XQRbfP!hqq5LW~3yazyWt#Y4Ifkwshq
zl5C+P2i;?Bt|?JrD_lTMDWUX>rZr0yJYcBZu5A75Akf<Ha|#40P~y<Hph|$j_+ieH
zN_CK)aFx<lr%Qj&`Ov%B@5}8&bDzy30Z(|g-VSYGYn4#AURpM`4iDay(Rb|T*S?AH
z^8d8m4Kj4qb7s~)R6S+&=<CxtQdQ(2Sofp~rAyzW{~L7^V71qBtDU*0d_N@7VY4Hm
zPCi7R(54qN`JC+P{z|aa7D}#PxffL}l*8~CG?3l5Y1D5dafc8|53!4vTC>?!y@5Zi
zn^x2snDfKy!HVzlU<B?%^<6Zu$q$bEdysbiv!!VEMQ9jB61S2qXz7xG_H+Dn!2U-V
z)Z%6pHuZCjQ6!N)X88A>*7qNR72;Q^F5{sXOw<K@)7#-4k8o!cPy3wrK<x#!5IT`g
zxQ$#iOjWUg?yh*Pc_ElcuocqWyqGTP(p@F`z7puiy>>=}A;r<1;nDhm;>N6H#=F|G
zMgTgNc=^Pfk(RZeRA0#%5OrASv+h1%PP^O<<q-#ooDnW|YQ#0Io1hg9>ndM>H>pA_
z-*m8MH9LY;67=h@!|}_65dhknu5p3BA8$qjEQAB93{5OpKK6SxSDIR^yqix7-{Yzu
zX5SX5H>%ggCQnog7BQ3CDUtZ9IHs7<Ni<gYbFvkl&QmEDF#(gNyWLXd(b2E5Gx~<r
zkO0~3-Qs}scWvd-g@uc*#Y=11l?EuqYVcPjFRZ{=8}BR&E$>O@iYmJ^wI|z(h7yum
zOvqU;uxA+^@?40X(ut+OuL@>ehJsk?Hm)ZHb7Josdda^$S!PHqg|PZ(Ksk?K)2!qr
zY$YyHlsDc!2${`5|EW}s@~@oRJ>xghZC2=IXiV#PwXG8~q6K4=LAHH5Ri*2%SrPYC
zS3cvyGQV8S>8-e}AQvHBSQO$?f|Ro|{Jv}*H{09S2+bXljd{;*^PpBBKB5k91LDVi
zZ;&~I+7zY-=uoBU9{?t?63jo4iq4cpk{JTB-sO0&?fFM{R4aNUU~<<u$@2s5{^#UD
z!D-z1VkzbfwKUYkPPgx(8BR`8nV+O3B+V-yPB!zZ-hoMnljZ%7suHN2uQGy}F6#Zz
zjT%5$GZHDd;Ry9<=*|-xBR}6DH(Q!XeRYihV=L{-!BG)s()b~tD|HJI|C_~dVcW<x
zS@$B(JpN=YX}?x$reiM>1g|$Hcu>g0Z&>`*bd5YF{zu6Y66zq5I;1Ch<RjNR_5(hM
z4o75r@G(qnXm{48ajy_8zWd@%rb%zHd_WH}T;<W><~k7E5rk}imh*>qSlRuxwNFtB
z&2QAjKdH=t`z>qAgI%WsU+n#gQ*deLS2O}|lw<ySj5Mxv2l+`<+HoIM2ft9Wr5-<j
znNvd_>=~W!4;kJhoEyV-6_iu=aepKy5`V>X8Ha(v2WuF&V}6SvN5)Sww&X?7Z{1yg
z&?oKqgtIj`|F=bMl0cbK((vfse6*tQ^L?~VbpJHNT1a5lBgXezgHNc#p`~4nK?8|-
z<?>2}vH0Y8SP(GO49x@mC%;faoHHUqrWx|k3y1|wmIH}sG@#3t1Z>F5yky!bEsD{?
z4)pjV&7Nrc2l_+Ou7PseKN|D;?6%3ur`as69X^kbkw2<@22BPg36n`djSUDW7D6o-
z1dnHePnZTwEht8#nAs4@kr+(cvo(PmPa=<pFq=kD!)jXueeQ{eVe(mh4$3bPEt04K
zqsF5Kh)9MKsqw@@2+_uVf>ODGm5RdJHOUMw*o5V|1jjW_tGR9gv1Br<U$?{<wAz%G
zPPooO;JdhRhIpPZ?<2?<5&RwI`9)ZafS!A(%>wp{JumB0LVN{SY(eHLYE|PtMYcQg
zEX-z<pI2-qbGWm3ew*3sa`Z3;4YW9ihKLXe160h!K@O^-p{9}ql$xk8iv}LqEXxvE
z?pO~GONpm$(N@S|`XhoEjxtTjip0kM%7gS;w5`D6_TDz%y|MqUCZ__!5kXvETwPyW
znNA1|4J{4hfBpZH#lUd3F(GGv%RcId<0U!S7WXhv%r8M(IYkHcenXOVfzg7?K(3rB
z<^`2iS|Wu?B7TbhiQx60Zg4^*(*Lkol;YZBBiXV@^9m~5E<+hWp=uUsaF#4VQb4T~
zLcu5<2ugYI5uNIdA<nQ95mZ@Z2&3fy<K%+Td7WqrtT7l%N4utlA7EHVn^o7sV2l`q
zGnrJtm`*4l!jr=Z;e>ER2<T{qKp;{8A@kvQI2}NeX~ASzByLtL4<V%m1J{6T7y^Ok
z35OQ~gXbl~O~W1l%pv1}AmKdo+;c)9Ri_1J^g+VW#j0uv%nt^ZwNfOS#(4$6!stK`
zkSYB5FwOlVJ!Se0w6X7qi1frU)&e|AUVdVxt3k)>M;!`+?NqutkN5!Zz9XVmB#se5
z^YI&oVVKZ3ehwTn72EVY)zB2~`?-tEq9D=%$7z@$M2*po$V_Y1&g?$wO1*6~_J-bS
ztQA3VsDr*!nsCmmLuIY4)w$mCS@z1FbRtr>*M{Oiq0|)7r1pM1nhmGt{{;$xKs76t
zP%JPwI3ge@91$KKkP1kKh!2n#5TTKcR<jL**~SMSfS=>2Uj+5Hc4OQM04k5oX0V)U
z!8Ffto%2N3ahZ(wWBM1CefP;NuOo9qHFBESAPbEX7!ngC1qF*6%tDsQGiHzDmuI!F
z7ma|a*lpZz!3g5H1AQQ^f7;G9JBfMD+I3(*OE+im)_N{^E&$lW<T-~MAbVd14^TS*
z#*4b4*MZ*sgr$4mZie1!kxRnCy81KL_5yyFV@(SF`m@g$a`SUEfJV7N8T$p5%7j8?
zMX|H7_to|W$Nv1%u$g*|Gr8Tgt-5H@^~5$k7ZrQzbAv#t7esQ&WHOmpz5ir$0H&hH
zwcrjHTepO7yPjoPed?_6#uCpf$K5?>+sn!8-TYh^xpsMx%EFLLjOFAfRjeGMo1pc}
z;Ll7Ddw2!Eei~Cl&X)RqH`3b_9Dm}rXD&|?54~9F)xoMTWjsAwdG-c1?1i&hqK!mh
zI0lx<3%}H3Q#dBi1<Pv15$|(+1hgLaVUb(SguVNjB74_m-VA8pf&G{|zhSnK=_V@@
zNri@K=&7h1`xTB>?2T=N$sR>y7|Y;i!|>q#cz>^oNOf58PA6DYGQO(xF?JNtFzA)s
zW4K%-8_o+Jm&4(FXjSXFwrx->%jSGM7hFzz$R3jaZ4M<+Krkp20@b`s*L~Zl?s0=n
zE@aZuQO*jR%x5&x0hwIp!+sl{->h-3IeMo|^It4LU~vRN<R+m5Ar6&Zu!v+*DT2sV
zA?vxP#g~{!MC=B{kq`&%e=GWqNGT<rq<xG$HpGd?WHVS!yDj;@X}k}jNBR^IiG(@y
zdO#wRNTdm~PESiH5NN21#BR`O!w5ovk4Pm_NHn1oVd6h6Mk?g_zK*ILk;!B~?6%@>
z%<GZ}e@a=Xx69$GA;JHTC5CAhj}&wWltyLC^b<{rK}9u0CjK@W%)Gis)3bzjjl#z+
z7^)BOb9S%~OnMSWq5-(CDEqhynr~3iC}?6!jpr1{EhD{{#ZVPYZP<0QclI#A<x9DX
zl|+PRwL0)hV`-1Bw=-~FE`?LL(;0N6uyijogg!*F#MY>`SqJ2@NqjeI`mo+r_$>kS
zA(?U2t}=dJdplKGAimnreK&egvA*YFJ;D9=vG0w)RGtIL>}T5C8*jpszJ8FUmrc3w
zHP`BikV$Y8JKwXbk|ycpv{O;4VNi6^Y_8azsWi32?Q&rDp-T}*6l8X|kaZI!ocMgM
zagtv2sN(_A*CsT<DCD>PFAxcX{qv{qEmjh{>w%q~ZehR-tzdr%nuH&;Ff3ZucT0Rl
zlS4Rfg()VqPLe3K0@NRIq}92Op&oZiMWogCM|xE)Id=ZbDNh-{C{F_H`*=4rDlAYE
z4H`Qf$+T+4A#g~`I4@r^87+?#=59>T{YlihKyz8eB8l~PZmYRVrqr%(uE(U+(E~;{
z0iMu+yy0YYSWNu&4<f0r1b6rD$NNhSAIP}K2j)I7K*4Y*b5vj{BGM#*hLh%T1EoTt
zG|rll6^rHaV6n&+QWqyGg{DX*o)0)Ijj1Vy5!q};v%zFE3s!qNv#EJ#ilK!;1pI<5
z#-esymJR=i<CZ|Okr#%tRo-rD)XKu~14>J+K0I?onhw(&q0m1&vxu;(erV#kk+8VH
zxS+_;P<kviL|Dcs<4p^7n<ZMwbcz+ZQsqUgGVRH1GOd`PAfR^}!@?Ayqb1TUGv+E^
zQ7x_LjW<~Z4SAZl)cyCV|BVmhbumIQ-{*C7odLyoOn}`m>@g9s)i;JQN;S{r<MEi}
zflSooz|4EUv%0${n&Y=HUM6oR54GI{n%xg|T4$ok%rD3|r{0*QChwocn~SyoZPwg%
zhZ<}9V(q5NxA%&~VkuRT#Sq*GyzUh$B}yQ8Y;=KXp`j6N6-jcCvT&#)y(>pC2;8=t
z4L)=yRQ4%7y#pT(U$VO{HnI}1_82y@pf-J~3tUNyCks)42noDyyXVHo>@hQbZ^K91
zQ}x-mS#_c9mWjPF+m;VbrJtID-e_3coD4i@P|TpgVFcU)-G2u^j%nwQPcc)0C;x$l
zoZb}zEy<m?8K&i=Aj^8Uy<wEb5aR5`9dc|UTD?V1_jY?o0o&Mufh@|PI(Uj8qKk>c
zTriQu$;?{;1XQCrJjx(;7hC(RnF0tb?5vUkh<nJf0OF3p9e}7q;UR=*1Hf88b_i%}
z1h?@-Z90-mcnyW9Meju<%SZ<jZQm0sT=A~Eu8C(z*e@QG8GC_inyCc?pm%7DSa(&L
zRmHzT#46g-Fi{h17=IQ_rcY>Jtc!w$8}tnMTxd#Px<b3KzDM)#HIFfnm(i1k9Q{Jf
zD36S*d`yZ%#L8=B=SW6FTtcZ?z%meaovJKdSV$~`tRR_l_iOMJttSEVBVHL|MgXy5
z(#&vr;Up$2vp`ZEaTVBJw2%1%=_}TMX<pA7GLp^BCC&&y5({>SC4%WuuMh~qCZpU3
z9<&;_1d8@<p@xhgU@G<GW)D&@giXrygu>3}?!ApO37Xt9n4zmGw|xK#0^q<<d?Q``
zvf%cy@p4b(p-bAMg~aG(JdT+j4zldKRj;=Qv7S|-TU#$H-Z;Q<T7>PCY4$aS6SoFw
zEpo32+zi}~g2{~@;&Fds7IiClIAttTrp&p)ZP?yx#C7m54!a_}IItDqVCIyzfHk4k
zY5=hVmGHie>(EK@19(>9$g;u|@aExEg)}(oTxo9pHIW7TEY?1Ph(9g&rxs0XGO;I#
zH*-MbV3}Kpi6gH$)|L=H&SIt4Cfc@iF^>xvvNs}27FE{SLls8Z`zIl|M5*yCmrQer
zZpm1EGkyCFyRJnQn}!2u*&I!!(ZIt3cg`A>+6e9g<UQNb2(W$kRoFY&KO-7gtCdP5
z(nS=8?>qWuHl)&G9)|bDZ-=Fl$_QXWx*^{NP)d-Ffe9iO{9^A%sFJ>y<D?;7(@7z_
zLw1Jg_dJOgM``@C79^8(-gWJa2%tg_zqIJ0hO-%TvQ-==%_HGYgZaV!8caWVrAE9_
zoR1tDfQ4vZv9$`KN0**<I*K4y3(au<-s3tK$EnOx5QriXC-P@b#!%3a;b7cm0t1}k
zz`HfW=j5mpYkA;YkKYI<3q;aTb*6IX#CXA}Kz7WnBVtR9_UQ$7b$>FqQ{;2=i|_*X
zp&fxfr`wOv_F}O8Wz}7m>ED#-U$gXftKBx!#lW}zolk%KgUJa$zw7kNk{{-Dlak*<
z%nd5$ZzATo5$35dc4>)!Oyo7G?Bwkff6d-)AN_jm>%n&4t=kgiwkEfGTC<rvv;7>i
zeX8y6%x-Q+kTP7!l;5K(R;i@-`g(@r$t*^2p1AO2XDh82&g{Plo%dWzuK(@RUtZl$
zr0&d-?)zTOeSRP3`6isZXOX|mKnddMo_w*Nr`qmW-EKQ?Gox;EU}p1^t=@V*rE_hx
z?&_*;yD3c!d>$7W=Y3_=$@=wRksrp%UYf*SM2Yb;A;x({0B02|=A9zuHZiJO#<gjk
z-Q8;aX~piYtM003=4za+wUm6y+UsDm|2bnT#{>zRC&9DtGKxu=k{9@5S*4WsTS7|D
zp&)`IKPfQA`mqq>tXXh?$xcN(tJBvMt@h$?<tU#+EPXVUNRgK(#Dzyj%%b$oN@-+d
zqzWti!z)u>-W-Y4?C3d9QO|_Rwy!fYE32xaA|et>A^|Aiz`wP~=Zmgnc>bQ5kx^Au
z6%h#`kpvL9INg}}f1&c9`u~Qg$o~t8BofL0uOj`Qc@qN%sZ5dT!NyXjh?E87#3N!M
zMk3ivnkE^{mLu4{BX-?2in+v6r_%`(TX=##o|`MN4RqYvopSP&vuTuL2vL3D8y{^6
z0v4M8+5azD0}P+Zsmvn;PiLkW-;TrZ0E3Nqt~xrgL@AoNDs?)YOb!l|5srz)n5Rmk
z!lJLql&*86s;13~X4c$5ElD3<wAsqGy+5x`fkK!EIn_l+MWf86(y-Vt;J3n}b6PJ9
z>DruiebHaKE@+BURWeHd+1yr6D`BcewYL6$ZA&6%SV%lB9Oust4h)Pk0*kSXH$AVL
zzHF@=#af*{7Dp$F2*(7&Oy&|<RBT{G268=@`XMP-@|upCa0^tLpCsBtBl;sD+TzmQ
zl=K^-V$Ni-o<;GSw(0-Bb%<b0<2~=o#;+~iwGzQrC{ZUIL&bxS-T4>6pDP_I>12(Y
zbW8n+(U1JQ`Q8jD;raQQng3k%pKm0RKmcUsxQm<-g{=t#11&}Gu!U+p*XEnNp;bfZ
zoZYO45?TM4Ew;#QDqy}|<^l@5%6Zn(CSl2(v1V}G=tSY+v}Q%8?<SGr7v&tgw~kAa
zNW*6I$SsH2jWW{Aua8`Bm=sZNHSnxoxti9=o2c%mZ(J?fJxPEXoL{*T8i+gsV4KJL
zN{yW=Dl?29wubw@YIj(j)yZZ(*_}o=ETrsAkM)JVe}30)iqLAebX;d)*L58yO~*!y
zkWd40SC2}fbaA>kVHy7>r_5rqA%S0&DujD^4m}h)Di|yk%Gq3{N+OX)qN%yV7M6o-
zp&La3CV<EWua(qjNg}#ZHkE=}B&M382*ST7w8S@4NWG;~Dx~Mu2*j->H_=QNi)wEB
zO_z&va21)hyB?P$y9Nm=BpFqx8nvMzr7V(rjVhsN7Fxw|eztRVRk;hrYPraB-Nrc0
zSu5PBU<M%xVqs%wlFwhUlIm47MXA+ZT$m4tiS!H%0y0y3bKEo@V-+Q1EKRd7ufC}#
zAYsGK3pOC@IRLAY3lg6os%M6NQ?FMuXFJcAnV+BedE+l8J(uv)!wJarh3j9h7iY8R
zHIYAGzsk=@X_7!h)c6<WXR$)0`QvluBrI8~5nrlrdG5XFH>Wf3_m&4$MMCtK&<)m}
z@2|CT6$WsM<AFiTVlwi}vhm%rEX6<Ux-;G<MkMP&00H-(12kx0`??yJ`<d^9f%m^w
zgpXo-UhmGr89WBh4<9n(JsK1~Q{ZKs_%ApoaF>DGopU=d_aa!nFIivTESt%B`bODv
zU<W!WJYpSKQ)%cPiUQFI&YgETvU!o=%bJzJV~$zWeQvljp{EAG$Z(=X<FFWUT)GWY
z!goC=bXXH_9$*~$S-E`<3jS>XPd<VWzl9y(x!<{+zzNkiBk!)JyA&~RcNu7Z+|C?}
z17|7B(++A%Thu%?cwu%!$vm5eqEB-wjwv0Hg^Vu7s;T5t1b}{&dQOC1?p6zeA{_u@
zPXqv4Gtj~e0}lzj0HLNN2%}vaQX<u7@p^SHvMyYTh|v1L!;UJNm3o$#%$u!1ED1SE
z6&`@<ePJ>94%mzXa~ZqDqv|k7L?xX>ND?a~+SCJzf8<Fr)@y^f-Iy$P*#}5g<^&OV
zv_m6-reA}xMN5J{Xs!T4jEJ@c(00cP;<x+>1F*CrWPuPqFo$Iyj!+1dh=d@=z%-i*
zKT!?VVFZyi0b6O(VzY2uqKEYHJv)_=58~P#5gU0`dj)gQ#VJ=3uf>fM3NoS91mUI`
zVX7H;TIjR>O=-L!U|2S3pinFg6_4kjYEy4GADL3?`+eUclcp(D!GuPoa+N66dX?uc
zo<(7A?K<ugBhB|PSZq`<9-E0hG=oBz>#R5(3b2Xz^tn~gAvwHnVt5H!>@e=CmEZj>
z04cZ<F*XsGbYkjU(-bWUWq@uLnbl5TM}~&&#(<<%>-7ejuLe9g-mXXL$F~46AjpHg
z0m1_vjEsxPR{;Li8~^2kHoRo3;yo)3^jv4c=fnZ#MtVB@rbHXY{~#tuC=4R!cY{oT
zE$}D*Oe65ckijwGfLY511Q0B+UYijZm>?q?0H_feMkuOtI47^32mYI#-axQyQQ(?)
zHQUvvUq1j3LGD1Qdtn~i-I@N0te#OlwsP{+VXmWHPu$i3vG`VXVOgK2$8g{>ZnI)B
z9WtI}z=3^-D#!Z`t{zeKeJInxR=9z#_J6v4|NEQu_biF~`}=lqV(lbBhrS>F>Sm?(
zZ|`Z)f5)}b$KZ3}b$M|Mq74hc4(Nu-2JfvP3&`82)T_>eGrKjerhNEZrmY6aJ$A|(
zT`$T2{F|%MnurZ$6`5&3YhW=g&h&xQYs>Im4xbjyKKW>m32U%2*;kt(%PYvB4y*_0
zZ{*il_6e}FB`lN<50)CSP`Su6n)FiX+})lM?W`Ko2bt@t%pLZ<!S}~WW$~0kQ!E==
zP!fB_wk9>F)8TZgARz|?0)<5T*ACdpWJ;Mpt6#_zj_atB`X4*wu$H5Zcd>Gs*G=lW
zpYY!+ZL6eT=KlE}$ff=|mJ*q~9Mq%ilpb%3W&;qz8sJPWzz!1bo0Q`gXv0^#!57GY
zn}My`EaAjKKH(xGC!@wgIV|F7phjzr*a(x@u<t@#lLEYeNVFSaY7C%Kt~WJ8{PZRm
znM;z7WzS@Zon+JCjXQ<~pd13`OVCUf6w;%0#SD}}<^EDEVB1hGy5<OyVm%EJsi!O_
z`Qt!90S*LV8ssHFYfB|MCSIOXUB^Z%iENFB_oYWxEeEwI<VpcBBoYO2Q{x2^HQS2I
zN8-r^1po>Z2ol4lw2Q9bia0|Gm@zg}_qmkHM?*5b%hR0U{OhcK+{DGU4PMN>5<nL?
zpfH`xQPZ0z%xaCU^%!C>G{O*6mxDeQF@~pD>kOOJi&ogqW2g>bscn!14-m@&YpfT~
zE$>ld$M2c`@`eIMh!VWfM3AKP@*MZ<tgZG?&5pflaq-Y>%7kktD~3#}g-Q1;A{5RV
z`%suEa^}$wXFYTk&ni``el#)+7UsVY&*n-?@RYQ#K@()ZWC%y6x#HTXkO2xBslukQ
zKBUho6afi>1rrVfU=ki^e~}`sBL9p`9I>W;XF+I_6()3gQgBUrckCQDq8h`x_sN+F
z01I#-wEfaq=RpiDQ6gFs1u;?AXaA+i_wr28;UlLXQymvJ&I${hA3c3i;u8Hb+DZ5M
zKJ`L=s05c2XjkEW8VD)cgIZ+g4##$Muuc$h<^-5s)2^Q+VxnPG1AE5d^E3Bl{i!D0
z`%PJaaeYPb&W4yQQ!cR7N?u7p$LP}$2exPivq<s=ZL_NB4<%WDfhkH=>0-MgT^(5x
zHbyxMKy{bGAs(mjH=KyM=|-}lYb-?LwMuW0gv#>2D2e>0HB!qMDqkhfr%uNB*J-D;
zgHveUNwl!WgIEi+Y{zNSRWHl4E&R}If@P*)ceXN)O6Skf$W0>SI@;K1*9ow290Dmq
zD{H%NEFpa9gkYS7UzdkI!{av)V$I*US{N_ju9^(#5uK^fScOT@5W7RIv=OopBW7nB
z#jrKheJh;xJKQLKCwuF9QAI`N$Rk{fPKsf0FyEVF)~^EA&bczsRx}OwvKwV9YeWps
zm}oJ=#tf>(5W7ocM-Nxr)u)f^GKhpYU@z{6TENvI7Oa_NEClHAeBIy3+4A>9rwbl#
zbi>#JK=RBThS(!mOLENxZ*W7Jip+^;7a&m07$(ksFH5Pi1DtEZRnKRz;YN$1Oh=UF
ziAzc?Se%a<m$Zy{6*992wpkOWc1gs*&{?*7%K>3V7aYg^IIG$$JQ~Per{Ai1U3Uhu
zydv2YKD`y$zN;6q-8jL2hDLE}uo*HEWF)X&)~G>5vkVGbo5lOyk(7P)^nE$)8LAAO
zA9$JEI`xrU&+ix(I<yKfpj+8K6}S<OUeq~xZNttnzlQVo?h?=@pmmYySuHfnK)ZB1
z{TRtPX(<3~!7Q$JJ);zw+Lt=@-D;I&>}q_M3TfEvttK*BiDXtf&c-@4>Tr%EvQzaF
zDwBIYMDlyr&?^+S=|`kyjR58e!Fc7ntymN-V~On?Oy!4D%@B*$hUxsoeaYvzqGg=N
zi5%Fv?PhAksPSYtTO~5L!g$1Ov~HM+`lxr-WgfPXT1FZf^lqHXfg>6K<&R88G_-ox
zO*129HahidR(-twPD2XA;qwt?`-D8Y<YIm62(#sc;C$%k=BR~Vau6R1={nsoDu!=G
zKdHQoAwVv^*@qPXyy?m-cezWVpM2$3maxUqku5v-QuWQLbgz^+W{%6yZ<W4bBwLkv
zxsj&!tQadB%jdR7*=G<Oi+OGJ`Zg-j4N*pbM!4LtHs==q3<i<`zy^d@Lsx|2j;cTY
zA@|--I!neH>a}Q;rqsV_>QHjm^RrR6bjrJDh(8vEJhb&FDL=&<D#J{6Wr)3u;h@#y
z2s#SD+Q%Oia7OlX){e3L85Glz!y`a?mauUxuVSS7$1~OxI0WV4=ZtpCcwIp^sMD$M
z_445&oBxt|aKfapR`sWgh$sj-0dXoFE=SI<KWi_p?#GohB?Qkss>EMpKwXBQe9K#T
zH#ziWIgWpa)fX!KEt%HhUsA-}l0oaID93UE#;_xE&sGIAa`g!MZiFtq7)C;Y)4HWb
zs?8(@(;(UG$ixIwQ=6*>S0P|rRk5_yJelI&!gp*p2lKskp}OoX(%s;A(>=?#JA94A
zV`&5+Ks#g<K113C1@m-mh!r}1uCr;SF1IxRl)1R1s^5`PRJ0gF{+?FiBMM6YkdCOE
zuLN=PM}yWY9O)7w>_WzhWJV=NG3B<cTCZ7^`u4eKEbcl3Znc$v*AK(EAZu6IOP6<f
z%N-0$32Tvg?A=1PD!_WC%f6#L=uBUFO|H?F`vzDy3!)!u=Um2CDOU=qW)=i|6i<Jh
zyd(}{9vY2|F9&XBeZIHaST<)Snx;cUbNbEtW~()i%I-wyl8R1tWhvx!lmzbSms9(c
zph|(^=^QO6vV1q)C>W`lpSGw|_k9tC9aEuWZghRnl6Ko%|3Jd`P{_}fv*TgUNO!dJ
z8sa_bDv^W;T{k>^n5xzgcEBvgodAHbOUNs&#CL)Hm+?-`4(W{IRZB_`Iq_36M}+g8
zkHFbh705k;#<TSXc#e)uz1A$1gAhT)z_Lh25m`yV>$xPgH+;m53RZbxNt`g;K^Umd
z(|XBOf9&#Uy#E?gh@6rUY{-|ZPm1o(bn!^_zR-{u?qT*%z5{ywUKZ|SGWp{MA9y6Z
zCO_6OFz@4Z;=`wIYY_z0c4qLhLk`t##0+$?BuwfnezKF_nI8$2r8VnMy-vY#$SZ!O
zS{Qm45>OSuMv@|$#n-wM3SBo-dKPW2)t>(Na*RywlpWnAk1KLY2t8fvhj_B+n%oW<
zbmF=v)p<7s5?#3_SwAPZW1|=U?z-36{M?pVO#?i!Q6HMOBXm8+Qua|J13TIGmUH@w
z;nnArh_S2jEo;!%!ykXBuP5V?(5`9&_5z?oEiS!mwnx_d)b0%IFIo5>_BF~^C{XL6
zMP@gT`dNQcDQP?3C8%_X+2c*m4{S(ymqceXboC#pvd^}%jbT)hvc)#7{q&P_rK_7A
z%ok{7ywXvC7lG`Pnm)1f5MR#sq=b_adFsf7p*abYOu<?N86$Ul9SfvW_ICD+*)&-?
zxf)seR?hHciB7EiLRJY&@>Dacw?#&<&$6OQ?Jrn@{_(Tz2&t$PZY5JHm+t)Umu~8w
zJI)3i>z5tadqVFrJ(0}vzHc7XeS*ie&{k+D`pt@W52;<f)aqt=_17<RBQ)zFRVKb(
zSiOu-7unaGx?WOk)7s@>ye3$|RXYi(-|$mjKHk-NbY{Xd9Ah)yO~Y6^yyiAvwGVKG
z-A<1-{`*@>;p6;N(8GTd=cJkD|I@|#sLqckKunWvgV%+h;ygi9wu17s5eHYP(HU=2
zUpc|_Vlz*1Nxz*#QcHkHJuOO7`{fx_5Gw}VNcmwkj1Ms7+GVuMMfUzVZE5&jxw-N+
zR~#FrxtY?zOF@}$0W*M((>j5t_BM^LGtqkB3=|@wvUb>^x>e8|tP8zYKx|xEdZJYE
zy>|H%mEA6^J*9>QyP3~3<j3qq80oY0R0@(NErWAv503vEb6NFU(-imj^~PQDZ{8sP
zTb>gwgN6IY#`~q?{^ulw;rF@bqV8Iv*KcRg<RhCkKYH==fM)#h6u#<h3h&pJa&9wo
z#5(n_{!aG&`G%7H@6HH{tWWlmp|iqLNtyC~rmRCB@zLHwf8RD#3Wm#AD{C#|80q#s
z<`K2Uj!uzhG3}<7L~pKeD2UsW5LbH9zSK#RQnAiHXUqN2KTl1!@vd1$javribEX=G
z7mdLO!<oXs;#Vs4=KK5Q+g5{)(K?*Yl346McpyoCKAH=Ux2N&rIKG+9|K~}Op5BY&
ztOI!;wd24%GFYQ~vvXMYv5OaR-ogYP+}c<D-h!PX{HCu}&H0Vbg(53=hl(d^6QyfM
zpkMrsnH#9UPR_Zl_Bg1%KL%Pfv)g{T>if}EM}c#k#)8G1muGPvLn`o8B2THA{(A5n
z@%^o~$0g?JTbP;r;rVu!8h5$8^(q@yxGGz{6}2VRwLypJ+gwKd!@QL6ckkNe-dJn1
zxoIw{{1`Pn+OJ$9`r(2H4cc}uB$@9b{2|oRiq7%_f6MzhOx*AZh}rAIT~ouYzNYx-
ztmDJs3ExtQ8m8E&i81Sl<7IeyA>Zf}HW)Efxoxb8`yH?MbSAdSiXvVeM;2*h+-TBs
zA>}35(7ecQx7OOGmoJ^0;XAwY601tHiHTM|FW)3afOIecq>J&<F;2fsncp@!ZiC3y
zrY9_>q2_ioKia>JkJ%RtKc|k%cJE>OKsA{RvAZxcm(rBxw5YhDn%w;t$rYds3JSkH
znYu`bZfjiUl|&wI)bY)iGBEnC<Rdm5zo{MkyM!<?QIl&5=-d_0xh>zXqv)2<-1}aB
z3#k)eg)4Kv=hgV*HXPs1$vtnM@ol=Dh-t-{ecN1I!a!j7h8|(M8Dr04l!O}WH>Rj)
z7GW3njhl>{(Nl5dkbfE2uEwWUIj#I}unK|<>iAjk)%Ij0>TRzn$aV~{75J*(|Af;p
z%cog_uj##v;E|p`?EOy(9FS2xh~Aqx`N}<cgAS_Hmb~oqeVhZcCooFR60g8X7lmtk
zJfrRpK0{$4p20M?GxOw;NX?zX-ZVfZr-sUclO$yTQlJnN&@x>!Oz-h?jGFHBviK0z
zGDq#DXr1nB&^9NEBHI(47b!V((`7fm;YvM>jrG1Sagb#io5vxJZ%V}_vq=f7{ZT%I
zYOixZ9b(1`#zihEF^o#GPW{Ll>R!?j=-(HMIXSwj?R<QmY*}N-)egaHmKLy9rx!pW
zLvE?fewI&hh<`{atf)c}g%VP7n(Xyiv++<w&X0kn*u+&?D_3R&EeYUykj*m~@-_1m
zGRNgjYppbZq>+Wq_*Q~uUWV$cuhpdgd3o)@S6BEkPA|Y>u>wI?6X>KQ7+#Zdv6w5i
z(o-+smM1n)RKZda!>6_NZql%9j45346ma9JW~D3~klan00aN-F-ry`Efm>Co2MdAt
zNNj=U3Hb7qjscv}{F&9M1dW1;>Q90x=yJQ%-<RK1(-d+t6Y&jUVgQNe(pA7|NjiCe
zV;dprX6+gQ7i>?7NiRX2bfLiW1!#fB;R3$)m5rQEg>KjTdch@4sVViF806mqW;?9{
zVvm%#?9s_W0_o(7laDQ6ATs&=ui4t*3UP7Y$CekuPu}0-DL7a@zgg-X=E;QxC>{6_
zTFZ;i1O?9-0fYYbXR)(uCHDB(=`5!w!>&^C^pD_TT&fn(e8oFon~CF<&1OG;Ntz_J
zBMzn6Y$j<?-dVNs6s~yEGtG%xD$-`5yrk6H6Cy4Xs8Kf|B+is&3<wEi{Q#}e^d#;!
zG+cGl+=`yAR@pMT87UP41Z~BUxYXd(zwe4Xs?$A7G1(#TU04ksycP~~am@dM^2~0Y
z3E2U<sHFY3H(wiYJa>{rR)^|yrnSw{-D0Y{83S7@jl>4}1=)K$JJKi?UrQv!r253=
zO)Qu+DDX&>Lpbmq7lg^AqYuUeNJ|L%)unmUI&1TSTkH2W(L)pVucJfaHoML(jZYKa
z?7<v$>UA;OmI#iWUWhiO-|yFJ(SoM5{{^Jj*S!`6TC;Vl7FFE2;D3$;N(S~GvlBYT
zz9tW6ko-+kg?*~k9)RhXeOhWamDKrsSc6)Xl5IqcU00X_6fM3Tg>ApQYNcbGlNcq5
zR1ORiRY-hqZ%JGIzFyPLQC@#<I(zSms$2bpyK)n2XHv&i$OeWV9&p0v&hz7Wb4Saj
z3d^?zkGHNKC(i}BwfR5o_%+QZ@s+&mt=qA0dDU!lJ8&Cb9^>Uy4ci!M$;Nfw4Vi<0
z;}M3GW5qgmtdiaVe%LOjr_#f3iGGgrG$(g+q5P}RTC6T7A_sE;Y7li4y#Kp{N2UMM
z8Mlc^@}hNhjM?B?E1v(OA%Y_%WMQH}ONWeBCU+GD39&9B+K=99Z?{(*b}GEhS&0dV
zfUp#BqN?FV$AYn=$vP#UOZav+h)+4bzY|>$$2wFdiTRS{n=pfyWNg~CD|<Js^9I^+
zC#$(<sCMV3bnnhYPV>Bha<~<xah^}Um2=5D6_$?YIs$h8g6B{=UQ+}H1A2Q;!vj5>
zB_G_*%{5tV#31x0Vd3PD8O92QavgX0;jO2~BTM_WxtYa;m2L_lVH7t8Ddi7t4d^-W
z;&YxItS!Ye;Z)umy9cKdstRYlD^z<oWyRk!o@Z$@UB4^LY}|4s_;s2<)K0IzRHy8&
z%+nuKGvC9JxS?#lQRCv^)Kz)V^@{z(w^<G)x8^e`3G}fRK?93cI5A%OkGWFV44CNj
z6u3Y+Y6kbQsrYHCr~VV35A>>HBtdnz(oH$L|3GJTmH7MpjZGkq{=+rV>r`pJa-Q5%
zw<|MwW~+qQvqFOO977pti-8fzW<<r{GBlOo(ZDqFZVIOx0hA;fK{a#jqTSUFz45HB
z6c^_K($<T~jNhcB)>iW;?{>*G*o~}1exUUGfk&M1>6lTT(d-gr9ewp!YKD)@P2C4w
z$=y;oLTe-=)}S+xQal99ZmroMy=h$v+K?jOMJmNV+wJx4Rj8}T8|3w6*f^7B!xixR
zobY^eZyP^=o@RSCUi^XC>+Gp_&P%uf2r>(g^Z)lv_>-$yx`yELyOS~aO^-9g`qk4M
zXgnN5A3Z!Y@E^sijynkX!R%%X{-KZF4tYzr%VW&%r_k{3O1<BAd&ZvxMg8zGNq8ik
zsG6jxDdVBYFX54A1-dvt))tSoSNuS}b5UPlqi~iCELaq7(Lf@T#+D|sNR+50rl7rh
zJ0G;y`>)vQY)Sdy=c``T*7Gw<?-{#g8vfhVDpy$5tWZQx4<$7dT6#ue0Fhbxu;}dk
z1BMuee5~jggb5<hAcCx9>%oQ!ie4VW+pRC=zkjC+d)@^ruBn1uJMpV&nu~1UW(tbr
z9{n&pPSm@4En4@-jH%*V)32Z;kQyiMeo<C=!_?30N28kwB5Hhz2C{NwX($Ov5~L3F
z;~A!CW^+2q4vn@qj8QVa32J)6oTe9ce!R-yaFge|8vXtvcb`AAD+|2*eS6z0jR?Cw
zl3gPXyyX<SH5LsCc4?bm$FrHX2`OFpNVRWJ-fcZUn(h9HmW4@Cn>0bILZ(E_>`It~
zni61z9RYB1_h#M}PtI`xZ+bx7r|=sX((`EMkM8YPOY2gjl&&%<8du|ccQ<!l?ahWW
zN=vMUj?Ku-(r%FM=4kFYx<)n{8yVpeDhH7us(e|KGx6jV5*|4_K_<6D)JBS!7&J_>
zfTRd03MN=+!7~bDK_sDZ=8Uq=Gf2eaCqpwVqQZb5ZkfIHoXx0X)nAmA5y!22KUNq`
zlip2&N~idK8+Y8edcV|4SaOBoW`!3b)uD4nC<>CJG;3>|`A}Ua^WWTRlo~oUNWadX
zF-hap4BmgtZfE(=Ld>6=AH)~uMJ46vnW@m>3-f!-91l-V^RQO+neg=`cS4a<J~eR*
z`a|3owcdFdRa2ezrIpGhGD6>WDVK0wx;zlRFXFREu7>XE?WjE-;wQbmm03xCCtds|
zfsK}$?)1~jH(!UQ?tLd8b&CIx@EZH?GB|}*QSe$GG>xjp9OkJ^r#*e!y1Nl}Ub5oX
zkiYy)#Cw6jdH(`j`2i77z4Ar0%xNxH#-e=irku|>rE4t3iW7+-e<2SQB4iR`N5t(S
z2AH%PRivS<1<Vw1d1^OIcu8h=sLKV|B3t%py*Hbez=NZtXQM`*yev^&XC$BYXEVCF
z-w+CHETA6FRsZAaD9t5(X3pHRQ8H=TMkLcVYDh9-0Gvl7dfm9mrIIXP)8SU!DNDuL
z9zxk~iJ4YlI6_jJ7}1C}A|xW8n=L0foagJyUIP6$E2F5cE5Nj8Nx;n(cCYa4l+cX$
zz{oZ8Ce2C*=y6GLgb6a7BP95hX+mbVA%Y*}^E}Vu^lhhyja!)`0yA6u@J!>7uK&?8
z4DHLSXk*A!Q`f3bi#Gg^0D2yU;ks+1ZPiOtW?U=gGcEy<!#k^rj#^n=fnaI4v|bmM
z)xscXhM#3#O8E&+a{$G0<oyF!p8ViFs5u`t8W{sylDf;~POu$ne=Tp^+w?p`G?`6D
zr%RbN)_h)O8uzMArB3p4b$NGxm)gY(28u{i^MhcYH?uG6n<FPB2;j1sn&%Oxy=!??
z(5q0DMZW0C5aARq!a2p7?lK^sc~JXmQ%`$^EcLWgAoZ^%@bIg!@;?`=qzePdvS0oS
zYkKp-r|RqLRMcd7)SaOI-RWk6B_N5p!`6ejTT;|?zFhV6P>1p9T~W1SE9DAZ^YA2O
zB07=5_1$07p8DzZp}!>~C)O&i%t+RrZ<4OQetCW7X<nCWX<!xSN6N0HXT4f_Qw;=o
zb(RcKXo%ym^(3S<nGdVgvA{_gf#iQKvzmwvS;#YmRr?DaoGw_G$^D-g{47s*21v70
z<s<(7gVGn-_0s1Jqnlk>u00QoW<7^GsPli3HmA?^U##RCakYZz2T3W>_ix9<3IC1R
ze?KK@|AT)8#_u;5c0W9Lkox}m?%uro$6{Bvq5}te#Rd5VuX}r!X&yZU<Ds;NJY#(-
zxEp$qD&2K^^gYJ7yjAwucU0H9`V{>AB(*YD^U?VJF945?0)VP$74Tj!9DUjZf;MrQ
zpj8xcTB|@w6ARjEfxTzggyFlb2B3%xkrT&UTNdVH@b~^>S9+GgaT`i-z?;QTDj2ss
zc-zu?$1PoT;7$sd#V2!R=uW|K|Ifq|S2X_dZVB3U*2@=cNWXKOW>&r3Yg<suIdA{?
ze8cSQ@0Y)EDNp8J&H<$Rl6g#&_r+!$Seo+-0RFKPB2YFpgV>-%tecve9Foe(nbz~W
z$=|;IIY9%eU<QRHI#r@Dyp{#?s6ZV`qp6juOW9EkCao8LFD9Opy!-tw>Hlxtorc}z
zOE+(rX_3k(rO0IJP<KciAq5CWZ(!3Lq>KtI6aU5`7*0yE@dbp5x6Rh^rbY1MYj}cp
zb}XC=Zy$r<l%`oF(DOvv3trvHQu(?!pb(N_pL=$}hv;p`I?FGfFC+Wx)4+76VEJb*
z9jTfnp5Vn3-To(fV#NuB#pmpMg$_Z)2=pmydi-m;1>z(OYfo_Mw9^vb6DPJQ@$rlW
zZx<Jz5bRJTtdEKQS1646_um*{955-uxR{PF?qGfN@2xldKF@rpM1iG-!II+R;aou&
z{B%Z-&vgU+%Zq(a0mqLqrm30SeAS33r*oCG@2Z-HkIzD)r095_YZfXVFQrY~pk?mv
z9ulbXXH2H)u5J6Ai*7uPbKbX4VPI;tFX*-RL&W)%_V$$XCKF-8)XFrQM}W+nzO5MB
zpsH6D-cnraR_jJ^t8@E)B>N5Ttm%3L@XmBn_Ge}F%aw#FsZjKhq?BV+%CFau!@|hn
z5u{MU!oyX)G(3#*Lkj{6g$+n{ZmL9T*a;J_*hJwo&MPm2F_09hAnwj{E{A5&?LjE0
z4Soi4qMnI(5^MV@jS)D27KTE|k>a~+)~uzqI@-FK#YA%;V0vrA<?!r_={4Dx?(A)7
zxU^S)DWh6{u_L^Gf*?$cFw^PbxgtD)AX1532K|Vs9BlrmG@wK-sE(nKVxq}p2n3kF
zEJUzA<m|2IO1+tO+oM^0%hryD6?fhN(VmXMu#*7E>rK^#ErSaQ`8RVL^5@?r4t`=%
z`dl`Jhj)-*STV&j?^v(<Cu%Kq8&{MhOiTz96E+@QVQ}%vPDd3HsR>FWg1%(CWqO-x
z|FiZB*M4sH-S=nYdIpP`%;FNU5nHJne<JCfJ=AFkGoFG|8_|@dxC57y6<|UcjQcKa
zUE7^Va708watgsmbu)gQ3n$hCKYI}bR!m~wCfN6<%som1E49jomH+L@+~F3J496tU
zqoW?D%ogoCJX??#xSo#T7H4V@T%>Ks72rJ;tv*7~7XtPeO3}mNIWeJOTo~C<Z@@62
zp&{gO43-lHhLRL{!+1^hUcA^uBN|1b6;vTTn$KdY%*Sz{Wc6~%BQ<x}O&xB%*VEJX
zpnmAo!|tAzd-VqhxXOx3Tn&McSX)uC{dX03-?6j%w%l%_U}Aq65ETV(AVko@Ao$p*
zsEWu-g8j8MErXl2A%5cQ8lz^9J#GjzQ+Xw@bh(Y=BU1;jNXUY&9s!vkZWqVkksCuI
zBcjN`4wr!9t=kfxnpTac8Sx}x8pU2JfbPfV<V<Y_tjK-D$hNmzkH)UPeKH`oZw1wR
z8Ve3fiSlurY{FIf8C^Jq6dzBeqFvh)k07FZ{u<77`IhpN9~8sNAz-Z>escA82G~VK
z7W-+1iTzdEGcHvt<ia`<*KF(1Q@cHY%Bsw@D-cp?lxzap!mc?s+}4YvGEqn}6B&^2
z<_M#v0<&wIT~#gr0J9UcQe_o5fsO!)<TKGD_GRmIxI~VsF<!`TLMN+mIJQn=pSunn
z&4&_1x^A4b75UdP2niDlCt)Blcr-#8IUW%{92MOe5q<zv(FIv#uEo}|yEZ>4<}ZyL
zrtPr=I)$Pqp$k}ic0)5K6L1r~a|EQpy4H-@V@m1qV5NsmAT>E2L1iJ4BqksTNdu(3
zn@5Pf;K*n_aR?MWs*UeQZ5W6j0ER=N&?}Bpk;E}vBf-0n=-P-Jftbgb1)SeO<VKhU
zG2+^QFC=&;HjYIRNmHS7K85Vx*;e4l#3XajScpMafUM<|&*SZ%qfb6S44xf)r|5f1
z(imN0PCBczHBI+N>P#1ycUr6)CqdGX97ME)LWD`-93(7_N_x0E8D_#B-j=2{w5S&i
zEKElvpqX*=YG^v?!f_AvwlDvZk8t_H5;)(#^g?L<t~9cE+fF(M!aiUzET55RH{azR
zLrW^6nj{d0&yHx1fCZyEoAQ`u5I?^5X5X{E`oXs&POX+^?S;1DTqo;Vlj6_uQ0v-A
z1?!lboNg3o_>?yvAzw$|)B1roxoiMF^9G=giRQBJJb&IlcIJ%ZTL7PTZ8JCGI>BS%
z@I(K;{+MP4Z>sX@W@-PIGJrQ`3=J0k#dOl}jRHB{ZA_c%Y+Y+w{5c+GT^q^Pja|ss
zwpavjN9qS}^+8@Uq|Qw}wD4w@ftydk@hPxR4W5~Ce7E)f1mMig;ep%zfakK65vz^Z
z$>UbPUp4a0#M_Und;1Ng%|c!YJ8i&&8H;2W+r-P$%;5Fw{fj=j|I1tkh;gN%!4GVv
zPE07JSwkE@;71*%)i|%MG<w4{x$>@;k_)g>-)-PfFUQq{JR7jWXu(r>`a0}q8};EX
zB^VysFocMwo4eD0m<Z&vc=;%_r|@`g^~psy!{_zn(CZQJf>uqlm!!xk*Fk8y{mXWk
zgO#0I#Li<V_(p-6@_Gcc_EWd|o^JixrZoqd9pcor9(cyJ{SPM+V6h@T4#yHUA@XMs
zgczp;>qEYfv(oVR&SbJoOu)<1fK%45%PHK@SElpI6$j4(*N}tkG76)BMq^kc!Dg3k
zU@;0%#%h95C@@}1j)kiDZlC~HuMaKk#&rFvn!|nktcXC$y42h7zTa92Df9O)fk=WL
z#zZa?`7I4|<4W?l<sjPP$9B@Wt9hlXCa<glacz%T69gKF{22tHA;jgesRZdAJ%{fj
z^(`-m*)+atF=-VS?ZBujvaJII_NE~0{b;+;wHbOAJYCkAWhz}Yad{PR4YPAk!c$C?
zfG;Z(Q&LJ2f0ZS8ZY`XU2!--n-QlnAEAKyAsa`2cM#YObIGm6Zj}j*T8T`K7chGT~
z_@}nPpYOWFw)3mKJCbpb4$T}KTG^o@cD*Z8gXyKZjD#_%E(5s5riDIOviYldMzOrh
z^obj{fXVH$Q4hd)U;s=sL5c)0(6pNw?UJ^3>b*`$YyXe3fvH$F=IJj|u|KK)zt?rs
z1xQcDnTYL9^IX=4eX!pBP;LJo78P@@;KZ(`7=KSgP#lK|o#K>E^t_0<ei25%jZO5k
z3bq=$X*1VclHgi_$1`GEtPRd%V8GxL`D%KQ^`vxWJ*8dE)K2I+)oZo8eN^08yVE^a
z;^=$U&51j19wTjT6$*-5nX#MO_HlA<+ebMow!1|$O*{27b;&XlBiL_GP-T#A$zOmW
zI00k^RvEN2K&P})#q!c$9MOdiEzT{>|Bey3`4blZ!HG1jiQ$llKZ~w;iKv7PwytDk
zCJNox%z@xbs{0Xn?w<`54XIND8DkD~f++3gvx;S?zldI(S)A25zTW)JU@@+A<=oKa
z`vUu{_F01vwcQnN2JK9_G@-MHCw*cbn;NlAh~s)Lbb?3~%OG`$ljES<g%Q&kgnaT;
zc0VM{hjh;{zqAG@O%eBYpo!O~>Tys*yAV#NrAI2JaQdAAw%C0#g@1@80o$D+^5Q@U
zC_VW@l!6j1d_UyG##V{hS6&$(#a`(#-mK{qMM+G3W@C+^n~s3RKD)qci2$$lr!Cau
z<Mq9h^5G2P<WGLac&rLdyL&_G>cr_lomiQ&E;{DBY)=1t{oo*_lQPAb%i6dl4sYwD
zKxpf1JGgRwuQJ1}P<1LOY>fMj5>hh1(MNh~&)n>W(9TX1(#7d3Sh~}VhkwAl)qUMI
zhC%fm9~asw{;yN!B&H<?VY4AkYxCsbz<2`Zpfa`m5r$J}5^a;#k`X5TnG**7EFfy_
z1@4ogSv8z|AX*ztdr5WgyKk(iawZJ2D-3cv401CJ5)=mUZNuEdh4gv-GrB#&h%Kp0
z#kthDg;DGnixY3Ral!XBR=iE9n6s&i@;a~!OyE2ppIz!RY?u_XK6SXgL$F-#kmj~X
zejO?7Nc|I~>?7^>9r_<}6xdJxb#SYD_YMbBH{a`;7-osQ$8~)zYl>UJHS_L>j2u_+
zMyEZ|dB3MF{{j=zRjGGpG3eBa9qA=Lr63<J0rFaA@HqAtpcwa36n+@vKOlibl7?gp
z8IV$%D4%T%h1gD0F%FFDwt%o5R2~@LDoQ|!D2XL!pa@bb${?eH&j7pqj_^e%(OGm6
zU19BL3R(y7uD}QGK--WnY!5sNPeH~cr#8Te0S5-CUkvmI>K@4~n8?Db6akY>h`ao|
zVi`<9Aw^OE4oOEN#VVB#5C$^$0x=v!<L^ra@($FGg0Xg*i>=RrxIevL&mt0|&1g;C
z7h(Y(87K~f@F>K?y;g#5B?2WuGTZ|x@St$S3}5Rg&@przRihKA2GycEbQ0C0Q>X!*
z?mF`Xmgs2uaD=AxJ{&U}z;s}BmUSQZ&AB!hLu89gmkCq4iG9EP(cL<DCnHI{<SFU%
zOuy#_yzsKU!p~q{A6T>I4SaYgoH_s$(tkjYmB05U)%pL7`oHPjzIXW5+l3eJEc|`_
z`s9xzjhxljZ}Ufw`g8V{U4SqA)e8$Vs6XSNe$6BJJOKOj!?p#tbPfOx1*&rvE0q1z
zRH8|rpR|-oD|$*vT%7r@jZ&hLTx8Fc^H)ig*Dz8?HIrPsi@AU!^bHd#_W3Pd28i#o
zcLdMohH8ztUkG0eMw!KZM2>PezHY@b(C-0V^|iwrxwk<Z%mtEXcK=tfpMC^n;Kiz>
z6|H+*R#6J5D7;+9L&L%`hS6O!r867dmBbfHNvxTkSxk^E)VV`e-<(SL{GQ!Xh6W-}
z5rVX$wG!wYyp9N2?_xq6;1s+&>=7?`V^dGq`Un_-+<sr)lOR-#vVDGwma?a2fcJ%L
z^yb!UvaZH@7S(!X7TYi?tIUA9RLlGfR14|Ik5_VuXX;!=XA=c@NJf<KP<ihhJ8Yey
z1wlpKy%ahQcWYF)E}%=!8NW?LshLh`E85peg8M4<PKTqyc1GY11w_vXhl+SAv|=^t
zY6*QqCV9vusV)*#Y6jBElS|Tj0hC$H{-SOS?e4CD14E^+8~aa=)kA<9SsKPVlRE>>
z!uM*c8pRvX!(HwE6|MH6O)SQk--eaXMSMnlbXJBEj$%`Q%+Z7z3DFC6V{r8509(wF
zKAEH;hi)yxVI`%OsT?W<a)RQzP~QwK=($0aV&#Bhi_RlaDQ%VdS|~r{VnKjM&imK|
zGd5$B$EG+O_9;SKySk&l>|*MW)?b}GR1}hXDzy4@A2;7rPzQYBgsB4;RDbqp8Y-$=
zOWk2q1pOW-p1TTt5k9T<8r22#V)J#3ks}^(YAk*Si&?r=H`Xxz9d)O%H3UADglN_b
zY-dj*I0)6SjY))o@U4HsW-Zh|yklp_)FCG!*+Awr|6pU!t@`x(Hg1ij1PT%w`vL3x
zr<*1es6ax)V#vX}`!T}0Q^;Ol^JBc0B5DU2Ko#;XbGd@jxt?U$d3l>dc(}q|9Me;m
zgoFb)x!!@2VB=JdDr`<>PDQ8~x26rhMxl*M5(#HxrLUlLt|yi3Ja6R?Bd+jgj>R6A
z<Zce|%JrV{66d3(XK>$J8iYY6TC<m<e6VT#m9tILF$!=n*bbMW8p2?+P-q4$3@|U}
z_tbr7)KL*pX_^553k|Sz<dn{)j`a{{Se__}S3wK#?Nsq=VgAcIrqLY#5u0WC#RQ?O
z-(%1A$GKfjPy#0mB*YGhVsnC{OQAR|9>F$B{Ku<VFZg!q2F|*+^y!7px!zN<&v`3X
z81hyB&p)xpExDWXyz+g|AaOoldR(K-t*xZtaFB^-*^6TwjOluXTU2PUB)BLVO=9aK
z=odD~F<#gmg)t!F3WI_Tesmq)Vq^KyY;TE9Ce~K&gy&#1m2$@Ph~}a|c(~~LaAv6>
z>G*EI=qL$f3hQg8a=qfLzx22$wFvezh(^q$%9wal$>IF^VJ~w(ePcNP&9R!>VEzA$
z7JLq_ytfN|`R8NW3}sx~#qK#ojJ?!7xA2(#`qO@x+$kVk#2ym`J7GWu!nh3hITP%o
zgrTm?NnHnfUJx1)$cN=A*<ktbkyIehYXvk#-rHpV=9)%p$YB4W;#2_q_?6qL-gVE-
z&u^WR10gsJAn=PmPr;#Y<DDC@f%P*o)}+<wuj9e;S0+EwX4LArzFg^Z{KZ$xEvhr<
zYFYO{z+ZR&RqpI-m3PWP$09o1gGTtjCV&Hz&XFANi{(luC+SI0evd`fsvqC;9JK0=
zDfjThY62kyX+_>kM6Iv#2j%i*Xka5&&ymb3{vwm*ZbcpR8O~99q6c(YS9C~Q=S#TH
zEqWn+_kdgmyO`j<#=lA1sjI_){jM}`*THo*q(g@5`*FPO5F36->s(J-!0kv@DMVYN
z=SI>HzdWjB1b5H;STA+o^rSteZ2~8;X`iwuH^yMM>7PR#FET08@*dRl8NI7rkAB6U
zpuYSN@pa0V40q#Rf2d3!x&*aSg<px-Rw(?8!LMi#QThbeZbChaUzx)9Y1WqoeDm8P
zLw3MLNC$sd1JSS@4#KvL+k=Nq%AFf+lFMlbWQ&#1uf}w(3}sLAsDhJl2#(PM6eJKf
z$1j&VM}r55Jt_eAXyfckC$f2CU=nZ^9N_ZCu)Iwn?6*5?(SUEhTV(=gD3O~gsKzhG
z;xf<nKWnyAXaE)fvYS)78_6PY8L{^SJUHbw0XFfmx!06f2P)BsP~q%CVCe|AA9ESQ
zHUjI*m2H9b6+r{^!acYG|5)c0T-zFl?K3^kM?ikS$qCd{aAxl}5IEg9Q|fr+1!D3t
z*7+HGiE+smHd}0aR|r4O5t&T{=6wS6_i9cX9AhbN@r%2=i1lg0hE!#Da&e4%*rXPY
z`;5sWI#meIB?$GAa0Qlz7P;Fz!2cLi8r;U+Y3B~sFI=w27tXT(YyDd^ya@-B;B;nE
z6Q2o=PkaG*8sI5_CjmBM6B+sdJnpFhkUan}>kx0gj(Dd46!wxp5)2{i#B|PffER^3
zSN^=I{r2l%!}bXZ007YdxE<hVfC~UF1o#f%N&gTnEh1|0Oxz5xVOKHl-Diz$<oGK}
z{)k5y(dho*WGSW~fFOe}H1LH42v(kYYCAN&)+3|<xKAv3Bmx?u9*F@J!I3!V(|;rZ
zY&wo4fhC2E9HDq%`s^=&5HP?J+=5TTk=7`ocBBnd;IP$ML{rv4qh*->gh=}Yim;Yo
z%oc99U?$8(5!gJD12rbOJZB+MsIC3@yX~}#0GDG&iD7G*O&X~<RD`gyE`orqdeE5n
zWFwKH?X=dcp)+2}USz_A*do!~?M3dNDNy6~XcNorw41<EmJdHPR)RH%6pO<h<`sMJ
zw6Tx9JX}Mi&2)%<LxSk!ESD*dT7K%aNa(PDk(=n6>=7#1(XJ7j6GkR7A(w7`8qi&t
zB#4pV{BxP3KQyL>yP0V?q6f3SzW;x<yI*4sAlia7xuDAf!SBKihyx|!rvy4tfhWWt
zOOgUz-9mK|M?-X8M}|R<KEESQ2I8$`=wa+0>Cu}4e<Q;!WyIr%(=uL2oQyw4G7-iV
z$vxM|)J}i<%Ttd%Ns|_BI(Yn%P;94WW*KJA;>*dB80lZHN!I%Hd1hBIZb_7ETJB^k
z{*$uG>Xx@AJD=Ui9tjx*wH3Lb=V-UR!eg{2CRP#lscD0xoZ>XbS)_R`CFd%}eo><1
zO2L!bTI=Eyv_2tG8$2gWTr7b&9t09?gq2cRZ9edVlbiTml)L!UG_-k0mZDao1WD;+
z(=&9DXE}NC&dAi3a+y0|YkBhXkzR~~Qi-JTVdAt+9LiUe+Wv0Z;kqw;lsNf`54f*B
zp~zApyPV{)Dd152dH9TKxkqt`6o}~(fBjujsoWtIKRUnZ!+*t8s&`7mA2PACeuICm
zRJ`P}D}S-{3!W6hNt)`=F|4#2UjVJHyWysPw7cbYWdC6CH)0i8En4OFuMT(I?XoLq
zNZMR-&)x31pA0$YE$%^T?r3+*S?8$Jz{T{<xU0$p9>31);ZNlsOpiRSp1n1sds4mv
zg)$vioy61f<kaVx{%-c%fEQkRWzcJHyfws^3Oy{|zvpoiCQbQn+7Ca?^xd={s19;a
zWWWnAz4oSGX8ktjPk8edFu?k5h&I;w@afC9Uw-@JuYU|Ci_PKk_yVCwEO{ZbGPy!i
zOIt@*Pv5}M$k@cx%-q7#%Dmy??Fon@B|$3LY@dtrgt-!C!}DHtp&a38S(;F|od}tv
zj*?OWJtaP~D6XQt@Ih8q6<q2F5@ddbg0qBiLcv+uZd!$JZxMG_CR|p`WdmO^<Vn2N
zbGDq@m5sWod4?z`RtoBeuPoA?j~1nawT|qYn8P^8UJt&C;NJYg0S~SrVOhdc9h;v9
zz|sWSa3rpE@P$QX(OUMh5-JK_CK1f2p*g;#`9c`IL10aEofBx(<INHi-ZVG2E)ukS
z<yE|w9C<g);VKIXN~|24=rlq4MY5u9Tocf~b=Wt0RF`^!^fC+9Qq62Spfz{jA?BFh
zAiYtRodi}dd{~}vqLL1;S}538Zz2piQIN-DvnmoDUj4DH2L44fq8EvX5$lOZyhU0o
zO5`rq<$^z}E7po&Wh}4rd`Jg7`B00wKCqS-tlSM(VUz=mme9(Jtf6vva$O^T>K0rM
z-sRt|LoJn$liZSw1GhTgf^)c{oUklt6|;i##)`z@VMSU=CfCM2Ogd!qT&~`}%azP7
z<mj!A8fQ8e%so3dekn(6l_;1j%JkSlCxHzDBw*&<O=%*UZw_qKOHqsK`k6+1>Sb1j
zz)`{mnHJ23&XWC@L8*gIF;7$17Mx<%iCM?Ll`i4Lwc@?fJbf_)lj_>OBAvF(%%8B9
z?s0E||E~*U%;t)O-ai~C^gOr{hC(z?^YaSU<QC_@G_&aL(^Yic{MDAdD#SL6C5h-&
zCZ-U}q)5hjYh9bHMQ|LtR0jsA=F@7o-RnJC@%pdk(^CMIu{{`#jfNNtj6EXUPVIJT
z9~wB@XT{wfS);czJ9y&IkwrU`jx0KL>DZ<fkJfxTb?J47jd`m&=}5UXmhIQ?U&n?=
zO%{VCb9M`FR)j%y03NVp&T=#uQG@}Q*I_=CFhD)gfJ(Fj==Cq=0%A3Loge{Q2cXii
zcBlg20i)7r00>YOFaQ7=06--Gdca&jtO^VT8M4K?<1sQ<V>Gts7w%*}oZ@&fh)ND8
zY+xpc(#%^UEd6Jk!zjv-65x2YRc}mkSt;$Fr_Iw7w+KbqR5~_WOJ7QB|9=SLpV?<F
zhay(Txm`u+fA0ivn(DA}9OBL^mtO{2HBcFpu<)I`&M#}3aBkAjYe<^(D_+K!`_5}Z
z;XSwOUb4aOdAMv{l9+b3<(@L9EbWs17uJDNQ;1Z*W_rfH=d^fwV#hJ?KE9tvF8;Bv
zQVi#(h{F2^cO}UkHKgYbW>w;)`9BX`ha%4VWikE@;W<X<=Y9<R>#Uj<FY10``<JV1
aHRNEqDD_Sh-Jn<L=ei94{-6J;*YzJxPYsv=

literal 0
HcmV?d00001

diff --git a/src/static/fonts/Inter-Light.woff2 b/src/static/fonts/Inter-Light.woff2
new file mode 100644
index 0000000000000000000000000000000000000000..ece952cf7ef69913a31e68921cee9a56e5667603
GIT binary patch
literal 23916
zcmZ6y1I#cy&?WlVwr$(CZQHhO+qP}nwryMQgZpiEbF=%OY0`F*X(l~s(oRm@<;9o)
z00I7kt_=Xfe;pv0!+&G2|Lyx<{{I(PfeP4x4K6sV4qyiS$|`~?S^%MJh!9YLJs^Pv
zy3i4D0Dx>jB)|z6AOxTxe&B^5FyPq5&*~O#`t1w_?A0U<e{T1&`UA7L5YDCNAacp2
zZm6*hyl@th;U<57fBC5@V+(8+N&twckKKrpO$3?Jm7AwpQZ2<NdaHAetxBHla|Vn+
zd{<)1%H8yz5TSDFXVGxCXEnPQ)VHUC(V9Unh|rQi@*)J3pEV`-NM5GmZ-$Ke?&j0-
z?}*<%acpH1Rw0{cHNw}PH}<Pvh%!ZW@JyX#Cnd(kP2ho}CXVdovJzf?LQf(rUVK7N
zBsu#1yX^-U36NXsr+4~X%g=9Hwx6AX8<+gO1mFC+9{?^pRRcP^4_l13f!E-{knSCQ
zqJh%`8>|SWEsb>B)6Xkg{(0NG%+eEX*V72ezz0#pEsi5jfg#WnC%wc?wN>6`!eO9k
z7^))7WguY?Ng$d*5r~jY3GSpNri9oGKw=s~D*8Mz6gOD|0T~GQc_v1ZS%>-l<3#t;
zerD1H)Yda^9tdy?t3?h*sniQ59vRwyDhMNGN>w0*;wxFI&9RNKvS=f0Yc|2KV)1xX
zKt{$SU}nWeE9=iOJqy+Nr{ZnCs)6gq7#|JYhnhXuxgwJgbo(XVS0)mKyy+7nf&O3n
z)Hm;$-1LR2#0dt7V6bTGQO1Nca)+Xo{UpoHm4AD|NWFSib0Zn%Rd9{Pn5<SS6&iHM
zPnnLrGds-FujXl26>_`wS-)25tH^-B9Ktr_p}XvMckg6um<2)uL*@?}=VUu}VvSeW
zgsP2+?7e_ju`QiVt8D-L3!diFzln-yg~Af3ng@%-e28k4tH2=t(PE8cr&x>Zn>4KV
z3a5KMepW@-0sj5~|5k24%eG~jelLI9zss5@FXHgLcnt=HzL8cM3clJ`)ldJ!Foe;V
zRT9?_bF!x_jd89uPNN;pah(7Sa=&|AVv`jgh^lb22~;4QY-ITUR$q2*HUTk&Q$cM3
zm6&u};60C!b0d6ZpOjf3!Y8Ekeh*aqcd8T8Z~3{fA(z!)VhkV9>P>M&f{?p;qt>8>
z&{^^tZVmuW+^$|`cF7Xqdpm_RUJbs7{FU@dNoc+IapRmGyE%GyW8euLP|~o$9B^lX
zMsN+7cPs=aT@3U%#~nZpthD!d7wfobzE(cP$HWF-I-e7nEN?uz_{_84qTW?}-Q<6h
z(#Q>C<P8LzSR$#-t4^s)Vd#xEDwqnK4}bwAOaL+e_t#tL59~J(Y#;kjknUy9)lPze
z(_m2<K^XJbs<!p*&AJM{l376H&NXE7T1K?Hcypuo+AAX)K!$6e=BwaGohDc@UCBT#
zFe)}yF#&P>?5~_EruwqN2|#`5T_jsjy!<-OrGFNp3!U(dowR<VfjrPdqyQ%EfY=yp
zvu4-H^TORa;Pw{SVB?o$0N}Cda4&1}{roHYSDV|)0S7S*jv{%5SQ>q4-JIzkD@Y-Y
z=drp1ffIPZsu9hAaoG5`wxVZeC){#`u7Zk{+%c7?`eeY~@h6%#(YO#$=X(Cfe!DL9
z<X1XPhB8J#a=ml5>zQd|wiibGeEI4DN7dXy0?{1(59yFk&oKdy5apqj@-Lqmc*}w?
zi5y*X2#Mso==&G#t5v?fWfw0@9wP{bi0BBGkY>I5Z~OjVerW<f?25RH9-~A=gv5wh
zGh$*wLg#$?y?kIoM<!n<igi>g{LQ=F_{MkpgK0<8H~{Dg#ON1b)wW_QMzjLNKbl#X
zRaLC>fuwzZU5J7Uwio%rferv4nC0M8p{G?rEEl1!p5UH$<fn0c3JgO5LPSu7jR;r@
zoe^M^W0?XCGtf~+kd)ZNf|E4xQ;YEeoO_Ox<lG=4dAQOhDvI@PxYABDirQVV6X|{-
zMbXd+jWGlSm>KXf;R?%JG4}4&_ZUG1Jb?iX?Gs{gKJ40ooq3vIgD3U!De{bO-~BNG
zct{K@V9-H@TpTfK-G9Wx275+ZJv!cjlkn0nS+4;F8KU)V0W>d}KwqT&ldtS#`WueJ
zqNQMlLJJgBGT~opHYj2)4~^BhDhQ?kQBOKSMBWet`HKRTSi(S=433FjY|}Gyz7$Jf
z-);udmBjlwY+n}LA~a7FH}Moxw>fE)R1?#ZqTJc;w6do3>Fv&k6Tfk+&~-Tw)6bPL
zD2}~Ih)Gfd*uKO45~qDo(Hw4n1&nj7l3x2pfTG`Qk$8;?o)We2$7b+!I4KGEKolR_
zX}&p$QMl7q{irc<6OpjZQMa%bijJ;vpu{bmAVB@F!>b(#h-&s9*p++jZmp>1GTL5^
zv6kgD4Z+o0b&~4mQK+=;n9_LMw<yW3ZHLp&jSdxUJ2#4Dk7auwgz8mS{ny=h*C=9r
zv0Bd*{@+CCJiKBv5CVUP{wZ>M?>Xk$dkzjOC0y%<>crx=<uu}FDzB`G0rw}dJg|0i
zPwzW$tzYKht0AXHj*JNg1E|3lRl#dnNAakB7I1P^yKYh(xQ%hL7**HLB{^`3M@dAa
zNJm?<<8JI)`<|Lve1fEZE*w-kD$ksQvoC}U^|So$dUQI|2hhei;vZ#oPa&u0sWLJ%
zRi*)7SoF@%ULWS&;%$#dq59uf;*D<IKV2;tSZgXvX#&%;kRnYSOb>_6|5W(04GqTB
zJgW4(z-2boqLyhN+st8DCD>K2pH_>XTt!*;KAL#GvB1Ly=~afuOIqhIOU+9$A7}m<
zJJpVD{%rTaxO;VZ#2iaGmUp0ANEgou?`tW9NdKN`<Yjyxc=RlnX8dE^pS1#n58nM3
zO3Ky#K_aWurIy#DEOs2n8}*RZ6Yq>S?OAu)-FkypbBc|(n`pT0@k~b36yqTh3R9gF
zSz@0QLn0`)1ZUS|<VH4|HyPz%zEHyB@$MM40DsXtAlWNkX<Z>>P0?^3>YkX}8H2Lc
zqZxA17E?Nh5fm)!0p2{(Eb=^**D#TUfXPUtNV-8x!#sx2EoQ4#3~;=Asncyv)wGhS
z9Q=rA4>L5$E!NzV1S>U{kFRvhm`efGUfvah^*$S~;%6JE#?P`AV5I?Dk7!-B^xdrn
z2)My3x^2~)ik8iOKBa`ppe^K(Y!?Eu`Thvqp|@mYUg<w+e)jxstmTZDcyw}3C>rpr
zNPsi?>sYF>=>lX*6juun&xJH+63nIFD?z~GEDVOk@Ofy+D8Yb(X+;yF6HQbEq{Pt3
z9Lzd2YuqShiR?4L56uSm`%X2z9*>pUyt0P(ZNf*vu=?4<gI|AC{AmnWvFb-Xwyy^F
zd~Z5#@KNLE@m14j^yMbdIz~Oe<3-bTehp2JlW*NFv+f9vk4Ym!i9cumipvDUbQzB9
zY*tlZ%;8m!qhL;hENLtb)LoLc^;dK-xG`XIrO`4o!nm!b+%egr7pDXHgev8vlB-fl
z?WzlH>P4FSE9FHe4*Q~P-vh2PjjLg^tRM`Oy7wI`9&sa^1tYcX3{V!9@f&Ui*ddUa
z5(A>l&k$2ic_Z@=-9WMLlO0-`=$0}5Wn{gr3!;1s#c7lHSys}9Wxa>!#WR0scl%nf
zeYM}V9BMz8H~4mTpH7TKYpdl1*};+WX9LT`nKwi(%wrw}kiT0ieN2Uw1wA=)FAwwN
zDPT%k$ie?DhM3hZ8I*Y}_RJPu(=BkHw`osoE^t8MkY@a=2fy2C)KL}0iwM`j+ltgD
zjj86#WzyD|c+M-`Py+A6JXD5K2|@@CQ-E4bwTKf%nUQ+?i`p83$2eyKvNr@QhjidC
zMf+cUVqEq5fTG>UVd5f-=l0=2Kz>o^v;`5MIiAYZ8y3_B9fEw5zShb4t#u$|Z?|kL
zo3!CkyV3dI6kAn^rK+IH?iNq0?R<T;%)JBdpjZ!>`g*z&$87TRK+k<!l%sL2##9g0
zoDWmlaWUsy{qrr*x!R$TF;k?OUIfjBOqDZH2BSk2!zwS=p_tq@6%~RZ0osBwR87Wk
z9BIx5&yks2^g~mT)0S-ygYEMiO?m}f=lDaqy3N`r30r0F<SY$GYNzO$iDI}^Yg3$4
zjdg{PT&zouv+=<m2cE5=wl;L$ZC#GKH+>KHQ)a_v)(6WzvER=IH@BfS+@dX*;obcx
z9N0HR0Xn43e`l&ffSK!H93a_<OarH`*a|MEb5l4I+~h2{2_Pr5fF@`LYDGIz4$h$&
z%WiFGmaD?iP^u2WahwKTp@*Ou7X^RfV<>7Lk@y#q0Xg9Tk-ORtIRk^&JGqdwf-5Bi
zK#C%0XyNW)2QjZIP6n8q3O5CV02x{ehvTsTCrd;q(j6&55{%T;EKzGKFA;@2Q$Q?C
zQBxr~R*N%I*kBpgU_-IY4Q4s2;f@0<SD;^cGGwn*l~FSIgtb#Ci8Lu@{NP8e_kuE|
zE^pWbxR)m5Xi2Q05LMSmGcKMQx=|o|`QoBb`G<3I@WoG#M&?0#SPir^%zf1vMow0~
zyB3mDS@s9qZ7m*F7v-Wb+20Bm>vk|?m?J}jBLgGUE0GvkMq<HSAb;>&1w47@@+WA+
zK#HFn8Qv^N78!nU!vy7QF|kVWMPqT$e5A(mrKj-w{5v|Fz)ixS>iwR5*cP^`A<bLv
zmo?qizlsA9sKap&f<FX8MA&6Spl*@Bv}10Ix`x6tb@dZFWPSQp3|xQ@Tr27>NM*lT
zx7(C;mx)4@<`80c;ir&87(a>{+{6O;uc#DxSQG3CTH(lV8yRpCw!rK@^-Z>=ABq-4
zARG^7;s}=@KC;|a+bAGrk3fwe@H6*L<CC<#eQ^!M6BFK+DVpzm^-I(`kO78Ly=H@>
zJ$BrcFK&V~4CBJi@G(=<!g5+zJYId(kkHh{^|jJ^e^oOnRn?6%Rb>_SyAS=jo9s}C
z+tT;+*Lx|GJFR&c-25_iY1!@SFtQmD`K*vbE;m8+*aZ+-<JUFaxt|M<C%|J2b#>C4
z?F2*kUUfo%(HMvdz(kG=gui&Hc3X+ZJUM5|)92(ewpheK$^!%qj}z@NH2OgV(DDV~
zqT;jKdVEwl`BJ#8#|zi0Kz0T!EvB?8tJ$q+UB-(KiRXdPO*D{tI%eTYF{plpGncc6
zrT7I#?0%^vZZ=C!l9~R+$j28L?;QnFW~;~1{>XweO%{OIQl9&hW{)UWc3pJM-=KK5
z0!7^FUC+N&P}?URS$a*+$S49(z`~;LT0a<`&IPh(bdedOr;H!96Ldk$l&#V$hjj@5
zT_v0D>W$n;cV)Wu<p{PPAJMIa&eS9Q>$MBbdu2u6%0)#upq*EG&@*tIhhEpd336G@
zy>Z~cQO}&4zO~&@<0NSFc!kBh7Ox!3wzdU+N|(M12pm-8SQ-NC1BCDP3tZsTq{Xs5
zdgWb4dUcpI2h$)9jkpuis2JJWTLZ@#AX(o1UI)Lxb`9qGCOQ60z|EPEPC5?H_=0<1
zjTf#gqgb#%4DJ#ca_<VnXYIIG0_Z@~l4<xwe#tcp@<<9sMw)AN&#MRi#bAoDHngSe
zRiZ84u6`vFrO1Q6F;EWT+D9lm=IqzvJlMF?Pgsf+Z_=`zEuM2@7EOj(!;&1h!#<#;
zp+l8u@G-L9k9lX(_6d!fHoCdc%TCaNVTdmc6oi_r74SsPbpgw%%}HISH?xXvYx}I}
zdo*$Y__DkF!+R~2Yh^XzjjZ-M8{)bnU~=sTPbzjy7Q$^&vU$C}Nx;c%cv2!LweUP(
z{|O2FYE@8LoICPWY(%wG9gjfMk!nR42V#G8#CZ=_yUxj{39R;<(FU15;A>}HJ70Fs
z2&v<bZDyKlYKu;0BQgI?!+XltE-o>)Y1n%w={msPw6mFnp}lmUbtA|QZxZAjKAY)#
zB2c#iT;H|Ue~kp&Qpi6aevK)aSWVd^3rAUII|Ii%oi_)Irv5$fA-Pb|oIfLb5TifF
z_X$8^>HatySrQidRq{xovRHsmTwlod>4yBtf$cOB=`v^gctjbzp?E`!Rg9L+VI-W;
za!jA=mkXyMGPY3x69Lz@?{uR|aE4{AZYIO_0+@*M^^C_$pci;dvsu@<e(|!WWxw)o
zNip=hLDAfNm)G*>`k_jhxtiCHp!D4-^?lH_<tx<*S(-``rZG;T{GpfrAn@71%hKII
zmy%9EbVfy+1NJcADf~p)UAWAT$nir8u;(fJO&_x@wy2@WljlbuK7U#B^8RV&w><@L
z(3xKSAXiwzu5RAJaPo`*Fna>rzaNQ*bA4_BgRL3s;_&BHV*sTGrV9PAeW-X+6rK%9
zi`}801d!BjWmV-`z$coa5^r&m&8ryzz40oSYT@PT_r4dVBa{t^d)ko#;cW=;@Tv8c
z#_G@RFtdV#K!+`xsMjoHgIpIb56@-Q4cEmASb#V#C7B-3JCyH+{2{;J4}=)VFFdH?
zfgNT<C?GB7#U6yoo}|eJ#iUumThqE_Yf4LiwgF8Ax-xWi$QrV>wKXOiO%F<Y5yDnk
zJZ-kOl67ca@hkMN8l%Ak13nbX6(XN335_{|Q<{W2nIKuVaB@v0BKMMImI0Y*n&!+*
z8&1=ZItf}m0-K%0eVZV!P5E3lVtCvSMlk3S3UMw$0;EsE$OZ`#1j)2`G7)^z9Zanz
zBNWNp@LVTA#|2V8(@E@v>QSZAs6>l4kL%Tir31{;3HvZkykR_#pv5}e)g$adhdeD^
z@4wfi*y|X#%WfC#<KExm>(w~R0W+|^PpSC?yUhMi$!)rR!oJ_|?}u?<|1XyJTXkuM
zntbaWQLZgTuO>&aEHl&Csl*spS&_-<r0J!Fru=gs8J8a;oR|SlGL5$oY%I)w<|pBO
zV4nVJ(Y2jy*6b9T>Z{H$Hpn5xt5qqUC^WM(v=cPIff0y^0Zz;S92dLd;nV3?cMv7F
zRP!a~d<QmLS&pt9LStvAu7~Pndx&*pfcAIuB#)a3CW;A7+9+~#>CtttZ_m;81~k?D
z>};L$#<v@Gx?)*Q@^_b;_0C7-^Q5~<->(`<gj&gHA+|_7>hTe-ZB?u)3gKo|)m>Ld
zNz7_IDU_O1r^R)#bxHxj-gF)9#=tV8kn5!5G38j;E4{|{zbx}r8XF6%t1=tVfsn3+
zfw7f=QL5ivD^m%lBe{9`5)(b|NjVPs{wch&BXt3lS)2N~RGXv9TGPvT^cSIC-)p6{
zyxl{0nRQG^a?)=lP~x%>w|#80gzxf8Q_!c$rd9ve`ybg!(<K9a=SD1pl_p-tGkYtV
z3gyVjEB?!$)vn%hwFfAjTVcPd*oLAeadknW`V^a*xjiTB=WcW&f)N>$Nyb?NahdeQ
z91Zt+_HC4P+61w-p%IH;*0zbm38*@<=VdEdtA;l6wH3dHJu@qubd~OWB2FD#JUv3x
z2ofb_u|=rT{=`Pg3~fz~t<CKXE>3QauG1!}dhdf$^(96I&ezMfSvRiRmT7$N8|OiR
za9oz-j3apt%XP}~9LIIeGhN3;o%b2<!-Ddk9dI<FD%zscAV8^<iZqt4%c`t9@5@Rx
z?SmY0n@f<DyMTjGlTaupMGxr(kjMS-c^2`#WB(iEIn2vIvur0ffcZfyJb*tS*$`|%
zUFfn!Qnf;*R;-rm6}yRqDs=y07I=`;`X*+;A212!ZrUPlrmmtQImL)}m{3H}LG(p6
z#>HTJQod_vIkIMW1*KMuhT~DBKBNOXb|uqw9G=&uaakuD6JzsMTr!Pn)_9(ay#KI~
z&4Hs>yX`a$iMi}nC;V>re6hB_Z2y9pm$m-9G@tvacav`UWZ#~?GK{~^yeKMyD5M5t
zT`|waKF@?4L}j>*HOoMR)x-XjbyjSrWBhx^s<A%pnCb<gch;N6N2jyCFiZXbovCpY
z-C403(fiP))&Qsl0u;vr%%K4i8K54q1;`C?72U*w!w?qq`5h>D`XFjRc=-V;!I1R>
zvq6eyl+^)dYlXzH04^0|v!E}UjBsK!5xP}Om&;Fupj#0w^Wq;|env(K9>BmDH|D$y
z-9yiG^#dBEREv^nfx!Vng2KX-p~2w+B0^%q;!q~WPSwt+Fe)Elp%szQ^=d*wk|-Y9
z5*&nFF4|Rf`jv1$A=R*03>Nd<HlR4ag?Y6iAV5Ike~j@I)kKJtiA16itL1ncNeG3L
zwBQ68frE&rASX^pq*yQ-jYg9D$to;4KhP1bW~<|W!75_18LebE?vvroM1YXOLDWrX
zC`SD6_~6yd7(M|GB_X52Asm#v34#B!fLwi%d_Q0?-`7d=|H)&|*E)@wUfxgrVI-pn
z4G;+w6&4p585$cLeZB@AT&RK^DVz<`o`cY>1SHEu{!M#}@86;y8MHXUc4*`thL=^W
zhkrz|!W{_s{(D`BA^HM@;Gy(k(CsaZ2q$?)7tkwCF&bA~s=L-#w^j>72|1O0Y@kqg
z=~1@D3223iRt%jzd?6>ot@l_YIENuS9h~(0cYvr=4Qct8Wv%iMurmj`$4Z&Y_@jIG
zi^rMBOyh(ut!J^vb*|n0>&Joq-={xpp5o^nIMz#YUI%Y_jEnm}I1#U(*QHhu#gFce
zl5M2~NiV3OD!j$n5}--pEKGS*#=p*(u~OvIl0->b-CgN+mGw6i9WLVxF_fipA|nTG
z;iB~v|9yuIz_Q(Y3_lM#w2;(k(dxPYS217^hLL;i`w!mXOA2eA9>T9R@c_0CaUryU
zP)HyzW<j7}LL`t{R|MeHf7y^u{S8EBUr9h)0SGsm<O<76&?W=rlK<W1fyHD3Mr5ZX
zE<Y`^n9N7FQr@ZjM*K-4zY%4Br|CNby0Dz-M=c=o1W+Xi0niBhj?Rwxu+Qb~MGZ7;
zGUoT5&Ys!l`#FEXB0D9puz3gwE*gH!M#XSOM0rZmyuMkMWT<~&nC3`^W0+=XrfZny
ziLPysN^<48E?FxlWhdJzH(6^hXD!s4vzK>nve&=SS{gEGtsJEdW(-DvCL}0kYT^ZG
z<1s*N<7K;hB`;A_aC=2s8D+G}EO~9_Vq7ehos31S?w!suBTliU^=?_Av1m*x4hX5>
zk@<u+92kw%XS`W0muC|Rjb&ZQ=5kJfq^71OOH;JWL_+k9H!L6{boNGyN&-&u8w+wO
z*7K3ur>ug%TUVB|_ulH>eJ_mjzjo65-jw-=E&4uyn2@ld#8EFGrQ&cEWjPYbNGpof
zTND95IZO7XPP_Z6(V`&qa}Ih)sLLWSNzj)6+Dg1`3MT!%I1qR^4hs`A6$J`63&#BJ
zUyc50O>RVnX;$^;Df3P?;X#5xhUXLis3g(aVUCuAt>$str|V$67>(8+6%;Q-<<|zR
zLTqgLwJ}~1kiXQlpP~Jc5Oq`@RK=|>s7-tgUtHirhD)p?KV@=xt?Tbg+;H}d2waSw
zP5Ci8Fg#{jtOg6cNKm{4`F~gvB%lWk6~G1bKn=$M7I)3fm2<=GOoI#2kkUb3YG=Lg
zwsIUuiGGQ-^=W#3Yem0ow(?~&KC!a;2DL5TFacqw3kl1QCU~^)W5Gb00&hcvfv`2>
z4<<CM>}4~M#KFpX#JC0%9^NjT1rt8{M1ctx+020o8>!7N@LL?IVLW3M7+4_n@nI}x
zM1X&`Ocl5GZ5fZQxqYEoUF!Zo!&|(2*O)#P7WTbbxXHUh-3cQ@ER@@^%1x8MDfGkB
z<!U#Ycoe3GyRKfWNvQ3A%~Siv*x2&*pC44k-Wrg@li{s>FM4PNSDSF}Jjm+?8_?;$
zCIX+5;hS0wyY#ZIKT9yO`WDU-$48iaO+2<*0!l&03UBGNk41wk)Uo|Qd~TdwQ4RcX
za>MMwRjtCg>u8E6AA9VFb<pgOgl5A{qH;SkgA0Oa+GvtLsYOk#2cwX9e(Hpz5o?|i
zVB7N`q0OLC7_?7qn^xJHV~r_t#C6xt_pU8^x1P0mOg2zX^#Lpl0AU;2BAENP<94vT
z*{&;Wkg^mIy7vrDG0%?2=H}ka+;-qho&1m&_NdLVjEe@YqAq^yJ<F`N#)7Wsy6#7r
zz2XiM3&IU+_c7hHi#1DlGGK@q5~JCBtoZC<8ZQVNyl_Lt=rJJ>DM&uS1H=qT_*35i
zrcmd?UI$G{fDO|L*_v@{P_O7<N1hgoIZ?D;7yt4n@ULpX!UXpZkqP6kw<OnETbK<p
z(6yx!*9_(unA|DNz;T_#rD=vXT8*?Ib18}{p{zm?)425y`xP4+!Y#5eo7GTVL6ldM
z=Ct3nJM0VJEM8~h$+S;WL2ooTn)4RjhfC=oeSz*jn9>HlKOxiSg+6Q<uY*<-P!dX*
zArd7pyaaP<8PRd85k9oXhnvp#1xaSqGJH>_kx(r_7Kb?U<KJbI`Jw4!8%5E<GDa!N
zfHp5GwwMX^8=rHUj5b&L$`NXX4nA8~$Cs5~+GH>i6u3!!`{4Ni`FYLx;c!bmF`d4s
zwwy+E+4jTAYIf!8&EE=70W4zWcl8|aEarD+J8T{9wnM#&W<{DY4Tb_n^_c+!3gn+o
zACSWUL7y`+#0Ri@oxQVkM{VHJibgkNAPh37i!!6zYg27k{3$!*`k!FD{rk853-AAj
z-!9esf!bR$&bvG;?-$PQovZE@t=@OC8GiwQ*}pf*Oy~Upbk6rlMfdk%JkR%R*WS6v
zO6Q(DP0!&dq1>NrYwKt@Np-DhT1u;Fn7rP!R^`1l`qtJ|ja#GRUI|wD!<@0DAxzFz
zxXIr=#&~2B<9iWEJZDF?oHaBfCeLzaplWP>+oH4QvihZ^sy>~yy|Oh`^}eJEUdy_y
zsM^bfDz{>mB9>zz336)iHj-In5*kg(;RKginyiFInLGkVI5675TN<`mc6ooO);8qh
zsc9=~Z-=wVa6YmlKsa=rxljZlpzu&Ypco{;ghrzxM{}WQI0_I6J*o<7`0J^j&Dymg
z<Su6K5*In0;rn889M8B@5In<SC5zsBV96L__31-=J-&)i74Y+xkTRJbXk17zI4%^V
z1~nA1q|%}gC=rX`<A0G;X+4P0s8Eiw?wSeZZdPYzR#sI-MMNZ&L;^s-vi1{R=lREi
z8pg@b%&e@cii(IxD2W7sa5lFw^FN`Y`adBm@;@PwL?ZeBH>Cet*&uLC4ar%3LNyg1
zFPloD*TRsRrW~Gyo=XU{^8Dy=TX;RkB|}J=Ob<LxG^6*+)48z{EUasq=2V?WXMF=>
z%NV9GlMIYQe%>VvWQdhQ@?Vkw1&`^$L)lJb@SQ`hxU5cx%f=9&o~s%a83{jbjtHg=
z#gh+=2LggFOG-5cRvR1lcxiCxR|ZnD_ERfWZ<)f$0XQw;%84{M$y!1*AP%1~TG8lI
z(E#7o_>(bBhd`al)e~t{nnN3kLVG=x=f{d55TW5hN<s-UMR^d|kV=Jh6eSK`AqD*Q
ztu+>nLbvwnaU)Dk;^fiz#5xO4*IM0K=-L)u5y4($hQ1ssM)Gi?`#px05)TUoDN~Dr
z&WkV*8u|3{qXbDw<fN5JAxX_D`4ny?38-tVR80>r2!Q<c@p;|XP0MiAM9vgM5~EQ_
zYyX5v-#!#v@Zqfe#-B8sSt3Py!(GOWzN`N|^2ml7&dtxv{72G%tVkq*0Jw~$FLa=C
zlfU62S>WuVh4gvmS#PQvlT~Csvj`X1;eo8EwfwA+^Z`o~P{6yRe`_-Xez+pSlvX%B
zeB+e-j?ENx8qU04*adD+<{5~{G8(YVHlzFLdaa%i(3NqHM=r7$JAE&*Sl5DA86TAY
zH+!`~IW)Mo$ZAW9KY`K1fK^_j9)@5xyt2p|G5=}U;dL64wDOb{OgmN*{h5sFPy0Am
zRadrkU0q*T{Z&_9?@}^O2aZEmW`V&#Pi%(YB#wd&@5e^(?K7v?H#A_XwQH|^c@w81
zPrhKdiB*G@I^`k>;YYWoF@m0ji&-3z2P6RB2#JVY0mevZOmq_fmYOW!E=b%f>l(W#
z9V;O;j!VLdj*H>dGO__<dc&w>%uq6pQDq~Owz_dt8kRLDr_)yA!T@m{qPb1&ur?%>
zGU@tpyB{8)V!QJo|Mfd>&b^ZvO;y?2q;so$n(A8UoEx4<0ALCZymcPd(bUE|RUfd3
zuI}Yv`N*Q6Vc0nMvYNFVO|OUH6p4THhOL9^4eCmQY<6n+fUf5NED}^ur<_o?;gx#u
zE`j?dsrPrInU?J)e<}EPuQ5*-yj2X15@h%3eM-9X)QHX)Jl+7nzNy7#x=P&Lyg2{z
z-ckHI@JgAQX0_vQ*DYn^pWHVk|1%K(+**`5d*@a#6`}S~mO8eZ!6=UDYOB&NgJZ@b
z>iW?tFOh9*^)b)ohxm~kq)+Qe@^xCQIr+}$G2Z^@F`CZz!T8RqFa5;h*<g5Xg^%2F
zr1?c)`E|1LJiOI|8?W6lISuGEN;&9yu*GNUn2ipS7oG#1@-fbz3%>rHjIA>UgYMr*
z|0OggW#0g#VxIV;1z09bx-r|!br%^O^}&jK5L(#pJKVgMS3c!5lz5D|Q*)k?R2&j(
z1so?rPAO8I?;Th3-D~qMj?J|&Rp+1u`L+=bdCsdX(3?tzoXulc5?CQzCA+RW@+iWQ
zqHw}SfYI8n2L==Xi!uO!0woA1v5h$eL}>cT8G=v%)pLrZ(IW8J!a7aWtsAfE8nuW<
zSVUAxpF`YU?>CA#$i_fqdgT@5{OROy0G)9<3Xq8rsVN8$Wl9Npl>z`b5NK~5gdA#6
z`$REllI~Q^viN|?JnBRVw=Ix}0wx8MpX^@~)Z4#p5bPS3J9U*A_`Q#GU^L(fIrrpz
zH4Eq{gE7hQGo5%kL4QWo`!GHYZ`RRTKbPjI6voiXpu|k_@j#M@kJ-)<Cy-Kov%{ug
z{{bkOZ!si*3lI{W(qML~BwO9S#L2ar{CC!uDnGXe6kU5T5XvpT=K}&sh$KmrC==%s
zj;nf<6HRC7AewCEzVoaRe%{ryXgz=~+?RetgX7udTH8e!V0EcKv5dq<F)+g^NJ=Nx
zIPT)8)%~i^3LpwRnUqV&DvW%EJ$a%&2xmfHt@zi$x5*_X1i0Jg3DMKWM%fRM6^TlL
zO0aPUA4nZ&En|P1B0nbWfD99MSxugA@G{5>^2Ao4>u?r0x}hLDb2;5x6K?+<>fh-!
zkgI>$W(`>2Z}G3XGs@5mqyhqC&M5#OP@v5O8iXP<9$G;_p-45k)a5P0^mU-UbJE8M
zm8_w1)_MQV^X}BZ)>THgt%GcQ!qKS<#)K$!#fcLBDa<E(s_zCHSqz)pCup=xyFf#g
z*-5V)2x9{bA+=!tRhTI$rgvMc2|eX!83i-16Bq9H@89KS{qaF>F+A_P_uVT;P%%Dk
z?)_A;v$q>BeSA#vJ%7{X#Mp56l)L?gw<q1gHT{G(D)0pMewJ6j6I2Fsze)~45`X97
z()V?TQLgAJ60v1Uo~Dw;_|UMF@Gw%tjLb2Ov%5}5W-oBW^cHTZyL1sjjnQ&>-h;!I
z;#5{eFY8BSZuQ7M0N1Jr1lFA!@2MMucaxSAN_w;L?#iwLp{{jF&k*<WYnJwA{LiU;
z!SO<Ya5|oETUirxCw-bj%NAC3jm&%?J^!y;#M892WfIABijY*9K;p3+hgh9ZDO3Nh
zgMKv|?VXv!yf-hOhqVS?YAqhD0J^(yh7@~l<HwQ+-5D7?EO`$!1uuXtkANK5vLBcR
z%D_nSzy?@AqX4E}WsnVgB!0h2@&xt}QLwCmf_iQ>-u1U2c3Y4x6b^va=Y|fI(Wcrf
z4|V)eG(?22S4{CGQ3bw)=6k9>`xFyI*uW!gVyoK-<EfR0DS_f$YbXp6rW!4#3a~2y
zj`_}{d6NRmgn(Q?EP%4W-Lhkf2}iz<8b!98C5GK<rcs=;XgSa<$z6)b*a%5bDDpZ?
zeFxmWX&xFMNB|K~1QUV*a*=L9Nr^!cSb-!-h&1nw93D;MbPI}}W#0`1wioz7DAJZ!
zU5FYm0GPD03hK=w#GSKMnm8dSx)7lB!owb}B16e={ApG}(e@ZBIu7qZ8!Vwa>IJ}*
zh5uSqruPw<;U9@In!PL{5s5IRaR`o$S6>IUZMWfo@MLE`7j1{lk;hWoz+py#-PTYO
z-JDi{p)!U^^5RaF9ttMJLHN#dHL91fXz-h<u!7lpSs%jXo4~^U3ida`$<k&~R~SxO
z0(6Mjkfhg;W-S5+2~LX%#l+$n3+a7L&6*W`v#=rQmQ(1TKn7WNwG(I*<-4_{<Z0>D
zCIk4<G2qvq!SVqwxr6IuA<%pX<j1X6-{I7+x%pyZ)9v^YmL35cE*K1A?4JlJo0q&M
zd!F+ts?l+|iD==e-}Ribp~jH+ShKWGq-G+OdqWZ(Yikj>bsS98abt!!U6@J3bv0cX
zM?IQPv9;e+tPr*TSSkKLOtD5XFS!g_s!3DzaA&|rw1YM*Xe8cg<Ku6jX#uchuiRu9
zvsH7yV2$3nYBE(RSY`C~{w`Yxl@fB@wScN?6zN6obC_S*c93?EXUW96Gdc!-4QETo
z+*+W)C~8nP>Qg+;py1y>FFNcx3V}%y+?f&fBy>)WI;J4fA$!wW2Dvz*H256snCR1j
zlf-L%_xQ!`w=tJ(W9nr4Uo9vXL)VkC_Zmjgq-e^9JVv`SC@QB+MeUs?Q@6@~v}}$D
z436rc>|ijnG$lYvLr-f{Dm`024!X8vHv_IksJfh%ZhVj=DqceQ43NblvQ(N(D#cQ}
ztQ!(~ZPn_sDb7!hL<%L3_OvUp+f3bhzUp<H1r*kXt<Ol~BT2p5xDttAAHIM@OyhC$
z;9Q>4b#w`b&yLg?ZWa}jZ2ecaNO9hj@Eu5)&4*WOkfpMLl~;?W7B3yP2dbuE<Rk@R
zljUlw>}R<`cu%A<HD*(t!=5ax;7?HxM$1XY&wb3qEYL_``Y|R${1xC?E`sFX*UlZN
zAYRcgi?$v!NyQ~#Sr2QoA*6G`f|K9%;4TLHBrb(vvTDS&Q&U1YORL7F$skX4Xp~{0
zR{=z3;MKVu*%PBO_C35$rn?p#c)hfe#HLx>(!^vECOcZP#O%oDX4qW#+Kn#x*N_Pg
z#Is`=n)15UIaarL>KK<cV)u2omGIK`fPE*~K2)xenDeEG+qFm32rb?oH)6IRl-0a6
zX6pD|p3W0(^25R@FPt3A@gxze>XGyJFQ`W8{s>gI2lJw*G)no}&Dd9>Y6d~6C10vW
zRPK}Sm8#~|QghRPpcm6YyRm&IEx=tTOs`T~P-|rRG@6;HkP&@VvL`izpE+@n?G(g#
zLFwF|*dvw<{P&2REbY~G#m3^HH!q>z)^ANgBMO;fligzjN(&L+(N)(<jbZ%sR`oAf
zV~zkP<sN_x@L5#Gq|H4}lR!1V&t|OVf_`KxPR#~<llhYfkdAbzP`3er<2{MrH7+cq
z9^x6(L=m@i_a=;;TqzdTgp7JZqFm4Bk*EIukQk4p!E{$yv6L?Rkz>by6PgdpmoDrw
z+npv0_EO?KH=IS3=V#sy2vog@Gq$vdh4;OtJtHc$4U2munDS!UE~nUIAw>7AuD&?b
zgk!gYsIoYM9-;?RfBY=41Xg>bHnr|@Ve|f#F|huDTSjzok)WxVS2P%_c5Kv@VqStp
z^pT`nD>LB^m0BC*OSIa2J66Ta>>n*_Ch*g0me;9dP}D#qE7~%abbo`SaT*0Ju<I{y
z%Eew-+-`_Sv5;N{L#S0w0C-Om@gd7?>vrn46seF~-(a6-iIXeGj2*fJJyuLhjk6zo
zK~^3%Q|Wbw+PV`VKE*Xn<SfNVk*-m+kSYA_aF{=11ilL?YjYv``HWiCHJ{xRK=!^8
z4t^V3unHxM(xo#ESHmVPA~|0cwA#D{9TMEID`0>1_OVywv)+52k9^ymy)&7!-5pm7
zy`vQaehY1F(s)aVZ;q#TJRNSVZC<>zKsP|z{xX<F5Qc4Wmj!zv*9u`#itl+<5-l2p
zt3V?=tmfxdxbH-A+i-O?uOKsK@-b<8rBh{yl4%k1#5`DHFqlZV5eo(Nd1{(LVS@YB
z#wl(j*M|JK%wQq0Gdb1TNgHx|*93AX{G2kNe0Zp~@IA7g7h_6Bj~70@$UF8nBMg;*
z9no8didPllq3JES6KXN_x<V=<7t?H%-M1wG;j+|aaZJ`BWFQ2J(+2)7ZhdCXe*YE6
zz9@M-Uzd48CSh@&Jlf(ivF9ygxmT45gTmKa2C`j?Ic{HQj;j%_gPMW~#q#Mn1?pyf
zY97rUz-P_{dho+ctzYo6hopvmGM-e2Qd<7)AcJMoGg=p0mVn(XZT8hoz`cgBCw^@L
zM$qa@xR>dvg?eY*|J^r7YNdPAI$PmdLL>kT5G&gh_sy%I*#W!uhxWc5-?mk=ENPz(
z!`c(k%Al@xQv1JTo}q*H_)DDL)OIrL-kbj%XGE{#>rz5#z7u*qDDd=Wfb3={R3gdn
zqrUKJUHkw`dsp(z<y7*G<fkDYhK`L#Xe<KH1%D%;+Bmps?nN2C64mA8dE;C~Ba!5~
z&9M<2VaC<JW~4y%gkPsid$}IUQpDbM8^fKP$Oi~b4`8!&W5ry4nsWU5cvSx7@&B9`
zSzvqfFDu89tj@%mo`XEQL9i>5Lw;-jgy_&6X1^P68LPW3)DoRLr-u{3FO&2VH!h^1
zbV;vk<ICzP6Bn|j&M_!8v8G)}J2FU-Y`(l5dXBp3WiItSpsNbd1HXpOWe`=zMK1~T
zPSd@{H<!*Pg9rY*4mP|k=%DBEw4tKB&F5nbHlpBi-*fu?OT-j^!d&0^Bw|L>Lzn;M
zH<_15^X*|B?J;s*yiRBKoa=G=^6)*aFY&^gh>ghGM_uILKf>lj7Yg8)#e<dI3-CaU
zc<f{$&tm<d1nZpKK3~tmCzr`CN8Zmq9cU%w_?-{aEqCp9Ie>D={d51Vy{ZCs-4Uuz
z(dhER%xUpvD!alC0Y9%I-<Gvq))r4uG5QCfw@|yjP%9A<xxvA8krJ@NcfXw2ynUJ9
zZ&NOw$5q=Iw`FjQuSI*M8@Xv=S%WiW;NpK_58vTjPJ9qt9L<=rs1a$ar<vDVmF4ds
zeC^6&v1NUh|4;vra6kGyTkVf;!+_D9N6*_r`g6Q~+aY1t+UzXw+K1jD7u^Au=y^HA
z^4Vny{P`4I(7-Qc)%*?{ymG(iUMx4O$p4E=6q?^v%pbbBQP#l#)qemwl##LuteNU-
z4^|tvUO!R#+0mrLS+3fHlk4A3iZuuGRkKfuY^6J}kFb5)8jTOyhl$(fe}%A}b$55h
z-i*T7WLjF6*svw9<vTx5@S}4bv9pxOSR~!|oqO3sW#B;gq=)%g*Fm$8oF8+MAE&jw
z4MEy%LvRPu{nK~mQ?rAjKVC*75r|<B|7b5fHB?31u`c|F1ONZ_`kpU`M6*I*%Cq_j
z>BVu%;*k6AWmxt%X!yRU>IelgY-<%7J%k8#;sy>p-9kI)DgKXh#js{kf?u7b6#258
zUwqxx`)2J2!iCtELLQ?hK{S(KrVU)+s^mR$LV4R#t7$$bZG-JAeZH31Tz>OwA9fq4
zUauL{vc~`5r@{9&su$9OA4n}PK65wB|I>?`&g<>lAMS_l%9ZV34xi=YZ-?WsKMChn
zM+N>E{-ud~t=i^Kc$Z^vry{EqwY%Em#rO`a3Mynr(&77CvH2e_N5W~2-}~h;13T6~
z>Dq+dhSrHX-WqKDR+x$$4H<V*{9}w!aD60sYclfF<bg8gui^!#71`wTF^B~@)Tiq*
zMO8L1EaICGM<DnTTq%C{DsgkpU!|4JXAK*klcj{t8HZs;f-R8pYe<c(2|b|qy_Ap#
zClr<@M7Fjyhr47Pnm!>m^sM~v2b(X80r$buzvp*9T;DD3bq(ilo7hpOHnX3{vCh5n
z;@<vWdRz~)*yrKCL}x*amFknkh7;I{OAo|c#LVXd!+{x}zpBCXYUy>C5I1`9C;vy2
zaCe$&HBJ3Hozk75PO2JjP$g?nnurSx*GDj5yxDur*MHu*QLXMiSwg-nlI%d$x8)co
z;(QWykr6tL$MOqhJZfaeniJ(PVuGUUK%SN%>q%J8gDtm-$t^fmT(6EJr!ZD<vN*hu
zAd!gLklWAvB}I_Ckg1)Jsv~)=5k2tRPqpRR0_S-n6$c?lQD^#U3=zT+h1Q=GvK|-7
z8bht6DD?%1{}6X~VD3Jn-3&hEFgpwMB5|V6=}eomRtpv(15ZDdROvwLB}WgTvXP55
zYM*i~TbAk|U?Er4-``WT;6vHFdC}`oVVNW6q9XIBeJrRiYecs*+b|WZEHxp^4RJfp
z^?Q-0@za_bz_dT_Ammo9-CxU|jbE3tCb`ZYwK`glp5!uv7CPc2q-^6L11MYnDL_rH
zS`8PfO5FzzV7;F3rRDT?x76Z#_p{sc`?F-ui9ULtw6Y4z+(2Zj<&mpKy@QJFWE3uW
zMf))Cd8E`?TNH4t1rgdBawn0X*7Vo|*FE2!N=weM+DbT%<Ayse_ECjS=l02dZ6V^`
z)r|)A-ma`niKTRC*VcY?CW<wI50*~39F$p&uHtxX?zdRDizY|=mBK4{uT4ry912Cd
z+C#zUD&Q*DV6Z3LXT+RvAA5;La-b<^1i54w`-`itE8<uJ9If-Mmpg3gSL(2wTcB?y
zmS8O{J+T~c+4uG*^{85jC%rZ$itXrFQ{SycD3Q5aHMG;B?dX=ntytRou^Z^Lbj#d-
zwI2e$-6?f{%?a;eyb4M49H&T=9=pOkwD(Gvja059nn>$NhnnFdjo_VDkzSpi%HRC;
zM2KlKvLUxpk!!u0XJcm0750O+{87FMVO6iEtfXE-f;eNDUrY>)`8)q7oxU9%TH~}n
z&UflW+HrM>xPeFtX*r6NU9aZ!%U@I`!9_frZ*M)QgQq@em1DgVOUCpcqy)AkmumxF
z|8&z8aQZtnYc_&UXJ7s*_z@cqdo&Y6&su<egV^pII3{fW5kqa7j;n%U1wGc}0gKpl
zV%RXP#ObU)<3LXKQKLL}_RKkzdzi|hPmIRr#QwmSAE;bwIVXfYmcwtZN0+t1p)-aW
zx2UmPes7s~3-1gopbo~G;NSYg+*>1~wGT>VcfN~aooNL^&o8m=s`oXmdmESzBtwTq
z2M7DoUme<GDvox$Tc;+6Dd8R?d)f(6EW}{1+BIp>zjXx8paYB+bUK&fzPfj5Cbwvg
z=B`z_Vlh>xTm2bE>>R^3IYqXPc-@B+B<#rCzekkYC9Beu?O4})Wr#2nH=H@)HVD<f
zy;JHOjb6sNBELCZ&lJb5P(VvQWlp|`xWKhKfbxbr!X}wB@+;;aL_iBzgtETIVMPIn
zr+mtfyN<lTt2thU$s-G<_Nn#Qhm6x>pRU^6v}m2HDB=lQF|V_=Ntx3@()>5$`&J3-
zbsbsh7>7C4U{I)5)aAcngmb(4Bmfdx{ibHGzjP-pW;ng8R$>KGX%R80_MW(dhR|PB
zSj0KPm_5slsn*)*MGmjWNbQ2RoL%jh>&B636`by_mT#+$mK+_-Vh!V!I)y<_?-(&z
zHPPatS`wjCAIGx>3v<cp5RR6^dTf#hWmp2n%p@=BfR;nMfdS2C`8()(WB4^b1s;g@
zCt$pGVvKJHhieAb;KZ#gprCx_1K^!?`Jj_>*Zi6{s<`$5C-3n=rD0-TLJRt<?_6-<
z!Ha;JOkVcK>I=JO6%<cgbDiM*=h_rP$wP$KkJg74#v+A~#AFP0<Hd0?5pVTfJYo;J
zMhTH$0qsM9r{%EL!*uL|K+T$w>Pi;W{a_=QQSFWqNvCQ;a5SA39K-9V_e4q*sjh32
z=^@z;LQ{L^0I=>E4oy0K;zLlMt!iy;jxQlDOP0K&8OE&I@IXuK&<S}m&+!O|2$R$Q
z4&MH|uKTqwpR?lYPs6IL<>Y~ipDw=s+V}G~h~{LLTKm!tK6}>`Dh`kR`xm3<duxXI
zS|TLZ(Xv@lgR87GM|lll&PEMzjObAP4r=$>Y?fw257jZ}d^(BNIGtS=Uh405k%qcX
z4)#L_?WuqxK(~j}BLRjhyeX_(mc${Mb-F)0i>JU%-Z%+Mr?lHlN85c~SGj!+&vZ?$
zE`i*mP94U@G6W~JIY1P5m)WoZWkJXp)j<?w@_R4DN3xz|q;MJgR{<5T5V)jC{-4x|
zWTjNSR@PoZ&O$&$XJT!yigHOL#f=AR5mc|c2-=HfM{x~<j%p*Zm{MGax}N{&zf#!S
z<uk_azZb+&Rh$K@nEpIP<-Tg7N`4&d{qL`gtS?`RqPC39osylSl2Dy~NmOmI)Tv6v
z1baPtSx&*2d7tpEzw8J@Cd1>T{DHXL{2}U*s6!g)oG9i^!<Q&Fny%PILzSF<s^$zj
zsjE0jNzS>tW?9@N!uWJEh4RH$83V2sh1BMVgHqQt2hr?>7&WNsp}yvxL_;GLIKfFW
zDoD$Q!HkwXq%Jc+$u0#<=Zm-jlWu}qP8wEs9Lt!83Ke_wq8y#t#}{Z$3(cYk^swbQ
z)G%*Do)IG(!hO<u;EuUqqu4U))u~}<?2_n)Y}YrYD2Ei`ZL+lH_E^V{jJy|e-fGKu
z{w(WfKiBt(JlT_bAr{R;aTDIKbom*9!a>fEt4%2_ze^3prqfeU+h#kp0*($L(r2X@
zj@d3ta^qRu_=qL1JmO@79^)1MdpqS`ACqg=#~js{S|LK;smasAYyz7_t!n5XwO-qz
zejpy1fI^-$NvUn53Jit%!w*3#u1YgwvRkJqs&=j8w&g9Z(?RRivNG${D&W_wHs&S<
z_9m@t9QH{yZMk29Th_IhbY@!>vTo-f4P9PA6L+Rcm~D~IFHbLSD0?!b#xFRG;6=FM
z%Se%&PGnF8tS-&Kr-`UB8u?V`V9oaJNtpg~L_H<_)oe+dtYfZ{y#weC2M61Cw56r#
z@#wWIeZ7UL_aa$@Hj2@+pb|*l@h|F)R5?6fDT)$%N3|ft^-IeVzw6DOPjH*(db2U%
z0x6XOAXnK3(fYN2Fx~Mp28E^1bjb&>IC*RV*t>!z8%P~gycJO`XlP*0i=?%OgW@?l
z+B}JfyNZ|P#}BX_S+Ar5>0s(;C>qr*VK4Q#-dqEQkW5l?^9mXkr<Ji(b*zLJ1F#ED
zo?#PB@KD6^*1d=HHZGOrZD8gAIQ+T#rt0k`Yaa-Lr+5p5;0Ar_<G7Z?GQhxFR;!Iu
zdNQv>29PN*R<^Ls6;#C0x(Ufc<}0U#NMMND5%JTTQ+q_*f#UcZGH8*xBvS0fB%*^z
zzx~;-995vg1KC}OGJA3=&fIr3)l`myMG>Fe)7JO;G^0F*!Tr0SY&Ri<I!|1m=_M!n
zNy+-8<h?-f)&mG_!LZ#t?$TRF{P7rkS^WWbXC9+lYf@l5kqL6_N)8gCeHhU!C`PW)
z7n{(ngy8b(RIuZpN4>7EMU;+~l0a=dIq~uIosyd}QEQ+n<;U1cTOBSQOrf^Mh*HLm
zoK!)}v^><Z|9vn?rP_rI^pJm0KyJKX1=8`kq<>v+s`SaKfmvOO+M^IP6&Cke5+bP#
z$*s*g55q1{6WD9^)75e~cYtdFi{0D^YnhsUx=gmuu4Cr|)%Oj=Ug>>A)R^(wgV+Lz
zg&#CJV`hcz5HwT?V$bp?6ff<TmC%>lz<>kf-NMd;4JQ~LN&{H}f}7tk-B?d3PQ;*X
z_m~#yzB8QB?;A}zyT^FU@8@jO=})rs{}oMa@%7zcy)nU7&moNyK+r90f!L|gG347)
zdKEU$ep$3h*5Xk~>?vXOvgQoY2|A8m)5E{3b>ghlSfj{)Q`GUMh~;&Y!E(R$v-tV{
z0^l4U<59wBs5!YcriMM3vMs19lHXPVoz`fPn_A1+3|l2?f+s53*HQzXt*q`)t%P-?
z_3!mkvOJY};d>1&buSatc4Dknf_X2)qsqx?*4x%r88f;25!YaN!c|^j?TU9>xPD6L
z_161#!~3ot!@GG~i{*i>>0M7()BAaQgp$DEoV`-PalLFmdzrz$a0&iR$l#p2#A37l
zeWQiJxo`!<!~H`S|3f0X0l#a9!IFWf+2FX$vfbjocyP)x1-yUQ;bLe3sfyF4S`#S7
z69QmKTR>`6RDdy}(MAjwZO|A7Ye2`a7__k#cqngot(17J3}Y25H_Eoni@dmM<)GS3
z)UEf^Jx2F>0F$NTLi;=k{E?IUWau92e3A#WoL_US&>GBY3bVg|KK!gz79`Cl4FSZk
zmX*I0c1wd~e0bXr|9L4cF=edYTGkt2M{c%kUfv%wrU&qu?Jb=xp!mHhU75{brVDb?
zc}xZ)U715?K3dqDJDV?gC%sHcY$Hi`5?4Gv_%iw8i!k{Pc*Hh4%sIc6S{xR)q6HQN
zs_!ijZE7|ZpwOy(XpSE=HnEJta3#boS`@I^V#tRhfMQ`umOnBsrHn~gNQ0b1c@bl}
z;7wpyJZu6%Fn&@=68pEw;r$6J`=31i?<=9T%Z*@sFuN*#B7TzWumi>jp|sI~&X`OX
z<j{i`3E*08dvfIOA?r;yl1#Vr#nO+Cn-N9EnI~S@O}E$Ex{<eD{(hn*?B1rGXH877
z=CxYEifcxz%L6ma93!(nGMgV+t%S+5wmdeQ2qVT1@~XQn|J-f+=PjLu@z|JksI2TX
z96llOTKWE%p>=5+quS<x%SWy9(q*NFzZGBG;mNT3;(CN^N(YhDK_vr*&J?y);DfiX
zW=Og=<N2D)Drc)H`-G4B!2`9=!~|l*wb?|z)p(2TJ^#P~{(GB^FkxzDi{}w!kY_*o
zk@ig;m?D1gi}%O-H~SO(_20I9Q$1cYj07R+G}a)EKFDH`JxEW^0G&n{TMf{dN(eVQ
zn+t*5Y;F!>;5mc=uRrxcT@uL#!POBdbisx+fd`sa&1M^UV#SO~rUD_*h6X_;^!7M3
zL=jX~1d$LRCac?vP6knoYbY$LDX#yD^Q>43-M>uX0ENjg;G<15BNtw@ScI2mWE#y;
zc{O6hI;UDr*U*akS<J!#EsajoMg|Kpe2xHFpTFLJ(WQ>C>5!1=u+WVmp&P)8jQ9VI
z@>ex29upz(4LuH{w{{`fS3tmvMWB#MPDrFoywEi~w6`_PztB&Z++oY>pNaDzHCehD
zA?oxK=);2L7DYo%8=sSrgd!DfdDlitRjki#D1;Ttr6pxiWm$LyrR&nJ$<4dA#r7&g
z!>ZS->!eyKEh`mA$WMN2r>v`6pCd1T7uCv&N~0R#xNv$Vr?P!F+Qs%!5?EdVONm2M
zkfkxNEdSXPh^T-i$6;w`SUd<mwmrnU$NiZ_JEsS3zo!dPUbWED&tZ8YI0ny0=9z2u
zw6t~ZYT}2dq#-#pRPNagi|1t^=&gw}lFbx=l9W}Ag=A(OG8>{pit?-SY4y<DjH)s$
zURvU90VOWN-W+CyJ-1v?SSF|-EO*_>so#MqrHMx&pl|7)^GVnW4D{Y(_pV;q@SsQk
zL;djb73cll^%Tlj{{Uq(g-qQ%FhJb|0@6c5nhv|4&M|K@fO;2?n1Zqb*19ZGK{f<c
zlC2XB>f{aGP0W~39J!vr>>6_y?FB7#e0&Ou1~JhpQuClpSXLe#ODPqWfD$0A%}s|D
zL$Wv-$=bwnmM#s6m*?eHWy4UMSMDS>B@n~gVg}qaAug3Lmi4K1$xX>K`;HKlIs_=0
zsF2JOcAz#1o0AD;GGWLnHp1_-Rq3Byzgq$geYiLU;Tw%ol|t1R3{uks17>=PIFv=o
z8P;@R&vyzdkoCE6zQb@1S(rx=^no76AG>plVfCeDN^ITec(Vw`u7p8ZmGDGVVj^-W
z)Jp(b{HB+T?g_3H><2nJEhz^rEKZ3d!*j2@I~)WB`OwP7EKIp38_LZufC(J##~pLy
z$*INVLTe6{k6|Jq1za2g!NnCo7)VTAJ`t9kgDWj6!j<M^6JTIH0~L}B7rGb69Yhr8
z=MqbjEL?Y&J&TH9in1~l28%RW5afl))nQCR?y#mCbFp1OF{h$Z5-{#7J^kTuRwWF|
zs05VMrPZvwN0nZcz}_rgA%=l=;b-Be-*<kl1|5f~k!OmJ#zU1wEeIbKJh(4!+ggDV
z+KBoMplee_knKUeP&LB4s970bR&*rlEUgjwyMr3MUlNlM9i0&qosI#uX822H&83aR
zzOJmR0>ZrTG$XFWPKHuS+YC4wU5_hnqd>_e_HJfsH4d*JLWx)f0Y?nR5)_3G=4b|d
z=~*b-juB6#8}N1+c{PI$PZQyB4Wu$sm?kJFhi}N|q@%X>_+vcBc;ksM;A8vi3L?jP
zOpd-(ySx_SGUH>*g12D;!YNULMWiiKbV5n6svsyV-dyEMbrJ(wX8+!y)5F(HOE^;c
zVLuvX35FVtHDRMMt{5g&dkJ<45sHDXT(jo75TmcOs3riDjCXByco@i>ba4=FM*s6W
zzX<^G_hbC{R@EstJ2z)P+1O-F1*W8R=%;Mp{UQR4JAKWXm6%mTD7J8k9~I+KPKm*q
zurcL}F$|jal#E`(nGIh<r+0M$^)kTl2oJkb6Q%CzkOUZ~2cChzh3@f>Z;yrV-`(l)
zq5){J3&SltCp()#?{RP}?@h$>08T=EUuT+_9H54SNN!GU%;9hV#hNM`s?r8tGZ~dU
z-YU>NP7?|Hc&Y$!lVNz|4D$|am=_$z)2QM18KGJ~35@ZI`<#}7`6<D)FXo|bzNj1k
z%FcBgPw*Bm+v?>;ZPtYE;YjGxM1?SH2V=!Hv13lcxG4GyBWc$BW^4+$W|}MQSvGi*
zBn8z2z!F6tgMryOCT%7;Rudbm9+7B3eC-^H+ZI@nnH=w&kCFKJk+@hVSmm>@o&E<W
zVw^*lUN{F<A3asHKCeJnSXdy?ilSn1UZDWG3x#4oKLdeGPe&j!gy3&Mkic`>Uwcao
zX&0j{Tnhvd_F*Zi2=tXu>mcxi1b9Ar%{^R<dxdZzXA_QGLz02y=$*C8YoF|Ncx^o4
z1=40#3-`=a7xcBhqT6o>mkZO?c?HM4Hafg|d(5{})s5HQo)3u2Trti!ZOk90If>kh
z#dKF6i%>{Hfm9&F5fU8B)Yv^CtMWLWnl+d{7Wub@%Y@)Q_;x=s(Lro!p%r8yN+zlg
z0izioS~T-O00pPa$S??$OM-zFKE$w|u<|$R+0GMQ8~eOGEnvnk5jPR=N*EXw6}ME~
z8-<l>xUEQT?JAFiw*4nZKv|(zF8|<z?cqH6+xcuPmjO;$vCCmwCsEZbI1m2Ic;QX_
zz**}Gg=(pg7PRxX3>)pAL(C(dvx+4tG#n}<G)lfHqDIf~Sdy)hM9nk)^dqY%J6Jii
zik4dCz=<%44i4)0``{Y4T?w}`<&oibR$ewM?s6HUp3!2fv*(3tI=d*^f7?f?y^Jhf
zK-jAbs^JP2TV+dJ$E_<&+A`)AOu~wRN_7G6FvY%t;1-yoz|?&T9*Hk2D&ilm@&t0m
ze~<nBUr1hk!#nw9tnikr62D3pT)5d-hkMPLPZ-zKQ^qFaiHqt@kgLx$AT&O3Gd@4p
zfK`sNl8P0@@(;!1-^YLQZ)2-p4sJG3PkdVWwhDS>H09|l4usgYMR4HO^_!@Yl)K}P
zimG8<h~&SWV^-PB3f<CHaGnEg8krc?CK6>Tao2u!797<?`6>sHjEKJLqx#{IH;k_2
zHb;0YHlp}Sc{Fsfsr(o+tLUy{+qw>DP7KPBZ^yIK!M3K<!z%0wN3+KN>Ctp(bIh$t
zc|@fsWae(Qh`bcMaI~rXLQ8-;EwLlVoI{MBd&P;u<t3aAPk_~le-1lm<@2kwUH|lh
zv<~2rVOv&Q3r%<I-^I$1;?*d4xHRdOb;{=OL~VE_3eq%0ZV_DB+UHNnD9Eb{6mH;Z
z(;i|VX=;^|p?Pxgx275Oj;YO~DJplO{;0u=w(^GvZ5I41&Wd)&+?tX{G>Sq&9#RwM
z`&`-Kykjfx(?K>JJwkmPfi0n<6E{sKl00vfmOO7|ap*!vqB{(O;xNOT+7*6nDZlYm
z@zA_Moq2;=^9DKQ4Pwn3_=H~X<xBD!cwoS)^t*FuYbM`o(9Hn+@ujKyCJZqS`>en@
zQ4~LsHWj%O+;u1^mLx;*C;I&y8TvhUH0K^Qq>(1jN-<w5RlU-dRr<8b*jAYqD{C5E
z{BGsv$8g;Ddsfn6)H^p;Z`O~$al1b@qtA6S-r~Mps9E(nxU0i^)$xaY_1_@59EFM1
z5DrFt?DBUZT0FFXcHWo#DEbIoBVHxaAyE)5My$9JKk`tj@FJq`?0Oh+zdww;wOxx6
zEk<l{WfuQAg__I{0SmCLBILl)YHP~cU%R1oz|rudhke*qJjb+nU0-IEf2xarsla?6
z`bOr*Z=UHs@$=Jp*0zr6!0xs?LmBl`@$=*UJOftktJFSS#|DbfcjW-vitV!R@iS<<
zbX&(+>#a*al#6^2x`$SoNZ1nAEoGj#7Bo*2SyZo2bU!f=TU?J9-<#|BS-x_@NvE84
zMzIp5&N}D33odS#Zq}W6i`J}4KTht$fOMVS)Z>&cv@a^&{PaZ|l@Uq`qc6u_sTH^^
zMjgEI)HBb$(CMWvue|ogTYo$B?)+KNdJ8~bD4)Pe_Kyz+KF9vQvgnuR9k|hW@1FSY
z)x@uRp51>OAKE{-{rvUsiJgD`c`%e_fUs8GUyR>me1!HFz$gc81m{ZtFdyR7By5u3
zzDXsS^e${KH=E^beyrG`&8D>@N;xSlDAZIYovughMQ&D=6ql4*fNFjpBuOR-!}gmu
zoz!~h%ol#%5U7%{j|f|1Vo7MO6bqrKUD<RphOog(K!0Q>wo@!lGUwydk{?umzhuuT
z5bk?Ke)BghGWEFvwgzi(-=(t<>LXZM^pe%d4;x8oHrPb78aZeTerReij`hu?kYr)|
zLu)omor_|jL%x~rf$jxULJH}Q^|k^i+{6lrCq_>e`|JnG<4uKVGftCal2Gys+i%uv
z-anlvR=&C3TRW10Berq69Ar~C!Vu7+!Px64i(#NF2_<_W_3F|OXsZ241Jx;`GzHP>
zeih}lTEJl)ISyhlkE;rTB(U!EQdH=3wjPv-@d-Ub3ci)0*Ko-o$<2@qj)g2&>3?M(
z2SE{pr85$Dw8GxXNR!~Rqp&t><OJlEEJ{c30cM~Hk%6!we(c*6BjaErK+*F{90Oq<
ze<AcK?VBt<y4Eqoe_VHXpmQ^D=jN|#{3sivDxpQzJ+%z*sA-e$Bl4`GG*BLEb`EAt
zo1$Q#KWPSdWv9Wicr4{Jh;_&hiB`?R&VplEHQ<?(tZDAa$v7?Sug#_l%Sg4TNYjS1
zVfjNiyeOr7jIx!rABob$Aq-Je_93oLCFJbB0~4RtSv*F`pQ^^947Tv+L!%19I?34|
zOA1Gx185t*aEA<%SKR>mJ!h~H>%d?LXsKL><P^CjiAe4D<qq*UwC&F_K>ZCb`5_^+
zzYE$`=L7lk6RCq2#`vqJ!+p*JYPr$$RRO=!a1q*6>AXKleN-mSKgyq@N${Y_W23k%
z21mvTx5)ZAu(mv=lIS(|&)%+eFdl>7l)DvWVlae;pk8+5V69VnTrFIMTe(hycAw>r
z)oIGQ4&RG*RmU@T?6<r7qE<LQ+GjE8wc0%)-pW}iS=jqzf<5NFoZ%@;K1u6K%du<>
zPKQp9mU>*_1+MCNx+Z)7bibepm=oG(_jv6@PYNHOIgFgoyv#X|^)F|>Dw{Q9-I+e*
zJL~4Op66<;N0(rfKJ!mN8Kl8WDC)X{fm5B6o^D_1qe;<}Z5m+>)}{mS+8o*Td{g#+
z^_+`q>z)w${<{6dM^#a3RubjzJ=gxvoVl_dl}YlC#^-3S?g3)S8XMW;>>);GX)lj!
z+ifdA?ip&!xC{Q>ZIed}ITQrQe3ju(x~6dd^f<5CHwSgi?%A;ubrwE>a~L_Fd6{!w
z=-=x3s%F+q=g#Chd)L|XhSSVca5{ugwNlP&yE9$__c1S%7ctW-OH>QT(T2gbo1qws
z@5$CjH}T0|d1tklU5?WyT)`<=ar2dQ_SOCH-~b?sPN4r^PoZ?5@ZGWf>F0&&9Z%Q8
zS20L2OSWg~&NzdjuZ8%vH}r=qejA_9S}y9EKbOqeriH0d@*cvTuyW`j34S+I@V-qQ
z5jJ^ocFS$=gr{}HPITZ6Jyinen-UP^5}eH#!?bKfdE-~JbmrS4)~<~}chZ@6M`<$=
zy4;!-AD-#x@Nx5hrxSDl9Q*0vJMGjR4|$qY_s~0ki*5u+!O!uuXZ-l0{1@2-uD*?w
zp0X_D90c8^=HEu|uifFAsU`YA(t=xBj;y_eX6|zRE{T7N8aAE)<>sguWDJ;qd7yF;
zdzWv9s4H1ZbZw&d42N~|y0>~tlJD)ezo^iHAsaN36kP#{Jp%jh<!?0w_u=6*;SSe&
zi|%0;^Y5}hq}|gy`9<$kciH>o(P*L4{R6mlA9IoVb_iW~jC?!y7J5a7<dl`$Zs8u9
zVZibjm$G|*`}oczgq-RI=1ik(-+qz2J*;g!db7}G0ew)GUszCIeI#^Vlk+y&Yf7}^
zc`YNLp1A|HbXYZQLfrNshx>VJwc++#WGNd@8d188(cfI&8llIJ?a}OH=KG515?HV*
zNyq9M``Lx<l5x=^!AaXED;{J2z9YMMO;tK!5blB;3gJG~LJM4s*N&CczU95C$0Tco
zBo#y(w{B9>iYqxGDLUbWH68=)))R)uyzJya;EeKNVgT>14TMgK#@j6d_xQfKp$CHD
zQ#|dsD0+p{?k$q!-CXLdt||wAKIhD#NHpZ?w3>6yC|Urcf%Z_gJ+XO_w==GKPHRt@
zi*X}~DSOY@djexqDl4Y(c8@lOl>4?g{Q`))FG4`C`vuV?2Z}%N7`m)Zh8K^Dnz8rw
z3<J@*IMJ8u$)__#z@6aIKHz+|$vQIY&OL6K_#Kgbdqm6{B#o=UV<9<e!SSCV>mOXl
z6`bZ5A@i5r#}$0$jfnY`>&)0Ne{o%XXC;Ww0*F~&LG7gT-QA&EWOWI)SKX|fZcAx*
z$nLw@o6)MiHhl3mX1iTPuPb~wPA!vbPCw)Up8)Rw-vGzD>d-6$XP2=7xedUmcPU<)
zrFb`-ag+l&7-Fze>4et+{Kx~hy|-t$ZG&D97_G=109g+_1l$em04@Wb1-{vB+18?5
zvyVD|{`xQ`m|g3fvs%XH(c9~Gm&Qf^y*bHdLZI~EiOCZMawTe?pX}c0RE+`PnQR_!
zg$Uwrg>ge}MX>d<ksNPDF<0qUR01;2%_O(2)G%$}>I$#e2|~cO5i^Z*Y_;>jv(?@k
zH@|W!y~EXO4t$J21X!O<02w54DHhvwp&KSTUdvtmMX{xnU21f;k=KXW66_JCy@e}?
ziXtq^n2L;90NZeG9w|@BXx7HCqu6X*&aesZ?=0Z4;lveR!EnPez-c5);vxZsx3Dzs
zk4VuS7H?VOfCOyZ*DIR&m%Xr!>y_~4nIB&Xlz@%T?v)9XLQ*<)&Jub}&SP`mgw!Hj
zKPihMq+JnFC0?8#WRdZBIahZQ>^`u;3xZss(gO$!{;E`JbKedbNCtAT!ICQsRs#HC
z9RqAA?bJ$<2V%KLt`kf$IknVHiJt~rkMj1|0}u1Dj$CR}*`=GFY3XNRdWIR9Ay7zi
z-Av82OSL>tJ<(o7=2>K!Ro2<e3~J2E)@*a6BpGwD*;8Yl7oK_kkK@Wo(&n>Zkp+LG
zTG}!TTW*n$np#m=&|twWZgohj?6J@OQ1*td+yOy~+YpvRIA1sl_Sfq0);K6sh_DC|
zBSp5>x+qbtj~3kqog!lp2^ZlJ$l2%&bE~wumLX#cpGBNRRh=j?XK~_{h!HKe_0=Rv
zs@B$IT(~B$mRohz%ivx^3LX+Vn2LnhA(KhQHimd2^Lh=oyXKRrB*U94?Xy8N$&N@V
zl?F{(1hlu}ml%}R@vtb9|7Q1d%S$J{FYItf7U+Lmlx2E<uJc`pGY!i4Y-s6SW0$*<
zTl&K>kj^qwiiK^7WrTd0cde$b_fO5;=q9Rv@cHPsl$tvA(z?~fE_K;uS1?gDXw>3v
zSGtNvot$C!8M&j`4Q0w1Gi8G7t07kv@awhv7kIln&2_hX&RJnOPTEOjl1XyP={kBK
zU24yI)MMA{>}k(>-i!X$%U<<EuZ=3G?&b3S&)=fTa7Hqkv5e<iz8f`W99@=`vc1&h
zmABsY&-~1<{LUXl{$>Ib&QC*<6;;y>)3P1c^R<~QHixUj;|qi$aR@w8Qby^@^=O4s
z-@wqw*u>P#+`^J*Otp?Cv+L=I9K6A;57M<Z80?ADtw20m?FWzh0s%AOp+oJcAlofS
zD$ZI(#=E363V~okjKp6A=-Zq9e1ZCLtBZ?VpqR`P7!@o~fix6sFPTWns_f<knwI<_
zAx2W?l_L#jIZnx0=S~gzl<z0Eb^0ebgN6QP1Ir)?dEj7O#`d}cloOKPk{}gQb2cy)
zPU`ScfUS0&JQo2e{+e#(&EiFa&2LajK+x+jp#=8EE<{F1%quwLoOCcP7AO+fAlQ~N
zOo;b*qy(!4vg+GLf(FtO;twPkHPtqT1L<H3QZ}C+B$ZM*2(%SWrGHR9-2oQOdZ+OO
zqksnr>3-KHS(5*G%t^=ha9}+aI8llGTuX3D1#*CGluG|wkyHxm@hGN`E}g=otCNRx
ztZG4hGb~Vebue*~JsQ5o^zZpdO7vKHckWA|av@%{A19Yw05(e{x)&^@iShKh#Em!Z
zKg$G{nPqkf8^>YtE|eMg^q#QBd~ts|`VxE<*o=yz93M9JzIcI5zVa&vfljZ9jtlW-
zvbg|~W2bt!Tik!O*5|y@jZw0zdWl-I>n0ZafF*|Z6OFhItTBI|>aX*<QM6LTwnVq8
z%~Z4N=%U#!)5m1bm#5us?jz&KhWV52l%K@Rjc?IB*_qt^Ln-jtW~{L9z8T*a_tRxR
z$VAfAI<4I3%Ix@`P0ZSxcm-7_eKGl}2)52_PAqDLu`$>@30!jjTdo64g0aD|&gh`7
zns#>Ty}L_0s`l%u=@bc4Gw+NdhhiRdt=)j~*Rox8|1L4?^SkS=HnQGZr48IFXd|Ol
zN*ft%m$aGFj*52Gv|ZABU_?H%Y64g+lWF_*_Bh{?1leUA+@+(NKhp|+AZGv=fV*^*
zLjgw+<^VY0GHw`i0Of=N2tz#pwf2QR0vk1-ClCQk2Y^D`(m`eb2H+?(6aZjA7Jvf)
z00jU5VE|AA^by!7fF?kKSYk6fnWnQbD_EYNQ_RxtWXtnJCilw{D;fzb6@-<5^c$NB
z?CRhg!17E+Ug`MpR7&HhgiciE3waYZ5w)SlT<N|rpY8*Aoj708SS-h~2vYw$GHCiZ
z`{nByyGpR*PK%=9e@8!uk!zx=I<IlWM7V*|EY|83JPwiQs;WZdoXBA}+RVSi-1!^H
zThiF-TS}EglF08&sgu)gGCj4cCtK_*@7Q3&wte7Lv!4xZ%(^ek`r{#DVcc_jA+GE-
zh%Ymm72<jGm<?=a1x$KzHs*lv%-Z7mUWaBsE4uWAvQK2YyYg8@2I7+I-f+5@o^qq-
QJN)!9`=3|8xC;OP0Ecd4aR2}S

literal 0
HcmV?d00001

diff --git a/src/static/fonts/Inter-Medium.woff2 b/src/static/fonts/Inter-Medium.woff2
new file mode 100644
index 0000000000000000000000000000000000000000..54f0a595dd3c76344a980109e7517ed42416de93
GIT binary patch
literal 24272
zcmZ6x1FSGSur0c6+qP}nwr$(CZQHi-ZQHhO>;5MX_r5o6)5$bVnyl$$+F9=MVoU&l
z0RM^JJOILf6Ch~Af4c4eW&0od|5vaA6|e*A-EdYMzzq16RRmSE07BUiA)o@gIRXn=
zpd;V_0NH>@fD<r42tY%@zzacOz_CM~$Q63s#Nc{0RlzoQe)c{=x6PEN-(Pe*U`ktp
z%!z5@fnmP0XMg|xYD$Dh1NLCw6>lt42Z$)?Ak4y|2oaS%Da%D~U6(5#H%VD)ADQF_
zt$SDe(nD{qO?Mg6_?7BqYEbG5z)5`NOeV3AnNc7h42ArakRMwcHtq(?UDofmKxAEb
z!sxCpP<HCWgo=~FKmq^(0wx8+_ZI~}*703`Hy8X|u>EzRXu+|hjV-9$sv3fXe_pOn
zwcjT!9Wvv>F05WOPKg-o4vMX;W~ZM1>c{@(TAh=^;j>b86j5sypjY}oJpJtaZ+-2p
z#o+mf;6y}JN-n7lj=-_sBP3b_u!+f2fyvSQz9TXUl*A6&$IOsSS=bUM#S4niS|{^%
z{yO*r1MVSGK#veTK=cYhA2EVDT{A*pDU6olmxIPdL0H=c*Tt428e`W-N5v%Df;0qM
zi+(DQqu2b4`@H+^7Ax;n{e|-1Fl`292c-uoIYQ4^^R+#o<Og7R&>fPH)*`U)LttCJ
zgKe*Wwg4%WWmk;GBn8bGTy|WhZ7L>9dY4@o*0aQ=mU>zgL}0&FDT{Wle~>|Bucc(a
z>%0ElGm1e-o|_!F5uk@O#?ECVDNQw*VR~ma!PrjcFxt;CrF*f|r~H=MKt5U${Kfkp
zdeWkxSofF!v|Z~{Sk+dYatf#n#0}Q-y9yN|(vXDfAI$>wF5oAVTSucVcq0$jiVB(K
zHp=}sT1zK2$U%{cMP%*0)_WreibxZY(4DDM|G7%($drgoY$rwh$sj6^ODt{>TlNzN
zmIa+%rSn`pd+#vgS2-+1q_D&ZjaN|ENR1K+8Y@~Tte=lZ^>kDH>-^Wh)yED7!Ax=!
zmb9JcU-$7-oKAxtdt-u}W@7`W(H;ERAuj0RezuDq0|t_mxeBfOyHf>{E2$+VubQvW
z#m!I@BdOm!O8=c#MPUB;R+e?+59HRN&_PIdYbuo3g%B;~5S4^ubhi7l_2=IC{?)i_
zBzfKdK^~;A54DIRh$jwkGGNL97U~k1lv|B}<nTBhm`+4W{)wYR=bM|mrQ_+vUOL4z
z+UBC$&GOyfUsLk*S@Epe{9tc;E?ONZtx>s&Srljd)2B=|b+Y`Gt5k`j^p5;5_aALB
z4W1&@IHtITRe)>)V2hgc2z6q%w~4z2@X)V%9l86mhL8doO@x`%Y}1B3qj-Y2ivU_g
ztbO;+ZOfJp9)iz`ZNmg$pij_)!0pDxoBcHP66cDuh!zi^t7%p_52p1I&oegP95hz+
zKsaUm#Ar~ygaC(2z?ksgSL-Lek*#pfJ6x&9wLL7xeaS?YMvxg&QcGJUApD+O-Cp->
zG6_UTH$!%;$tCfiN1yGfGGDx%g=7NlL@Jt^QqCWXE8B%M7u_`)pKu{#nd>-tHAy?y
zU32-+VYxLf5`<$`^pAk3Z-kU#ZSo<FFV`wi1qGZGj0PgjcRS{BAHN7Ttq5DwI6-g(
zPNlH_EBWHzU5*cIi;FI5brBI!T*P-oMTA!Cs#Z1L$V3<x-}qZqCXhBwE{2@CT;uF<
zD!+f-siIqBgPyqjMI>Q@65!Uh@AvvIEeZyBfViPngHnVDaET;($r$xGc5=dAS)oA)
zV5kU+fFUtkfkOgO!So=sDPFLG8ezy`6rNONm;#&ye5sB(#osw(>1d|HEEoQyD{~=B
zHnixap~xp}2-82*L`EwR5a1`EC83H$D?(y+5m-S_44|@2fuQZ@u}_%l;wW8=+(s7z
zmxbkUG$aNqI0Xnmu#Dh}HO77;e70!I_rFb$-K__`CNu;Tdqxgz0klsQz+s`i3`zX!
z_LXf%1xmpT1Qr$(AlUD93Kt8d!CM$%Q6(~APsg_~rN2`gs3ALwN~%Nwu{mvWRwjBl
zyYImW$x0a<_D@{$@YKac0vS8b0V*CzKNXBE)nRF2TBZcm$&yGs`Un{2!2P7-mQ<;~
z=PmWnH@&biy599X*n@i#eqT8wX`kPZ!n(xmLR<BhiZD=RoCQU0`ku{7Uv`8Ko*jmE
zJG8iXE#fu0n%Zkpy>VnR65j5NjG=F8RR)a@RqdG-D)bOT@l7B>cidrXUu)Ua$#hE1
z;4_09JTA-P%t`Ec+#QcPmq@b<Dp6=sHBMFqRTXN#73CrMiOVpmy9j7x6`;!pk0kp3
zY7d%_{`9D!cA>{_i5XxT6o=)*jwW+SNt!<O^k}$a59k14(+)?2k&qk&Y*aiX15rt-
zXB99B%|fdk-%drQS}FV<+4#9UOHhJLq#H&`%#`=IV!TfL9CflifmU}d$|C?x2;X-L
z{6>zJ$Jas`ZT*STZ6scxjHY$J(4X3^0FaEJzsD#2YT;gO3SZOR%C;0p-Smq>(#m5Y
zp`izdR?;eFx;G>;)WyQ0P&+)`ht2*&592J1)WxdU$Xtn{{2Y*GV&5QUpv{jk91e<@
zU<5(ylu6+UZlJ9(q5NM^<%L*UF=euF`+1!%V#>?sD4Qunw&1Q{NZNzmGZbM(AFWx7
z`B<U|(}!YN@0K(%2?3e|Iexhuau8`n>TYVZyDf)&X%K0Rm_u=Y;Jw_*3o;5b7Lle5
zGol%mLE{^YR0n57>e7T&x@NH>v>EPNH0X$9ukTVpqUNDw)3gyFM#S6&mtqK`K|(*Z
z#{wiL``(WtP&+1EZZo8jm@tcVpQ7l>7j>bOZ@-dRWL*>8G~4R~iZRYX{k-e4oFNy`
z3N7v0YBnC5>tg=-K&YAx;}Z=ww0O|wBKazA8R&63dJX*ZIlJyV{wccefW?pRyKaKF
zujBQF)#7qdS*Vz*Mg@=Vy$#}_-4>A25%ZOkJ20?nfa!{CTn$zEsGNkibF;!BbCUi4
zqKxf})-Q|*$O_VUDvon(4*?7Bx%ZyvN2F>#yH_<l^lT1PmtbGQN$`nD=$g+uiN+n$
zW|O{VeLq8lMKbU-m`5?T7cR5t7HW3LHSk(tn*GZNAwx~anicP@?T5g@d>^PZR3fh5
zbAIh<Ii$kiVC&M7Sqt8DfpL(6q+vf9TQmf0WCTi7?NK{L6ayOru_?{vG(|(hhR`ik
zt#XkHS0qy=oJB(OQRN}mTSB$H`PI_`d!>25(3lh*3D2(CKCgQg(r{+n>JNTA0%STJ
zaY|Y`WLZeYi@q-~cm-w?(cm;YDLc(_Ys^o(Z%=amE9yE`6azLR-F|e>x+VfJ@^xFX
zA)8Sr>`r5I0<0cMJMq8b{gp+h&Y+(p!)3Rie)#Uh+P6cNcse_Q+4N9450#lr0fN9J
zQMmwl$O(WDX{r+;-m`x?%blOo@bG{NQy&PuB{7t5M1G4+Iohwr<AXq6vxlZt_7yyO
zq9^<sBLm_pl&o$k@AIVL++`I6W1ij5Sk^+xm4s$B%jwdQ7dDb8cSRR*c=o=U^px~K
zumN#X%K#QyUY;tO3>^Dr7gjpA-(5xM1kT!tiP$OOMY=Ai0(TjM^s!$XNVM32S+Q|S
zMAIYM?0<L>%fBs^<5`5pTfs@i{6d9J=mL|+jORr8_Ojg50pcv}?UY5({b+sgoFPRS
zSfWk)3V@NUzciN0p^%ekW#qS+OmzznC=S|GEQf7;Ck3jYEB0pZ4Ttg8#*~|nn73^u
zZI@ftkHe1Qfhe;yvFQ`TsKCGEGpA;9eqgU@b!+}*_fWJ^P$C!+pwH(()XobJ>zU-C
z7<@6v(r}ccn53~f_!n)z483jpuH(Wodz)hO-);%*1rC{+t;&9Ckg3NCSjtn?D(TWQ
zSz8*_vurD|JeR5F;xF#Nh@P&K7j3Su3$J1Pv*naaH{(Ub{dyk?2sXk<j>A}nbr&q$
z7!@J_wGs^!P#MUm6{6r&i~~U#()03kaYZ!4jYhaputdhxDBK6@&?AB-Ii=f9mTgKo
zHE874BazV+8%3eEsEF_vCzL6+L`SqKxI{<PYTvh`5&V+VAX0il2p7zQ#|y}G#9Bor
z;*u~zk*Mt)mMztM!1{hI3Wgkz%Y`I_OcO$qh;mg5i<coTroA#EWYQEHFBHcN_@~uU
zgrN~Ki7r%VtVWcoO)`Z6jr>*?Zs08)!HYKur|NVoaMo(5QywQfmFg2rD@1oORYn^;
z>$svVdwT_PJB82Zu*Ln8(R^JF^8o`0u0M(zr?KgIp&A8>OY?=%dY7Jwp;O%SG#IzN
z=Iuaiq}$4!s`r$U6VKKN<)vaDP;RTOZLzbugUd92A1f5yC^$MaZ0ONTUhXz6U7=VV
zo*ka2rD;TSlid_GS){q>$Wq9lVgi<oWW};H=Jia&!bby`h#$4H-Iw<i_<dMG7{q~A
zy`Bwd+pEXh5i2C_BM(KInZ%+!0=GKcMM@Be5n<;Mfo*AHnTLYZ^^=zhE6W>J`|*fs
ztWvq)rxVXaM`oJMPapI2mECD76==u};Gik+qx~ucHmyjQn=<Z=X4fYfeV;679C(n~
z1i1=!K%F6HKSW%SG=k883J3H+iHYAZs;HIRA{-b4GGGY@F(6j;#I6k_sj3IXpIJ@b
z-*y;jdJDAtG$^JJ!v)M#g7J;I>Km@>^(hcVH?9Z&>T^QVQk6SX#6QyXTPrHf6-HEi
zPEcK=sHzT;)Fp9ion4cq_9UL5_4Ww_S$-5Y;coUSSP@WXo9<6QmFakh<1;iFpb#%%
zFk_dv83I)=kl5k}K8AoJkHPB$(B&y2Q*Wdb45tfVAVAaubV!9?xE|9EY@r0oM|f7A
zdWIAUN+<{+AxJtw9EUp_k_SM#fG1GT>IDX5k=0Y0kiu&jnXD|BSB)s!WJtGAm<CrT
zx~+o1>4`{C#z%@O<}Vcwv9&mPoj06fk2x{QmnR?pn5&p}^WImPJrdyoAj9(3^kJ(x
z4l3jTQi=22UoR@_TC&(DW@n#>D)IA5(He?~#orK62BN9(L`mO$A{`(}!A{-&>PjZ=
zeX;<*x}q4WER<WR5B=oqk<y064<>#C#ik14ceN&JpyV%Y;8x|HJsHX{gFOW%65azY
z<(1<KKNmFvfgQv6ij$paTgW>4a;&sT*_jr-JUHn(-omsI@y+&Yx*HNo#MkV%JpzF7
zlx{3=h51iw7uJ_NNmm71#Qh812zsH8sQTx@@ssPZNFl$@`P_4~+nEYam+g=NuV8?V
zk*eEX<lL<+RgX71FLnxg&!uXT;vxJ!{sdwf{I#5+#in6<SO-?CkcJdL3pg@5`N3k)
z<;`|vO}c5cHz0=)lY*m_nAs5v+Pi>yQfV<KFHj8rcE6J`D#*=0kpn^7b=N>6*y$`N
zUuhL`BwVKRj-Ics;zd4lY%jR5fg}jK0t$FS;8(B{DNkg#^?U9y#+R39r$ycZr5+Tu
z8O*AYK&dgbn_~6Y=gnP((kFinhQlwY@36$`bUBtT1~aUAkkv97%0x=;WJKYr;~`?!
zCD2)+KB!lQ&KE@KP3N|^p0i%;RTLXPn>sZpSPQw6z20axqZN35IX1DPYJ(K6tW{PZ
zJqdK)>d1X91Halh=U6;n63mp;c7&>v%&3!^l)IP$a>%3^QZYUx&X2trXbF5PV2<HN
zCVTb@!+DVPrq0GTZ!z7gKp3fa%$Z{28bB{nnBQVm0NGxsx*&u$pzfLbtVP3nXWR6c
zt|ni@C5(i;68>-lNUAt_!Um4v-qUFQYRC~Z#jA(7;x#BL_u?>TvY*tM8BU#HZG<Kh
z>OWtrZzE~P>SeWidEcijZ8}-?3X_zS%_=RV?-1vqcQFn*gHGskBki)S;v#G$8-$kC
z{aKuCdn;?$8-EfcubxFs|1ia>6nqmwTolSPSm5}q9YQ&srtT+?AP_NiHWLttj7PVL
zh8R5^Ehh|yq)i&$m2BoQ0?9e3iMk_ZO?G)QdguW3`g*|XZ<5B1Lcr|J!!GRk$OnIo
zw2Mri<OGHQcv7Q|?CWeWHW<o+KHvwP*M#>|rjs8q3Mlk8MW<kQowGA>k7p08m5!+U
z7d;t(ceoJ0ccz3Q*TDU7DEUU50z4YvBGXxrBosj(V2#>cwgK6f!2oA=gW7?MWokmJ
zk6*)I7)}m&{i~>v`OQ@_pv)E-RF`>$rG;kA=V1(;<F|Q``|B>Usl5G(nK~jL<6U@_
z#pYFyDfdL@;h8OOxQ7JX)3$4<2dKWK{?@3+_3P(dR}uvh-G{_M&nCsQC0oz^VlrR$
zz!Reb<x{r^#GR((-oBcokKv^)056ie22nsUaQLwZ@LK=8Whv+a`6ES{q=5MF8o#!F
zF>?!3)txVz;dfEQXF{~s>01Zu(f(yEo=!+D3}yt&0dGW#7s`Xzf+xt+)Q)hW1ErFQ
zG0w+^-IF(KH5(-Nf9<vCGwxc53@nclQpwmO84(IVFNhX&(ng9rB~gqs2&k&T#Wtrl
zXCF;(3~!8a4siZ^IDL2Ampf?BDr`*>VaGABpfVpO)%F?tqnc}|IjV}ZG6sXm0kA<7
zwgIwW4wI3in8uVsH7qpK(2A<XG32<!a@c_l%eDhrzB#auK)0W4dnz;tmw-`p`xJ)h
z+W<MNL_jj!qQzAQW6VPGCP4ZdqEcOSUuM*3MNUYTQ*_zH<g&^sJ<oA=$x)YA3>M4E
z(h1dZ#y*G}Yaq`f;(3But->u7Mo+WbNx+*^?7fHDv970m85MW&<um>~1h@SGv%q8t
zyeOB%`hDX!nMAp6-@BH{ZX<|cpotU!(GU|vX^4xeFhIgxFqDM(7huYWh<v>SY)C>w
ziCDHIWciBd7&}N0f(;aGpln51c#QHtO+AL&et3vZPR~D+Qx~qelothNFw7vCNidm-
zQ0PEdL!r4KOt68F0RkonHc)W9VS~Z!cfN-FhV>>Cw$_W=rQoghXAxSn39WO-ZOdU#
z+|_Ad1~v&E8_HFL=!s&Jj_B+-N7K-G{iZ3Lyc?^I)io-Gd<7^vq=KhqfxWx_B2c^x
z&wKEGlUodB6oloX=pqZxc;^t=a^^iXF&F@Z(pd|qSTr6%R9>5wfg^|w#vg5;nh?bL
z#CqX9IhlHoDfBR%5+$D($7Cjq6?@f2rIUq|lao9m6&3|QN?vvXj+Hdjj7zqP1w7>k
z$H4ys0Ht4M3MJ~!f>B8Gz&RsIw?>2J=uAU?HSL6R>=i}VtLC@%jdJmsM@pFM60zix
zb=^&ArWfdsZEtLr-Ckxmc=qh<B609mjrF`l`dp-{G&wgyc!qiN*y0VIug?zN-Rvh>
z*5I$*G=}%a+Q^lK^0mpEy7^SZ_0Ja>mr=yy@kHAw|3~Ikfk8Un&g3AeI_)+-wK=m*
z<<lE`u&SuF3#V4HvNd(Q6v_>Ip6iNIQ<778jP;yO&ds@POz-R3eLyh0<9>f)irnWt
zC?E(Lg+wDl!Ei`40tFNhGBlc8D@Mchk`=>cTOsG1!SE^tt96#EUe1?A^CBpkuJbyo
zx~}s!%#8i#ENv^#qe?Z~ZReMsQP6259mnHZgg{YYVV;qpv4L`5fu`{$&_}APA|$en
z+2~QDhNJslS_po=JD$mTQL22o!gbZt^^*PJYm*ygRsj0B!EF>bKzP0y9w1l%fI<Dg
zyNYeCUc9P#wo<uP;23-CVmD#$xWPVzxn>7f@Fy&>0hyS;1?8-2%O@x)OPG@35c12z
zmM{jF^UJhs^7z`R)Rwu4t;jeWG9AUL{mSDRok*bA<bv6BJiby{eUauyP2ssdZw@D>
zoQZszHMMlfw|BqHy&@GiadbqeEe7<_QP)>@uF#Ezhs!_QyzGE#h5avZK0w}Vs>26a
zA!DDS_@FZN!0wRq*kah--TL{Pv)fty_WtH44JOTn6~4Z!`bCYSw(7Q%s3vI2+tZqI
zdZWmxEi#C9`(m9gw@xZm?dAL4%6w##@2;z(rlC5!{ojo4Tg}={YV7X&V6%PnKJiVQ
z`$DVCH4VAZq%mcib*7SzwQ#|^UJH^MozywD)F+v|d>_3KIZXOIsZ`Q;gH~6*hKrV1
zRZnGBMW*x~&up5uVX3N`wlOXG)%Qqh_6ys(Me@wHu{T8iHscby-!~}4|BHQ0g}{QF
zSg<!%bNqM692hJno6&NHBeFKfdz#o&C1el*L{Qa1IDv={1hG^Cg=7;-rAQ-p63azt
zPzA$+TNpvpJ3`q1vydN|)PiCok6%Q;Or8&m#booZg7Juq3(tYHXh?JmbI1S^iBvL;
zDAi($fLxVCN%dbyB&s>OA4D*TL<)&!luFS#^xK5FzR$~yJ3q|-y?sWcak1fs(DD^8
z6Zniops1jz(AdDpP<fzm{990nVzbCiT3h<h08+Gyhywr@QCz$|f~={V{*}`RuLzP4
z;1d!tADGn1eDC1hPpmbp8oIYY;gcKjhX97tn7D?}QbwlUnRN9gHZ`5CW1&4BTpGiK
zP#ewiKw8Wt(KT3ajh6D!>5MK*cx77%3EDH(BAjE&#vL*3n&IuR?tO+d2VdHykF4~Q
zbmzhHszD9yl>_6l&ijFATe`mIbyWMV=WTH8+skZRzCTOSkmcyLO~h*E93A)kBzy|G
z5F@1jv2$&q5oSplL5x;ZULg7`Zww_bD&0Fawu+{wAUO$y34`9AtgOoj0&Z)X@tr|x
zw=@EwwNGf&ez@;lyJd*!ck<5tXg-|H^KctPCLj#Xq;JJKCE;}`Y~XzNY`9*8|F}Gx
z=yzW);=CN+1HyMCW%vZDBN{b-I=b=s>kY=nFM8U?6a-Cx_3%q3JT5X;I1-9gC#%I`
zX|Oq6e5>NY9*fr*GsFHs@9XtS7^N8IqrI}rpVANw7#q!*W3FVjpnR4RVZ2Z=GiRsW
z=}SfRFWi7id~y2h@~QtUG2S&J7|I4n9s+`kCdt#LB!EK#ky5ctC>6`K*&;jGoDH|@
zdD_^3&i4uPaIxS5UJH$(X`Uz=Q+p_c(ix3Lv(aog4cFTY=iAZ}gBha{povmxx@K60
zQl8QAiA<u{;ldJ)l)Dy0W~NTSRod&=vFu?{d2}OUnSVxx8F5NIk@D)^-~b_UA5lSp
zkzrwe1mXNtHdJNVK9y)hN`<ntv{-#~pdv@oRUk;;Xx+jRq2pYvUq<X@41?PI;zXW+
zBx&UFZISwaFckOY`?!v-@B6qF$B^y!OOQ<zen7$JRb(<2FCYm;sfg09R<|qw5|jVj
zSqj^+ZZDL*bda5*YFQ?#qU+QedEy@{F;s$n^VjEP&2Y4|m`2V96K{)9oH>C|rjTQ<
zw0g*81QS;AS_gm<1C0C}XR%P1fsg~o1$*hbNl^mfIms7yA2;nt<*f=NMT|&$WN5=9
zOuc8B&v^7Nkt9t9rnIFIeNQ+aKGMOnaWRbc=_pTY_uvR=)qcT=n@90&DtExz@+DIO
zqqeYB3nu%+@k4=FgdZkEfF@WXe8GTd`R)HoP6cfJ0vron?t_X1Ix>|vrSyeEs->Jl
zE1lp&ij0|Ja*Wuvm;6Tyt0xLF!WzcN_7B0gQxzIU@#Mx93r3Ns+!sJtrC<kd2;pa~
z=B2xpi$SDUbBDwrq7OG7T=*Gs2^(fXv=Nm-<jHVHT0o^B>iuT0LNgrIM8C))G7XiQ
zsBGQ5$o;q$-w`n)=1~rxs(1xrm1d{QytR!ZKzvxEdSm-Fj0p=%%$Aa~(G}Md(J+f8
z=731Qb(hQ-=1FtWTu2H(nqo~D|HC<-&21E91zUMY^MyeSVJtY6&q={bIi(K%h;=kY
zwge;gjn%U!;vS>l%*Rq@z>uh!&~SV7@)|FJ?g#Ld@bwf<^s4uXh=h`nlBuNnUpz_&
zmPfb%>m0QLu1Ch8lzTUYEe;S+06%)Bt5En)a<L#x!igs_2Fug}pi!MStjq{eK>^R>
zG>mpsG=Y?GNJ?SdYqFl^VXWkCSqwC3#SA+DpjH5?0r)brPRED&;-K=;;L`W*^rEna
z-bZBR`x{H6yD9T2_os^m-kxwb>2qB>2OQ0<!qMq5YPH>@l96a+PV{jC*)Xv5DAPLB
zq4vCxvp)m|6Gb(;v+DfL%id3i0Qa{<7aTth`93&MlAr*YwPx}oVv*xYEcy_dj^Itq
zen9jR5eRUO`#ed-{;Gwj<y{;z$}v8!8yw66KK4@4f!0&1Qd>1En%d;vvyuqOMp`W;
z_+ct$y6*MeMuxhkaS$nA0*%{BcJ^RPWhTEhsTBlqp3z7oznDlXQy<CY*5)2}(YfOQ
zn7f@?gK-43aq+1(M|V1x->`aL7c$|~;o#Gqut#ZfOq7-?9MV)0i5LU^?OofXl3EOA
zh@sC7qGYi$%Bs*#$mghvHKZvm3G%2tu`l+GaU*XD1GP;Eo!of{@Ih}8!#`?&lQZX}
zVDt1(rm#vT!s`5*n9(puVXqcPN>fSS4+ZpR$F3@6ajKW-jO@8!R|wvqyS!2tn$0+8
zdCJMG2@R8--AQj5-ddAqh)lI&MSq#*KukP1APP8|0Dx%QINSaI!dBNpq-q|P>k)7N
zg(?`5W}TvE>@5-SiqOwe!dVi85$BQk2Y<Blar@%uTzdX*X#bqJ)iYK8-!eGfgPZ;1
zp*i1gVZGl4Htz!h^!&T7z3<J4d9K5mww~AP;L)v9HT4|-%Q?2L=Y;3jtclExcRcr=
zlVPi=TmKTQ`re?D_xeVeb$!Qs9h-Km6C?1F|EzBtbDm31;wjhF#2Bt;$e<bXOGq(1
zH^a&~WLUgt_N{%s_l9e@Ez8<ip8K|0eAb0BJ(qp^37Pl2sQ3*_VdC<H*J@u`YP!1A
zj<vSwM=2UbksE7e$Mhj|ZPy}JDuqbst4Ez?xvY<s7x@`Y@+cfky0jYQkvMFw;v~t#
zkWrGd-`9DkbTBLPuJ`497kHV^{dA>m^k}b>nW?3W(P8=Rrd5qf9EonL8l8F*h~Z|1
z8ij6+Kr55z<G)ad7;;Z%vzZK>0fGI=G)hJ`CV(hpYAYif6N`YX7zlX4L6?|?Zh7RL
zEIdSX(ltg?YI7rp*%i*SoXpHj5=jzCAONJNc;4s5xnr3e8$JHB9A`5#vm}y45=a1u
zE1vM2NcbG*Sx#nVX2~RpBoKfQy||g_|DVVtkx2gUF7dxr5=o^0lm9TVpX@kMfZWAe
zr9h>R#mGn1f-w4QsVEdmIn3u>nmg@JSEX8-BN7NBc^L9^W(wVo7Z%)5$`fAh^O%`$
z9K{$?)K5FG#=bWu1XO5BD*4}O05HCts6WX0)k&e&q%u=V7y=*UZ*4G>4+$JiW#gh_
z07k>I5OC27gpdas=bzucX!{S=KBe})-2ZC*9)C_J@+dj+pxoP1-YWng++-pc4+JYE
zF$o1YgarPYyvnzX-F00T66{7EO(n<%M5o1ae@<o+IY|S+hVv*1xqvC)rX?B?2Q?E5
z6AWSq#rZdU=dUWi>bkE>^k%BgDNH4hg5juxLPeh~m50ShWF!&Rz8u`Vk>q^Xgj>E#
zWqE!pgy~I2m-1Ir#6*?1yLuPpPWjPuU1hqp#IQI`K-MFQG#G}4N5nAvF5d*}%WtjS
z7C6aq8uK;a5<wh$q0QUJ4*q%LBjT$+)jDZLiT>2|7&-pIzrFEtA`9o||DUMI+}ex0
ziT;N#G$hPF>SwZ$S)SJ7Yf(@s;d0LG7levUG9atjGrvNU9<~MqkP}6dYMIh`55T?!
zPy>qa9JsPI+>-1l%y90Vs%7KykL}%a%NUA8ps^~?p-6je{ML<5m6;bVMV1+hEk?B&
z$8vKO@WMOe6`OW#k-_j1;}x1-sS?@w$VQ{G?iB|R<`ibNnS$3hZB#C+E}2iPB~31!
zGbKIOSM-R#K4`kG<0eC5GMOwk)9nhzQCh{wumP5(L!Q$0^2vtOKU*CwKc`D*U}mMe
zHY-%7hS2@O;Rf`QEEURBvao*IRfh(ME^!7?2zjsqh>VyF>8m_Jq1n<_^ArU((jR6i
z@my)_JXIm@ER)6N$(Uaj%jEoImzZ+N>_?nZ#(dSy<ue*X-s%?1yy70JjiTsBu;4<{
zS%!%rd)j9TA*-){c}jtt!y0v0<vDxx>iK@+xXk+@$#UGL;{`{CBwaZH88!{daC6?>
z5mrdDsJISr<k{f#5D!6y!;-0T<+)L?6l9UQwYK3pe2$Q<=0h+zKz$3O<OW<Ao4aiq
z<h)<;I5^DuWp+<Lr?)-$yG7hbaoz5_B%D61`ZH(6Ygf8bYg>2mbsSB^9CYFr;RW%1
zUD4QDqla<C@#e*nJ6x=|;C#8zv;`fG_}gxo633Ljc8mPaS2HCRG#LFj<FOu@ko4?$
zV=<hY7B-B}Ns_~Qyh2#>)=p6}!>_g3eN5-r;J!D^@Dt)+3bbq83_UB^_da##JUvwX
z%jRU-wfJ_|k^T_z%#_qK!xGtF@jLvo+U~>7;agfz25Ut)c0t(kl4;a!8Z84sGv-ca
zOPL-SQsnG0j8(AoUwFO<9KhfWpgIvFv)-6FbjJ>pvtE=riqb?EBQO@@S$KOE1MY9e
z6IJnwy@bn0b#~&d$hmdFs~5vriDfUy;$mx6LHNk2Db-vZFd?3^#6K<FaEtF%%hIGd
zDAf@qV#QH*<fgt!@_3!5pc^K>4`c~2K>I+b4G5q@04)rY5E5M_$P*G0BHN{dTGSg@
zN@HO-J0U3yD3WoF;$>TkWkWnt4P_6kLN>_BO2gg*eivp5FF;SF5)e}v8jV9CBr+*s
zu}%a4JTZ=pT@x{A$KtH4Zp9#-E5{l6Ny-XgG+F?L|K;ovEIg=j7kMskVX#-Jrv6>M
zNs@G61)D{pNNS=D!?iG3-W3o%(??wiij}mvrz>Qj5_*+aCYr?vPEw!?>*9gUK0_mo
ziGgh^KH(e}BAx&n(6S01MdImb0g~N<s!#r%%gbX9ZG{<Z{}o|ZufHcYq_jQmn|9z7
zjUXUy(h4OYBYojGsx~FdSvrri%-px%M5^I<_0FF}`vv*EANa=)&WLlB>J9UNxu(O@
zch(R<Gk*Hcy<8hS#-7V0ChA)OvfzlkU!f|k^X5G=Vo2b{5w@!2jvg;eu#aPbK2__)
z1GknfU;I#)-qwm;0H8b#9Y7pd0NncQ<=)|CQqc640FwLlH50mlH-Fnn8wl83NLFi(
z_G~rZL-r(Pg@Tynl98wd#D5Cu1j8;4iiiw2<N$#{fHX%e2n0sh-~<5G2oENzuypN|
z<HiE#W>MFXDp{GKjGoNge0#ke5d@K7jBeGZz3=mS=y_=K;N;`Y2bj+`9@JQ@<>lSy
zZc-;%zK4Qj)+=4;B4o48G=N0J=h1ymEgxId?M9nHZSymRk6_F5-{Upp+q;nSpK1BE
z`r0D`^7lft-auNf?K%%$e<v7rTIlQXg$G6lem`Y`w@dj0wi}sv)H+E!Hhbn0LAv+8
z00#ds($z&%+v5`BsFh#0AhoFq6aVv>#bo1|6XErto$F*i8Ev(y2943U2C9>$*m1VJ
zgC~=#hlCW3)8%J?&C*OoAKE$!HTrnXSZgU1>m|FwwbTj6VL#Z%nJh-|C%)HozCgJ^
zDp~(|rm6p)Z_HKwrD~eCv8ZX~mZbXseKttk_uF+cnNp_I3MBTzQM#`SvRdW3Zl+}8
zC0IGm?Id;I#kTKyTCU>>vw8Cbz&Tl)hmD7PcB9jsmE&POKq>$O*lGn_qf9@7)7%5d
z^cyp@0vb>$9Mxc&kk^TOG$a=rYb+4Ka|;4DR%OC(Ee{0x9^^9#f)CU^y17ZkjI=F3
zY4Sjcqo>SEEEX;hCHB!xcxCUQqWlXcfOv<`QbqlDl&XFNGoY~BjS4sf!%eDN0bok-
z4pKXDMuLX|K_CynJv0u|Q9ewOxbQG>78NBcySUz^=1z9Uz&r`1Mx&^Vgh{3$;(-{!
zJxHB9`>n>@LWu=vfE*YJ$$$W135ijP!EqU&2^J%Ht)Vs-SV|hHHZA!POW2(83+W>c
z1<ac+*bfY_ai62+8c`JRZN(}HgdYr&KZwNQV-3TwtP-PX6+3Oo(|{z0!P5`|kj@2E
z8ce~qz7{>J>6U`fug#~?fssun1UH%zd7-u4iJmAGAqP{XAVl4`6E3{HNw-Cn#xHKh
zbE{2dI?U&@fdQ6@oYmcd45Ev?-=0;jPVGD##kh^$4TH>>kw!$l4k(8H;4W(*XO~GW
znGg_fvH)CX_FY3X{fW%Lgph>>E)&N_PLSQ)q*h(7-25K5xNFxzOclwvjp81rMD~7>
z7K#N?1!8+GR8TCSp_453&1RhJbzE4^C{$|w({K3no^OBJo#oXlTe}%nfq|^F?nI7f
zfGw`~@<uK4D~Ss!%~8|1mxwbG>rojF_%LI3pp#%O{-Gp?GocfWfaw<U<B$OEHbBC}
zuu{_BrA?Gmd9K4?ypzm^PBGYr?tLQQmGSXw1&f+}?Y2c;_{=9XavyvyFxHZ1T7r(Y
z;b{pR4Ws5-cqk?pytmpwdlsy&lCDb9CcgrVB7MX@3uTR)$Qbq6An^sl%)`58w0Ow1
zg&{T=k~LxEVxV887+kbJyMM9x4cZFDW$s@d<{y-z>%O$iU*m8{ZAMtt_Rw@T!C%sa
zg{uGwUE*gFE?<&9WyCLdrph0*Ecp%Os-pn;C~lM!p*1P(6vG5fD{W;i@lQ<*eIxt;
zZLcbJ<nm6@r%!%HMDThC;sW!Wf;_Zcz=Hocd6__Kio4n`DFlhiv8m4_DNb#L%aXbd
zN%kDFx%c>m%<F(}+SV5b5c2H(L(3|wdt*W2b_1uiVf72JwacDlW>^1<A;);*DYIqx
z?))Uw2&1ZOyd0gP5Zi_gx5|#00@hg)-u6`zB~Vwpgv(X{xqM}pOIW{%Ft;E=tB`iD
zrp@!-Oa^LE7TM5TojvnJ(m$#!B$wZKjjYyd7cEgQ^9P*x^~NZ6{Qi3;Of0N?%{($h
z@XnEGOawM1rnsjBixiklir`-`i&i>5R68T->2s+lGK;u|M6XD(TWvB2bv7;us?4U_
z&`}F*Y$k4nW0n!#I-`49_?7x98C)~mQ;zeDnI~QW6?Y<v_Tg?QE+6y!#r)>Mw*0a%
z-8-c{o_P_QYb^yk+b$|n)vH+D<(FE=e}$K|w^p9eB@?n2G1LuV{@Mrk3fO1e@s2=J
z7(-Mb1UHgl=4I!pB27si>F1P=yE}E_q|T|0%nuomu^104Sz5VLIgUn9s#!ry+%2@L
z9L!5sJQd5{&S-5FjJ9ECIobjgVFcB-I7Kp#csBm6*uv<|h@RBA$TbOLj>+}&wKz?^
z;NOinL4b0%9e0@PBb1j|=8x7<ikw192tyic@D11bdjitUPaI|FLY0Fz$PIK+Lzu7D
z9<bN3<sYK+bkb9R36t5rxDgu%H?VZyA}zgi#b~!;_)}sl{m1HrR(`xpKX&G@gv<5H
z1IsvF92<*5%N`J%+z_CVy-m1dSCjP$>v5q>NJ|E3u4b!Xie;wm*Nd0<*a~HCt#XF>
zv~GRnHxV|Y8|S*hB#x7kMJSZ9K$-g;-7NIvlyGC4Cu}yK5Tjws7{V57T;15XpWh%#
zBOJm1{Ojrcr={u}Xv1%1d8_zW-QMQ5AM;jj=8sO5gfGE3A|Z6%ooc#k)n42SR75%V
zgcq)e8991AXFQF?VHfU5?rrZ-nM1eVaW)FHP(EohS2Zb;Gj4q!Wj%)BeO$-9M$T_Y
zp`3)IxYcf&GYRM9Ovw$16lDEkqoiZ8$w|<v2l7yOW8Lry=lA>{Nqp?q1SB4Qw4#Bd
z`?@V8$zZCk!<wl}Yh+1MyTb7hlWwH|CTS}jW6_&&`9+NEU`t%xW7!DL+2N9gl>Zhx
zDBJdm{-h7Pfd70FtziZv<t_>smi0Z0YUg6am6^*wIC@qwS6_`-5$K21Jsh6?A?G8`
zPvCV6QTI3aN32@Io0Fec&-fUVb#*giIC0(q(J}cifb98i{JFzG@|;aw%tMM(S-m`G
zzWy?&G-l-UU<||af>uUF`OBv*GLF+xr)lU!j$>nSteu@}twd-`>%r5>8%!q2uqc>s
zry8)t8^c%+PI$jcKcefjI?~mbS*#02Qn$Hf_f66W*L)sljS0=xsrId=&EjqTcfZez
z8CxG1F7WMO{ya+1$z&mFj*s8Z$5_!TCm1ihv-`aUOtf28JE3QbZ@x1G+9*#uox|24
z0;}(qXHkv(CpB4V-k^h2+<)$1Y26?9ty(q=3ZOm}M}wYpIF=5cs<qb$$Y1-EeOnNh
zjdxiDE_(%6+hdkDx52)60(J%AfHFJg3x4HC=3p~AK=ojL4>cJpvdAWQYFgI*hD=3h
zZ+FVJ@jpNKWS9I|XWI~94NltSQ2Hj!Y&8?isi*HkU(C6ttf(<dPk+Q?I+YI^%=K(W
zykIJT2I4x{xnDAciIq+)_6NFO-SyWoeekwj{$Hf+tv{JvoiDJpeh6<_NBVoRp$emQ
zyOv|92L0*Iu0N9?i?POAhFkA!{atK^T};&bF~0d1Ti&mX8}o%sVYb(KUNwnc?3mqX
zbqPh!+g4=l2d|JI-p0OOw2)C!j^?@95*`o9aoVL<M-ND2Yv4ABP|Nctc1?|C)AIIM
z^juH7Z0CQr5O@A=m#sO)Cayb|_>JBNnr{pI+ZHa@&R|Doj~{B+JgZyc6IT)#&LAeI
z?0+FN3BB5~Oz`~IILMOe(X!z&Fu_AC6W2psiwvJzyB&G#yRh*h?v*!~uwf@wMn)Be
zQp_|-xtQ>VtM6s{uP<IJz?Wf&Kg|T7R8>c#>YP=E5KnKgg?IfBHTtW#6#x?A$H}uw
zD#~w`>1YIijQs`L@BAPnBChz#R)B>gap`eCf8A}NlSZNM1WGZ>M0#{~e?4wTtI=2G
z{mD-M0NloR4qeW(PTWz~#)T)QZ|*($&xw`{`z^ecOUy^MM>zv<M>QwY)6lZ(+4TFn
zU4UxDMY{EcNmO9<@xjIhy{3BlyqzvaYCvQx=}^0UsXb>9<puroh-{xlFF!J>XMa{i
zfr$9z<710;cw`jA50xN+YRhnd2nGxn{I7BTx&xhk{vJe69v_WATPAQp?@;dFVJJ)g
z;nsK8PJJ1hl<dcAmumSmhR4LrZO3@mr%>W^TlL9<q;j$Y%lj%O{Y;HOYx38n!Bp6t
z^1=7I1bseCNn$y9_!ofIwEF;D(c<78PcOb?mQ~BT-_qgwb$xfU{DfXw34sM1b8N$9
z@XY*m{n6~X8!5W_uNY`<j=w(Ft0Z=yFiIW?QuTIn|Hc2u)!Mr|kExnEESbtuCO5Az
zH~VzIwkkaGRp^WJC)f6~@!x^V(fX`8vh@G!x1Zy<YqMw#YhmG|sh!FWuJ-o_ejjQF
zG-)JM#g60bx-QD{@Revn|I^B^KdG4s)BC-$yz!h1gmTCc`${w3UftOri1aH-KeOXA
z(SXw6QF*0wrS&OkW6QGL)4bFDu4%Ehas)0&y@~Y8<#W}W9IJYzQ@`P)yW@HEwf^CD
zSHyj7LvzTigsz3hm|5v_z$!0m?H;>rJ=KCogf*LnZ`c*$PiWslmSlyPEsEY=HQk&}
zjE#N;7#9p5321!!z60yf9(X@2+Ur=~dlP2uZw&R`%r5%o7aL^)5v}enRTUF|^sfiY
zu^%Lxo!9T<mQL4pqTVl)e`%t-J99R7^4D5b|JY5zB)QzA_v<v@vqYVPs&Z22Ps^Lq
zc^+p{E`q_aQ_%#a+=8sxgJReBTlEE>`osO|`;<g@xh8dc21F@6H1u0JiH~xIRgZ3x
zQH%(>775vm`Q`scr2P3aQw?$}NA52}qp@Z1-yVpOwhed?i8btjA&Q!&gEivHdBTV8
z;NB~&*LtU`Z9Ov1a&(G)bS`tD(8e~0AtNJ%@bP18Y1_r^?`0LDE?bk5ep&O24tyEo
zl-`hj8~CKfH~c|+w_R<}Ej<pmo7(cUlvxv~Av)8raY=Xi%`NSI0N;`-xQf&AQ+ABy
zAu!?|GXFM&p1%1K-2x}_UmMZfAGOOdRUnMFm*;o6-0!6INw57DKGTusoM-2E`Llj%
z=my?-Ntx=b^=YsD20q)Cvn{uuJ^E|Wwkou>+&ZCo`_U{0yj8h*x%us(Rd)|Ga91D2
zOt1E1lYaVkJWz@_*B@tBP%N2-cX!^^LJz)5&_<qnC6^R+h{3-*9lHAM*<bI}Cq-yp
z2rX{kX}uI5Uh6DR+Fp8i37>$gW}{=^g-*GCJJf+1IKzP)<xC2}K5e-F>lW=kyH~{E
z?B|R*mq4=37(47wAJ8ptVRn(!PK&6ZBWvkitWCa-YQxFy2RxWV{zR0Z<dfL0p9;K9
zBEEdsC$ZTIbb>3Fed;S7ri&Y+3ifwml#3odF1##T;P%kQV2jmddV|o>FhC$2MAgV)
znp;TTYWkPcgtcjzZUI3&O~=_Jk54Z{5kJB%c6Pkr9nXMVl%yNsvF^)WzMd52DV69H
zreow3w}E>lNUicLN)}Box{}hY2Ddn7Ig&>rMj<_c^e^>r-m{{F!ru?bKVSbEPhU0A
z`Eu9n&K5^aPvk#t_Zh{CVdO&tE;?TDOB(uacES69<g2O)BQ@<<R@Ayi6d9Sw7pLRW
zYno%vTo%O&^x|2x<6`<tQj_@bY>hcXW4~4vySsGP&sOufi?xaTvfXnweAx7A$AVpU
z-kWIgp$=~YC1b2dB{8nYB1ToHvzw6t--(?!f>#&4MzXG9^Z^`dJT=rh%+887uMBG`
z$`PbPT{cgC@GII}bhnPA!&Z&=6a{iY{b_oE+?7btNG{4pA2qhiBt1B&j<J6JqGm3A
z?XKV85^W#KO9@Wz6M|lgc{MZ&aTj!PXk?g1ji2yP#Uy%#wG#kyy-LF{2)KS!xO}|b
z7*szzstUW|5rdGpg?Z_IpA)IEg>h(t?xK8AOD6b&u@49qJ;2D7m#XLLR|lSY7Adn9
z6x1J|kEYXp)Mm-LVFXaRt<gLaR!sBV(bcO^E<P&;^+2vtWJu(fiHfC*%r0?Fp7Gr^
zs-^IrwHEpU)277?Z!MCXs=nXvn67_0qI3dAQ3B2Po$w8T(E2$5QL?zcEk600>Re%x
zz(XN3x5)A}f9qGf5iGR4mifhI)>{Xz<_76{O8I{8cnYf&cSuspCx|4n(pPp%dSmY{
zw%k-&i*wQ(r9T%RPdP@A@Z^xNDTcSNKB(#0c-WapNU0-O<}{=&1xng=*C`S$bg5fU
zsfmh6yuFl7w?4IgwyBbtjIf@Jw78y_i%gY+%T;1NJAzA!4S+m&TL)6LsC{mguLr(W
z=(n~j&Z}fc_QIFA^#!=b@$fJ*pa1MX%?^soWWSEMk0s--anlT^#nh{?0w)Ob0qnR}
zm^oBKeHWV+<oqDX8EZ+%s3M|_ZL(i)oh+{uNX^@6np!WJJ6e)*uStoUc*KzE%?O1u
z);+=v=j77U(ttGm-ke}KW@%=yb>(VU_+se!^lMgg<Xks42e|$Uq?36awavO3*3)h0
z$;#QVq@&Qc8HreUXq9SMP0H2LrVs{}WI1SX_{^TR;gq8{^&p-)95M{AHvEdZ(QLMI
zyhms9>a3_(&6OT=4>78BaN4-RT4b|dID_ZDL@i>8K;*}vL@Pvp@)Zr`gLOyeTUAfI
zD&^fQd~u|`=Eu~%7~)dlNWbpU8V+-4zHdWEX+h04sKxIRhiU34=aTyv`R)rA9dqxE
z7n{;}9{F$jg1xzk{@%E=PSC4PG%FGRz%L4Ya}WN$Y-b+T#la7vztiDF=Jei<UTOAl
zW#S3v{J?#FDFKDXum&r4zxkz(PjS4$(FHGM30y#&T-^OC7jf{}{&pW}V`Qx#h9-C%
zL(nj~Z?p|;AbNE4u-h?X+sUtuIN7B!tYu(59N@0?IJXbe9-YWslKyy5vQ;eNB7&RS
z0uFx~|2C1(dg2QGTVnM9vKLn24S4+rZ8a(v0t?weCre9+PFmkSgg-fblL&EACCdt&
zU=$_25D+cKgS*kG_TlheaqFq0{I4&R{OFmjGeZ^VYK^k9D-LF-KJ27CL`COEE8|#8
z->K21R{Q8IaM7=h7<rKd|55su@kpkJV5CG4ft8>@Y#J1cf%e-SD5u-a0oSxc96+&P
zXDMIVxVK-s@Ul>B8rSc^b9bzR`}gvN`t8&lT95R8X(MX~x8djX1qeuG`m-<_+HTJh
zUsW69yH;GKIzwhHZ9UyRwMnjgOfW+6=-7(3(`yGqqeB2MxsBPoSm|wkPr%JZ$QQ1p
zvbF-IwF&+S22At>+UCJpg|T}aZV3f%Leyh_C`S$@*r1#2N;F=-O-$SaVl5mOGQmRz
z5fzbFbZk{SjpmGfdF;KsJ>-&)I@#BO&b*%a<E=XT|6ZK^FnQfx*B5*3%JY-1VDq_)
z>X{S$aWhH%_LGR`v9c@wV&fKmXM^p=%XuB|_@}Hf{nYH%eq&w6|5-{KPe=nj&7;_K
zF{MmW2oOPK<e#K&-%M0i`sUQ;DK`^$ZPu%)c7xem_5n{`Z}laq$JDF(6DYbQ;*G{o
z!k3#NP^RQ?h3IgXnx=;wC_#2eSh_)^YQU67t{UVaQ!TwqYpUjwYBMHkYWcGH_v<dE
zS?LQUH;nhZ>#`}F%XxJE5^iKUG`lL_rV@u6)ppp;4R}FAs8;8fUXrb$`rL|1DS;t-
zfMIn~vBjxboBcDG@f!vITIUDRSN(X=l)r&I9iK&zo_ZkuFMVIbe<@ht`<Se{HHLi6
z*DL&B<LyW{WS}cgiM3blJ08V+T4LgEoxYRXf^0sr`o1uQkBZihxO%?hOLL!ln&f=W
zvfwM796uyv2Ga1^tD%5v9sLIkt#@M0{<7!kI9BaL%&_k6pKq6?2zlXq%Cd`gg>m)>
zsaj|D-dNN17+GV%p>CQt?$BmtUkPFU45@mWdAHO}26B>ELc<hW#$x=wU<OkgAV+4F
zNqiJO5yjww1s9)i7N$_yNeID-7cMac4Xnhv<P_y+rF~${8mO3=xKU{O<1k4_$lZoD
zMB%NW^jy>-_xDS!+^&kGLE!R6ey!0b^k(nlKu>(vXG|6{@-`*ZV6k$-!?*UYY~}tV
zg$fwEWi$WFup{DaNq%qjjy{Jsyaz*3{jcuf8`U#5@c!<d<bc2Ngvmzi+ukYX{cZ{j
zZ#r&<3x#7=hIkUi%FyXoN=6`?rEZG)#z@j9&CB@Q&ynSzVhwO@wuMgKQb)i$PLv>}
z3N`FzCW7on9%i>7YL0TEUZb-YsE;DrzZ&^9TA01+ut}P}%+*Wsh`^SU+Q+bIGuhf*
z5GB2M6QPHnG0SCnsz4z)q`*fSrbHKO?ZVT6<C#sP6Ba<M_Qlfd*Ca1POSkY?{6~Y?
zXFGX6{Mgyj;gfuq!~#KNXbwUQ|1{*+bWb{p&Wg}&bP9yG+{pO}%-Bd9L_<O_=6L#G
zPUGO+g$0aq2D<Dq9?6C5(Pl7K>DcuSX_yb{V?xW}t#f6wQ9rKLm~t=efkRP|2M%Zg
z(FA?E>_(Lbh`-wSSS%&hJRkg;f+RgQ;?ODJ_EIfbGdUstQN(-Xv@y{z$izZLqKRIr
zC+-o{PzI}ybUwqL<U~ge%`{gM%3EZ(TcShT6zy|>bUQf4)rOYc8tqX*k0nhggjAw1
z(XhqCc0GZmY2HOT$@jwLj*?@|WY&g_C~p6v8G0KDt|<9w+~fr~y-voBqI3dcC+Bty
z(^KJ-!x-_t<2$kiAR^b!9)mPk_M$0a<-;V!Wxv$1@tsh^Ehu)qIXyq{h2EPknCCVw
zpVcd1lS%Y{1w$UZ;gQG@&JS%%iR<&qxTtG7D2^o@?|Rso(dXHiQ0Nj#ixj49HkNb{
zWL+7#@BDUa<q!@)X?(W+Vn(mmWeQD+$r>;C?DTm1K;k33v(co`0C8YL+uPrwy`G2i
zLhpf<djO!0w!RW*zW<?#`MguZ|7Lh=`l<zGc>Y%5aZIuA3H@xHEH9++U^J=5+8I+L
z$}^4Y6JC~9r9Zt<R3tXyrfuWSw}*t&!*JAu{fq5J&Q~W#{*~9B+ajC1D&Bp0RO~cA
z?<AREwe3;4*##Ya+vIg_ce_N8M+$7p&I#4!1#y`<jPP=HEVL~n9xQB?TI#mqES9L+
zeHYU9UWkO$Dq6ZxiuO(WE~f6e2)?&3dA4KlwBSv4IhR$RdL}F>TJ@2#gg0OW#)P*f
zs+rN8E?i8?y(iM;F5glY7G6!vTTUy@yLU(9!dY9azxAnBZ@n(*x3pM$S5DYgwz2PM
zd;X%VrN8?r@OkXCf5RWw_*`Ib^krbv_~82Bdh6{Aw>J%aJ#+gE*!V?bIh6gdxpfX8
zaYq2?5;_p89oin#z~eQ<#PaGziHWV}DX}rUhW^0TwQ`WyA58=$n)q#X^DTyaC*o_(
zdK-poU><LZJV4NvC>}48kK#r}cH@B`p4C4IjlbkSNdsER#{8vlqrmCkhawsty}5zT
z*q?U8=@pRc|8O-{Ufn`z_7~rBeq&dHC%3MixEiKdoTdYa+gI<c((9(4O#x!-`I}d6
z0%TnhT!O2raU}$}xVoxJaHSsDwO9JmFY+U~+{kby5j;G3Yp+rxcoC6DY#`zj2V6%k
zv@Aq4vgdBi;hlcG|04{XvC=Y+RZ>_)O*j*8`^X?1#|QjtYqYGRl~g9B7(qq(4ts<U
znLq%+5QuH-)%YbCnW?LSy^rv4D!lZLvFfp}fA!_ZEzduLrRpsZtDz0m+pD01dBkc+
zmG^IkfFZ__ZB>wGRD&V7G3c=^GrtNa;*K=m!8a|(_Z0m3XVG<O^NiE(xl2&dyo|Td
z#xq>wcU3qUtFn0Y^~G5dRE&bjQK|C~8;mWhS6>qpTuW3FQckV99wL0ezd2L#w^{%9
zJ*Ul{4EI1vSXeNd<>fse+v6PR=Lg*_p8@MX#48qV<tk-oV{%$Ii)J=sG|@CnHVU1M
z#h|lfniyIpe=~O4PL$R@6fILO#wiw#R`xk6AGRqS`}!CG(?oswYQ0wqmpyxWVwQ!4
zgoHFvVfX<6fj?h;yDPQ5sG}(5wMLjzx|7%`)9Luf%#WO@?Uxe3K2CtBD^AcQ6bZV!
z;zh#Fc*KBMturoRD1h$gM-PD1Hr*d>hJUmn0r&;N@B<lnd~+xxha*guclq%)GOWe6
zpJ}g)Vq;k>F~WJ+Z7(@T-0aH@D|SvtqOy4bllj(z>5PavT%tdm;h#K3+Zt^<yv`;u
zC^RT81pM$&H<uw_OfQpPX-?PaX3|rxWau-5YtVMlBqT^NjTTUxOs4H^It>v&JwW^?
z&0(kY2H_`DULL2ty*fO-+rhS_<@cAJ&geHD;gi{l+D84R%l#w<2ZM>`12o04@Y}8Z
zFVu>aT$94`QqzBT(|=6i@n3@w<f}YImDf2)=Di&_k|cR_3WWsq#oz*vI~vd~lElD*
zC}e0x3KqA<l@d%T=C?jPcj5H(kY~q)_ug2ZKol#c<Dh;xLO{}vMvRL%5vGVhg{P-r
zFzXzX(474uc#^bXgud?RP1a5X(RTeT^y$Z&YhTlLg_3M{?!|ug85|tC1X--LezyC>
zauL|b(N)G+Tkb9Fg~x=UvFs4oWWjV*bKj&X-NhaoOidTWgz5wvPnUyz_DacML{bJI
z+*MEX$C2Yhef$zbxzXBaLR^UNVFnC^iHA5%0mAl-?ubN5OC&oLgH4I$SZ|Epq!3dH
z!i*D<pdPv2auE*|YOT9ZuH3zS@<~_M$)~sO3_a>@AmXcx<@g#Rk#Ge6!mk8-VGziL
zKAYJ+CkBc^ve5A$K9J!PfQR`9T=hSh-CwHGcN!Dj4{$`9grwL+TTBBuV$Cu8v*RK!
z@u~a$gUCTX0XQU)SI!GWheNy*{e773kQ4qKkui`SU5G%)!*DbKa+A&9wtNXgda)ev
z5~?vi%1>S98JixI*r<+0F$W-^%9d3cN=)2$+6D88cL<dj5y502cT8~FJp;?0*3+Hl
zHa>Jc=u6GTqE&Pzt+;{+8m%FUeaUP@kG?5(@lb+*Q4&c{wMCtO__ZG?rbK1?Te<@p
zpN&Q<>6#ORN2(&2tjI7bJJNlr7#__O0L{iW+o}>&3#SX1tP^U(8FF-h7nc}%(x!H$
zG!j8h)P`_a`cQIWR1`ir%f`Gq^e`8KX31;A;|)lB1T>I}3JV825SpqXWe`+ofd2=0
z;N#|#{Vz~686{El3>)<Mr5FAXLWoxu(`HvD0*O~(QA!$@W~idXS@~t}ku%VJ#+JA%
z`-L$*-cQ|;hv1AjR0N$J5l&(OVhW@NlJGbyzzF(QYyE41?tb;&>OI!(0}YDzMtj`A
zP98@0B22^s1(-dR;U@wzdx-_~UqKKZrU*N^+l(wA96*|Sd{CGv&+9P-)L$t=@W&J=
z77L-HFi=Q27Dx>751Wk-O@f!j5KLn#-g2WY;9#Dg#KgrN;nI2d8Z$RhQqINJ@K%ku
zn(~|9L<*H4=uyE^3Nc(7MMs25&~IKPnYmchS-9hqO<YVP7kA|DB;}C(Dlh#?0bAoh
zwfCFr-oWvffhF(P)!x9Lw|WHH3%ri+@*+B0!W{Qp-d?>%7FWde#yB@ocJG~xs92Md
zpawxNodyO52MmVQr><s&QSKnC5Ns9N`mD^Y_y}zU+sv}~1frZH;_z0x*N77uA)mDX
zb36ocJ~&|C$sVES^=msY0L=ZuWk6Lu4>u2wo*h$D`io#%e<{6|m7o(~9G$wa$`f(q
zoCIRLtWdBmdcG@jE53F4R+VgBd5B2?3ooz1FgO76|3lQd84S76Xc%~QJFLLIC9bhf
z0gTdKm)_mO-A&!Jp_2)EhiN7fOiy9;>C?pNDUcs?687-$P)?q#vudut2&Sf#RtY8e
zcp&hlbyNSW2E(nJYS|0xB?EYb$1O;M@r%u%+QVjeG#@l3B+^jem*oI*%V}Gb7K*{d
zRQdy-5FeZ;gOm3$?^ic8bY>yc51HMp%WfK2?N8Hu_6(k5N--j3=B)xdq3?(J55Bg-
zZGuACAW6uP`E%i)^?*dP>Os6%<>@n6u32tCDOIPgt<VR~;bSM<DyWc+09)oi?GAfq
z7f7MNSs?`mk=Mh?l-K!SU^&=UU=zxu1O-F0&`=g7IA{jIj{JW=wfV<>{$G2Wd&TE~
zgYg7OjUnU`@C1b#OCqbVf(25S3PaMvu^kTk$zkbp12`sszn^H<^>1&~H{!Uik#@8R
zFnTmg9oXgO))mM*@LJ|?#TNsiD=Rjer2+oD`Ce%6oyPKQPv*7(*xMg0Dda#-!+~V7
zmJbF#Jt&DLtQU4{M>VYaqc0(GX4_-aHZI(sO0AA!aOOe#0*<QX=LQBn5%3!P$BXFv
zaCQhw<BDhRX(ZvB<Ov#oo*eZYOdF_$XnYP1kIybdQBw>hHXf&Oo1$pppCSx~!v%)O
zBcoSlMF^r0VQ@<Kgn?uN97ZO-w#?5B3>q2nw2>RC&8mU5{mWUbZynnp($c)quvXzb
zXo8s&Pz9g;oC8ezq{c>Yg?;-@0M(CoxqgqaosCRcqnw*NWcprm?HPa<hk;UtL=|6K
zUhdiQEv3J_wAz**sr^fS*AXyT=9hW$FR@rMTo3*okQu8*1QaIAwg--qwyCA$6Q~TR
zTr^&9(ua(6DZ)~B3aH{5@z3!{(s+%{rV1YMfQN8NrmC+<I3}6kLv?F-tkT+YNjf*i
zSq8ObwL}dV@T(fc0ZCdw`!56kyt26^r&)^2BRRtIOlMh^${5m8QB{k4;elGjh$XcS
z1$DJHLsHmPtE#Z8Rv-Rs%Zt!Ioj?tcmU4GKSgX!C!5MXC0LP0xh2SCxP(K8AC<pLJ
z#j~ue_?L4$GpcreO6!^KD-u~RWg^Dky+y|Azv)oKzoJW9gsGxM9u2X}FpjI28D*sx
znsqy&Lw95Ys{%w?V-B+j@Q@Og8)jL};$Qam{_LIPDHBKkGlUo$Ke^oC&3sfdnvZH6
zh*@n}o1)eq>BcftT`v3hUj?ZlC<(>ik_sN;$1*>pr8Hd}xURy8F<J_7Pj|CxsR%wW
zYlivB8jy@ge~TIVa)=(?5N?sjW92Tg=ivXSA)}E$f}*ypZU@npt_m#)g9b?2<An%l
zODjzGIUzP3i1qZJV2#n?T$or|+j+!Ek;!yyjX0MSC^%r`PwP?SfnIoj<d@aC#KSjE
z1W!-V-SGdw8jOEJHL?5}k(THWE<{?uBia04mL)DrV}BbD{u3WZGn(K2(ozG}{;N$*
z6sT;<NEuw(jVRX@<S9CNcs2~{wGyJRxK^!-)SS863uQBcgP<0dhRE+^@oIr_S^i?X
zFp9po5(G;tj7KzzjMxQf$XuCoexUK-PY-!Y?KrSk=#vnrO07aP8D^yDsLG`1sLD6>
zU`d9rhSg%jOfS;T#dS&kLd?~0Vrhl&h<cGJazS&shffu})W<!2a*Zw^;>%=64K-=0
zN>^&EFTa3-elzrS8XWO+j1{iID6&^US{!jq$k)M05nc?|p3<Ka%=Ks7nUCF`lCxb-
zDT<4sjv1Pvp{p2%+myMUvQ&I_{ZjBFn-M=v2PsP*(!5p8mlv+<`4jKvG49>HQ?uf3
z@S2r(m{pJ6t^Ox40X88%oei0ew*!8LXz_FnsPV4gMsR|e_|J{-Pm}P6?Ie;!GAWjN
zkCXywXhVSJ-y%N$3t_B9LM&NgmXsx1ij`UFLk^*)@ZW&(EBLUIRjg)>t-U)9xd45;
zm8V_sw|R|2+t%MQDF3KB|KbC~x9}|qe!X86ft*q`t_o07gmDLi`q1jLv{pYY&k$%R
zt|(>d`#G=%#2i<^&9YKEf5`GH`3c8Ab}~Kf1}+%;iLIK57}w&oX7gF80jsY@g%aFu
zB<dSU7)_SqN~-%P2lif2hyA0%5&x=mRFz|@9e2XXd}^3qhu=eMYf3-<+24Rn?a218
z6=n2k+<(?$j24C%L5_^kdc3I_bX3%8JG9YG2c2}$O%J_1=LIj-B6+ou0rh(tze0Hj
zW?R>1-*Daif6bh~z4Gsq{bx;D`#0L)yI0eA2tIG8%`p->^ZUky7{u5gE&np-Q#$9R
zgTyqDx?;>k!9@T_k|seo>l7&|?j8|K6G1omMkrq!_Lx=|CtYP@loC5msC&A{Ub{y)
zeaNwDCVAYEPT+UbhlV5yx*c)TMSbsgZxwOekgbt$3lZFaD5oeNL-qvt)^y5E7Z4^!
zM7GO?!r@eCjcj+uWyD+QbQ5|4&u=cdHdHm2wN(nz+W4|M4h?hT1BmXLJMxS}gP8h4
zD2+8&e~Jj=$lv5a(YHs8pxgbr5lUUF>R>>=wreHOImBP0B)w?;mjX;g!qe5aNH|Kp
z;a-@pQ|XLpR@2ZViKMuo+q@g$J<=uWb1`-`w_cOJ8k?Oy^(#|kLsW=$G8|gV;sB^-
z=#rZda|L$zTzbS20$(yBoYgPe=5+0e!&wnq1i2KQVN1@cE*+copL2|xs8CPpm0cTJ
zGOc_s*iIdZ9FuC`3qDlOxgSir2ejIz*HyUt`b;qGitQ(+)DtM{?l7%M0vz@!k^szg
z2WKV~*u4+t%s*h)oatDAIWe{lVCN*1csKw|=De{V56t}}p-1gGIFN!K?GxpKT-2xF
z4?V@9NFbU5+#F2sIU<rcx5Vx7iX5QH9ZO?spJ|{OU@_~dS%O>$K`x8so!*52!O%+2
zjU)g8^U-XH^Ki7e?DA<zs^k}2(kYIPj^>{?<UNd_N0iQ>c8;}YLSu}}KGiIiARBQo
zY3@v`8X7IRzo30go-y!8-*96fyss^YM;%PHj1~&fY%CO>u5s^35!Bj!dUdh^HJEMb
zX(_<{Pg2lSYS#jP+4RYZwU5DredNt)Rly5@OkQi^w2LO728~;ybAPezdSWVdZgSP>
z(tzAXA!kLOjo<Q>?=BO*a4Z%fvUK-ifM}qF5<m)7!P2pgMBdzIF+ii#WvTBss|}J@
zbFbDwzmt2H`T<GPy;}@2Vi!BZr!(8e#ro6<>%2Pto!%CbStr`}2ArmjP*gcxxn~u|
zMQu2(5xJcoW%UM0)4f}#I-(aj<98dn%f*$`3ENFw0eMlknXEI>Ge$a8-Snb0rz>}p
z%f?&TFUS&bRUC!f2N*#c>;^vYNJ;Wm5in6dHtV0rqd>{Z+w=Bnz}yD7sp?&w-u}J7
zlbyfIPpc}VMBp!-a6NG@I%_>OH*|^EH9M48Y7{cJdmfAHI9?j0)a^EsJ!~5aneTOZ
znRMSCe3f={9l05Z&Ryen^GDe`sF`keo$B4a$W3G2-cQI^P8V-C_X^0Hx=pgq8R;4D
zKu4GM45(Uj`oeCqZXH~0^PKBCT6d<E7l~C4_m1EJaSyF7FJ|pu*F;@GN}Q7`Q@~vm
z-ygjzUJ-7cb#m5=-9J`kr%2yntD>i*u1(c=Y-9~Y<y}GiA7+5Hz`OQW^W3Q(SQ>|x
z@<HfRl=85Mn+FrT`uBE-X7cf9Y`d9uXB^hptopN0uFXf4i<i&Ru|(>%y(HO1W@U0l
zOvm4Hb&BUZ-hQ1TQN1fE*pco~0T~Pxh-4EiFo7^vzE!hI63g9Yg~{*eU7B4Dgo~!t
z38!C<LEkOU`PTgR-$aTIf2Xgd14#P!W^Sqa)`~plnyZFR>;iHykYvEuK@T>(zH$C<
zl?lv$5j#*EYfaaI@G$c~{)Pr)#>sL1mDuF_j&H1PV=hgY|HY<{InFI(XFf9DjsYET
ze=E$0Q|Q7aUGDEmbDZxS{OM|4hr%w^6YIE99X)!EA36*sSmFb}P<V<hubuwgak>my
zP%&l>v)+CQ^K>5J0e7Lz{JF`59#+O5;cFdU!Nx^41JrtqZ|YNJvn1&vA%Q7#&ZL5W
zf<*`MjOiF`wu6*_LgPD8naAz$o~<BFOFU;OgZ$Fiyo0aVW}P-W&WX&a-}Bv?%Ea`f
zUeABNVZ!lsg<8QFLy<>H0i_>eyw{_OZCnesznpP;qLh$X>~J^ntv^_z-{;fmabe@f
zYK+A0O?GrY@sPkDM{(U|voj&KCA@~wnL4}mEY-8DMV4R{GMygEJX!{}^_iKmZS%Yn
zvF@m*it!@T=`1N1n$)1)U1wa}s3Q%!I4?T67vLT)F9Sg532XCRI~_Z|ZETDLt`RbD
zhqefR=O}rB`R5C<=9@LzbmpVfHO6q=HN9dySntx^sH6du0r^e6(+kT+m58K!vPUB_
zRr_w!VF`=VtiFlZt;&j$syKG8LFtI+Z1dZkFA=wX#W&(M9%|qnbi+-MTlW+^*cny!
zLw~uOfcuDB8%ZArH)o@ObAwYoVbeY(Ri(@JTP}6df2fOj^%H?zBz9#A+51H7V}fe`
z6|;4$Te@7=D6g%|dmC`y6o}cX)~)-Tw<4@t^LsYoj>n#Q=^3ScRcen|H&n(h5A<)g
zexB=ES#$Hsd;6)bY3LNwDc|=gpXj`%H9TIIyECQzIYPP!b}~?bSI_&wa3FQK1h=#S
zIV6Bd_a(coCVQ?!p_c&}SWUo6P3v!fcSQU7^6wJ&yHk(h)Mh~^0A!}XdBEPldcdK;
zv%stS0p+x)=yxucw*h=$S1})1e|*NO^gSNCwY90U34m8ud}a`+0lYAIp+IKQ>FF8W
ze>_oR0JyOLu?W#ja}mY~a}mMVi?O7A5rvf#i>Ne-IVX}l7b#(KTd0i9If0NQtFh)-
zWRoVHMYhp#xuZ!;?(`i#*x61|{6t%e&rhT<0Zdtl!MA>)8)kHQHcu}}5RYCNCPXMc
zSFSlw7=b8jMdJ$+Cu;M>*u~BgOYDRPZFq2@b{2wd_^y{52b1H3_>N!9DcrZ2UBWyC
z?`H_yq<N<7g#<;u#jJo~*jfPh$LHW}vYBh$K6`%H#6!O4jN~UyMDxV*B-SK~OFhG5
z#?P%jzGZ<RpC{k&_TDL6kN`*5iC~D(Wce;Xp<$l%WO(RF(Vww^;)o@VIQXu-DvY_X
z05(6ai7zVLt{MP@K7Z$&)#8DGYlk>cD&HZP7aa@)`fYv;FeDd5N){8bE>+SA3m9Fj
z#A%_tmKJ%OT2DOmDD{h!bheoBWlEfuT)M=`WGG}R`1&QcOgA$j&fBBSQ_s>fm;Pl;
zvhx|@N~&YtqAXZm!^Fu--lbV*nvG8FI)nzjmWh&W_D**4SCnNOv(G69-&_j~0}BV=
zpRGo0g)k8!BNZMQrD#zqqoTDkdi_?}Y1---t+7k27;!PNuyI<;B`#j;;*0JtU4+FX
zz!!hnfmE*8BqVD6zt-TiL4F3cQ9@EO@-|74>Zl}%l1q^)O?ve<m(dnm%aoOS*>cL~
zkwR{s(#w<IZX#(HK5_b6uFgx!ZF>oMyXyOeO`NvNJKPUn(PY^#J5#FEsN>T35`9j)
z+<*FERkh62Yxpr!v001O@7r&?<EKx>LB|dK`iY;)L;l9;&&8-Q<0eeTKsrWG6&ALo
z9Qp7yx2vYjm^EkKLR2@X*x|Eflr(6R+oId<xZ6dSFi|wQ;GVnPb3aAOYRv9II__w8
z(`jeSp^JxOz@W?a^7|L>%!e0Y`6bg6Ppjt4i9()Lpiq%a6^>-lR-T+zbm;7QPju_i
z>$w+RdgZk@7hqxkklyd+K`w3{UaB6w`WiK699^;H#Jct9_0p?;88B$ba73nQ7W_Z}
z!i1t3mgDh<AAb4EKLgwr!6pqkTpnLwyG*PxB@~GzCbX&4OeR;DEA6N()Rt^vzX#rQ
zemkE~=5I+GqB^;amc*&aj`V~~vd_m7Ny0_WqlqsgXc-0NJf|fa_gq#INlHlKlKdtj
zEYj^^u|x|)cAfMZf_5GwlPRn@OEL+;7~@BQt=_Yxt0qgd6Ff($%`D&60>L;>kRYAs
z{Z_HqC5P#KLtk&-kHhhBc?+kcq+!;>Ma1zJ3s@qMRNMtgr6FkNMQ+JD%R^a&o4!q7
zOUHVA?(8PE%U2exeI~UI8Sd!_WfUG-RWk8Fl9M$&8JA4bwy+;Vbj70{C;dbcD+DBy
z&V-V)f@yTzBy9spWEEJ78gKc7WRk87%+Z|<=~7wB3#>MLjqI;0&JS>TGungcSvUjV
zQzV1k_+UsW95@w$<yR08uizk&m`+?U3NoQs5F*ak3qI8|ONCZ|3sY9uv>ggt2MXP?
zmI<w(hy55-7M6shRxnUI?C<*_G11$|OFdRV|IYRD&rw?B8vKN>A=c=@U&)TGSKBJF
zK0M&8taw^kS*?8Qw8k%fGC-R>2&@)&59d=`fjsMLpt79Kj@#<Ce8rgZOs|5&f#0Ye
zmF&@Di;$pzS$(@-K0duUEYeZ8LmRH^QH{l>OD#p9l!EuECaDj~Y5JX+>ax*_*E_4M
z(PPsF@%(vnMJGJst<<kV_xX%H>$F`L?_{U`QqxDeML*$6(fm`<WWF6Mg1oPe9?J*N
z6%+=sKE3Iy$T!t+x;ARDTDvvqI{jOrt$Bzli;P6*aT7a;EEzQT0dGYGOoAgzIvuc3
zu1T^TwdcD@rZ!)$Nlp;W#)UP?0?LK+&3=zpybjy#=HF8ax5dNhZjW;3?J^Bd%4C!$
zU6zdUWLhQTBFWTAu1Tg<as^iJF0PKj|5M{>`+0v}?l`h-@|3j6Mz`Dr7AR~301Bi{
zHp<zNf+HzFs((opNm2kY*#Wjf4M5Ml93~)nFXjmdICTJU9fe~n04R{cH9G(RzySaS
zRsaC718fBVJ>W0_$s4dYfFh^ZppRzRY|M_+^D`qnv!|4vu?QYdL+ofINLEts6qe@0
zWi-Cs5C$kcsU+$Hc{?h#t#z6l>l_KzY;`1?Tz}P6&3_iN!=g3R<tdD<bf!w2{$|Ib
zljj9hp1-)O+0toXyaAa$gGu9DcMYp4;aoO@x}nvi$9a0h+;p`JN&Q@{yJUl#xxM(i
z7M5w-gP~k!OSPo`*~$dx{d9IVYfCS&Z^84y1v|RH+vqSKR_J-(Y9gBYh=Dd2)fP0B
z)6iW|o^$a$dd>%xLzwekI*i^RJULhXUdW+d&)UJ_jOfRzy}D|1Nh<lO={~}AIlI)1
P-_POi=ls8!^0SKpO5f&U

literal 0
HcmV?d00001

diff --git a/src/static/fonts/Inter-Regular.woff2 b/src/static/fonts/Inter-Regular.woff2
new file mode 100644
index 0000000000000000000000000000000000000000..f15b025d666269fb07daf0263e54231481e4289c
GIT binary patch
literal 23664
zcmY&;W2`Vttmd(8pZD0dZQHhO+qP}nwr$(C_q*BbP4>wo)3lkknf_>|&$!8nG6Dbs
z{0D7&0EGWGKv4bvWZ3_!`yc)P53B%r?0`B^oE3X8eLf{+0cBl)5LQG8sDLj1fC3cg
za5w-!Rv=>Fcnpw#puyVU1t2is*l<r|>9(A@Tqmu7%|~nTFH+8cD^_e_^G;ScY?_tJ
z8v&a~{G-isuYZ4L#N`ZNgIeH)mMu1+gZ1><ro^jF$SNx}qMOy1s4E&5Liz-SO{GI3
zC-pb08j)YokU*!=7o$W1fgq4Gbx>T4v=9<QMlXmxVV}bt9~L}d;Q`ykxzVpDj={b=
zZ%eXY-M??GTj(?M%-knKBO-ovmk*tDttT<~U&9}15<`-0b>tmT(K@U|hAR?!p8cJ8
zzgNXcxgBxKvWsl4Kx!amez|p9c}{y-3|S0dLXFV|a*5X;Bq5t5BEs04!OSqoNzGGr
zAH614iN{|hCsvxQn|wtoQ>BS}YqUmE*h2Yde<_(Nn^+|*mS{Snl9r;a)dGUT@xj6f
zNCb!xDG&`+sw>qPB~ft8mzjMFs$<?pHFJF4Up&`um>%eI@emT+#8}Q~D#AjINaiPN
z?@Kv<e>>G)2Z-lA3i*z+^+u<9TnVKa6fUJgS40xKP~VGtDyYUX-d`+URoYy=DlRJi
z_R!hKboKVX^o=U1XItdqfmeSyty*7gJvq)Z#Y}BwqU6zs1@TBl3FP0HL+XAPy+2n7
zRCRJ;s<{O^!$I$cD?-d$bR<k%KSIt6mnGbf2s}w6vds9<O>VhD*M4O)Pxa(cNaP_)
z<j0#kL~V{Ya+$BLwsPj7gO*<a60&Iu%4DmP9MOK|&_655oKBfJLnr#*qg=kalwm}Q
z4bfuN<X?q&mFyVdyEoT8`dHyB?n(wCWZ|Z{`TUO1CIH|>ZGN>MKSgQO=rK3O$f?%W
zfa+aciY=05B86!48r4L1+-s6|)|Fjsqu>`~MgV|81kL}%caV$S#cIRaJv*3=GdT?_
zb_(0?x(U`4&#GY)*?2#fKhK};rJrX@AIcue7KWaFH1j@xm6F={b#O7#Gz*BN)#M0&
z`2S>jIDi3fgIDzUL*}7R{6>H%fW%_?LtLUG<`GkC{$`r5XSb-LI^$JC9PZg*Nnes;
zxzZF>ni&7sR4T^0iETmxp{4fKff2XJdh{+l70!aK021%~$UMYv*P;7+d3B+rGK`Pw
zU8hEhL6%c2bbqR6jOreqy7L?SW6uyF2Sx+)#QEu6(B_X0zD~Hh$Vw{di0rnrFxHBv
zr?>Jz+PO9LDz$l?QN^l`A{xkzqlf?OHt&=y8JkNxZ$=Rg)C(9)ncQ?qZ){$tZ@+ir
z%9=Gakt)BVgbw5N7uqXfa)U%HV#ln)Nyqy35J3iMqQ^O0&~u06*j31LpcrJQ|FS7t
zeyXcWt}1|Q1j1*a@L>uQj>(1opw@<afHoVGQL&l^*HZ6KXZ&@i1&CAPs0|vBejAqE
zz6jrXtmlm42@N0!3BuR^31#H&nf&x2{`4)?3k*fuMYpVqCsIiy5@TX&SjF_gnuV)w
zn7~x2k7nT*F|`deYA0huog<p~VpU4%XxpD?_Jsh1BK}dL1j6^X5lSOUlI!slzhZb^
zk}ThHJx?J-{{xH`1=Hs~1{@XR>8C~>vTh0j4GEZu1W~etr&>i;Ev2g-jHn-y4Z(Hb
zybh!?fK46B?2M?aqNBIbRQ`D>`UkWP)s8k?U2)3XQe1;SXe+pnC3swv_niEKnVTm9
zIdD;h$rZfx_LI?%0?Q7EO)n3mvTlI$a=JzebT{Pq-g^u80B`c!U&@bR+u*jvk6lNr
z-?!7}P^vd%$F~gREe#Y7e2|+&wOzJvP_Hi--j*>ipl@z)x8{?6*&(2(Fr=OW%k^n6
zuw!=;Yz09FN8}NK?&rXFFrvX`Vzx<0{TwI|ec7vB%1$k@X&q5ql%el{k$Bc^Z{YR;
zE$U1IHSAAG#5X7qWDKIRU(Gin0Tx}hCj>4da{hs#@=Q-vDkxi!CiYt6D1Lw<GZ65M
zoIWT>@|YNT2lUl&aA_TCzL0)qK`i(~O{zCk9$>>-wX1IfLZu#`oQ6J~$=I@AuGv+Y
zfl8IBIHM!dM5FZ0_1c~&Q40$>rnQMd1pC#05RmJxO<S0$DG?R}^B9tqlGgRk9rbc}
zL8irCnJvaZ@$c`*zKRNY)`T_X@wAZ0;opi^Na!6yHibLumqM9n2_xtsi)QB*9EbEh
zO=0OjlF_k~@rHSX{DEN%s19dBvA=*V7De#2HneuZ)}Q)stI!EO@`fRADUNl8?aesH
zp7-v}qfc2JKV2r0aS2l`#5Qi59(qf388hjVKHue+On*(`Afw9I2`vPyDiMEVpKSFm
zbF19*VJ=dulU@65kwj_EYy=%?ASo=xMAAdfmobc0(JHVF9ak^g`(!U+o4y>@N;ZOd
z$_=qTrJhVQXeQ3gg(EW(JM5xxa$y1}g{J(IS@tLgvYKpb@Wlf+9`Q5?2Mgs}VUd6^
z8a*PzZ~ISV01WbG1}tv3%h{EQQrLxUgkSq*L7YWqwsAsvkHEyPaGmL@Ot;2DtpU0c
z;EwR6X7l(~{v_Ul<Pw4Q;xun1X~uA1hw+u>^B7qDXKXLxbz?SiuF4oPKzey|BY!LJ
zWhZ_)wzCsQOFUS(s-8xqgeZ0yD^_3w@>X3S<GDSp*sdc6nU!H5ZV`O2d(^%69?ruu
zI1Yf>MH|=E3>lqoMCkPXp-^uATN1Z~t)6Y5(V49D6opq^6=b~#4!4)?rrhVY73}r;
z5$-m*BC8m;1%~z-Z|2)V%;#_`W_ymDKBJ`#<1l_b=iObjUMa4^QrQ^8c;?~zs}2&Y
z`F}8?Y4wOpPGcl9IMZ?a9l}~n|0>b@I|6pYg<OKDc=q&@KT2mey;!jZ8_39SvBfT)
zFJH&QiI7#dx<&HwjdURnh0Ue)z?L0cz8p2OeMY>e;1Hl7x22A5M(n_2ba5xr_8Tw4
z4RP+t#DJl)SDj8uN8r%_KRoY^D*#cf=Tie&bOVFp4>-YWK@?p_Qud7Ih3@^Y7RF45
zV`$x;q8s~ZnXU_(C3=CfP^;Q#jw%j;)+`#BntawKd0zorBNo=0tDqB|@P+)rSWB<;
zxC=FPe38_jPIv_UI~V*gD*M4lUD||$u)Ar}VT;<;N!>PN#XFr|dKW)l1XAp^GA}Gd
z7)X*X=?=>K?#qywreEoBTidaRL~bs9uULBT#Il05-l#jhGsq@M+f_`8T^<P?1v+X$
zHK}H1QSHZ-ym)tsqzn5pY3yXx6+N&GgoWLykPjto)Tsv`jWnGIC#6!$-bk5eOkM;*
zkW;8fTHCF@9ve>W5qqe2NF8qok<tv-;?QZfmZ+I(f0ZoG2!0+t)SI2to>I^OY_JoA
zA041`qW3JZ{Mmm2IR*v<5r!b#`JzPAcxud&KC1G0Si0#UK50BJTiYaxCls6Q2XBL>
zP+Q~??w-#1Z9}keZRMz>4{@y<X6ts;F+K<@|ESW8)F4&67XCIFRd631`fP;1Jvl6|
zx^_b-cxXe2q`x|R57A>6%_{3DczqgepP1N$2g)#mG>G~nwz?)F$Y~%Z+-POKG1uW$
zbzdm7BSaViB4f1mO+dG+4@{zL;oKgc#^ZDW4=~xT1}izjh(ku4$+=VIL`Dqu4jnmK
zJArITNX{~<C4Ehn*gC*!Wa^a6oURtt%zwzc0Y#XrLt;cxHi|0>GkZ~XuD3>-^&3Vq
zyv!}|J&E8D4@I^MM0YpkW6=Qz$@Q^dvyA|z();Pr5Jtgb9a8m=ba0Be<GG&#J%DrI
z)9H#I^nK?+^Y@IUp@Q}3ze@+~IHw0OR=mpx6HoxrKz9i1N9Jh)widJ2X{f-<*5B*A
zwFAWtr$#JYkT`2<Ac~CpR|zOVk5<>zbThd%RWTJkCDU=vS^Z4}CxNDFllF>B+b|bw
z5L;VvPueQ@wksHRTnRe4HJ-cDZ&LGlrksf|uoZ+(QLUUw8Y`7wQzr5qW320jD~y#*
zW@gCmvMU!EwUQ(8Oz~~kigNpNUttC^9!9{Z-Z6v@{1b=>qi*h7!lJb4Wi8a}jYm2o
z8i{*lj0wVHne8OSfpBW|<jn&unj<R=#u`Nb2y~e~d(<@mrBt7*UN47rkQ^X7?e`0z
z!CmRspyo*kU_}i_#iujXr3$$t?ktT-7;Fk7@IV;2VHSc0k;pLAtrDx)4I^<$AsYA-
zaaQufC|^&<362B7Z1aC=cI-no7cy#6`yRVhdSyzP8_?{>#W4s&IL8H9XX#qX+6Q1b
zUpP%hJv@^l_d}ChsL#28neOPRxL8$?r41bt>ldlxAux^6M|)umo<IwiFlond@uu*f
zpZdwa+Y3?3NBdVVgHGUyF;itx`e9u##KUi3KAj&pdND!rpEL*oV7Dn#@Nh4~uL5XJ
z3v|xoiBrecJeQNf#PhcZQYd4b#%R>S3d0kD7@sH`-#<Ip8zc@SW7Jkn2uzCqSwzBU
z<?tt&(rChR*@Qfjgr&NazavAQe@-T+-DVX67r|H@4!~G2{fyU}aNrEvPkXM{AG88_
ztt-ZIiC+>N4SWn^iLQ)ip*Lsdd>Je>gcShspNG&VD@oVIri9CJN%pXvX(V7{jR~Jq
z8~|dt?`M?LWru(tk{N=|=aOp`WD}8DVy)d0G#MF{GF=}{W|te7hbeTr!1hrM9O)6d
zp{yJ3qSSvzr{cIfaX*RoBn-sd&~+^@e0}FF2{G})2zmctb{wGt!`^-#D6)fOfJo#T
z&FPhvJr6C3;6XU%qKmbT2?@is-e#Hj$ZvV*tQCJs1#+AL<cHpN{&KkA@WYJ0)P$My
zmGL1OW2lxjCarUu*6yCSamihdBukx5NPUyuX@Z12Rzx$}5JNi#+q-e00&;OW@eP5B
z0v}qT9;L2a^&;%6!?2%>{@A!jpEackC9U~w*Y=>3v&nF{iVK80<7!MX@}GP)-v0q`
zQQhctg$VDmkgh_@;cUFLk{yrx(&JV!evrOf{7U&v6lpn0Gu~WsNqI6U=q~<YuFywV
zx`azN2oF6&CE5xjMXwOuYlsnJBrB!CS-dnPDbo-$IKjA6V$jUtZYVCf3Np>tYvnn|
zKPVa}6w$7KGMIKOtme*>HA(jU{K_Y7+k-7!0G-*^szS0xg~UTv7em0T!LHYgMlYoH
z`_ZplhptIt>%@ELFu$E^2kJBCdJ__ZP{dwh>{G2Qa5$`ft2j7AtH|M`&8X?QN&pG-
zUL56z*<e~ic*}N{&XD97L-@9JmSAr(AOj?m&p)~-)A<dbAPBfZYD2ka=rJ#lqIo8j
z&$`(nvZWBteEa)W+ENe_&x)9+#j4;Rxb2}cJkV?prL6c~FfGC3fL`bdt|VcH6i$PH
z;$HJW7R;$CXvEi^zK^l2>Ml)bt*{8JyIr9U;W_{Hqe1X>>jb7z)X%e9OUmtra6VU=
zUsat{shav#?uj&%q!(^oH2n6tFKgC25evJcWmb{#-D9sXL*HbN?F;LE<=sG)B*w=k
z28-e%dRXh|U${&o!?a6RtUBSou^tiw13DUORgHvefrq_@c5PsM@u5Ob5Qh#=0`qR9
zz{hkvB*o0s{?l^C8uf3NlCyh(5(8h1yJq;1`@G>@x#c$2n^VPSy_$Ywv3QEob-6HW
z?7M@A(}nB8&K5HoI;T~w&;+1AUqn%Ot=an;GND(e$5~e*M0FR+_9YS4V+Sb9d-Ol{
zF_j0O^A3S>Kjku&>3og3HYJN|zpMH)W10F1X&(Q|b!<+piflTk1UgFxQA?F=71Jl>
z_^VU<j+<Rcatn<z7#4H)<GrQ%Jri&~u&OKg@_7!xR_}ps&x6|&bh|WM;VSowsMn)z
zCvKue+b2fbIbkeU*zxNt0<4@JMoG?63qQPfG`UvH5p3($bmtTf(}+`PybGNernz^%
zKaR9%_1fRT0vI)P;>k!B#1$p%_51k4e546P`Hl{d#`v!Rf^_?^kvFrNH?v@z@6(HE
zXmC=KrGi_bTd_?=oeVvigfzl6{xfL^;~cme{Ks+?FQ%kH01kb{^{XcGul3(EJ;b??
zV5qq$aXgC_GgoYUk^&3|Hf)Ezi8(c!dA37!M-~WZdKj81Z*xCTvpsZyc+`0mn$Vgd
z<oc>4qaY)NQ^g|01o^#nbA)*8j`Q^cc(NUSp&|+P7cReYRlu*J)Z89igZ(<9XDsLB
zAj99h(j5r0<yrnyZN9b(w!@fCvezwvCJ(>IIYTX3F25Yl*zze!s+w*_{?4B|XV1{X
zu9<14w?XBW8ct9z)9VoYd0Ae#p6>&Takvo(WORfe6u03&;BG@gWNjk?=+R+OR_W*<
z9E?0-$SUhbgA^UtYSGLti7Ns6duV*3cZhwX;HV=}LCg@QB70MmS$GZBB_GupJRTA8
zWQHMpV4u*y10xW8BAogWIB@HPf2PFVqlcsF+X($*5WGPDa~uR8&^w!c5LrqT{~~#D
z;Tl}R1t0sR%|QM~)bl_N)T1H6%^H3ePsh`_5!fJloRD`m9TgV|sfbDB31`80(HKhg
zm0SDia7Y<3^UTG?vDi|}4gwmRSmmhx-L(tB!?meR3{cq`e;S3FA*g>8&UGCY($yo9
zT-*!Y6x`H)UoAvlIy5i})vz7w7<8O?^dO35H+Bx9^qdDRhORSTo}vl}pcV+gbTkvu
zNHiLgffX+;RInhMo*1AX07Fz9glKpTJ7;ud2F{;^Ds=@FpjHqSz&=p%4?u`s%a9aC
zqEz%`{n<K@a*h`|j)68trTga@-^g5ZD%ryjM@7W_oCY9$qLb_#o&mkj&YOgz|Lt`M
zAIRP7m59{Y9ly}~DMW8utvuRAiFnVi{^F3PkM3@s%Dcev@wXM`-dqQHJCgL-a>Lw5
zmy}_=ugHiXBXC`oD@LI_+zQU2t?>}@R+h_5(AOO>^h@_NHyaj$GG)J5TBd=ShOz4c
zvwZ=^2?AuXuGOWXHMTaF7X(?t7%D~7%&DEbmp>2_3o|P{Geb*VQ)6p=Qy`Z9DI}_X
z9#7J*+*LlNZ<(`t7I6&c4ZbBwmg6S6X_n(IFba#g^SF`fw!Lb_2cG+(h*(ihQ*%Ph
z|G)8#>};*}5R1-Ki_VzK6v3xB1Ig5;Q;D!dg17WlvAUe5VlGhMk(=M$^%DtWtq;o%
z6FuPGJlq8^y}um`;6Ahcd>L4+!gS4$flDm=X}jMt*MhmE*j)O}&3Cw?_!~XQKLDGn
zzdLTWEf?7eu9f;~B3LP2cFDB`9}doVEj^s;FNfb+@l)0&(K2!nd~(TVBEtrI@f4*>
z`5IB&9?v;z=efF&+n2WGCJ_^!*`m0f!d02Dq+{cDxv#gMomvi$+G}*r9ffP!Jl+JG
z>RgwaQD@pxC1?+Ot<garV0pD<St;$v)cjQI(l13dojseRHZ!dgG`nm$C@h(xgWC&<
z8o#-0ZZ6+i@?hZ)IGhRkSa?&T2OH-QjefyqnQG-q6y>KVeX(rSGyL4!=qL@Wz8UK^
zZMHFFx|x;RrtnT1Z>cYN!-z{M$_w2Ikr@}2spLh`N{g0r1C5t-UAAPuq%(6+w2gyB
zaIype+o7%r$NPv8@sIQ4ShAd%kUoHbeS~=VdHVXqgMCDVgm?w{h4~WU(Z45qCMObj
zjmDFGWQ55SF=6UFVkmQQG09|<ms+lboMWx-C7CL*I^G{J?;h!DJyu%Ymj4-8uM{VE
zN?Q<c33kFbVjE8uhR2Ad*(g<5-4q~^h+H<5gk0-iFpk^AQ$!tlQIaC-EMN*b<6YOd
zby~cfuaxci*C_#4B3Z$wkyDs3Ed7^nkhBI$+Kr$h-@LO5F}`IE%9VtWEC2s<K0DO&
zGV6u!{XAi|)9m?txn!6BrD=}6SX;#PNi0=N3W^1s1c$~7M~kQ9?K#?Wgcyu$U3A@g
z5kxYs9CA<o^69?RP|l(=D4@H2QqIC(f)DURp^yhm5~{(nm^fFSDM|Z|Gt^0$aLx>h
z%ZRR^mn}YMa3WdAc4nH+sCZsSN%Lp8ghTW&kDvO2{qC&rID~eobz%Oz$t!(1!urG-
zPg)rZTw4>?nJZV8WDmYn6#P``^8+aLWHjlqw9Qg@tiPrm*E-a5zeshXdv%}3_B#h}
z)(qxz)hh@53v$%YDU7Q5>6Kw1?Wy``;(dQfP52=^Bq{;#gCoev!ccPKZ9<**{pnyf
zHM-EE8zbA>7KYF0@`XavOf_7NyB_;hWQ{>G{@z|p_nul4POEqG<IRixK0KDE<qsS?
z)UilgPM03{A)F~YbHrxY^O=%NaKn^DMC?l&+3+|e%*OEJWr9@to$eF}$@k|0vfF3Z
znQ;k%V-O0oJki6728YKBNFYQ=DxJ~r53JD&-eFW4Y4v&?`$aLwDB(D!STd1Fqji1r
z5}f9VrcHg6)?fXRZln<Vc2HqFMEzb!aHM;w+wqeR<TT~<gL{%iPxon&MddFG65ok~
z9|UAjkQf6U-X$T<lU$t701VS~d3?H2I@<$HgJgoWtGa1|H%u7QY%yHgX}UszgN-w7
z^muc9^dwg-*W)Bdt~X|mrq9<3C=gkImS2t%vkX%KA~IZLxsW|tONTdURdu*|`8gwP
zYCYZ7WlP=7BCP?};%8|Z2E3zm0g95_f<P#QhQm4i9+6Ni0)s*|yRt)1)nl^rH*#5J
zRXnM+5}Aae=<56&lZNmS@aO<Uzk@wXCJS<+jzLj&B`goIZ5m4ASN&67?C+)Y@9Ns-
z&T}t}_qAdU0#~P#Uk(a9iX6A91$93~lVrz{g|xCIEt(;KOmAv$-0U4nE?Q|iV&ZyZ
z>(%P3VC{MG?Hac&>_$-F$BK|z0G#B0E|3%=fB=SkUx)w<SA|x=$BJ%!O|mrIJ~+ff
z&7ONADV#KvGAyUSmy&|XHvU+0{w9OUl0sozWu%JT87u>IPITXvb$Qy`#b>xc(zrIc
zG>xYLV#CIMZP=bT1PPvK2_F`G<wtjv==uECt|D_sX?Fl$cZ2>ca!=z`;|7c(9S-A?
z`~BS&#Dzc{#SyTR6>A4Ia<;P>@7!^}+kwA<%}Is8p}}KqlXrA8bXdkl=ZW!IlK)U!
zGYuuW`@eUn<yt+PBh5NBy5uelM6N{!5Ja-e8G^t6;4~WmP{WM}@;`Q`x9qi32Y`Ur
zfeiS6?j&-+2-OnkfDor6N&tb1;`B$r{|Z8f%1rfHi7o}`D4v`ptMA(>7V+!IJiTpc
z<cx(@)&_PC>^(78IiHD7T@Utw5ks3bgkYy@KjF#}G#4!AKQ?0<M`0^6*TQnCrV%Qc
zoj&Ien1vC$?B5gk;x1a$jOBOoJc{$n2=v=f`>+Fpzy#wI&N+2SXgv3(v5)RT=z3`w
zj_MAB9Q=m`+Qz_{0h-3~%rC#e9!jqQV1=%j|4@!oK5>mL&h{(zlSFWlsLM~eu$04W
zO(9KMp-m1D^Z`>HLT)nM$UR4d_kpY*&<oaGz8tXPz0Z{p1>Xk!cPeSa=x?nF5EwLL
zk4EmE7t`yiDLcx|s;DzYN6`7fX}P0A*(3eBAhWUfc(>|oZ;vEnBV<%p8C>+(9>ynY
z)h+%m?g=jja6D^Ls8ZTN*!v7vyNDK7a0Itzl6D9H9)Smm!MY8)j6{8)IhiKnVDOC8
z?^*GJE2%ZxRl~RuXse;^4VL=_AdbiRz|%*UYf(57lzXCw1L(=op8$;c6eDNHU5iCF
zf~kpRTqLdGNh}2ZYH@dfKi}tqI?=rpYs!;7N(>AL=1m%3#0MfSWokx|Hk>MC<3f-d
z98jor7)W3zELD42u?M3IzMp`I_^$~K(^NgN7bvR=uBv}pU*Tl~QuMgh^;;>tIS>fk
z(|v?D+h>;Gy!Wes!)tFQp6~@dE)Zc0I8`LCTSK%P-5Hkm=*B^Ewbw=T^V!N9Rc?}J
zOzsGtus5`)<fl!jjc?k_mr7ncJhyADRm{8^iKQA*HxMy!!jJYIJ<m=iqrN^DLniPT
zb$vSn;p}R0#M2QGK`2ZYFyS6B4*xjb%ENls?X+{>Rx{(&OMau5l}EOJTx$s_A$D5w
zhpZaJmqp2iI7EckC_zsvl_1y*zxN`_eYe4ZZoSjd3_G36sv!jqA;qy-2xZ}v$dwsZ
z1oa&UlNVx|!s*s6cdsNPe*2LAr2bx?&+n%0e((?4KApuKPF!@BR<u7*@%|QL9nYh<
zTyH1VIwx5c`e{??wk|!Zt~Xe0{#>gKSg7<K9$8Hwq4mx~t!OoEq1FD_x-z7_^yk%y
zrk|sw=bEK=%0)Q`4`6KSljw&Cie$|!)sDXPbX?{O+XY&3?}WiOH%3)e6eOCaC@aQC
znQL_#1f|NP;4(_EGaa+VIdYONq_mzD%7{G<LJ_s~BO>v6dYEOM{_yR%9hV}Auydc1
z!?sUI*V?y3PPt}Kig3+L*BZ5IuN8qc!=oxTS$Zt8QzU*a;{~uLNYLac2q9?81v3N>
zmDB&mVj*n+f<yY5iJs>LaVd)-4)}qkfP^3@aV?eDg0Z$OgHVT{OLYKqDwJyUJEn9u
ziKp<aiV4t}SQ&lH2Pshq_HL%{Js(IB!U}f@R3?w7QiN)Q)mxdF+3guH1jCw{A)*kj
z*%xzNww#<vc34kbiJCtyGBYqG5&;0pD=Q<z#ToJ0;hEX63sPpxOifLRC4d0(D=R4p
z2`9MR(h)rkOie`-i2(pAD=P^J6Qc=8|D((PcR~Jt^!zc&{~G=i{@3RI%_z05QltkC
zEb}=0AQ^$cZBDykocWLRd-*6Q4R5~vIGOYRCQdtIIVB9m)a63l-&Q00lsvV9t09Rv
zRSlAEqDCMfUHo5U004#N4$K&7Hp^Yuu3%WP(%L30k@5VL03fva<*E|Je`>AFNE_<n
z@rJ|JgaVLZoFFMri;8M#$G054Hqp!^gkUfCYxrv-kH_L_;dHQ|nmD5*Ruu^Sf98mB
zDl<|S?kp<F8Qc=z><ojsZ|^Nk3t$LQ`LZcUT{Z+{B*OwhDf;2^F3S)D1FEo;gP;~G
zYFU+mj#IQW5*rPKA=I@7zNUsXmf}Nl7mA<P;@Dg4iklvBWR8a16cGFQf~3Jp{dqT;
z%W#4kkSi)G5?xz~+!llE3xlci^og2fSV$PlCoyKXodp9FVk`0#ja#fxQw1Y^hbw&k
z_&7Ty5|ZK}{a#RbiUjRnd)seLtb$1y{~_Ujt~%zwdXoQeE#oU~ctb&Q9!2^_0vXD{
zWU0RLTVSovY>){U^xl;0!<>KFP@nzu-w<4<IszXsDZ$)}*+unB%78wBgWK>qJZh<6
zY2U1R*14i{0WzsB?<{6M{4#Cyd|WQ?e49XVV%ghq3Gc|j3+qz`<O%P@ymc7G50Wal
z4e<yz%c~Pv*7}W~3pfnf6yA37V%WKq+;0X@!)aZ&h>k8i@5%lFJ<Pd{YMf=WS<RX}
zq0zJ-2Sx=mi9~<)vy3fp5N)=>fd~BAF-l`scL{*B;}z8^&+sGBm>;Uo7s(*EP)cqj
z(jc2s^3B@Y46G1m0QaNCgRb1K&kht|<2_~LjMCy=adR_Z<9&H>aGE*Do}KWlYH;Vw
z4IzI~=hn_n1v%;Bt+ngJy>)ZzJavCJKzXGx^dqo~NQkO1HrInEl_<w~ivrmm&!=+y
zD$U}v>d(g;5Q)ZQ(VHYrNEjh9ll%*V(M^+kdgWvy-&+WtEk5n@1oTxd4(SitLv=1o
zqVG+=9%1QG-pc7XVLru!8<ZtVqRU+c8jb6xIzz0RCH#x%>T~!y`>fwwD{^t7NHs2@
zX%kuEY4Txx7RyVO9>DSC+pQ15HhbCv;RE6M-RA6)mSSAoOi1#0?{VXi+=26EC2}_a
z>vkBygo4!hjOj&Z^YN-7<=pPjhO=JQGWVv@glYcyWGSk%DeW<C95cU;)7w33)|h(G
zn1e^+vv^-9ZkXtD*V;S$b9F!Rd-b@0#?n>W@}Z3~d&&aG?|UTjl;Kw2b#wN3^SIIS
z^;+VkG4D1dsBNRk?C&#kpF*XR>JB!)Zn1Ch8o-@(nZsirk;q8%If{zr34M?4KoWzF
z5i*JDt66%g?@1%td;m}{y2j&n?|<G@+3k#zPl0{A)GDxmETT?PWcC#Wl-Yr6o?(W!
zUEq()1#`x#(V8l^Gq29A(*ac}wT!MV7PbLZiZJPLQd24>b2Ls?j-m);O?^M%Za{-%
zT0%i~cZ!OJMAI<ZmZqN4m`rS0DQCXxw!F2jn3$}d(GD;m){RNpNvH2TUx|@KM5870
z)|~Z2>eN*`1U>ci>jiYGtqP`}nUEb#ZWW=2Fr2L)xt<@c-gacpyYQSIr^%Ib`-qNb
zr1+jPMK%(w1MRzY*So*)#J?XtGC=EVoJ&E@!vDD{wXa6+?7YLU%t<f8oMo`AAXyez
zX@R#|PsL)L8%0A|Ta8C8F{IMWG%vjoABB(}BxKIKlL;kOV646z>ciuKKbf&N5E2*)
zZa5~EG4G=qBXEX<z+^C;i6wH=_5LB{&!;~i6w$J-F|IIXolG!`^A3r;QM;jQS(fFh
z8&F}}UbrkM+jRD<lWH5#yp~uf1OFELsRt=FUSc4W+4l$BHeRXB#eGIx5@A_!lnX&v
z49mA_4U2V4aWwSm^d?CJt>`|I?S{+9#icOvf9dytejn^vdiU@!s>e41{-^a~6to6x
z*O+ZL=jrD(NMg_7Osf+NaJGjJDxil(uh%-=e{-)dMQz)x!~G_>`y1Q5kiY+<=aJD0
zc^`APAQ41x9Zs(Ru}JLi4~rMy==M!d7wdhWQc!>hy{+P@e3CodN7C-Pn+6}kITT~F
z+ump!YgS|<6j{2S{BjfiF6k}v5HnnA2;CrTO@>GIiYlkUZbQ=WIdmx(VQ=pK?!V=5
zQnk1+2#p&B;uNq+zB-K^DKl&uw<B{6OyW0Eh<E2UmiCAL>FiN<a)SN)zREwt|Kbnu
ze)Oh`|1iI%P}ie3XLolNSDdpf>zyLy8{CiVpLW3v@~J2U_&h=vT2?g&57(GC*OzVX
zyF%VzQlniUdeV}o;v3zdp?E$&_>UVW5xg~cE%qpmXd0+$?h`J$B48jhySkprBMmv&
zWn0Kk$>^0}|KzJ)A{5BG^#ILzdc}85RJDhcZBt064X;X9g@3aqvN@^kIMO6M;W~>q
zL?jImnJ67=V#Ay^`;t*0USCOufg^=qin?Xm@xs^LuxqAu-K0v}<5#&-x&tX}h2zkU
zkL6P>$#hM}DhPYCXZ0Wi&u>2S>=nS<#H~?Dg6PxlW6<d%H*Cyr4Ky0p--E_K7t;2f
zuHR-4uzhx^pM?~l7BJdqfw+;T!ps~-xS>XIP_#fCupafrr0HPB1>11)ZvojxU|8J6
zcYaZd)thh3UQ9umKS>N{tF@K$_v?@bKTQ<?83UO-ph|{4sZK$-eBtRz9iXYC1_?+d
z&b$H{xgLCh2XwD8%vkFp6`&$S!aN^{y37hA7IdcyuhQSj>aeB2yZpb8OEDtwkqu$x
zYpJ4J5l-Xl)|RNpsLy9Go@r<Tg5^+<A}b*jkHS-2!ID%e2_?<)tLV~ALN}A`DrxJ9
z7xQU!%w4LcIkHQqj$6qeDTA81p-?n5!RkCM(`p~zn=OMl$BsT02Dy}+!`w>Nh*Kk;
zUxAd<A>ohHgEqz0>V_szuj(I!NpsK%yu{1c)T}i&KMOoIrbr(`Z}G6F<&lENm6T@1
z?itqTwxVN$-n=ndCKU>`tyYKptWG<h1p=nKoQkQ`^Ni3^dxSF7xGLMn)v|Z5J1XSO
z6oNS66V^MG)$2tSorYNzmmh=cfw@aMgCLv{P5;E`7E2HVLyrrfwv*-)Sq-|m0f~SM
zz6L<wVteKI7wgSv6!fI06Nw_TmQOg>4g5zd(}8&mt{qE@N9c`Wne!cU14k<;V9lK{
zRV|W~lZBBo<1D|~bj`o#oFL{3N~ub)zJXG@2XIR($6O4GMf=90qP1>+pip1sa1x9y
zP_4A{um>9O<0{PM@l8^xt5L*~8AGDQW7o(Dg-qllZL%x)A+>J*&856Miji|H+&~;v
zqEE;@O<FDV1dE_A{9x+QKauOm7(#9%hQuF!mB&_ttF$FQzc%q}OJB`>LNplzSJJ9%
zt1Kb3jeRCB@%s>aa8KA+b=J;PkL2ZOxWauL<F$6gMY!^flHlRi1vGO^IOy~PqFb&P
z3mGYoQM*llEYFHWaLCJ8I7lc-k`Q%8`};+w7m?_q@JtlAj?rg;*RdFcmuLWidAlI@
zSc82@F%%}mUGLbQqUZbmN8fG?!6;Px!!V)TQ3hXR05`C|o_Qj~p4UUpy1uJQ@rhH{
zAztmII;9ZeM_6Q9b}T4;K(ntXaT$TB49RZNI?@HGK+?*FM$0hQO^|?U<TOxRlQ}))
zJR4KpsivwW{WlSqCtKXQ0A+f-sZHd;59(syee%@kllPFBQv3=k`!A#`5|}UM83dQB
z2p+v(c&c{Ndko1rdb2Xb<ke=-0*`U2#cE?{H;EWXW2=~}h9A0WC93j`Rz!nCAe@sR
zqq5hv9o9lJ3Ja6axK$gnV>s=?5OZ4lu~u2rQTEqOv}8o!vVV};DjJyYp4UA7($t4Y
zk1?G`_O)D%bV4*)QTfRD`7(qjWQ&~g^Tu8){+}=^G9Dpe_~uPoxH!k`x~a`lmM%7>
zO(cDmYhijvfMywjeW~DC7*)1dC~YjABL!OT2EhoXWaHJ;m@T(v#rZV<Oo7hBtxD#2
zB-&GmV`!u?=|{@|2ezWzkeH=vLsy5jo*|h>@ff;8@-}b5PwO4c7c;@QJe7G*G?Gj6
zKM-KfY;>wGt8%wwrCVzZb)T#DiV?QAt2%kei?)X2@tV2d1e2Jm)nUfQBXP%biex-+
zWFmX+Ye!qVB#-r3c62O@C{|4;)2t;Ja#84F8&AZ2`LiC@DV}|d;q&E6P^)^5GLu8(
zMFcp;RISG~`FZ`1(y)I2QXObqBA4OP)P+R90YFJGsDZ$O;<Zsk;GjzHI<02@yVEzS
z7ZMT!{~*y_@OPtI0W}NH6`p=PH@n3lc8Iddlq=Lb7I#ihz|VYMM%;nuvC@Ix%nUdG
zg~0V;Tf{7mRSx!fW7Wd$U_wnu(8)f-Lcw=RMs2CgWRQBnO?#x3E&Yh*1%-{LTv@*K
zfKx6+ofG+sNp$Wl^ziCoPO7&@M1g4oHyd$!T4l<2XwioratFMqmKr;K5b_b0I)=#n
zy;&F@P2F4xm_-OlJ#tm-zC6uo`Kg~v`KEg<*dr4^rw+?s^u&$cWq(32d<`Va1h}t4
zEH|PbAYpXQV>L}_x@PGOmuQzl)-v|pmZq1xqbiMq?gi6~&`miEFAlEgiWUr3!QMzS
zIPo>7LEPurG=ho6OgQys^_0?4qgdkeae^;W!|WOkj{xe&58ZCI+8ei7349!ihxvLn
ztb>CBLdo>Y;8=@zg4xpsAFv`r5yI^}=_baZHL3w&OfQ9V$umu^$+FfqGml(Z{SD<v
zk@;woY&)tQnM7>U=k2@79miPdOLG$HSh3K6&`EAdo^2ht&+P%gIzBc`=g-d@KtD$I
zmg9dP5)*P#v5zf0M{}9C$ey%ZmXcXkZ}PAzdfJ8BVMiVzak2QYfT{&Ge(X%z3;WD=
z<GQcFymh7O=JyfP#AKrKz!o8wKe>(~I~6HCHZ6P9R=WI#7xx_$O<a>B%v26E1D2Cc
zF6H_e`OLt5(Gf@!IIjtnNd5TA&?I6@dL(EpZt&jVlFp;WvR8o^U%NU#nzv0)ce#lp
zWPs^>E8%6PVedz@74nhR&%~*_a(by&bpPh^Z`i}~LRaeT>mF!?#g3qD!b7E1qM?IS
z+k-RNcRUDIuev?lD~ZnitfM|=<ryyy?iYlf>!<m5@&jU|6swJygSQoDv~Iz$%31ep
zK^<}4B>~<VY$e4)^JVzRx%u0pDY5Jk=j2_%ebKN1hO2t=y;}xYcI#M*j2ICr3@~1f
zHKFlFr{GJ~Ve$c+_O8VDmHL5+Ys{47AG{BOnQBZ}oYpvhpJILccSgJ*)a9|&$NYnV
zxY-uSG~YB5#ahFDJfV$p?s_-pd|hrV&)f7Kx6cBPgsQ97aK6I!b9A0QO*z3eTAMq3
zUb2RJ!hK{Pi=@H{F7Z1tZLxS!Y4tE2#*pL$XJ2;b-q|eXCe`v~HKu10Mq5?(7EWJk
z-9+H<h(tM_McbT_cew|j61;9I|A+}Bxkj^{)Z`+OigDdC?D&UUa&_tIwJ7VW_}~-P
zYS(Y&ShnzWUF^UZpOO1@>QB{-Cv>%RdoMZoY-zZfKY2I5&kE(~s=alyz$+=G)N4F<
zg1%88fnNi*KWWqn(Bs|Sgh-wy!d_Z@)ip*c1&<l1X&Sw@pGq!2c*+DA=~iN5MBggT
zjO+PG^^l1~ViYnM7P#qx2&?(6JDq1ak`Mu6sd9FJD&#fsGw@!uc0$1`<LLOmEUtbu
z@PYk1zDJp4677Dyg`oBSIheFqzWkXEMp_>w>dGuPetWIY|A{!doHs<bfsY1RAn%#k
znTvEiZo1q2#t~D%^LyuI>U|YVx8>AL@Kglr6{Z5g)y4nb_j8F&Dg>4K$pCEl4Q2B<
z{AC411l+NbW(KHOj_%4SxdZ{1f%oIoGumDCQO)w|^$V3lCmC$vDx}67WFIJ2*uSdm
zZd^OuUcl*~;puIJpPj%OP^>_{BN?XZuE_!!@U>S5>*h*+oNiSl&wr#GZb<}TJ!Csg
zG$IH5qawa~CB0(1q^eQFVqV4e)M=z`j~9;TI!JRvi82FkX*=LgV;ksr*D<O%2|;$e
z*BFX6EPN$7-j*0V(~C_wH1h#5)i==vQ#A!-n`eHwZ$d^U^W8{q*Qv~Ef6=39HNb@^
zYv0~v<I8<~X|rdz&e2oY7K2rbn&Udta~s-^dMa-zINmJ#l)PFoiCKyI1e=Le_tx2K
zH;=^5;X7z9@|XK_%rVjt@&-sMf^-Et-7t)MirM4y6V)iih^A>o@>PTxm>QV#{ldY?
z?M4qcv=W(&q`Ld7PPcyQMHBRe_|tgTvM<cN{%m<Rx0fYa3+bn9#=Bk_U#M~WT+F=&
z$grERJjd3v@ZVOeKV{{-0jZvjdJf88F3dcC--1a1*Lq#Mp;33!D2wa(T$%|u{9y^(
z+-~4<)l@dZtsK1QDSGC;Kl0!Z6t#pezG*etd^W0)0^cwCOt@o#f-9TN7F7GRqixnG
zj)7xFfXfCc+mwaXfy~I0{CLGSM{)G{h`!CxHR|z>*hg5oV7n}$g2k#*tbh6p2%%Wq
zf^U8Z__*>SeQoYBSJlksl3b+I+$_E7=R6AQ`OC3g6VJVLPK<HeTq<<PEldHjGHlR~
zu{mxe*KdKx<Ll*kEqr@B&KjcYO!FK#|5gb(URY><t37^hm>?B_W|T;pl&!QF5p5$g
z=>VRC0^`pbyJzd@1l4+B!S+lo22Z5KkennZGNQ2FL2SIT9=0B?DUp@=NttuniuE0@
z;jp97v5(i5KX<o*G=|I^K3WxM&l#YyS!lr#mCBWLx*0Rn$315z$W{keEr9K(METwH
zSnV{Jd+WiTYJ2J^Wy+vjxtNAg`n@@c*<HP3V*{w-wsltRg_iqxyZ7EdFmZGazWemG
z1asp7IjxFa<8;;c>GJ+;RdnN2#E<n`Yi>w#`gI!1<ASO8)#>%Ye$Yw6UURKJvi@~}
z&-s{PooXVz0MG4W1@F2PoX#aI%bOca0MJlu(u;k&GHVEvcgR4z_-pGVT10jalczIc
z`#!go0i0b|%Ss`Otsm6b3+;~9A1S8Mq5`Daf+z67edf&;Jcpnq1VKmUf=2?{>r*7-
z#9lrZ65YEAgMLPo7<R7m7~EhSU}D$g<qSq+6N(4Z>E>XU?Pr32VAhz|8Xroti0|nY
z?!pP1tg#|kJr~!tC5}+Ui5=~b5fTEuAu)q1;n#9qNl^N<;>*5rfXEbE5+Q@T#}3C}
zd3<+ngkFm<**mZ!f)(7?XJ{DS?$I9-;vRZy^DJEr$KDe%nn!MxOf<~|1rqRLb@-=~
zZ<>2)0*&wyKn(Qy><cd{vO-d=-6C0I?l$op3L<}E0!+{Qr5xQ5`ufc7n@|m3x?oVj
zLe0C!FI<(7Q65fB(0`?-*rpe=E_Tg!dnjHqfrRxvFp+a;Nge4lZ*t09&p3DE!cEU1
z6GdU}X-M71uBK=DQM|!SY?)Y?CUsICQVQfy%Yg2qQ8P--5^<3Wi96xcFS;Av*L0So
zT66NuaC2(^wJc-<s}P?~V!M7(A7T%Km3WIuW0O*pS{zbNRl`WZJOqu68r$bcIgOe|
zNLSPn2DC1Fv~<ci_4Jpl#m#~R-Hc(JnRcYhQqP!|>+m4zR9SyaP@oX4p;)z$7Sqvj
zSPHZp*p1S&O%2+ZL!{SY$tts^qVD6|9L9sYq%7p;i8FWCP%MT{Sa#_FBw)q5``sn?
z)(~tj+$}MO^O&z@PG`tZp0~BO(DuUlc2?bd`ASR~eG3G8=i^8h9&09l7jW(IqAjR#
z`}+z*lc|oEQj@pJ+Pmiqk)a8icAjTR>C5XR{ISPWq@WlgT7tjM>s4A<^Lc1xs?<9_
zK9H@NQg9YMsO``M;v+yglx;B!wu}tSr~`dw=|lKgt85ij#=aernuSiQa<wHzp{d*m
z2V;NM-hT`EHfZrr^469N9VFdb0s{><e{1if_v3Wu6gL!<UEd@ZSk<&l38}_(jNTrW
znJ>YNu9s<FPE5hLwU8FA>XP%c(%G#vDp^P3x>|tKt?{(1V{Y<uo4K2qpcLTA@%9g2
zBRfMGDU8yn4oGV>2QU_ooO#2<)`eE~&36;4(Co4~RZo9T-k}S|rKBFBWt*1H^|=gA
z76#bL-gA{C-ZRtth9na1r9xr+GJ&J9=xQzD4i}#wZDVP7E%$TS<_qBMxjD#f-9P>=
z@ntB)r4L-5**-ek9@PChIVWt&GKZ-w(5-Zh;iDvmqZ|V&pw-A%ukCMv7L=~fC_t4I
zTkvseM}mmp<B%G%j}|wlf7GNy=KAK<?k>>;{dHR!)aiM0u;Z$maz-ZhTDe2hNfT#(
zz0~VgGmp^kx3k>V+FN>eJzj5nOIM30C3a>=@Z^5`6D_2<NLCs!z}ptT+iu&I76LzP
z*m`Upxbtkm_16#PjTzvrCZTJ++O1qHGv<;BoYr2Bt0V48Z}sv?l*4RtXtnb29z=w@
zk#vqZ4fRJYd+h<hD5zBsK@(+fuqgZuhyCAfl0<|Z1ym~lzUz#Go%a?hdGPkzbg-AH
z;4L^r-%V$ORV=ip4#9TH=bYOa@$V7O`OymUUtO8_+lS@NSyza|pZm+*!-drQ7*pNv
z6Y8{zd+Uvyn&9~Uu0vX~zM1L0@OV8{?TuW#a|akR%)?B~9Q=~R4FQBLInWNCh@J1R
zy>MX`l@IqPda$H9RHzBqki1M-g^?ei(OJL|AgDDsj4%2|Sd&#OJar<r$K4<4SMOEl
z8z|Ktgsp@L3I|LJs`;}QQBbRKtdV9=c28?^EU=f(6=gkRo#xEVT3~_NV<L-)#>9$R
zV*#a7N<9T0QPBdui445~YB*Jm+!LRA|EnA1=H^Rb!S|T2$_BjK)e6iDBB@Y|jhyGr
zQ5!s2hI$L<?OBUf7V7v4$I9Q<B^TIJv_?7u0lI5JgEpll3enuLDOs*13h*ejevuqF
z>*oU%ZrdGj^)!?_2OgG{{2a)b-VB$?{A%$|3#Fak`K)HS$D0Cb`+oZ{cmP;5pkjAf
z9|-`cN!U6_0O;IFvWd)K5%>uW3HlOhsm<cW4%e_t%0~ujFwsgDIc-wbeu72xxwKqp
zPMG!f>wX|GWKx*(C8tmN9{*Y|Ex_M9R^bg{F>K-q{GGobC%rGzdVth-yCGk?rHr0&
zORJ)BPpJ}#gilkf^3mr*x|jMz_0`F5vR$tU*|dvq>pL9adA5w+tSY_luf)vv<KX(b
z8aib<-%l}Rjj4<g=+2DsR|#07(Aynou@SV#)T2nF4;Toa&GY;rpZ5=Y$Lky7UO;c?
z-L}Pb;HNoiWU{t4rkFux0tCyEVb0^~kzmfPZ-IA1vS)FbPt9t$q!arSx;%%Q_jm<Y
zTZi)s)C>ZvC_{%0y(dM2q{2&KWU|rZa%b?dAt9WqJenBEvIqkR+PYNg<EGP`lVwa>
z)FWLui;G#L4{m$xXUVydw#v<9SxEl%{=@!NYvWz`E+ceUqQlJqjQ@@wpn3-2PRDCP
z{o(iN;gqVxu(k^fZ%u?O@8ros*Op>?`Kiy@Y)7f@IxB4qyWQ6^hA4_GnbpfVbmD5I
z+g+vqEQb-^0#kbL&jGBqdeld(u$Bi=+2gkBM<CanIt?91h18E(s+z{ICA)aFX5DhP
z4U?+(v%sE>q?O517vmyD&P;`cI0tbGa;dnXLYF4TzH4~@*g@Vy)tO*=Z~k`27n8$E
zVPX`1<xCmJrlhOY87fK189szd3w&_o6G>#H$AYa^q|pu5A%dDl(|gAI`b4%WhJ<YC
z63dM`TpO;`+WdsD2N$(jMzu6Q`q4u;kP1#pX`~R!{=@iTBuM;ebx(p4N0*Mn2+fvy
z6*=Zg!*9+}MU;9dz2b^e%&ARP!(&q1GY{IuK2qbCaOcucR{Oo_6RyMnW8<?uC7Cv$
zT!BlgJ-Y=BwI@1R&Z31h=#KA_#>DqU8PqBIWg5D2X=1}JE?Yt?HA`Y^`i!zh$2-MI
z0K8C-5N+S*tV&Yll(NYqY93@zT&V*W{IQ!AfLiSf@8L)RVJA@c1=%ClTbV;p+^Mf(
zDuuiWWfxF|cpXf6S*lj$47;1dE1`S7k}Ie@qHZ?PZYGR}ireo3@GzOmdq&`x8mRC0
zT*Gy=Vh!0cRZ!$Ll(K0he<}ZigspBHkl5Rou%X$&hz0<{tXQ6;B<)n=#Eguj>f%+x
z!rmJ)0fsFn>Lj;)JQ8ROLNS^!ksx1akAHN6M<(7igDYIu7jct3XLjP|sHo_;x`q!y
z-4Y@@2PLM8I;NaaoMF|~1JwyrPIyUjpqGRCq7-5K8=Cgl2e0}c$BPwt1PbhyP=PSY
zO~6Vw4X>ASeQIWr);16#qQl1pBy*J();5=uV*G%F*G8o>bF>~pOms@Hfn$yNR2CJg
z*(!Tvrb+L)c7&pHB>EFJ<W<_#ZsMo^A6VyC8^(6r34H<qH)nx<;GlVM<jhWWC90X3
zN*#o-nb^=P5`(V?^|oyAWqz&BKBybYY}$c+B~!331rOR<K@dACo^dW$k%w**7~_sQ
zI`kl6tLn+vVdVMnFB5wTP8u<Whgw^yFA#4#Ahxm8omju8m>8XWM~=tT>=b(Q=U~wH
zM~${(;)71*V^!UxqAs6`V&8jcx$h%=<?VwQVO_5Gn%VdhSOiYt^8qp27M$$~>ecL8
zX^-7%)Ec_7NjK$kI*-x5IZigL6zQou50=VOFGk)U9}ia#i`|22>f6Ya#;(<x8#Ed@
zkFE)zn_$doYk$%$S-l37p>kg#w`yIuWXS}^gA9!9yS)Ny`w20<8&|<}0)A{4{!u%A
z)RwQeXkP66>VnVhj)m>ceo&Jqk&`jyk5LX>W{kA0{R-+_M^REX?c9g4b7gX6=v1Ah
z<Z8=G^?-_t$A(LbcaNr&ruN$V?{%`K!&N}z;A!zT9G%K;S6HoLUAC9x*dFr?<t-1u
z*Zl47s$cs4ZGY|gQ-7_|oxy<Q*l~r#S1tTe(vkjES6j&eJ`ZC{I>7Y*2?reb<6=Yr
zsuEQ|H%i>jYG*RrS!`xoh_cvi%qW}1Y+oMOTOKcuYD|slMZ=>W9`EQ_TkaZl)pdQ=
zIhP`L-L2RKf*gXba<>%x(yH80+dpjB$N+Nd%6j<F7|hscVmH0M{(zD0$?p8CAlYm?
zA9D2}L*$uH`Snr`KHN7MOwj7{{)7NZ&dtf2QAY=F3<Avg6VsE^05&9ztcA)-*|3<%
zD!EJ+@Pr&3f&Qt<DKkBqNQ{mm5~8CCgeXW8qkdh;1Sk+OH=!Hl-~n>t>_n^u(O;PR
z0)L(C2jdqvRnU&<;W(T!o`NR+8kB%$r=HxTq94=2afAvO0nYs-C<adjTo8RO*6H{@
z<Y{1X4S}bQ0>MK{pY505(yh;Z_KVY-U%+LfLmYQ1xYDEj=3ul5&+^JGaU2`cnw1Q*
zBLt}b?9aq1ek2-N?!`1eBG=1);WJZZO=-jv%*~iByq#A3C?BeZFv%`ArwtCKnaj%u
zo_M+CN)7BVyQE2VOQE=>QW-m^Qr;HK1^&xS&c8KV{(a!S&5sxmg^P)W(kLN;*Vuy|
zg<)YOZiQ>$|KoDmwd=C7ywj|b?ybDDj>&bI3~U)1Q<jXyDCP;oGUQxG+*t=+ey@p@
zS9V=4yEa}w=&D#>SGW!i4h&xP26dx>nTluWqoe81Dk_YPU9Une5O6qh;p?5*Bl=N&
z)|WdY+%w&!?pf~bUu1n@ag8y?0A7grj2?D+4<{qNw<j%w)18*q`=rx)y5A+oBI)7b
z^hii^=n--l5!Hc2>IT9H2gQ1(A%;>+%M=Pu?5Eq3ZL{sa^4g3{#iyhSk+DNTKKK$&
zTL|HBnY%avQJi+bB(tmDM8oQExsWJEn0SG{J;VMQ$xZ}Kh~dS7Z|f@;CBn7pTH)2j
z{L0FO{M@Ux)fZ+Wbqifgg4B@7k+u0`I&GzEDddQC^#EC)yAQi>{<$)U8Q{+d3PAb?
zA%N2_&%PUU@2#>vAx)+hx3p`W2K$Ii76!vf2T9ER!p)4qSIXii_4;D-E7jn_mVZ-W
z@%KOwaiC;4IlIx7Hx%NYmM1RED5j93!;>+QJ3K~z<q06Aaq-bo0Ul);5CBCKlUwec
zG>x7c4(;j=_T{Aug**{6`EWQ68yVm+mK4MlMij>+#uN%MNmfC<aYV1w2yRxx3~sCO
zHQOCYg@<^fuH5z-{fWLio|Y8sg?{%p@QFITf2P;=WmV6^3Sg5{Q$ct5_0LbdqcRdu
z7*;}*spO)et$VI6&(|4#7%xbt#`YB2T-XIXN6WJZk8txgq0a6UMI@85;}3<4<2i&1
z0x>5p>;MyrL}y2NjssMhs3(@2)fPw2O+pINX!h1(hvF<EijzMQ2ijm(=E)@RpKDNW
z+q2(%@9xOc?(UIickT|Y_vi_@*7^oqJAr`fFc@$xV0X^`{lh2iRy&7A)Icn83Yr?j
zICuybc_`x7@Z$voYMJU-ZAPFEg<Y1CDU#cx>p_bxz4jm}1vi>U@d=9|Lk~hQNFqbS
zh(;zr_Sc2)OAU<Zi=(DjM-rGNiLv}>G&bXnJ=2aRB;}l{1!?MP!~xMN;&#TChx&ii
zqoJhk{h-F4SRRGS*mpb}8M-f)jE_%XG7#J5ikp3oC~wxIc3rf2joukZP@s@XB8i~V
zVL*%R!NlD;l*In(F7|3yI-8)3B?;_dgP$aYN8&Tp>Ma3r(J-_Ofhr>_Mo$`R5*f_I
zI5HC!1PeHg7NukXO-kREmTk}`)*z_1<ut|+gz)gabo7zSb^`(YxI|2rI+{wUgkrK1
z;t@F-yY9dvq4WqiN!S>Zrbgo8Ay6tZK9PciLXzWAA_y`jA|eSI4TV7?BH%GVVMkQP
z67%enhMvMAArXY=eMNM8WNvH%x)g~jC(%hYjmd0_s?{ERBD}w@hrM<*oq2SBQs`cU
zACkdC!e}W8@kAydXoIVQ>CcpVm7r(6F0c;h9%~)7TP>^jRZ!QF8gvV}un*pmsK@Uq
zMR*$HO=0;R*izCjAeIza6gRQU04v4qf$2N;B_S5}-eQ#!e!-Q2uk8+W9Y7^O;EldM
zroO(jM{TI_NP<1HiJ3Jtcms_@Ll|mkTwWC|$uPkyvx<Ie)DYtH5F~i4h=hlU;3Pys
zUJ~LR>El~XgYBKTO&Fq$?d!UYws+P7fvfz7)rgE|;-OF1TS8kvu+BFS?fxF?ysO$%
zW5FhsQuZc!v?Y6Z9K%&uWYCI1iqU<4B9oaP`_&Xx=S8jb(6-WSLx_olgxb;^yBj5(
z<Qy7@CNMuHE36v=Ca6MMIJ|1z&T&8T-rXHi08D$FD_*to@$&IG=6Q0gh5}4ARBk7i
z0~ZjOHxzJaIW$hPWTl?wsQpl4BB5RBRzqV@O<r|Tgu)j-ETa)9V1Q5;r7H28+TjkY
zr+A9HAplurEi0Cem)ERiYkNkur77e+7#l-Zb4_^<50t(?QGI-TqV4Uin>yxDz{#=l
zO^I^Qk3}cz4$mL!YQm!MwW8^lO&;L*u<}4qjaMOpcQ_$kJ_PPo;Y{$Adci4J%7=Dh
zM417~$hr0&UZ2Bg42(vP&HhEzc{SO88+1)4TBwW3CA3H@|NCY#JTv8RG2r^i3Gd!d
zT9aFy^S9CwLQu$~Z>2SqfJiIXu_#nHAY>czMWLSEHwI3nu93;8@Q7q&B!oH<;pK>f
z?WGpy*k9S7`e<)A`}=9&>@tQeL!gV%&Xk5UHd(<yDi<r9%EQ)&K(N@uK=>~{$-ssG
zgCWQ;dez0KFeZ@pKyC4ppl?{Dh@K7%JQYpz`ZO~vCCf66KxGwD%fX>fFSUfWJm@w$
z-&u18k(>Vn`ZA$0Q@yw6{;qPW8t#|KTy?%<bQa>J`C3o<mV;oObqlx=QhwO!GR|&R
z8Og<{yi@^CUM75|(5SpvPCXbrci6a>t5x(wF5<f+&Rv_lC;sX0K7{XUnOm1EUw4pO
zyQ3Ci`)ivP!v3F}XM+o`uJ-#UV?+<=e{in7Xq85)wK$tU$iK$^SC;RK+ywznX~iX1
z+~OiPXTwdkaBm||fAvRD*LZ5zzgdmbo^Jnl&_jQx0o}T03xsZ(ULx?I7{afCK@S&r
zXc{IEqb_7e<N3Q@E91=_!o8lbmV`8lrUnhgrmx(n;x6t_s$0m#dd5v5wI*@23+N77
z?B+mubmY~`DIUC>=jKCk6Ep5T61e4<#hPQT>BpMUWhw4?p;_D)#m(Pdqr}UGOniwd
z@m&oE<+n^QtbT*87t>t41q3PpClF9;iK{LRge$-YAjN~5#t80h6>GBRZ_e;=g`oVi
zG&D76bQt#4&tEh%{e!W->%>2%i(%5KurIt>U=zka5^1AUMM5RfM3pQ~1JP<RXtj7V
z46LQ%76YtF$ln|&50=04Pe06$3~V;g$rpF)zFvD91%{gg$+~&W^WdiO-DoSY;rJz~
zt05Y)dQ+FkT9K@A+cY=A&Vj2Un;3OUhI-i;F29TSAXjqi7cW55Yx~EZ_LrYmj-n4Y
zQ*wXSM)PE-_xWXZTJDZKt?8T>-8AZC&lv1Oz8)ybLpPNug<V)2i)YO)Qal|ldf}#G
zO)vFK>vz4aqM9r0N(e!5r{#IFABd0p-PwCoHC9RWt%>q=Ejm3zYRx|t6t`UZbn~&-
zJBm%*dxX|C$DE!)|39qmGQ{1XV4!xc()#7jCy={PKL;vxGB<(K`)i6ANsd*Qg9`&C
z=l6%5`T6e1iw(JDFK9M=6Kd8N-lbQQ{pJjBhb^zrgJ9*wzh1bh#I0TpZbR8e)K#qW
zIPNbJEbsEmAw=0zJehK50QSdLG1NjH`NM8*`NM7=@hJwjx~nign|*9sI#tzf%L_tM
z{#{5h!1OvbzmBRcUG3l&MQH2{UO%E%J(z*_D{TqNG*@f)j5+E(LebUH{z~kAi$AR<
z#WZgk&GW%DtFl3em2Sc#@6H}6gYV!jgLALS#n@(>Y3rWM7;!igUB}H?=FSdtjz#90
z%j43c@qdQGWX(VEE-X%8j*-og{flcCwRA>b!X?)3k=c|xgU17}=RuDfg8v;Xa3|bE
zHiyC@+W6KCIz?Rec=y#B%u=t9oc7D&vVZaPe?|u6*nmvQ`f@6_0^Ccb??9Dyv{kZW
ztV%ydEyLutK{BOSvc6Sdwrc~zY>F5JA_&2lD$_pO;B?@R!hM7_V4+0TsYE@09=n!J
z^|&ksFqTwHl42>Arc9+hy(6|Hw8IBjIa}FPITihBKdZo9he5I@&O0<2v6TY)VXyc*
zFIHi05WYZbwhQZSJi`a98`jk|5mLGo)r~w0ka18<Ch77;ry2TG4%;A^@_CXaU%Xcq
zjIXtFtFXPMvVB%*`>o0jShXFr8v9FYx3aH%C|$&r{!y`?0am5jxba^5;pE$2J#kb=
zGg^9SK||ks;7$uzv&L4@aGwV}<Pnc~!c(5{oHkzMiJ+H0J4P?I-3OxsNM6^r+yCEm
z+aHlf(~o`jyzl?V-}(RhLzh?oQFbi-nC7>`|H>co>*B}oKpj7i;q!l%|I@R4`yJGO
zfZLwtV+z2>oD%RLu%3BR6iIadG)jMkG4fd?-%&5L%suYutu4lMV``Lnd#L=LxAN9!
z$j57zvIzZZFrTigQ&NO6k@E)mj#|A}h@v4~qri*^Ct#wdw4+`bFM*boUwPiZ1-;Ab
zjGLp3gXh3V>>;OB$3OpWr(g*u@bv?wcT}BG_FY$y_Qvm|@zk*O{>d1<H}~w52$LGA
z7wB}>T=l0Qh>+`jKtCsq2xA`FpGex6HwXjr9YuFwL<mPp>09l;S^>VuO3!DDOCvx1
z#a^~cM}0PyKdTo>A&J76ZO)?mXG08T0We16$_1}j`{`SQ#Zt5|1mx4Z9(9$)BS36u
zDOlu2K}@iRW}XN0vrRL?lk7gU$n$w?-$g(KgLw&N0(#edEmgGjyL+!ig`Bif-BDAs
z%vRnp^WaQCK3|DpC19z}1??8RKiraQy;q>U0SkV`h2zW$IRVvBuhn``z)3!($ppQB
zw;WD_@r2!C_&pf6TK$I>^sLzk=#Y;pWjq2t`qyFH7n-5ZUXRQ>D%EZY8&Nj7$LC8-
zinyu@%%`0iQ>{QqjX#n^mkecXU3qGMO$J!WS>oxt)#?Ya0r`&7SHq`q3li;j-gz@+
z(`Y>hZq&00@fkIb)=HepwM=!#OwA}|{5s0&FrLmt3C?yOJmotoIujV)%_v=YN7FGD
zJvo4C=V`u^tye!et&Z;OpEYAF%k!=xU%00rxex^Q|FvGaxM5=m>Lh@Od@nE%c6$+P
zT|fHdVk4F+!1niG%XbvnHNObvyVhrlj-N_+hGXA*&FZ-fDCVW+r!x2;l<;C}IOH!S
z+@*DNm-39KvZ=@?RB>E<-r^TsK79G>ar_;SEM)ZpNgy}0gW=;{WF&xZZ79&g2ji#o
z-*D0h+1kb(P-oN4S0m?@G_y5KNIWqQ8aWqjGHS6)IYV7dI}^r<u1Y@P-uP3OWMaNR
z;D)ml*LJ$L12Re8osBber?9M`!H_ugK@Ep9-P9r*I%7U?brc-Q2BSj;Gik0lKE_V-
zD~;Mt%pZ!!{#mpqx?y;(n(LmORm1p<EdjPe2S{N9*n!gi4)CJ2{A@qLb`9m|+}@in
zVCw_mZ~Xy&!>&3ZT4(vXo6Sldd`ERoze_hqxZA9(f$oW)mv&HwvXx9DE6?~oy-kRA
z^n}W8CGX~zbyv$HzUjt`rCjU@6Cyy}{ZV&T%(8;du=kAUsNsmGo2!QBj&nonC^!`x
zOlt;HG1s*ENT>Og+uDxeA8N+_d2mlOdz@HT*K;$5$yGC#E3w+dV>4JmQOdgOOULmw
zE!qpqD7bfN1ukLn{_M<nCu0VU%1a`hzm3wPvTe#o=lR{%k=mJ;!VeJM@eHuPZkgdm
z5KAM<Yu69`+C_>$A1BCg8ErMs0^+v?dFPYbv8^_T)$hR$9RIERoYuhw-76};WBQZp
zuZZ<ldaR)l{TR8W-0I1N8R5^%Qxzn76@eXkt_08zN<d6m@O&m1*2`K{+MkUwgoj70
zXB&d``ad-Y2#>WX;IH4A@nR$H-&qt30Dto5c4b+0?|<?|oIk|cc=}xxh{JyXb#DCo
zM)|+UI^g5ikg+rT!_Kq8`lQ^yM6O;tZ9nSBbMnbIsUKPE5t`p^|3N<eC+hYQq#X6A
zr59I&<0GJdiiG<tUG2qg9(82ti(D}t*2CsW>P;>`VZY<{q{fg1LEVh_kxmJ<?1}yh
zb#M>s=)g`pmCxg!$bC8s<j?TZh>TpRc3YoOMLJq3ef9uO-Piby;d*D~)WuYthWsEC
zsg&b5JhHVK&Y(BFLff#>>g297mWuYd<9%VAlXY2u>S3*gN55}ny?Hul%h&%aS07k8
zEkPx7v(^y_clsUm7|76_rnL;f+52a4x|Zitd*l_w{!CzC?XhC|8j9t%o7y$m%In8=
zbXE&ltp6l#Cil$)`Ao88eNeW3l(qLsUn^y=-^f>e%hu22wXnnNHoS(5Py`uJ55;iG
zDuMpvSgT|#VeT;u$??$Ao@7kc!X4IZDjJ~y9)Nn%Rn6wbCl3VX2sefu;61FnS~-X+
zcUU`x#^T4<p1~66h;5i6%J+D~wUC@gX>TXlH>Hn{xQxG96GxZomvkOYxd1o=^J4+M
zfZRl-#DrSsxhdPKjB%y+-R`%=&&KE=$&RXgd_|-oE<P8gvshvwYqHo_$i_PgpP>V;
zc5Q{*&x@M&O{;y@1lx}bT^5kCLtNcqVlRr?^|8=7R?Zx5@_cP}$BLL0mMpWx)s%b`
zSw0&|p6#uu;g`H^GkfedWBh3O+zPSNSJe26bUMK7aZ~WLg4wk&J!I_4rE`~UeQm2_
zem#->e2@2cc-%7Mk>B)kgxKqq&QVw`C!}aCaM@;yU-r;3TRj-dI1O9nz%n4fuifLH
z^o4xDz|oyR?*VZ7$}~@%OY?#h3XU=$1A8H;)LQ%;z|TnPQTJu7`_9t+n&HY$4WJtV
z9|B$n+yi(G@I}C{t>awQqO#o9s(JzVlQzNn;rg93Y$;ZM%-Jloe38Jf%~jkW7&}Db
zh{S+CicM#(t?Jt<lMUc=3zgZ3lXy14PdJ<6s$(|IRMTt*Px+jgN$J232NV#2cWa#O
z&4k5lA1os7zn3_CQakD3S(2=^RHA95mP)Y7a$~tmCN<}vCuW|2yJGX!C>JMuY+YrA
zm87+l$=35VCX+PANfcimB$9?rPr3d{mt>Y=g=zNjI4MR873VQkf~B+tGOV}C+r&>?
zkgk0kYrGXs>2dR9O($NK=Q7@j+D81ocMLVptnsVkN58M$?P-&jdXyn$=|RkmhB7^W
zGVCSpJr^?Mc{|B!ah7Wilca{KCHZ!;m_yhOkt<JT%eYt`mo`ST&Rk!;*J2g%oFihn
z-sP+1`L3}8h>c~AI-=RXmfsk}fReYtwthF*iS>(pY;e#bP7_TW<lcv5792U<iNqMi
zKf~GW4Bc_lt&HwKGHW!Kdyp7o?n`30KIV)Se{+&Av*KojWBzd8UH6h?oy|Q;#_e;!
zCmc5}XYM?1P-1xUKgz4Iygl;3Lo188QOQX@jW>MxKdOoO8{Z^;J~|&fM95H~{Z?>T
zQ>?N^LdjN#3op@Hl@THejHFADBtwEDn`*svlBGn68ZEkMrpJhBMk%G5=`mR>sie~G
zDKKmn*12Vx^ItI-A^ayYS9*ek<qDN4%YJehHk6kraryo+FNrYoE2z+dijvwXyy8kk
z*pw`}jTEx)YGN$pgChApQSY(HIiK!YVv6QJ+-D!?*rLeR^cgT@M8x>}@e^ik|9>3{
zBOhzi{!68`PRDe8mHyeiziV1MX^iQoP03_^=nt4yFSzK^Z<v1Z*k}hxRN>;8z+a3d
ztUG7X6-$<_SjBXa&|>dQBv9{!?X7jCt6g)-X&ek{CtY`~>)oJ7-(lwc%feL+8vX4M
zOIF1AzUX$wpO*f2cInMKto&tmr@N{Jm_)aGa_y35v%OTAyKjeWJ?UYOTxg>wJ?&Y~
zYwJZXdsX}0Rq(&${hzzj)>ChN^*7Mh2KDJTfaQ0S?e@e|&%E%mZ+-7aKl_DhsJ|B=
z$%?A!hH2T3>-l(srk1vjuAV*w6G<UAC{!Aq!DO*HTpoh*1wxTnf*DZ4UIsj!-_9qL
z%a*hu?&sQQNls<$NKbZ7#-EQREaB6HM-x-9T`ia|4?8Vv?x{FUmJ%kokiQXOk!=r)
zC0e{?+}3OO_AnzGDXa@-nS>u>e&lT_W!82ZCEAsIf>JB7_ln@h!-Dwqu=lscVwWDK
z_f7KT-N)gmzt+OZN=n8(T*_FzbN~xMsN4xwY54YV<Sd=o<Aw+~_cnbk1yX!ByII@i
z;{mH*t2IH;D+py29?H%pE(p0%!!zf?SlgnHA)O^LR_tLSL_<Kfb%qGXp=~IrrL7Pd
z#})WBRrQC1FxHhM9i2&tD#dCLa7#YO{*rZm02NJp`{^ytKn991&9SPo6yeROP#xbO
zAZc)r3PzFVjDoyW5cU)2q|$trBvyn2CR0{+X&1___DbqlHiSbn^f9PASO}pS3^a!Q
zeW{TYy$jy(V+A~2iY6-!8NO?4SW|QbS4bWI<#i(UKe%eFWVko1WGBQwweS;6hUD3m
zT$TCw;e5&~$XmCDj!Qpy+}h{mV_(YKwaOsS@hwqP8kc~L2!sf`>xupH@ym@q;-zkk
zlwHwFRGYJIVy+KZTyQ^8hx5Sd^0myXFPlc;S|QsMU0^nxoZtLbHVH0UE1ge7^qj-&
zpX65YIy&h$F?G3GG*9?9k^6e3r}OPtk-nQV^H^R5SNcIFlqNT6MaHbkPX6n}w7rU#
zP;}BKQ(hNA*O|_V#sh`XG3Y!IGJMrqSqGQ|#*$cjbWmMGYdiH`-=#Hm`_(nHi*%`6
zbVgjzcp-SBUB%JERC<r>-+h7e;+nWyN_p=svIee{w3O2#qotfyD_SmSO-<_>TCM0P
z_}%kYbwI=vPurFI^K!=(a+Y)OEF0bO{8sP-IRsDu&$3Yt1sp*n2f&pIu6#)jpqx+u
zVyFk;f%b*ofi!Y4Pap!84giJLrGqR1D1f8TPyhfx5CBjB0{{RDKnwsL0Q3%|kpPW=
z1hK@1(af^h7z&o>IYxNaozgOgE%msUFr$$mrI<>l5N6qBdU8X^9KbTGlBjj^ol;Wk
z$dq<;?hAP%W@KY{kY$y7-(q(7%T40)KEz}hRArC{KL;)9J}-XdO^Ay+Uuqgq(SVwM
z4jord7foK>h@Q*_PQ6&AS8z9kXNtNCj<cs)-Do{Oo*n+Xw)Uv8IkXgONhm=-W-Cvf
z_tV+AU30p{E(XsB8@BEPi=)GQXrtDBV%nb^A{xp)vL_*{dJW<W1LuX98$IU(+g<^^
zo|}z2Aj~>f{+`BA?Pp2npHcRXYIj$8UXet8%DR_{j%Sy$@k<%r`kepwe_cW|s@){n

literal 0
HcmV?d00001

diff --git a/src/static/fonts/Inter-SemiBold.woff2 b/src/static/fonts/Inter-SemiBold.woff2
new file mode 100644
index 0000000000000000000000000000000000000000..d1897949fda5c7fc5f04622df43a3fcba5b89d84
GIT binary patch
literal 24452
zcmY(q1B@<A>^{2YS=+XE-?eSqwr$(C?LE6^ZQHhOTlf3r-uuVXCeyS{noMUhok_=C
zUW^$C80bIfhX5h|HvmIO{3jFszq<d?|KGq4RKN-R>w~-O0AawdtRkqQ1r*AL1O*e=
z#S>VF4jTav1k46P3YvfkMhG5?4p|8H2NK8U(cQv&ELdyVwgWEk%&MyP_&0d9-gaZU
zhP~PZwrv}LW9W_BckpTU`yV1DMMq?~WH#j>fC|(RG~tOTtJO{SBda_OBqt68MD$x5
zieG)j6LDPo5O70Lc<;NC9`xwkA5*ZHOHZ5yNdK_oTB){EX~Ijs?2o8P7EVA3v*fJM
zph%6acbAYQLOJCGN_ThQ5^<=&o`|4g&>uM-3ei{P<_;i&!^+b#cnD|^UbuEP=G&Fo
zq~|853o}GTEZj(dqb(z=qm~au=-srCQ`>&-y&lF@QU7>L?4JEJRr}`J8QiceyQ@2`
z$!8{2p06aAjHn!@n??ZUgAiY1zqgs?6Uvr;q$hpnFhV`{THim|b-lWFN24qVaITfN
zPKfIru}H?bwqXfOR)6y^&ik9)^J@?|icke3BA(3WmS!I}znpKpc?jYu_>ktAhA7aD
zNZ3xQWNWlCcMEAX)0|c7Ca&EXl0=((b?(pK*KXI>KNYg=WTpFAh%!x-Mx_anx%hH#
zKElIYf08}dG#VRXQGCOl6LXw(4sLQd6h}j0U6~P3ip?9F8;nq_t!b>$-|4>2-UD0S
zZ*O?4Qu~Q(O&cZ9V-vrI`Yae>U@y_9iSOH3n4ANB38!{^KHHT%OptnSTeiPW*n2C*
zcBBYRm?ecrP!g2_K-SlIOJoRzBvarAgJulq>Nb-XKaagmAIn2ZgGr@RhE_}I**kGR
zy>?quRrhok|KMWGqrCPGX=9q%YdQ`@$;s#U>EnNisU~Cuoax+dW-sneS%Ns?m>3Y&
zZ|ftY6PkfW*&G>eCgi<?q)uWR(w-sEpOx<Mbc1Y`q==Ml=8O6SaR`3z{I0N=pKQIl
zr>BIJQ4%E8GmT}$NDLI?LJ9BB*NBGtK+<*LA4-si<o{-G;v}X?NRtYYmWm=%p?FH4
z$=HvHU)2v@)eArMe50!sS&%0&6Ge`Q+V;{JMXwREMdYVDknM0=Xenla@MyKt=bIDG
zq-m+{Gk*2JBN7AGXmA)_*^+ybSkuJNct8}KUb;n%I&NJ>A8-&}vIGPtYUeJFE?s@r
z2X&wz{_dzWe#hry8c?kdP$Rixb>LcI!xO3BY<r%3>(Vy(^QURhN?2mhFpdWj4k1Zs
zkpxMFK<x&!AqpKMf{aO%G7KwlhAfS!bTBwmZ_L=?d@ldX-@bVr)bnTcmvDm(EkUFg
zsWdB-Y>ej+-{1!KyhJ6cj{isL8k#KeBX6F@y)w~A!~tZLHD+j+RbBheg0EfNfb8Au
z7_d&F*_Lq!tR$(D;x6j@?FuHFS+(Apx`>4I`@K;<T@7EY%f~h$Yg_Y<n$b;!Ul>F?
zB{Wg2hy*iN7{kc45E}k-EBpNlb_NR1H;?*6XY0mY>Oz}~Yz<x!0bv0>`1r=I*V#Rj
zMIng@)soi4D@|GtL?TZGe+7GX>S@co-TBq^23_6)j#yI31VWUENz`C*Zo~JOzG6rP
zqZ%t2f`dgievS9MqL?jyriAy9JH!zKQg!|5FaI2{L)wX$IPH)i2tjf(?$2jztFkQO
zl>)S^Fs&q^EJ2hfaS%yCOsoVDCGowTRD&Va!?3=WLRHVo^y7}Pg=c$2fBYwT+1O1!
zD_|^H>W}5Td(bO9{Vg0pJPrz!C!j>q+`r)q@;N2CX3B2R+7;@%7XpPW0FVN@9|KJ)
z#v#-<qEt|*U=Xr^lB$q(wrGx<<I*jJ^Ah^Rg~4+GJmpr-A<&1wcVZof+83^7Q2sKC
zg(e303HV|j)?c1%-vu-M!9xJG!l}da{W9T<+?2%*+kE;oZ1Ykt5Q8*m1q-1B4$H7^
z*o~FOBE1UxnRV42@?O{P#V#P-A$Dd9lsP*EPq^kDlieKBbMM?gVuEI*|Fe2M1+*F)
zC;zWzG8?4#Y_JduX0EdNuW)bOCNjAsGb$dbF$2~UiMRNZI7*I*uC{5ZJT8xawNN2T
zGG3D^@q2<5U|=IzOOL%CZfPmvqPqHowVFDmF>wTTBeU0+vV<o63N4KYxSUh{U|8Wn
zbAq#T0DSrWlk$P*4nQn_Y;ubz|CbGQvfr6_|7`$C#>^ypjZ`7FhmKYdsW^`LK}mF)
zR<`2R^<&lDLrL=Ax8qG>XI&?$W6;Uxc`<t!<CCNIC~Gu5*Y*6RJ>DwYSrLmEKP%=#
z%H@&P?W+!}Z|4jy%XM2)lc(bl#E;PHRiPhXV-w~P)ftlTcWKv!ev>j@gQc4Vs$H%e
zI2#GwKFvoP-efq1k8U}2hlSGfCwM56sQ{cvp4wSQz(&Obh@5z?SU8wIqypkmjiWE`
zYO-HrWmgd78YI$<En5SqDg3nKPy?#kqkE^?gguzILYycpSi$_zFySUGl+FG~&0d}Z
z96DTROX#ccO>CGjTL?Gi#dt}ufqf_?L#)9glFuvqMUSEsDMJEv-r+;S$q3lv509I|
zm<UlgOu7guC7<F^H#0dYw*h}&vzGduRItWcKN9I7e7j8~#q4HH7hF59g+%+bCsLO|
zBCM%;#3-`)lh^hEMeP}iC(-4q-2puOdY)@NQO9sY6wlHf<;rpRAA=&LWjn)Z%NouP
zj)~AJ-TL`>F2QbgxN=f8Bb7nAm|ZMt#0elFpl*a`yK{;r6H;Zrf-o7H+%c9w@g3-M
zW3FdxeK&K_yc5j>yR0?9I0Hges9J~hwPG3yWZ0+xeA8WFfwb4MW~f4?6(qx(V+Lec
zrMdKK&O@;b`*MD9LdAPDgJn%gmqszAICTKv$7_<r9km#O=HVW!cVGW2oE`Af3W|EW
zYzc%(S8VHo(>?zV>T3XU;*v>@Vv?dVvh!!#f^j!A>I~Hn?LW_#mp#sA89mz1((`y;
zoPK9PKk3m>?Z;kz$UOZs68wGolUD}ajZm*Lr#~FDBp93Vb>C{19QtTd^eGJOV|@Nv
zGPw9_7;!O2{kO!xyRAALpLy=R3<2<2kJW@%&Un7OE>@>2lFe1?-qLx<V&KoG<_UGs
z>4%x3{5iR}1*WonJ&?4tgt_%iAQDP`8XZ6SN)A?<IGCBTJJGnm+bBm1JQg*-z7<`-
z03%kVdh}JbRyA{e=K*6kBsT+P_W~DkSlqo57ON`9uv?h{vGYi(9Jr?OL4PEt=pjge
zGsR?bqBZ%t(6OdPLg|Lgs$FQN+UHOXen9OTeD5J9K@%5&Za^*PH*}YdTfq=`MJ!<d
zl(YaeX=!$lM+}QbSL|%eA1^6j<FPwe03WesHVR%#-H<XQ>p}d}_9;itnH?YIQ3BWY
zaH-CuBf7!V(!5;sJH`|RZa6Q@MbLOMYDPEulZpd4o(JC4<H%0^S(AAsJXIFGxdI$a
zS=Ge51DF4d%p+V&4Ok<C*7bl|52-hT`=W}br{V;2bVb0im3{WhiH^OoJw5rJnqi@)
zX_>SBss*h-COGHwMA<iZK+l_|x@KiZT{Lwy<2po%P3PDnl?nT+L=wZJ^uMFGI3x2x
zug*zkv3a8V^(KG5(V6S=(>h*2-t_vME8sQGMJ21h-B2~#nf2u*x_qJ*I72%!re*-#
zgo9WM2GM0oDs1+UR;z?nP}25of4*Sk0B$2+-LMqFx60JEZ|%e2*Y^%abh0~pIJ1dv
zbNli7GJx~4yWm<PThwVE(&*W9)KGEM%KJG+8eCym>T{{!daau4QsdP`KHF%IZVz#-
zJZ#%aOMvgFBmW2+^|j=HzV71UgO9)&P0ekzcAS4~(D>h`B37=wh&<8K!uoj@+n8i^
zAX%Yhw-vgNMC19V3o!YGq#^_@KXy`#{{c9;`o}Ff#$-;mOra<1QR)}An|X&5<Aw~M
z+iw+A`Q8L6#)3vBmNh9AeRj~4tg_<YDpt07wc6MUU3JZCvg6fkTDX#+upMQ?VtBQs
zeRb;dBLeje&g9hQJwr4)Z*91RJJKw_p)USY+;}ilMPOGKLR!f_cJhK4ILaglp@SJA
z0VlX!3>+j1z7&BXGV+v^h@+6H$h6F@%hayR<f9L=c3??61EZsoIVTh{{_}sNDk&Dj
z(5Ylvo=KH&21=>O2P)DzC)QAYW+g`&#->L_d5n?d$RCuIR&si=IPsn|<Da%BNQYEH
zD3VQ*(6Vwv|CMC1nfY}`XEMmPYC?^p>tDF3?lbDi)uE&tMJ2Y5MzoSb(z7R8eR#ZL
zr1@&)cPpg5D`k5tWbrHIdA2e}*-7SjB-!ZiNrkms+JtTMJ{%RW=)&o|u?oSHGyw#h
z45+-b7m6Bz#pfM=O!rh5HEbG6^U&HQJk3KzD{h`E*=<1b#=Cp&ppAG=K1t-HY{v(s
zQTaDDi>M-yhi_+SD7_nkj8V_2M6p@@o(W=pQG?VUCNwLf(LA+wghT1n7Brc#WTH7n
zibp0;giUL$DjAa_$E2j$Z|C1VT^Nwc;RcE4fNSmO;O?SlT{>EIKa&}-L!D(-s<iMa
z;;4j5=D;;mjObT#59X^DsuqdFWgu}5SE;J2d_)SuwFZ5RYusbJKqh3B!nmTXh*N~$
zUFXvgV?GMbYnyHQv<_R|T4+U?XuT<18zC2gBLOU(^W)Qc;7veV4mg3?hVHtLgnXwB
z0w@7&KmxYHkWYWz@vJr17rM9{@786UO&NUiA?d+E0RTa69wkUjCV4rO-O-+^maF>6
zZtSeLH8JddAv%+qdkl5DnkO_`@Ahiy3$SYKZ|s$}K)h{0s87{!BK>@%fTX_C?(!&y
zC<7(b%Td+B{8o8;S;opn%(;e!yDS%P9Rnj+@c`oJ$N&yOo<v)g1#6d|K=Dq;4cfGU
ztOgMp$W}nefH9M*GHr$pX+bt8LqylbK?am+3L}gw<Hd?-?wzC|MdbJz5H&`x$9%|Q
zm_FWh7ZSH5lCXWPCuoVi+F#MCY!^#)-Bjx!3Rz-KR7xk;nDa5IJJ+o)<5}JoDH7FG
z!u+SSkB{Qt+JI?=uTSEqKHD>cCj!Sgb%;7_+S1|2l{NF7i=xzL&AXnl&Gc6#bPwR4
z<!^r{PXmO|K<n|_^fsv=mykU6xEr<e?@AaOI_)qMDK_34p6A<hSQ(4Q`ySpcTCzug
zGhqn-s;#HvedqEyAN*|w*C+H}z1on}f1X}6#XU}aLDu^27TfSY*~rBFI*4Y>>8Ua(
z_K^DXt4Nw_UEDVvucWFI)))R;Hi4mZ>cgs!x*GbnjzRW~ekQ63XtyALtzKvdDlt#q
zr6Gb0s2^t}S)aVA&&AeB$y(h8$AZeI7TEkCKCWX-(O#X=$UtDpscSQ+$Cj&>3NaVd
znov>ftXD89XzG29#*T|wC&H`$sjmALx%8N-P7_mi-^iF$mzC5aE0m^YG2gwY1u#5W
zjh1#IdX!sF_>BhW8M)tUYV6A5QToke@s?g&AtvwRT`r@qy1(Uc5nS(+%Tm9>g;cha
zBJ9_BDWkGDINi?j`3Jy-!<)#>I~(sQii#tc*~C)~RU4RD3S68*q%m8+e%Ch~3V-Zf
zzO#M7^AnEMhRa2lrOvw}fp<zK3O_sYk+4jN*7l9dSAjY%np`UO>KD^h(7nm2BGK@(
z-G)zE6AO^v-mJu{Yb$?Ch^xGS84&DGvr8?9<^#G2;|}st5@WADRLkB`@MmO>Ra+~R
zXKdy)R)LG$NC6%ElqlBoM5HttzR<w|52Xtp|E`ktui^1;WUeTC1e%gYsub%3V07+E
zJuY5>+91urivr5^=4RC=L=~D`C@+p1<`?+Qi>)2k*MGXK??6N#N)^N2pFiB*N{GsR
zUjM4ZgVoKQE1KoDYNROliktf4fG5WXKeR)H6*e!edjCGZjI8WYbhNm4W*#>6DIb^L
zkX4G$#?n7fs*7diyCV32Ta%|sqQfESBP}~AMqF0?jIP#?EX0vF!^rrR+b_51m$brk
zV@N_VTp%aU_7hOPim`4+#EbXeW67*gS&?))CDG6HlE2n0Ote>tBogaKUZ1(_!^znn
z=KO&2V)8nIOR9>d#yevm2SZ>^5rz@a6x5DZILzM#qrvCr#qfT6T8(|78F`&gP=7@d
z9Lu-{y*M0uUjFG!b)0Z5YM+VV+l+dN<m=bJaiiCsn`JUtzB(4jagbTFA1J@lu5lAg
zH$Zg2bMO@qCF_Whz7iC_)hh5+NL;obaWM$ZTpdv9W#2<}E(Ub%bgPql&w30A5R(%q
zmkv5xXFZiPaItM8=$LIX0_N_wM1nFa3{{W=cc>s4@`P%vi0@#pe6!`2CW1?uXkg~z
zoBI9rp#7APZw^6`We4+jLm#6L#d$gIG1t+3aGG>-zUj|Saa-H+KmKH=FL$*OIx0H!
zRC1?}fq<F+HE(`rs#|DX*XY-lkluM2EYjSD1=kMmTDEp}@A>3VDTnhdxxL`7y(<T=
z_WHI>;ybu{SZgsJTo4O!2PM|;`gbsb%=?>S+{2MDlQ&lzvf+48_4{53ExQf$D+ujR
zQW1uJwp<D=4w2)i7#8sPRydc>j|~c*RFH=s+%ToXs7%R%OB_>cIIuq6UoXhlA{*sk
zqe#BaW^B4qn;1fq4YE^KiD=NHW^uitnB$_<29BUe=N)}h{dX<VjHsPVat~fvq3E$B
z_#IXRgA~jRQHn~2gH{N&)Iv-n2J=UT*&y@Z{P9@m@wjmMUm&%Lj85cI9U5hEt!^=1
zK*Pg)QEE^u-mc1G<y3u$v@~6C^JdIap>P0Q3z2OrO3S33-E~9y3Lj+Ka%J+0Ac6BG
zO8&!3roF-L2l(<|IpSO=>}4$T1l*ZIu3KWwbe$kwH?&1o_WErX<tptPWA8nry3xEv
zkA1Rc^`F7zYdVJ8uHf!h{PSRhBo59{kpuw~R3*f0Ffv4f;6Eb6#IT8yiZGUrV}edx
z9bYhr3HpLT8;Kp6C;gCDLkx6fnp!sMr<n@YIR8<$wCoXj2j!u8Ue!0s!%SPAJouuK
zmW`p6nPJuHLsM~bF^Y7wWt!Pc3aj#o%(dC{D*D{~fmiYphip>X>y`z$Y_Qs%%-<=m
z7P^=9P3r7>R}{0SEa9aGzJ29O7mydPO|i-<QEHUbNb<a%$ZcNrIlpHBic7gQ_khT*
z?B)r7_4O%0vm`KCtQMeA8!uM8W<(+jfr|wgMVdCaN6ik4`(s3$*T22bxM|oFL)(a|
z+Cx`h>=xj>rw<GVto`FWzqhi|TvliJR%hrj+wJJ;{2x^hb~QCOH_wJ?1@2?*jL-bX
zWoeCz=*<@JBQ$@zFM7=0>dvvv*shqgYx-hZ;S#pq?@t<T7&%^0x)7cM+8-B4boK29
zbF=bTC&tI7P82cbR$2{&c~=#7?>k?A!{FlIM{Pl|wP@6F(tpyTZq&ESrkAMjPB<p{
zdt@p|n1^MB;G5p<vn{_&YEo?qQa33-wcYQTJt!5Wsv~nPdftg^o1|1=pGO|P%4K?<
zVwYapa?XF*+=;sdb~P&X*DL+oEd{_W4O9s%5)8q7+tfSnOAdy$5v+JE-{v039*R*&
zGxQ=D_lvMHhoVpz1dB+=r<6*hlIexxblz#DP)ik)%?4kvBES2<NhK4h;r0_p@Bi%e
zg(%B$AJ#aN%W~cZS+bZ-w;$Glzw*|f?Iv|)HBF(kmr@N83}o~-)H^!d|6!aX42Gjp
zloAV2zfk7i{|80l&2x;1l$@fa1L1Rg`Og3&2Na(3D#AF9n`t>`RgZBU)T(c=IQRyr
z9@ayMi~vXjg0Tatpe4e>B^=jnh-oyJ@#IJ%dvQK*cO=SQ>&n&kG~n(xq$!gZuS&eY
zjTC+s6^?Tj2fKrtTB|FAaF?7C@#wjG+y4Z*#rBAyu|Pdkl$(M__TvE*B_Nh0J4Yzb
zh-^Zo;%V&AifK;?P!F>Pa>O03p`IBOW?Qu;f9f3fv*<g4G1sHpad#j19miYeixDSP
zyu6`$v<mbc<7H{p*`IX`i_JQy;22gVB*Gl}vpGxL-AePeNcEY^Q3eNZyj&xF@k9IO
zf#>x%0ZqjR6GMf#thVngi7E-2GlT7rx<$6v?=6u51sAD=={AgmgmdZ%tFY}T+ZSDx
z(?Bx%&{&&P*D|*TN-cs>foQ#7s`A?@EDiCQjT)`Jcr4XYh4{!=nDSQ+AK$qb@htc{
zE2>LbVZvL3?%JMKj@-cDEg8{xxZjPtz|dfS4+$|b1WFV=j2KrnL;^6iS0{PT>_$r9
zct9pWnn0=<rDC~YDsqw~fNmHQIJsxiL&3jSeCwz2T)q2sgWx{{2%cSW%@-pg{U6w1
zN=mGjI0?6y$;k;)$@hSSDmIaqDd}YO)v^kq8%nIA{%0d6DKAK&&<`A#)gr5u-IIBU
zc(rCG@Oj!ssP=o#-u>R6O@mYn9@9}CC;qdZ6_FF9l;;BuV;;w88IjReIHpH(^xt9$
zv5}Sd|3cjR$sPyC^Sxh1>({*9gsb*`OyB-g{Lq>`vJ$P-lqwONZZ4GwBpb9DNIIH$
z)E#XN@kmI7$8{7}mc^F&H<SqL3MYb{N$H%nJW&^Kqi-fF8ne4DFa-F)6!kz#{V`WJ
zdfQcuEm<x-EFyVwMU2!Thmp1eTSz`wBz1vMN8ZL)O#RR(x3^<ZCyOQ4tyh)KX6~M}
zpmou4&t90L9yOzfhpWX;STeCtDZfVUZ|STY|3H|(_0;}CH%i)Vkl7}PRQ^tK_1Wks
znhE7yN%(IH4zX2Nw;dMgTDKind0!vL^Hw{$D|cF$`3QKecRCX%VV>M~swA9Ylh_Y_
zWTiFq&Nz!=a#7_$wBoyGu4rI6DtS))OlALKW6Y1A7A~&FSd);YA;)r-Ef7{&MZypf
z(}-|VMD)J8hmnvI|J3a^lG~fbb?+f(gZwIjo!MW3=QQdD%;$@zPmT>WV$7@;xvCQY
zaOZR9&7+v_F07vXzVb@=dP^lezR6>H27s`IunOocgl%+u9>8FvsCSkCO(FpUS%%#%
zMqEEZV6eHb44a>=FTuW&1id-OuN9V-6InxKG``0SlAkbg!W6UtR*Wd2M~?!(rmwwF
zRX<gs71{ZAdFxx9lG$U9z{d4`K*M5HC@ArDl;Z5DZOV5AN0k(C`osiUel8&3_ZWm3
zc~KblycMC0P-x^jArgv3!;Fz=6na4-l1W&Zr4q42M3kU&jwKwy3Ml^!%BwIb{*Fk^
zc6tpgHCK$4gIh&kg=~tBR&Oz{5Y_r-XPzjW;3QF9e)SI!5%-h)w=?3X|A6C+GU}^~
z$uULpyu&O}s)#&`jZ6J9A5$+ukRClBFtI}A;7}K2#$1(G*6;|~b79EW(5CgKq;<cH
zXy10d_KWBHybLp_5w|}Lz!n?|386DJT$qknD<)KfTPYpiF*C^YO|aa7DHsY0NEl_*
z<<e_89>>z_ImfFhnp<wBUQ`gz=rF^HOaK6+?{6SQu+rbx?b0(D+}B061osSJ@c?E+
zLLek;0;m)ebtS4?Ng8xLB0lK@Sm8Rhudv`Z7%dvT<p3s171^KdCcfaa0KPEn+zA4t
z!E8{)`DXTiLU7s7p#F%#Hd#t`^C($<W|}O%`t*2u;0dl|_EwM3DzP;MH;Mz&uMf`x
zXW*#NFs48q;Jo5d2MheX>RG)+&!a%%G>h7aInthk+mB?tkmC(q*z{71y5UDQJ=g$}
zz!}Mz(DYu$aK^A9g*1Us;ElgdRzQGDs|o0Uk-Wd&Ko(ULD~>=L{i=gm%S1qcR;y|}
zplb#*8la6_F(#l5(aas7CN<N!O+xUg2!ELVA;Ndar>uqK7zoy|fx7oUT`0O<+N)U8
zZ>;yNJ429*4)q55nCXBZ0vXPPR4o2$$nOGznBH(_HSN_=IhV%64FfS!7B~Hp-Yte9
zwXzAd?y^_-q9)ex`)xw~_s0dbAA_Ll?PLmMU;PHOv>|b7+hals>jPbFF}WDIfjK2h
zllF0>aOB0YABfQ!XMrXPK;7R~e<It*KEqS|B5*9w7_r3$H$Px$DL+`A4*Na3p!o1@
zrUC=*eD{7guP*k=STrs8PZ+QODZBJ`<#1I<8z82>8XKmn0<$u1fknwzaV03wkU8kr
zsf1+MU})(KyD;Hm{=+bd)-Khn?qeGXnb%SQ-HMoprA1|;?cHqn9qf3&EQDAquYRxQ
zn-LY89@(qi`IPgPE<9{*EeixO{$~8qK)7T~VP&)t?C>qN=wg%1DfZxD@}#U7EEn{p
zU3j{#P2s+SLch*=_A`9%d)kq%nL<oD-*BUnjYuP&>W$__;3ofev@YP^7ZD;4_#bdH
z@-{60Mkr8(0sX1&eVDIr(c6U=ay`h8GJ{V6D1NxKfjX^ZZW;W_E83>`3IHBrqqNr1
z<!*fz`Uf#Kd<ckZs+lM;3`Bc^h3xZ3tOT~yqvW$7eDc2tWV#dVeX5kZ)a75>O^giQ
zG%N(qunW4#JebJ%dw|h}T}$2>%7-VCSm#TTIs?=)90qP_{jQodEz_iktQhq%pS5pk
z6bca~$nOfGDRycR^I}=B?3WR9bi_#(8%TC5@^v<)m*uIYN!BEQt#{hKy5U(mDNn;M
z{*`h(i(;B@xPZETzMLW_TN=9P?A)RPN)s93frwsc%io0FBO~ga_+)6(Kr?1pX~BJ0
zh#K}r|1=CWbVz5CYYTnYx_wy6{D?7Y5Nb*^63(17NgO<6N(Kl#hG!bvuE0LzRJMW#
z*p)=vfqBf%5~Y$mH}nQ8FR=b9eD}^O^4MwA|Ef0oCv)@7{Z0ODaCb5WKEd~uOWyAt
z!#6hF|Li^Q<ILRWquh65bUfhmkiNBNo)sb2?NodF4qKeTx0@ur{cfFNXIWIIuTs9P
zdZ@iyo@;bZ0xAdXu+|9V;>vWHd`L82`Ci>E+lGNv&pxg-s&QP4XM+wB!F*CNF?~la
z4dQ|)syMVK>t9LSzZ620+W|3#;zxtx%vSH+Z@Jda)aI9-&Rje5<7s;roNWE39@TWc
z!wdD!iDS%!uX*WJyk<}951i9FE}P<}^B1Ws%Qm-RJ=P*%Rdq_?-dPsF<DNi{M8ANC
zMpR^Zsu6PF{NM<x@KD9TV#o#C<I0e2x{VKr*RpXdEtmB{RztBH9nP9Xu&bK3VI1)h
zoxEJlWvea_LM#n;03V#l!_c`vA0Z(*F%SuaONAma1uc<>`J6{-Ubo8FiuFX9h(>!>
zHEATNBoNTl)Krf1%<&1q@qK|OKC#X2_@sQ2ND?U!keQj;4CkqnavYgt66ycq#Q!b+
zr~AM9D+-MM4?oGI|KApHOtZ;oR1qlk*@d6JXz1LWi|5=?y^6vb4jc{^*aM-crvn*C
zBxu*0;QjYza#6UnmZcO`(abA=DYINOC`04F@IXLm1Xk=%HMEyzw*UHzR8OdcIt*=y
zny3sNOb0X2i8Y~E85MO*fE2+B1%adGx<gelk_tN&R-mU_x7JxorNN^=pH|Dc$BrTw
z2oVOtVPcVZwNf0w?htgFRwQJJEV)+af74XtS&vf{6h5w|UwI0r`hnn)q52F_BNvM#
zKqBCyp+SkMJ%sADWweo+Rg(&<*|4k06g82SL(o!bG@E2#lmh@tQR3J;(iw5Pg2q)n
z5V0%k*=}Bl%pna(?ZiPqOHhn&dh&|Xq2NxW(BKC~)YNrpQBqJ+7&OU$kV}!{!8(}W
zCXST6Z$n+6iNPOVddu_RyZm?aKZ8H2PnD>`YU+C6yZ&|j^lrU=5)C*d=l`GSyS}`Q
z_z+FY)||@GPKP5Rpo>xEEmmI_RSMm=m5YZ*E2b+MV9k8>OTxN^su-Aqwk8}7Vl@hQ
zb%%nkb!GJEdJIT=b)1r)KT)*oyH3rOlOj~?7P~m)-X+0Tpl*{c$xClMT|kg9Z5O-H
zGKsW=8){@#5|5{nRErq2E@{aj?x2mxwGK%;a^Yl`nraZSLOwmw9zIhAm?-U-FO<_}
z&TN@GzUhm89dMttp^W4JZekkAbDcLrlw%ydBZYunr5wXhy>sVRPd~F`v|8PA69dfh
zzKt|e|0I4zYMePu8|JT9O#@`9kI!al|M2k^h(SF76`TQQ1Vl+ms1Z@&r6Q_RRhB3U
zam75bC_=B-Cv~7oW+Bk{+9ZY)k)EfcOIA=Rg0R<wY$TDT!qF7giDV|?>PnDf0>R}3
zstT5&JB^7MnzNOFls@fnZU4%hf?qC|?*<48zi{srD3XL-M~gTsA>!g3PagBwuQTE|
zE2{%2Qg5x8@BRtsNm0rl9}iqN=>s$DE|oFT?y%MVz33e}YLgIz&&i2k$fcx&-5c{L
zyEm<oT4y+r%g6ifDW~VQ=pJ8*>d?r#nP6V|wkW3;D%+i<Y~F<atFZ?H70W^sRB$==
zz|(`aED(Cx7YRvrVe!-ayiP-J*HN0@mHJs_dg0|u%0^yC07=?Ak+RD?eT4P7jl{(R
zcS4e^@jO8^*R>>j9d176%sy{{*vk<?o^K)X0p%xFHr&bhR9k@{UoAq0plhc=QkS(?
znduo6?NmlgAUR9+Kq8ytcl{OFG(3Ix1W`J)3goa}oLGP*oK)HyArEnnbk{Gwcssc}
zBHT;m?^~olcN+BEV1HhFrNMM;K<l7VMmk$SwO=nIg_I>SfnX|d)s%M29ckOcO^{u4
zW{jFhBof~V<&Mg{q15p*R-4te0dq9c5<U$1T1V}Nw)L&v+<!?xoO!?WH2Pwcve2s2
zHIb?8$Emb_Si;j$t96;Y3|e%<8*BILLAcCuHdc@L<%wR#3?lV+5+Pj&^>l0bvPopx
zw~C<PFw2@Zd0924h=!Hmcw~V`?Y`k&C6<!IlczMfok5cUp=clUWK!ZTMpdMyqGsbI
z5E{o(GoamfkkxycvW1to+cgK*`?|<5kCkoaR7Gs_UqwT^?S?3e{ZTow<Kad!M>V}O
zW4e6jrfui+O5>4brKu#~HSk|Z=Sgt^elw#3UBo4$@wqKd?!yKM1{I6`XsNv>B+Vv=
zwN=8#fig<2HAn+%i>#fBtWqPydhtf_RY!8~SOVDOTR#+r7!E9a+McQ`eHeLNV=Dh{
zZS7&-JpImBAGqLPp>gC08jUg=RVFdn1;A?FEFO69h1+1uGMT<jf-YRGPzlX%&T{$Y
zui}-K<t@GEfQA*YF~^J2JfhnI@R^TTcpjAnOBn+)7W<DotctKE81Fw_ICxggX!+oc
zhja_C0Gk^}igJ|IIN!lC(2~VV^gZ<E$h*X*tIp#@QXsIi#(+VfI4~fC%|=52Bj|*o
zKMx%+>aH100XJ~O=L<-|0A?3*^viP|Ti}T!L3AqiPhX^csRRH36#vFUFAOS)f``+g
zfEdvN5&#4Sl9gx!1PoSd3<CsgfJSLz3z}b>iMH?;)O~s!dHwpeH_mi+Nhh=X(PzHE
zLQ3lWmh3>xv9V2DC0a|70wR*hC~3{x(#rg{wMO|hO-@-rG=&t8>oI{f`40}TRpHvR
zTl7xRi6qXjNW#Y!`KL%Wo&WdrDZ^pft>22-QkC^|f4sJK+V01{U*_TsRur{PtzA6+
zfdJD0U*0`1uL6Fcxo+WM=MwGy60bj0f+hqXgc`@Jb;59-x><C1y5##V14-?3Ld0})
z9)-#Kn4D3#o?^RCr4wb#Ra0!mL?Yo=?~ACeIsFT?Og`Xmk2_%#SbOU~>KfUc&sh<w
zRnD5lKHe@F=VrD4beHQghdh<(6+EVRUKsL&hS3l%*Z(yJ!cwYt9#+fVK}FOv7KRLB
zQ0RfQ`_m;+s+Os>W4kVKxt_1=Ck)16KIdDiCjxrju|4Z56szUPy3P3Kw&VgJhn`1l
z2p+#){cp*#rwkEn(ScymHW`6DKu`898PfvH=;mgDG#P;i;p*3+x(e|y&Por&*fh^?
z;#$%KHM?y*dGh-2LiKM3c!4n5H&nM`GbZG^u@0!5mt&!KOK`Jp;LjnGXwUtUm(ZLA
z?_j6$V1l}{tk}Rqh~-I#9XVX%RZ~zFgjTkk7eXxvML7htnNonXxR%C_-nN{{hEK>W
z&G0JHJi=`NG%}TbMTv|jB13Nb<w7xwg`=e^$cb$ta@cfSROZl0I*4M-0zEXfvXm&;
z3HzF)UMn{js;k5w*;)(cJ-&haHk0CLga;QkYueX#jr~pwnRzLBjDq&}F)TUY(n8&=
zs8KJ}?><n&fv_i<s56DmI~bg2&v$yAOa3l4K0@Y-bZn$ErA?8TC^u1*jnk4^ryw>Z
zkyIrb`<oIfoj*e%yHb1rsV0%!fjm(TaN^n&T}{onw)i^D%pRRLx$Y&)saRS|3K={a
zZwlc_DgK{stpsB8DU%u;An~$!U}`ZB6~--iGXaS{1>SnWT&mY(M7rfmi(0n43|e-%
zHF`8wXQa1`&ZCEf$Tn$qYfVTywAOxfm3dS`D^}{uLpWnu+mpRA6{zbnz8^8WXMQYh
ztp&??^y*f070_HL$(1fF_eA52QT{KO<*)oXjx-xNn=1{f5yl1SZI21T^f#B}V<z^Q
zSd`hJ8b_N_K4Pbev|z?*<z+uivNP<H#%fS)!4g8_n+&#I$x<B>jaR2XbjApqdPbIa
z8)hWq+3xR9IGysOG*;_~!lVr3WS!(p>uj;xRG^xywFgz1Os?5Z@yxh6(k&DjJECRu
z=4KxfhLu=J3(hIXQ_{rK&ZBP@r9GWdt$G%&X-Y9ckYQDwMtGMgLzJNnv?u+Noaa)$
zOG`3qI=nJ*{#yyzYDAjl3u%yFGE7lMM~N>Q=tCL8=(Ky|n`@IDfAf(5a`z<7t&6Z0
z_;hXe2?)qkc@q#!LY>g-s1yi+8bYC*2Xor$+2<O~KJg#g{5m^T9gJ5|OeV8{Fl;W5
zNmFaRcgaBm<|6PE47^xy3)L;+Yy(CdO)_fm2pOTKxLBu5lFl_)x6*&tW)M>kn7sPY
zy2(wF24RdR1_;@?3HbtB<@selTbjhiC6V<uD8ucRHIP!bXnjU<OD=vDp?|Vmu3uCS
z8c?!fDyg_ppOP7IEn&^Lh#lCJs<g;2PmV`2{}^En<#=4b*hoF9L>87ahb{G3b4U&P
zgv4sty(Qq=Hdo#*jv2dw|8gUhx3thIs{zUO%+f05>E`cif^=q2;W?USSdK)pr!X3M
z>LduKP}T-u;Hmf9Dn&+h7ZnIyLnjYO!&s#KGf!$*mz1p|#}u0`<~IHNA?P^M!6&cU
zn|sRokeV21q!;3d4=cL`QL2%cb$4ZIyiB2}iwtZ7QHi}Z*_?>Xb5x$sqGS|!-hAZA
zcdaPRIeavtl!gLM9nC~PudnrpgzLJL%R|J|eW7eRO9L3LC}4udU<~HW0LM_e+*#iN
z3!O-$Se8N5EV3QyCh&75uDlu*D`nX~=$f*%HnJA6pha*QkW?d#4x@{;6?1K^T#aht
z*%sop1#ynWOe}ywH-fJjvl6CMFxv4l$HGz492cKfZZfm^y|-Km{tjWu-9U`aO3CL3
zqVL++<dZNCC(>_SI<IGc=YN@33W*hfhbZEb4Fe(BcqpJgCR8qnM>!Yq2Sw)A<P@1Q
z#XB>H2I+&R{+YJk;+j0%dTLwXOpFgQy9#zGk*LRyDVfOjRYyD_Y`Pyp=F9l60Sw9(
zu;-}=XBUe5yn1~bd6H;QNROLPbV5v{z?R9=`g{IMFe*?EnBfU7?Abb0<=vHKTR>~C
ziYIs|PzV<)4@iHd&Ai*f9AW5GtLB9{u{p%yjDi{lNhd0hRbGr~`S}T^@<HvN<Cbc^
zc>SyTs9&J<MXlNS#HHw8liEvV)jU0GH_(WiL3EcuD{Lq8R{!r&*7vFS0lXyUzpB0~
zr#thFt-MUcwE)#^H)YH2+uM`T`v~K<=2%x+u;P(;je16@T4M?UC4(1MYSI9D8>bPt
zafO3#nCE2sUP^-8lBB<=7|OBi=GaZUh@KF)V_k9QGWT(pA20<8@qC9!fO|JDM$Qlf
zTTaXtF+)27TUK1Ql!R$Yk(82A#zbc_AGQHDF=2yHY|G{imEB$lntMMm&N2M8nnAMb
z>jqm>VahM=`x?}rz?RjoLpplbgjgTQ9Q%(LZK6lv+gI!6t-;HSdo=qF+!&7s+1g=H
zKwMz0btmR}r%sJDm&3m6bu6pvL=0W&EpJVjVWtd?h|388v4lSTdvC@16w2Z?>6Uz|
zoQ_hCdD@yDt7HPjsX_5aACRhjk%iYAi^le&!PX6wp$wcCmU7NpoKhm9O}7EnDFf=&
z&Q3Q{B+*!d620fX7f8nPOxIwvy0g2QCZ%(v^#Kj?@zSG5B99T>yZwE3BfhQa*z33P
z7k>~z`gTA5(<W#*Q^3~o?fdu9YZ)XNs&`bDahe5ndomvp<i&~eQ_nNZm?}c6jxdtT
zQcoRO)^o*NAaEo5O71ze=`k03608OY*GplPDiBMnj+7Z+|GQr49T!*7om=n;!jLvC
z<}<^JjX}xfX%sS@Ux2zem_BAr)uDj*EmOEV`OZqQCjXHA$KtEWs?INa-skplFvSCS
zXu!Y0=<xeKDLfM5b(Cr)oPO$Sg=s%|%C|VlEW7X{p2~!WMv~1c2&w!07t5DArJbNk
z5wE%lCIPswjwwE6$y@_nFR`mBRPD0!uM6Kd0V?B8tG<%)zmP1(M_8pV!cfT8uB}2`
zlg*dy>|M^AVIs}n655b$(9`{`y*gtzI|(?@Ch+2?&oYLqz*u*HCb~0Ri<|9-;wMDu
z=>!GL{0nb&*zEp05tOx|pC(aX7Zel2Y@gb{s+h6lxD3-ySd2=2Y_CBDl(h=9i2c8h
zR|7c;{H0(Bw>YZ7VA3mFnodAW@Env^S6ylRJF(stzZ$kON<~p8$KLW`p!oAEv&S>{
zf>+$*4jB-El}~D0#GlN*-eZ_6ozt;-XU_FzGMWN}T(>^M*Fxb+&|hwq`m>XkrHK|q
z&C(yyNkX!JBB>jg$P%y8M3KZKZJ#Nu>TN*w{{C}n?<3b(z%B2Q(1Uh%C_(QAI><jy
z$_{oHk9Tvq(O|z}sMAvfOCa>{5@T(A0Y*l>!bdPCZ-d%QPx!W`XI=Ey?AwhxB8d)4
zcWd?UI6Gjw&rahH{rBGIZ2b;mi(_XP-mbN(DCYc}bN`xA+`%0&-RuI_NTAIFk=IGj
zu%(@6Q|+m_$kNFJ>++Nc|LOK|r03}g-UNyV>9bcz_#D9qQJxfnGCfVHHBBq0A1C7B
zMfI$(HhEo3#;J&@lEo7Nk;_U1)t%5_ktReL9$<Q+mfl4!$Jq0WY3wCGMMYpBKCw_v
zhe|$T5fTucZZ}F<o?@9Vj!^2Kl{C(@aLwc6kc2d`1faX$QusFFuu$+BTk}>=`FOeO
zUt(u>=6d8?>iNUv$apna9*p|5MxF~^aL72J3Lby5@$jB@k-q%hI9cwV;5<26#-e97
z7bu>*Y@6RGj;Ze#!_+OOJLN5aNhO`lI9tCKu=kH?{YB$Fh4_21AM`wbmIhXYq~<KJ
z=F%3HiJ~0RmaS#}oJ}fIf@y<ZkyjD!ss>!I&MpCCLtmdUMnfr*hfj_+-40OiTlfyg
z*!bV==1`?Hg+!QoCfRh=2hWdHoIlZdLvn+xE>^zmMc=tgU$FH(ytl?Z2R%9&JHJ((
z!)>!Q@1ECo_n^()`<NwK366En5z|k<O0jaec3C<^fU<6It}b^tpSHKV;r+$ZywJM*
zG6HTH!e()!dc9cl@V(nVxXteQL6a<E(98Xf{c_<?y!GoxW)|?)zT0av3ttV_g+%>=
zBE_JAT<hXB-JO7z?n5S~Gm_NVg6J*u<*0kz2`}HPs-s-qhv$<*n1X0wj!KCyA4k@U
zq#Wy-&*<;deEq6@yplor4Ke?lx=vb2FWz>%{Xk9$?oZ(q+U|8I{)Y;w_xc>A|9$D1
z!;Ev3Kq%}KECPZGs&Uef9ymddzkNF*%?Ax8DPP}+t8TiOv4587KXEv?2XB2Rc=j#{
z4Agf>Q>6;Q^{RlY9h?NNCSGr-r%l}V%o}Iva#4Bqm^7VhNptnLkcUJEmx`@y7|uPP
znd=)Hd(H3TU6z5*9#gd`s}oDCp_X#WGbedc*f7Fy=`H#t4iTXa#rMdPk+y{gnqRZP
zxbsn`tA|(uu|JF}<x^D~YM*vkxhG<5t>WYqC==j^d2Aiat34fy7VHkWvjcH9RMwxM
z5VwwowWBsiL8o_YY?&SMm&rcM1L&iMxFLrAeiu)B8TThln`P#?1mlcqPd1EduNo{Z
z`T2ajv?I&3Wz4*XUr=H95suonzUVydUN7W{(UG=y=({}P{?*EF{GEGTx<^)FJOk!F
zP%h>I9pVRzud$;)eSg%qEN5Il#!a2M)kyo&2fI|$oQICLCt-<wp1ft2Lfs7mV*klo
zys&$;MTb;1%MaP35MJiqZ6NqwH)kmd@Ew3rJrYxGB8pf;=>Ha(eO)}<fW|>1?=q^g
zC)rF(EcI4pzFA^TZIr|&9d7(Hy7zQi$iqYO@(~WztSpYpXUS|wi9Fzx<$t^BVeQd!
zCF0=j^7rPX5z75OzNH_8AXh!MV?`l?7Aqs1sGAMTK!lTealq?J+_|}t_+U%0B;k>Y
zv!6T=Pg@ql-R@_FeqKHOU_TaP&Tz7F0GG`av`|UJbeK{5<1~38maU<B$Z8dN22d;A
zk_kq=BBf%1Ft{HtSA1Sxg1i`OP)Jl}9OnkmkunP*$4Cg0Qn}AcVTM3Q6H=`VOCV^4
zV5&8PqY4{ECloUIp;P#QY!$+>K9CHf7NJPpq)_*_voObYqCFyLD(Uq(NWu6hOc=71
zDh7UMW(Eqk&zsDKiveu=TJ*d$*@SnqqyPv6bn`ze97EU6G!bPO+9EYx_*;?uNM@(#
zB!`fH%E=+Gl7X3SQs6M$6JIXeRba8Zn-Ugpfz1RbZq&vAGdapZouySnLM{?9$w(?V
zdvVR9oAJ2H0ZqPR31X0Nre+W?r(#TNN^*S$Qc`^m^ax`%V(ORDfH*uw%kPDSd>4pi
zgRaG0rvah;;b7K?flL`JG(|z>GNi0%NtulM+tV`r?dzf_niC-)K%%?zP1!x@&a+Ki
z2RkWxx|Qy+ukNM;4z!?ve85v9nmS`>5?qOS$~2V9#0`|FbIVsxEJ|b^LbURBDvf^*
zSMuxcwto~#ltLjc|6-%{sr~U5hTbK9SPJ%1W*+()jVa4|drrVk$x+{o4p)V}h0TI4
zf{Lw!ZI(q9Izil_teW2P`6N09+5Q4(kVrvT`84PUjR%)+)Y%P5p;Uf&oCzrsf=L5#
zr`8FN8m_PW`~PIdVRU`!H!k<b7q`a0)nORfzHRppgwP5ZDY^<+7^T*$jhcOf<QVm(
zKqHth?M+~isx37cMOswEz2hmk{@eSRgcUN}$m0V_2)?2<(JewP(n<inRY5m3!sTF$
z5gsq@f$QF!Pz(=z4+B+ZLQY1;770gAQpnv*@C9%I?6*1HK}99c+)JXGkiavE$RDf4
z7@uAi$NqaWX8umLW*2*jFR#D*-|UuMk-KRFt%d9UpRs*zgi%2WSRv?pcFI1PDjN2g
zZ7|J|DGJ8#>n0i8(1L8e^^NA*?(TY0GkKm`qVrTjEfZPqz#ZIy*us;<13VJ_F42#2
z-J4vSPK&7D(enklHA(q;G1hgOQB?e86Vtp2O~W<oXLmmCg-1`hAz6*Hol1|xTW#2)
zbq7dv3E=LhgGJ8ARFc$|IXD@gI1DVeW`6_O0Au`p4?rfT&4Y?zoe=QP%^<$&2J)&I
zxl(eZ3Np4!``?wE0~5{fF2%gJ;A>oF3T{ydFu6yt7|fkbUplYeS6vvZ8tUrw4k#Z0
zCgS&(8G6T;7>Ql-!fLv)`o)v=tq50%M=zW7(2a!S_ccCSzLg0(ZUo92{5x6}ij{Im
zi?wH)#>+noTM4PW_p7GHZdid?I32n4{&3tc<r@<hbn<_XsKGjmM-A7Am$r#rKJQ-m
zptyRL0#DZn+jewYI8VDEd2RZr0LJPPV+9ntUVh&K%f}5fvCDsX&Qka&jKWY7*G>h)
z#{~_A_rAi5nMMT9xXnB|hdi2p5L#W%2H}Kia_3GHg*Sv~O&VWTZEXY#vB~ZZGl0X9
zj)Xy5DKrnc>#+OsfWG~kf`M)r=e@ZLLBiFYQq^IjQ&!bT!=nk%N2&J%LH>|4%3@(^
z{{h)STRvc`v~p03yX@pwL-W18PN<nuPYsLEIcsBk%)ReU*C((S>u70ix5f1@R+Q@k
zD3*Ly7GA<@&j>W#7k_)3+&9esv+#h-hrLW04hYc}_$vtiguPe3v!<yY!0qJe|A;SH
zp56~N6141F-1zP$teVZ_rH1jmvZ-6M&}&j=524MT!hYm#Wc~WzzqA|&<GD;NKqu|?
z%GN0ZDxGJ#M^$m!!>(J#ed7WL5>>w)C$@=13<T1!>|@&6&}9vOgN^C$0{&06ytB7<
zxVYqE#w=!^*LI()&dco`-@eQS?CY+y4QKM51?VRCAbx7Q{Lr_<1K8_f&y|eI23y%`
zeozqOl&j55`!q^$jQuWTX107jiatqz;Mm(nW5M4#H6}l~82K7rgpms?aNldqo~UZd
zA%A`!u;1b$N_u=n2m;QSPd!a29sIJcUj^(g)|mHC3Oz__v!>t1rZ^05Gs1fb!88UU
z01Y7_jm`AsmN%W1tu{LP6xv*n*GC;-)#?IEwHJgnA#d4b7FO$>Jn+A_8t%-hr$LIM
zhL9sC51aLC=BOnMv~ZZ0(=v}kM<aKkC3LvhudK>=OIh35kOybZ&<n-(T*rTsBn%?c
zbQQgC;fM=0_*|9z`0n!jJT|nRe73`LC-z?$d+-S`mY&&)e6^)ZZvBoSI~r9<5$f|;
zLkj~55;YUa--ApxvI@hUR?pcRNb^C$Lj%lP<4-FSt-Df!45YSs9305juGV24org1r
zF;N@CQxA`3PP#N=f=)V8$;3yle-lBOxy$-_yPoWN4lISG-@|W@L8JG<O^htT(DZXK
zq~H+S5(eGL2B|_8Kwvm70blbDmgn)W&SCz*a0!9EEG5b?b|Uh+)RRjBCffdD^lG^}
zQg&84QuKUOY3w=UEvyDvE2UyD4rtHH{^laPMW_AsR2;-aB>WjtbOMOXksLBkz&UI|
z($BC_;)Nhai#~TD00IwM7&OHE8^{~2WjeDo`D~geqL{CykQ6b|v24D<y{inb_=u!X
zpW#L>*W+@6<8N%sRSD2fY%gnvo3>9%;U6wWXl(2rZcf4&g&g@vs9B0+DdLI{BU4I?
zaG5VAJpp}PI-ZBmp`kYd6!4hk<*z~inE2iU44Q;p`J9q2BeHz`BGStvXpd1c7{*VR
zeX1kfIUU%!0cI?AML>DLHQK+hE9KKiAQsuDL4R!!imQl8wc3{@B5xv;7IjXN6BrXy
zSMh=k%k{LgU)dp<*}uns=`RJn3!mzxv1IOk=To!z^SR!#>it})Peisv)@K|$t>33y
z=GlL3BXjBp=Q{rB^r1zVrPOx|ofLF;58jZ~cYp!eHlKQyxhPE$t)xVq1A9?0kl6^|
zgoG<Y-H3=&#8jt?<Fafc9Q!OdlXxL;>8v0x3`*}K5F8#$!8;gn88_fFrx_rB{JD*d
z6DHitQIY5APS?=D_mXSUiEl&Em;VqW;^_;>mIvVeY!vK2rxzt64vrict${)B)zfE8
zwH@|4YxVB;v0n5gX>x46s-L4tR9Z^|9uc0p&i=q`rK4ZNJRWdCidh=2D7+4^ymEv#
z!}^>{n*Kil0U!S0f#_gjz<4OmK9&NJJ|=M3SR99b>Onh=DU3gN0P~@9T>ZT{Gu#T#
z2IF$asCXvUo?pkp>3C*x7h{35ynQHvm=r4il^B*r^$%?;b2m(JjXeEpVL{0(AluL<
zlil3(i`)D|Q>moxUqkK0BvjJya_L;bJ#f(muzTOQaTn-x-n{`bY`T12=>zHt%kueg
zFjmlBDeI7Z#(WWo&Z^ia@WUotw$a)%>a>&@l;`sW`DLvWP|dK<L(%D~17xLrS$vV&
zl#UCtAC7S%wRk>r)IOILn5`R^n7_NVt~d%4@H-}UtIP5Mzr;r;mpNKH7k959to+K+
z7<dz(|Jzq*&a20HG2j2<{`dMJx%k67x!Y0Mjz{eMZTy@d>9$Bxm%c5&jVGx(R}{CT
zZp?T-n_m!DjXQ3{ztHRLiT1{XFgK6a*F^rZ|M>rL%Ht-9XQp|OV<&i)=O?XWPe-)d
zDjg{3GrH}&CpNSeva|3$HA$)d$}FD<N+uCj7{T(WPp5&iW{ib-&hu?9-gaH-vWU21
zGu#F7RGEt_w$018&V&CT1<ztf4sza<muDLr8GXhpC_v%7FvNR1a`3j0KPH=%=iJCI
z%$c8+$z*df(R^XP=*FDf`OlJy`P=1{`iaW<TP0<;<_X8EN-A&6mzR~lxN)nb^7d`u
znzVki?q3bK4VYXx1`OI)PY&Gb`f~D%>8a1hz8nJ@H}4KyKDPL{_c1_f4g`QIsRBhc
zEq8V^gVD^6Vl+vJ9o57LMX?#pgMnc$*^%f|tmqsU-T24{rZZ)B(Hi}PK#%J4_WVb=
z9PBj5aAL4L6@%>pD~(N$^Pp|@<1`3uoEo+l)xm)ew-MWJX<l@z-&WTS1Q6Q%5n*u)
z)WQ611%~GFc5(aa%gZkVBknC-UIM|audlx*)jeE!2uQ254bR>J<P6ORLmM3S@nZV8
z4-O9aV3-5LfV4XG^x4y2+EIYRL8CY^OACbtR~upz19x2x8Xd#AHN|kjbl{WMPZ0L3
z2d^LSjaHUdK!2ZB8RcjlBZ{Deh2uY*a`eN}0dqmKlzOz5!44@13PBl`I{M(lHDZA8
z2`8QAN1|t7_TE$#Z1M^64)?B}cF%wB$A9?nh3SJA;7+Z%;~#_UPW@7_*xefj1CN_I
z{yE6%)+<Ge)rp9w3T*zxVkTs>;=kl)T{mc5w^GMtYaZj|JxisUZ0%Zh-lBEhNE&}c
zK&lExqT~zFy?xOOayg^mVaXNf_Vq=D2u5F?*DAjxkz90$C@Hz@7?epa-P+#nm;GH^
z`1jqhhR_HnFER}7L#6L>Jr~ot>0cKYtquG$!04eQ`}~D$andMD*k%-a?Y1zSfJh2N
zBn1Z}1W7>%f*}0XH6vcyo?&K^*n+ld-L-wzx%cnqTKDxa3LcgE&a3r47G0%xbkMJg
zM1+J?NmSk%fbYd~FV<x>3Y&yk&)1>W%hpG%m#;tjQSs4kOmJQRHYM2ed%3(GejKm2
zm&fP#@VLEkd~Qz<H}(uP#Mzkyb)`^<3lxedxk7L4&frQ7qtc&}9m$JJ>2_!8QS|sm
zlN+@CDTokqG~D2_y&WktvC}geRlGS3g~|-~x+yWZsv^5}1an+GNl@M*-i&H+l4!v8
z@$#a11AT4jOh(FVaY@SDOnPZ4px7nF#e^lJL=M(9HzX7)<>H8VZf1psAmTWH@nQXy
z^}1dn7bL>j84Q;k;d%)I!&)!DxV(O<#GpYGLKoGylo?$90Pw`H;NXZzfF53xJjUQF
zh3G+Lg=pcGa`3r{&qtRp!Jm8p=Asx2Pgg?(FI+6ccx)am7KeuRVqN$qh1ktWJilBd
zIxr<I2(MvD^NXzD_CB3BJ$B`gL-(Td`UonG8ObIgU3a4h&}QQT?3M(sPc{M*l#+(P
zYFo{cqP8aaCZ~2xM(Ru)CPDm>4wmbYd*1w1q~WcER@*mVu3iH6j^n<M$_ySCPTa`@
zdNGB2cv{Dcr|djwzQIU}m-`LnbZytZ>8dPyOFS%G#EJDw3DN5t1)EAGi3bo#IU1y=
zno%xj9NlZTbCeI6U&2Sxe0J{)aYF<%T&!+}#0m$35|X+Qj0_wmokiEz6B&tO$;3F}
z;UM6P)LFQg{Yx6O=?@%veB<WPC;k0Lp5C}|_;LSUET&vlimAlnFjXbRm@=?Q%g^sZ
zr@`5VW5Wf2Te{H}<3Zl-j`f1N4Y*E-hKuv7`YHrFwlWfm1PLKjLsS>2)sL+8U~x53
zv);r_P;ZRaZYU-I&8%a3qWoQ*!l5o9JGM?}qG<_L{t>JKBswh!8xf5*GUOOW#Zgkn
zD*#p8hJltor=CU`-S4s%59pw2NBw}G0j(?`RA6?-0l9OR9}x!+2n`Lg?qv_Ude(pH
zX0E%W_k^*_J2V>;EDMhaFRCSiJ^J3#%>o9px41cGwwuqRsZi7mef0UUiJgSVBC+Aw
z925?hfksHlMTdqPTi~G-xId8s-#!TU!iBPcl-z1q))CSh-T`X$c`ZS-WVE|8od`Q)
zSWid_LXzW4VRTwKoSc9_kOY~Adx&r-%>zwOZVBR62Vep`ya+*le#9UzcT8Y_!0jUx
zdd0)z6cl<56d2M}sBobH=KR=!UG7-e_RKJY>tZYhmxV#(lIdY(HDs=*WMgV1roX%;
z=3)n*GqQ6Z!onex5eN$nhr<YA0H=hv!;>F0!WzNIa)*Bh$h+I_+`ij%kMkZNZe=-L
z!Jc(NA3#*#HcQdA)$sjp!UG{v%I{zq#Zv?uT~~pWVmAj@jJlvOXPvIFrR3j3?SMA#
zOCtGXHNM1WED+~`TY6lx1hmIq#d4)Kn2lS$9+$yZuZ>ByEMha0!Xh=*u@aMOSokIu
zg+*wtVG8!)y?Fr?xF?^8^NoX10(^Mbp%+PYOhPjY_6cfPf+wtHCf4}%`0~*1wNY9f
z7_L~U@%ZohGB8@QvgrRGmn~R)`Sr1YV_@fHV;9oKD=s#hA6R#2<_JpIP{PJG7rQMt
z5p9~{loH^d?J+f8HLdF9WlXKOGI@2AJjpW6*lpzTh+CR*5=6EM#wVrG;^~Z~CCFzn
zscu>7NM8bvc{ph2xX%nZ(`xl+j-?HN$9NucYdjZc7wC}Qy?e#xKwE4fUjyRr?ErP$
z;~o=_nGsJ<qwz_wO)>!_T^aoOQWRLqH@&V(t`%dJms{0SQ$XwvsTIZ0lP@i+Tc##~
z#b@Bt+B!RJxo&V-tphMS)2g1H2B;<<b&E69*;%c=FwHG?T=@5X9y&+9;B@~U5O>`z
zE>IU|B&$(F&o4FydH2LWilq4ang@Kd&G&XsN)wBXGIEYPKH#GUQ)yb&N^^EYDvjM?
zp;Cda3b*QUaWf7gDRR~ey>qvM%zLR3KFM+4a$rBzM~$e^-m9*$Tso+ddQQ|eHC=wj
z+uWz7CZ}4|%S+zk+T=>NdzF>~<8-&l$CGZx=@5bJo|?p`rP1R9Bc13uI8c11a4D<^
zk{klA#1&7Ls=7Bs<kQn=7~uU-6CM!`^X~yT4E)^{I5iR~Is>T=EE4}iuxao>b|fOW
zTLA%MAb^zp{fT3`Y2ovD`k(6$0_)#KL-Mdh5rH7|Tu7(_OA<ucRpx~!c&ZNXrF(K4
z0ygxO;gG6=I@8XEPIB~42b2l*D!4l!%J<xB@6heZ-u5yRs>O^2apBY$AvGVkUcP!X
z;OO=GV$-+hOu@<rAK(#Ge^>+sP8{|}Wsy)3gmGA4GgVHn>DgUv@U~@fWae4Zw<^;p
zn*WjhUJ|b6XdZP%hX@?+Cb09;uP&sGm;1u0C=QA%Hhnv33P$~*zgLOE32|TbEYG7*
z6exU_S$HA&VJdG7+RL+V%-b7__VoJO-pBX5CIc2h_VtYjg~6$zdZdz9;Cdepi`W|P
z^ZpOSrnZ1KpdZ6mlAE)umNwB#HdRp^k;~fR=RnlM^>JvOH{YHIlMkhy3ex7i9RqCc
zVa>X`BO8Ycm*?hB(O*qfrhw)sngF?&q#@Cm*1($B&SX4igRQH5s(~UEw&r42a;)mz
z|C@ASbQ3TsQY#fhvRusE2YIl3GMSqmT#%^)vvxvuS{HxQYq#!ej$lKln8}bR=~KZB
z4vK!Kp~h3#C~in|FozhwYS54hggG+cy*b8#s<eyfzf#=!KaDkWf=NT!usXu@jALr{
zh%qpunXY-~3zyA1MogJsC=50~GpISdnS(jJIh_a^(xGQT?D!cVn!tO3-+>-74H%jM
z=1Q9a0{egfqawrs{Qx!yV=8dm)iD3j$nU+{ME_JUL(Dt+9pfKg6QjQlMo0WCx<nU^
zC~ad^t2`4rEZU4l7maG;5}GVF8*mE{GTwW9bp|sPF|CcMaNw>=Cp#y*xwlp6v3>S8
zcD&Tw;E`np4rG~5c!2D_CL^LYEpizMV{mrTT!2YaLuQiUXWS9Yl)_XPize3jIB?Bm
z5o6lPP;5o))*^xr%B;kE;|Gu!%74hjJX@m2_%7CPWg{n{K8IpQZ;cK5Dbx+Am=9t|
zX1z6rK`C1LCJqXX6$#en1X|jI?1MivIz)yClfh&|-9icQY}GKI6!6&7px?9sAl?T2
z5#@%#v*FH(;DZCW(0_*`7=OrlFg;w+jMdhGkOA1R+F7J#qf5v5ac|Ub(Ku?WE<Hcf
z(ioM$*?1QPxbYIY1gBSSL`p_0MJI)_!DN#qL_<E=obq%bbLEfR1tbSS8pIB=i>2)3
zFRWeq{b4{M`dW(Esg516p#wsR_Cc!AzRVddP+?SR@;H`Ry}a#?`Cu4nL3BLTjG!}r
zSP!T|1Hv&qK_`_~L;tf3)AO{m;?bl(j;Z32dyZuH9EaU=#JT4XxaVM{_uL0BP;>zf
zpN32y!$UN&$Cn!6?h~;1+F)L$?*gx5tcVDLDc+(X_gq<-LIqIy_wvj37hC43q>-1L
zCL=GK*;to`vvy<Yj6K;nY~xyzceDX)pW*x@e98XCPaH*E{?X**e>us=RQh6_aW_Z(
zzM6Hl<2rb3=L2T`;M(GEU;?k_p=}a$lidzp;!8apcLtC(FPTLD0h!H@W_#1@et|t4
z;7BKnIDeGOLk2O3rkAd0Gg*V}d>0n&reW89*J0POI_-#`IDZ#RSDwFuTG)YyoiK+5
zEXC?WJ;WN|n=2fb#}kl~DV0;38#zXNRP%*s1p@f-T#O?woR86xQz<A97AQyFKuWll
zMv}AG(508M3|SAbX<HzmtUa(CCyn38Qy}?*`#Gx3>W0h184i%Mz85nQL3G~zzP7AS
z5x_0ZCbqdXcDc6N>(v1q<CLr8oEw_ZJ(y}3go_X<O0*cU6yn57kk}?ooTB^a%q!Vb
z_*w%Ekt?t7>Ha#(W&o{my3=47&?p_pO?|C_tGbBR8RRQas7SFArOK46P?--%s&r;s
zKi2z0cpXUjt@SQv{{N3df6<fm{g1D|cf-%_IpuuyN0<Fvi&lOwyJ!7>{!Bj5^56dB
zzu5AF*_MxF*v|kAP4;jA&Kv;1G$6hEs8qhZheYlBy_Olclm|}So_fK>&hNLW<fyeH
z)tCIMXH-}8djiuOHAx-Y9Sp<+_2J1^S<8IjWl`~c)D<uCxS=^pf*GPV4hbEVb6N^#
z!?|V8yDW|gpu2souoP*A;X1e<KIF)oKiRnlQ{oQ1+f#m)Vw}r7Dg|G9e7cSv#nkKr
zM03rYe&oTgR(zpAi8V8QR1)M7b;~x=cZnLc%tv)8_bn#o5JTX^MN6P@2sJ5Wej1Z6
z2fggs(bdC9V$s+MKLr0h3kT2Vrj!6*r7y3R`G8CLL$W9?hAgLWYc*L^V|DqT#mcC(
zA&j0?KzeyCi*vy&ru&#e%|%O#Tzcn`0P!v95}`BRxZR^GQ`Qua5p4Aon3~;e!RvH0
z5jAXk|7B7X+ZnIsEY(OaIC1idUKubrJ%cEaDtabqL&QU{CDpH8%_QHLN!ofYzGPAr
z+X0U>rx$7)b-s^EQb6}@+erk%2^%tBK-jtU{`>}XMQrUrn2I!ka2~W}$M$Q7SMcm$
z>4}T|+m;-CiZ?|kk4y1c5YIf+p-2&02uL<Z1<QzZYV2#y9?1b(s<M4Ddu=`Vx3CqW
zrIxAK5G=0;S);AGs?&GD7HGNgRX~O66SXCeu54k=xvr5=Qj!wcCYFxbEo^Rq&W`Az
z%3!s%JlZLfJIt{ho7Bu|<ZOuY={*En8goCdc&4lq5HCC7!9d;OE<kqahNuQxPzXbK
z=7K|Z+nCiLYPamMU+V<N6oZOQ>cK=HHgM$%Oq5nHyt&`IH_bKS{IK|!;*!XF4DRp?
z;$azF4Y&EUA<%T<pID#8I_f#mw8g1#Re{<qIVj%S_)ROkbbbowHdK;;Q~n*`E?*i8
zQp*5NxhvpD!|%ksAn>VyHRK{Bf7C^@&xWe3Qo{}v=XTtmrCcNWu&b`{M&m`5<*abD
zYN=2K>`0d41cD}(Dv5#`UAz6Cb>-3v89CL_n+zLNTpHuiQp!T<vs!hvOqud3TQT<f
zS}paC(u^hB%HZ}yx-cUlHM(XbTdC4j;hQ1kv0W?701cO*5i-G#)Jw}3GQnp2<l(dT
z>~{5;znm8h@TmphGPX-Gy0Ep&ttDHdkH_Jgf)ksxJByPF&*c)m$lhIj>ma&ACh1k*
zg!y&=oJ67cP`d+eq*~Wz{HF)fVbm3mtEsLO5?OG{8db8jy~!eQ_T1iymTE1ONuTRL
zJ@GZ=)wg1t@wJZDI}7-DskD_D*)`a@urVQZdCjoMmVDdK?91-B+Y9!S%whPU3~rMH
zQohOF%I2Jx;tC67(;l-*prGm0z4UO|<dLQlu6Mb=3gs`ZkJ_4G&9FGN$vhn-n+*rD
z`+5QPg+rtNz4jSpt)%<jqQ}XO3BnXdv62lDUVksa+2wt%jj`QZ4?b?M{H0&pU!$3|
z_q%uU5)G>8#KqBxH*et{>=8`4IyYzD-4cA1MRzp7iY!V2$ag7#I4EGODiGC`?@>*8
z-7UTvF)%W=ZUv;b^#ZvRXA$Hq6Ult))sxru8xr`tz7_`n_~}cDuUbB$jL)s^p#I{&
zzAFR7;qU*nIzC@W|Lv>*wlPA6ZwX=@2gc)0@~i%`!5WR%UjNS3=~o3mu4<8tuhTzE
zp8aR-b?GO~OL$|Nbclm|_`?&~ad{1)bielcs!)H#d2}1{baj**xNKa#cWF;<w*mf*
zsP`5-gNXJte<QfK3_G(6YxJB|Px%DT+5RNYb#)-uA7R$1pViclit_z@C?|KcHnM6B
zC|I-J^Vr114eLosjWmhy#r&Z|AZcqsw}ad$qP43*jpAmnXr<DI(!*QLqpNpM_{xb&
z2lZle;P^H)^`58&RU<Z(l>mEt?WjHP8);8&S~0-qhvfb2F;35NpXRbg)$@GHCpgWn
zq|9rK#+pH?Kea@cc8Sex09BpEzX_68JYM}*VXu?kbm{e;us2Jty=c8f@?c$t%7j^H
zha8|oB?zG#vckf26w*){4q01Wf+W*b(eI_0Uf9sUlVl$Z!#MQ8sMt$UGnDKW|GRV_
zOh-U$E8Qq6Ta2t$QK;eg{I7Em2A9H_Ye@a8oq7B$nNC+bvg@CfEPc@BE2gY;`}m};
zv+4@~1whQ<H+?}y8y4Yix5`a7B~V(u)?;?*%DQIIRJNh4rwkc6MiiwYK6vg}G+e^u
zhTx*P@kW6~xC4`L$vgv?*)4kP_n)V079?M>stC<ZHQC|f52^!g1X=4K`8p<Gy=NY0
zkXJu?-EyMpB<CLKYe3SP5FbNlyqpozNqGJdby=e=7ZJ-s=CVb|D>gwDhW(fyg>X5@
zkB=S_UY>?9dv~w&-`M`W@I5l>fkwL+z~Q_@$(<>p-i0aVExdH$o7Lk)o=43C?g1VK
zxE<hWfalXyQECH(2oM3Z9RSGhF@Nox`FnZ_V<12vz+40zis{9-0(f6EA11$ca=*)U
zYk{)bbOHcs1mH}7%>Y{f4hHxP@N~Tj)3g*Z2#b(W0G_uqj605RoFpo(1;guwgR#O7
z;OSMylLinnC}c<>9gs~Vdb-(_*K*N~L<+!FA;kumrhpAda;goejP8}w_6;P(>D+)x
zqn*n$U-1S4t}N~z;+fbSBJjmM0h-z%A#d6Z5@S>G^j#mvGu{^**rrjv3JnIZs!(T)
zD$z`uSPk3Rq#9jO_Q+0DBfl4pG0JFG+3@;0d8S5nstwS<sz$Sg)onHzCrPA8G+rZb
zq(-|MMm_Oy&+CuSsM#pr%Hg~s&*Y6W#`}zlOd>>y5-r&%V_1cYdtxfbtKyXuIb^eB
z8*=aR<PebMj?yv?SfSY|vM72b)HXqLE<BMj43B&BoC#`*y!r5_f1|N#R5`jCT3n1y
zoR5nY^*Pg$T6(k=l_FFXOGG-N^KmsXhIv5<()PT{j|0wDSO<U#P^r@aNBpVkvv3+>
zLz{ZBATSn!RQn(}Dd-(j<FKO{qKuD{P6%P(rNk~&J(0qk%&Jq4JCQZ-B%Ote;Ge`U
zlFt&msE-9j8_99W8S~3%l!KNz>$Ef3^B2H>$^2k?jL{)6g=G@Ud5K+|`bjOm=n`CT
z&UvHr<isRdVx4X-=@*nV=_Qwu*;C(!hJl5HFQtBn^)^PWx=4*JL}(4_bwn0cpD4Z1
zS0kr>h1cIWA8FDYRfI^i1{fF}qd_sT8tful>{?j0@;Bf#1T5r<ZJ0C-cEi;>Q6r2`
zAW3prCYxf5i6)p-id1RR`&f1v<;X2lR(T0!H(!1^L|IHvOwv?#(|A0wD^TZFs0J!}
zJr(=LGagOsO4M`Qb5FQ5%PO<0$b*t66|bM3&uE$}=R=}a^_n#Q6;rNNoAw{H-}%nJ
zdCCpjXXMYG_-GyWkDLBbOgQDVGtMTBZX2DgWbvg+SE`(U-<UMzybGqy#PmIdGLNJY
zeBx7cn>FX6OMT%>T#`QXx!?WPWmj^`-9A43nbxm<@S{EU^5sV)@1<A1vRs9ncg9WL
zSANWN$KAHel)=@R7FcMJnKs(gg8R)grw1N-)OS6$=(j6Xrd)+eRjSqSyrN2__v^Wx
zGA<yMu7i;YCokJEB}$d4R8^O;&I@z;xB`-_sG4q=mhHHnFBBPbVu@5HSMW+z(9vqN
zI=#Wf)Xdz%(#qP#*3RC+(a9N!RJmw(IHMzWJ3?{XGS-sH#kd@06)mJR|8})ek!(?A
zM)p!sAj$xeSe?T}IkQlec#2ISNYVNgh1wN{e>PStTVz=%?J49?qS-NfE+i_WPimXi
zEKb;=t9N=ngLFe=QW}ZsY?5H-EPQN<>RiIz#jF1rrs%tecMR-BGCeWsV|26t!U)=C
z5PKgaymP5Sj}nPT7ABWdov|I%_)22(2kom0CaQgo0$Cp-auPEVW<Ql6{ZJG0mZRTx
z36D_vPRmw|*xLlz2)EmISPIIE;@r@zHU~jA9h3&(NJZOrK$e}SiNW(SL<c4ICJ>VH
zu}Ta7&=pwMSaPEL3{}B#qaZ6aL{XEd_~>P-FZ>7^&LiZ(L<%iD&oXf96_EB~NVTMX
zOATQtqKKJgVlQb8*h{T$y0F4hL~$A(G4Wbpq#<Jj3%v76doLsg_7?JrR|k+`>-qKY
za9pxiy&9OnuV575J*mfpPY`StYapd8)_Mdy=I{%j)G-MGV2Qtbh>j)$EaR(g8G5OW
zV7N(NEhd)b6=wmLI9HmdZ;@lu3Xn9a*cpL+RR!lxvrw``+MJcDl=*qGGC2hVWQcU7
z5)+xA%$5=L6?>B+Sc`@ln7FjM3sTNpJS8C7EspLn!rMID;nB=d?_$SzRYpX)h3V11
zCmp|>k;?(@6`VR1<gd2ixi}3pLhBS<U1=|8nj>GdG8RtCrLYq9Q=iFpfsGk!2}4O|
zSP8666dV`q7LNfOg1n2RIxJ8eM`IJ?9-pK!?EJ-Xv<4F+Of5!+g3O;2p3_s5z6RS%
z_^))rCMA^aB_VS4TEqlLXc{7^MbHpQqYMpGG=`;d9E~z`Drh|4Rs|5cfgjr?ms@<n
zE0~;Qz&NqHG2d5^2233Q0WePNa<G6w7R&&^hz*RS!VCcY1Peel7zaSf{DNBo_6q8p
zfC6yq06?c%@4&<W5CDTtg9QKpAPWFM02%-Q01H4h0H6fmmVmt!;7~w?aEsMreovgn
zV8QKqo+A1!Cl1WRA9R(1SYSH=8yVRP0{x4Fkn`DqTL6K%#?x3Aek&?QE>g&}V3Mhz
zZB)zaoTpUdO#CDM_Ti^#RgR@Erh!_6&Qki_F^ARM;<Q-qVvB7TIR><AfS7a(rC8Op
zxVFj#Rh?&|oU}-)<8ltwve+R=(W;S47IXYobH$(Xr_sq4cc#QK&_?_uXDUL$Zja{G
z<Rf-rv7lxi*lZ0f<ikTYgxvRO1WQM@2nC5xhf~6tRRiVeL6Du8$KMW_P^XM)N^XX{
wAk2+CeO<&Md7h=N1cJU7_ISE7$$@0`Bc2ppI<tSpH}B<e>)YX<%g=Q=0Bx~6KmY&$

literal 0
HcmV?d00001

diff --git a/src/static/fonts/JetBrainsMono-Medium.woff2 b/src/static/fonts/JetBrainsMono-Medium.woff2
new file mode 100644
index 0000000000000000000000000000000000000000..be878e68fa71bc1f08894c0882d07adbe485ef99
GIT binary patch
literal 21832
zcmV)CK*GOwPew8T0RR91098l;5C8xG0O8O80954w0RR9100000000000000000000
z0000QfessnP#l4pat2^OQ&d4zOaO%<5eN!_+%$o!Q459^00A}vBm;~Z1Rw>49tWcg
z3<n!K#TVE%jUHZi0$R8Fs^?vpaAVxSc@!k@(JvT@uve3mH2eSmdvarlNE@j2y}b`e
z%xPwuIiyq7**(`<J=G{_3YLTx3`uBx64R)Whv~YW%*JG2k^Q(tQr1N!CK&IBn9PtC
z8mm-P6@Q^Tydie@;d$FR^227rX1dM)lC4nU|9GN;J-P=Tvfo@R`Fp45@H2LbN>q0^
zXx1J*SPJWkqN@ORelbZI=kffz+0QvQBq7ESLkuZJ8e@!U#57GQVw#OeBSy^9nC4*~
zk48ich?F8liWrg7ltRSFuLvwfev61S<x#YhQl!-4cPV8lkEJZ;QI_&pmhvdFG{6n~
z|F`y^``oGqdR^80y5CF?)F8cYOptYK^r%@r;G#rW7?xof6_pj}pT9R}&fQkg7JO0D
z#2QFCSUA=!7=iZ-|Ipv3=l)nY91Bo16paR?6D@YU9N=!an-qf`Uv+!=?+<`%&V#vz
z=jYZlDMfV9W5YEJ*!us!V%uLduz=q7|6mNZ5vd-WSaH~QqNiY7ik^y5ad$RGo>%H6
zUZ{6db9%nYOxUsUvpN7&f)Eri^l)38Lz5Mg6vtf;O!h{g`{108xJWzMp}J)9Ng;bv
z;%WE8HI3`)0tKdn{PP$zDKj}ICj}a}!!^Cwq;vl~KvpG9$rwEeKcNc10{}Jt(JlXR
z!hI9kAR2K3NeDF?rnTedLTHRy@w;$wE*=5?m(J>c$xzi#vWFl$hKM-B290|_Fto&8
zDUnk<1=?lXvyk3#N|gg;$<4n_t@i)<(ps_?BzwW$BYP2xX0)h-3b4JRr9Xd08u&BO
zXf#enmMKzTOdH7#$nk;YvGO#sl5@P|<bY{pCs{8mM?e(-^tVN|{q+@bdqvq@fBvJI
zSqprE-p9e>lAU=WR;hHIcsaMZ=srkrXC#uVuK`v&&T_bvYX|PEgI05alAU!a%1v{j
zbz2-f)m~@!&E#hGpgU}oqgj#CF3A#7spCNvSL!9^Q>w(dQXNPJh4T1)YbAsSf{LWr
zxfd(;O;t}N+ufNBC?Jqjzv`eDgh|{fo0Bq7ZADT&pr7#}%i<*>9TB-l{CB9?_sLkk
zW%;<&!sLr1h|nM6I_Vyk-2v({3QLe}(wH#ibMy~i6Md3-dr7}KDNQ(~nPoA;2qQki
z{41L^Z6w12CR!lJGPgZ=-S4LTwEi$LTeEv}xvf_02pFnB6iM#;)y)9`z+~~44zm@4
z4uXLMLP`n|BpgEHAcU3<B1#m5o(UpG3`DF1h|`iGQk;c&*SiqsWI_DqH;7fMkWQgf
zKqwI<0iiP}6$oXaY#@|_-iH7Iz(7O+--*x}f%X20j8tGj0RUb{k)vA&bigp6I0VT*
z7Pb^AU~|Ca^z<Nu<>>&tU=BBV+|?RW1)j#`7{k=f-Nt1X$}d}h@_j@t+D{bvI~;X-
z>;llQ!4u!kNcT4<0Q7@HZI1x^D;JyvBZfKSTf$zu?63_$pSu?VAjksW6@Zik(0m~Q
zEKc!J&4hIb@Gr;~RskRteGy2GUJiu;q-gS`NuY9Qw<E#v%*y~683)6@SSVcNh>mt4
z3EGbipa^sb>CsUXgJMxUI*Aesldu3VKhOjXP3BW0bO0h?7*sYz5I%#%l1d{hUr-8w
zLt;iukcFjFFG*anQqbFtQ}{f}wl1OE7Neu$>heciUl4rzfKdQ}d&3a{uwSki%Hu-d
zWgrS9d{~@Av~Mq=9?pWIr99YS(t@k$e~88TTKx0a4qDliA(|!woq?$qE+Ml3*z3Q0
zdGW@w1wn!&DbkQo&@g4mmWxjWA*G<EWngAiz`><h88<JSU#+09MlIS*(dm8N^4NUD
zuE<p-%3V{f#&wOFwP@AmGac^e((P;CIOUA<F1g}s*W5JZzK0%r>bW1h@XBwN{hJ#x
zHUi`j6?r2jVxcX_7x54u`J-(}fP_ed#7Kg6qdiED6et*lpirblDx^kXC>&`}1k$2N
zq(f0ij||9&qLB&3pjc!^aVQ?Wb0qqRDstL1YI<NYMMkRgfwAjwE5CV9fcDKWVz6rC
zwd_MHdi5bu#IUX_!V;l7IHeuY4rrqfYAGHlo#vV5f<~tia!}|gbSJtQO;o>Cx2kc~
z@2Y32o4t6ps$CUO{;m8;T=ibAoT7|Zj?G)mo1Zrgj!?8>u@Qw`AyhErd*mO>dt}dL
z*JV{Q8)8V0NjJ)?Kq{6zkergpB)Nw{<Os4Iu6ipG3cM3u36F$k4cGf1R0Y|2v&8?2
zUx??6>qY;Go{4UX>>{O_p2fk<TX}TH`E@W_V`^f3Si)+U3`HT`kNIA&^)h+i>U?sn
zQaS(i&!uItFa9rq?Atk9h7-!TGU{A0+qNsr+&%c?(<a$yvt*{D-RO)OYpovCo#n02
zYxRrsYFrhlOvQPTB3ERsES7naBdNVtM4iYNJn<?o;F*zS)9jJpb{4^ci|7;`qGqb2
zos5${PZCR_@Ejh)@z_{AFl_&R7H?0P%r95pT;@oQi(}E4JxT<up=W3v41;C}2^{Xb
zdTp<)xV{D3X1l@8+NHXsmTc!gWNU4cpB#<5nGMU-Xl!lWS35bk+CS*k(W<9v4Jn_K
zbd+6XbH1D(=;uT=`DP)7A3rm|YnaNX{E4@9H6d?I+X~$GtBxUuo5Jsvew{Gcr~2wS
zuCBi`aDunA$J!}BDz^yO?V)1I4;r?@$F(2aTYchv7_7xz?k=9i-n_DH+S<4N%=Jy{
zrg)=fiZ*qwE7qD#QpVV-cNN8udrvO!Ez`YC-c<VhqI!|LkkDDQo_WJuO%qXvXI(Q3
zRp;fNx~6Gf1}~ueIf*1zd$_xbUz(K&C8R_EcD=PGuZ3P`co-lkT!x^EOE4^`6dHXO
z*_jLizdR>U*kT>3>QbXY9m0q(*b>2okm)W!9{{3(tme;9f1vm2$5mxav<ww5O6cvU
zgIU0O{dyzj`GGb+G~bUbNbV1SqD()SY45zol-r>kYvgUf;P-tXFa=_Y7rq$VQKmF9
zI`2*I*lYjg)6iLzj^0HX=p4$FvOfyxOr%&4X*HRgt~UXL29$vJbKo14^1d1ZKN?Fz
znLx{9OBD=PP#l1|mC91#Mwsn^pvvPy!IGzEDl?wUHx;VBN*V+oA5KAVegJgG4(LRZ
zehr8zC&d5{z#?wj0{Dc|g-pyl(WQP|W_p@56Qa<66p+Y#!j1X9yfD)VCBmLhIo<($
zBE#-E^GfizyvZMs&Da(`x;mEw!vK-6{A?hOOCx*3osYn#ODg^4pBUK&WbGSx8GhF7
zk~qrjjX-({$5eNNX<ovSA=lk))w_M<^|_o2{Jq1U-a)16w`Y2~7o@N|(>lB$RV!yI
z+p2f?=raX5`DB$66>Tpt=sDb}aOYR^=afRu&)BLL#&PFI`)8)-C;6U68o`9SEj66|
zu8aG&d)h}!hNvX-gz#P&sYXQBt?s-!NR!ReH~Hu&;E?&#3S|gWEcojOR<{jwnFoYg
z*{!tA=|g?oZYJ`f!`Gp}3QcyW!kkc;I|LK27Xpxxf+s}5){7(YNm_pIb~hk!STC1u
z5DYpmHNR2G;>EUAALHXZ-NEv^hxg@ZVOE@7>G(XyTopdKNNG^=7tH^=j_k)zTLu1y
zL$}K*x`4mpmP6(Oc3PIb4N7*zM=zaPRD3}negseyYiqJIWp~z|pDCBvthO44d`Qw{
zb0aFhf-3Mo0=BfYQo-o%Bv13aE-n_gyVy^k!$gVv<fo&-C|=;7qkY+FeA-B!;P2^h
zcDuqg@St5-)loRv3yWl#BXFxMObtq0?V}f3<!FU#;9AS^bO2A}SZ@x%*}`huoFO?5
zlSQtncnus>(jsp?#c<m}6LxN=Slk-D4Vjo2w75^5Je;6NlRjl6HSh{#N3bfmK{<BL
zqY$pt%_$}X#mH>QHmQ${qi0i*TPnCgp_Vx0!|8Pd#s_f)7i@ESN*sriky|UefdeJh
zaba@dL;{QKOhm3YA$l9w7#C>Y#{|w>f+A-5w2^4w{G^Ot;Td4wPTR@C-gDDhV*w9j
zT4Ydyt~h#XRc@^C3@~gVmk8G6Ak`4SDG+O$Gt|amy2woxp8?`Z0LqdL(?wjF#s#;1
zwwEr-l_9+it(c3rDB8a;{A>knjgI4gjW6^)Ym4FJp+7Ad1!(Mf7M;fxvpctL&I5s*
zn`=;l?RainFOEbxQ#$@-g^@RMrk!WxQA!C9^X`#v5-zjyNNrHMjCt~~q9Tjc=5_ny
z(qi387FB_B(|J@jal>uZXL#cJRX}Q$IHj>OJM&89ESY;H5Ib+Ho*hTqi4)4>PvEgp
zK|abv+aOwS--*26S_e6~uUl_JHpU^Z<`Zi%5c2{QKE@g^q=lXnG-~A9hq>D3I<mMA
za=Fr2%$a2_*}Yu1+Ops`kmhJla=PN#Ha1;(BKyD6#fhRM#(BBB%g&3DHW{57dDW55
zefF;P3g6YP&!Me~Q9qTIz@01kmPr6WySDSyh^HI$%FY?CyUcm2ZmiJbMpfE81Lwt+
z6q_2W=Sj#dskdPaBX9%zHbUPcDDDeB&1|r=qexDzNMd)EF+`e947au-3Nv%Y7HN9&
zNW-wF?+3RINh=+v;=Wv%)gn%xua8LB(#z1Y3y9!m1)<#TOd@hK6^=`*h7?=KDkV)P
zC~hKiK7C9Y&J-0J5vNN%mP)fpB|+b_DJPp2Mm>45nGjp{bxn#+P>dD+C#>yBqZ`{N
zU>k7L;Va7+ALFUVK9gb;9vWmHUT=dE)5FIuqnM!RBfY|r%ZQom`Uv1Fs1XUSG|C#4
zkirvtvUZ`D<3g8dpemQ4NkLKNdxb+OW3rH}oB3IbXc0nM&Z+n9VuPw8P2Cp>u-O8A
zHwbVDZAd9Z^;W<|FKLUw*G$7ta@|J<`cUYYY=QPvIKV$DvoxV1gcOA=)(QzBNy_y$
za4`tpv7ZI+0@^dtR%QLdOekIul-*N4YW^Z{^HOgTOyQv`Z2b;~OabWSeCts=K&zdc
z-Wga|mr$#qJ#c8<B1WZ8D}$Mj)oH;<|F8u+2si(*+TRHB)%s-3z8A+eIp+F+49|MQ
z)5rv80@hRt@y;gtgLnsmV_7l%me^2lgB9}|EJ^s>V*`;zdxiO!qYf0^&_eND)=7W~
zEN`Hnh{28*o1dWTujM&Q+v@qP)c2h9#MNeQ=INh!%A+c1t=_l33!v3Z<N>1Z2yLMG
zmec8*gv#~g%jO%XnHA=u&F*w4JYj<`i>j}hQuD9o2Tf#Ov{X^7eUM!iJiQH_m<z}R
zpV&GBkvu}#)H>9u2cZH4QXw|xHKH?o3v7fXd2|wAUT;Gx<^&QWHt?}+y4EVKSSBOc
zvZn$EW=sgzMp>rB1%V8*!-5lz!}BJCsafJN1w~``3gZFBWXg?lRv{Q8+u_k)f`_d&
z#e`*stur8Hb<|s*#91I=_<SNX+U9pu6izsNgLwsdnKQ-m!R+Q9uselU<mOgMjMOAz
z^CP;aaa#Qk+iN=&D_u9o=4qA{u)e~}l79DtVnEZA&$G3~1m5nu1Mo$?<9Fpi(H1c^
zgmTdactvOf2dBZYSNaMLm>JOluhtBH$C3<9pPAtqtjZFtxBGelzVHFlD$4cvYkQ_E
zRi&swM(K7^RZ*%0!KO5#6}Z^~Ycf4O6E{*%uF9V&iQoX47R^&U!3;*SVzvSgiZ41l
zjk4dA1=?a2C0kk;%5iehEJ03)R?7sUeB_nsARo)A$c4h8J5zF^;LKnV^ZZ%IISaqS
z!RsB!?9Gc>cT>p*HYj@150*5O@)`UKb1r0H*aU%TL^2zcSg?Ontm|a}M~a8dU4(QD
zPXqlE&jcie;-NWthAziRWd09gvo(PTiN;qZ54pp?!*9TNG=u)xW11QKf~U*zm?CU~
zK<yhJ69mQrhdjn^P$I{Z$Kcq1h{dJmL?+B<2tCQ!KNRmOcBT~;fwAVg1p_@&8+#h!
zuXk?L{b$Yc8BE1t+syC5CV<+CG}9WCYBN5r88<rF%?f3xIc<B9To{JA_M~y4W|#I8
z+nhc-ChZ;}k+>^H>iSbdO=}C~G>O6ZP&kZ(NhK-^X>@<xYVIPgZDLRHq@X{wFR0Fg
z*I%|e3Dl|jNFJKNAl6m8%ulE`b9e%KRV%7sl=K&MIly^Lp|dbN4fHptmDCyV(3q$x
zy$x#2|Dcod)e(ptABC9!MC5))1p;Q$*y=pg&Oz+=hxmUlwIku7AE7L+?KdN6+c`WT
zVXv)YwEJHq!hx|YCL!fP02tn1VJG<J2M8)B3D7RjC0ptFEASZ(Ps`3IqaoHy8wm#s
zyvdRv`X18ih`;$BJXZ+4^F)>Q2E1Aa_i>)!+4xKTOCd8&DQuIK{Y5ccW6A%bSZ{2M
z)i4+-jiy0~E%@jr__FQ@X5i)A?7=$OC01z$k0I<}bu%oP!6Olw>+L=+z!yHiviNu|
zV5rbpP=rhijA|7Bf^^_z<ZJoWa{tWifu^beTgTIV;Y)ZMqA>SCm-*OKD~WUp<)oG{
zqR1#4h$bYc)0XM<9eBPg<IH!Ub}6H1Gx}^#OLgeFt?l)4E;VQb8%u`hTkrr-g+(jW
zFPy&KhAB)xD1%SXpaI}WkX0t39z`-EWk;jdA;@3IJ^z9VIg-~<kQRm~q7<kP%nDM<
zL=-K$E6k$b`F%uTp?mKnm_EJ*2uWX>UJyMW1H^4hb}AIXO#GlGPFf!uJRA}fm3(n<
zh<ZRLP}uB{O<xIpu-*m><|`Djd@>je#3B-fj~&9EidlI46*wrvgMx8W)qAa)!Iz*>
zs9G;xOSUUamGyb<+L$i^n;CpZJ}(g@M$_ZdM&{EJUOjT@LQ`Y?{D8@|`C$42%>kDe
znlE5t%RD=wr*5@w4^pywm8ZGIiFE=IkQ^I^#qc!HZ8Qx@yYWz`G}UsPo-v<853@Ca
zsQXYO8N^I$ROG)GN6GwmbmP&*Za+d?eQKl?;7#*Lhyc=U*^*}2Lrye|POY0yq2@Sy
z#7BY}=kNsf)FVb`ZI$WJD~E)twv`yVg}TdCwB{C6rc^@O?%!KHsfcCwHs1ba6=F?N
zc2ilMiOz2-ju?%tdK?pzH8)t6+zp;|4q?b{1Ko|6is!aYa|5AGwuT0!P~)_fw#Am$
z75#YWi{gB719EJ!Y0F@EUQ2(*{S^pmy9HB|+@Du(g8<WnjVXcm*g#y}Ug1D-#Dl8~
zS@J8;$R|TQJr#*(kXQ%!`t|VCfcv>=?a+e&)Th4&1l(F{>af~5Jl~1~z(!|nXDQSv
z4svDTW7>k95rvsCCs4wk(@Co+JXDMOGTh2BpJ0V@g)JM-o6&v|V4lF<-o;2ZEe(D7
z_jK%JOBN%NvKrnm>{~!#TJ$HJUj0@W1~%cZziR`BzRq)1hJ^MPR2(K$LJD<l5sJ0Z
z6c>Aq)|lMl5Tb(*q}8;tZXg{X>~R?f_L!=0T94Ramj$Yn)2edZGHxod3`n#;CJ>iS
zuW-zAJj&#L8Vsi+YRV;d$)%5RYOq*RvJ|S2Q{DCCCi5{OeYt296vK*Fcv0|J`1kn}
ztTrz>$o`3uLbp9shEowPw3t$a3Jy=3wUf`92VM5VXHWu(ptExU72`1G=1fzJAdxx2
zkW|dZj{jpw?&+S+n!C@7bTU<=<X;tTbYpeK!B(yr0k+QZQbo!d7kfyfD{=^_w;>jD
z1qZFHp^u#pVC@xN#a?<DIjH?$Ooe`T3FYdUrj;%iTaOyHO$A++t)<?EJj~@{USG8~
zsRYG&&YVxGY+?%uHq@`Tm^)>hYa=Sa7MjLUd#F%0k=}-WOabOB8J&Eqo&(U9?HbKb
zvGxj&c1DE??D|;f$tT5%#4KRr)@V^a)+WqMJBD{3Znuip=g9!Rh|`P}-WvnTU>f1b
z$e2qH?M~E9Ya_VfVydvi6Z!yafE&8a2bj`jXnFIr?f8Y4zX;Un4Zb)Oe7hBXdhsm3
z#c%WA6F1<QwWu=e+)D3bU*P6S^FAuQ%=r!Z7%iy^yKqgbB?Y;&kdDAblLb2!;VS^n
z52@>3#W85gFf=G1*t~)+VVQ8b&0Ip+Bzby+Qd#b!^LU*PIjfI|2c^mO0dx^dit8EX
zBFf;hTaE9pTP?bNwiIdZVytbIp5ou^9_VGDVjk6XMls6pG|&aiv#IFEL)kKq=xuOf
z&ZDU2t0NGL0u*M($tO;QeZ!FoLp%t;d+FLTgt48uDSG3!ECPsAu?W-v|9!;*oIOTy
zi=5<KJoZa3Y%R1}_n~|;Msr8U@NC>w6Q#uF&6I(u8+rL-HmRHI{>416)`8_=!BA_9
z=}@CScsKH6=wNrx{MUpR{i^Ofpr~naZggixqR3_AoD`*FVxvg0*&LmfaeciFqnNWO
zG<-tqw=L5tQ1}9^{iRM=2>|CeX|*r^HOg$*AGO(+8#Uf>k&l*{k!C!fdi8b2*Ff*c
zXjpGU5GECQ^)llV6!QYFa7JYv*%zNdqrS*>wx?1GhDp~gn-t^{>88?-pb{bHpSx$K
zobGAYKT<?Z9!&J*z<>~@Y*(Bm>!du#Bp0FgniQ%$1*ebhVxJ6sMukQoWS5<UBcVj}
zWa_x`P?Gd>%W)l;L<F_O`FtyB2R1rrdt7au&fhB>AF%GeM2DWH;K>l$iDk6Yh)$w6
zBWCb14RlI+ZTzk?yADcN_KNT^XfY?z+EP>y6x%f4NyI?bJ(qdv{!cBd09x6DsgP19
zI)SbODa-mIIw4)H9Otvl3G9~klbK0Eg5u8Q({M5}F%-!S6-n&s%6fFd$&M=#>VE6U
z?D&E$$GN%uxJuZst7|l^v_ToZur8>3{Ckp6FeNJ?A5R0lh1i^SEIbq|u~d$0+~&W~
z%&;|q*o>esGooy|`HxqkktK<VRwyy<4t-rb0Kk8$h~mNVUkB4)udIOm)}{`i)hUaV
z4Vgt%x*Z!K3Ln<#6e{hgbjh(ke_)yTumT#2MMKdDc89`5Pioh*qf`&YTvu|W<;Dsg
z)TP!anNjhbmU5#?eS=)OdNapqX!P<US69-w{^Ftze5W>n;1C=-inb1Il-PRbf3U)>
zJr96v#tq8A%-Rf}=hBCxE8))%Kxvt{JK9s~I{aN?x0+_g6IL5H`ojkRP+7&&XhczH
zAz7?F^oH!_<v7!tC{$rf3s#%o$-KfQWRzYooU2ZwQ%S+<pq8y>Nrzpw)99f4>xU14
zb&qh+>b~ncH>tXP(e&necpZew;o}TT=V7q^#dq_-%51wD_UWF;qCZu}K;eMp(Hk{R
z9F$TvqCin38YfDg6@v~-Q@tF=iaCs8!N+2XKrANE_`s0<G<TR8#yq@o35ue3BA;Ax
zDFO`(q?IH~rU<E5%K=7<kq#~EDRCTX6M-W5L1ZKfwL5{oOW==7+x@KZ$|cK3c5kDi
ze!^=?uc42U26YU)+~)oCy3`SJT<$cl!_)bMUQHmn6%?K<3iKDa3HBz#4KO?nbO6;v
zavgXmOsWTRoU1ka;p}WpOP7Vh%$Vn!VWT;L9zxcz<dpW%A5a;blNc2okMk{B3(#un
zg1RC0Y$et$fx~y7q;k7uuwILXlqg3X3ZtA@^}J4IkGam2y$qC&v8UHa`x%}F3PqWc
zQYRkTE2T+}ORG%?(tNfi5Yr44W=8yB8Ut6Gm()SfVN)7v4+W!`cB$CBf|SeQX|v8#
z7=8PP$tX+B2_6u3Xe1phPXoP-B0VLwct|dVS#N_K^AeIwzB&RiNkCy{e9BqVhJRZb
zkObKTXb<uQ=NHT#By{l;@0{RQ#Xo6~27cE0o~^d08~ZV|!vn5ZGkzsA72b1=s&d~f
zM=G-@c(e8PY`50sS!Q?Pl{=Q98;brwi?;Od0IlXO!rE5Sa!u*wB)9B|7o6lDS~gsM
zv})mJP{?fII<Gch14)XkPOCFDy(n2xJ-O6K3YWFbQ(L67m|aj@bG!M7_$QpabaFIE
zVq^hZE~2_cJ0+vbacVX@Vau#oO2~(DVN*;pcN1+$3Lj_cG|7J1sOpI_tlUaLJCNo%
z3Cs>y+UvzaEI`8I&O#>BGhsm|u~7K5%4EXjq!DdL%IeIGNFa%OIZkf#0yM+c1foVz
zn0X9MPoKKj+}*~}8uh|6I(VUqtb(=`i7mI804SYrKEj5CVmUl*g&iH2?Ed+HCy~eM
zJKf-<)``d;33iV2RR2fErvif8Tg<-x^w;%O_pJ32AHKp_Th3Q?V%2Rm6#FoHPS$sI
zz3~6gX`mD<3;jw7jaX`k2QPHk4G(I+NLF|ADph@v_&>;>Y1<iHeod#I3CZ0DOpn1R
zt>-#Khsk@_cMf7$<q{Xp<dkZ-6J`b?G3s^7pRZ5{aV;9+z~&ta!vTw)UZ8|a^W#6Y
zZc+V|{W2YQyZWIFy19)sF*IZayse_%<*W1AwW}{P#H_1%8nJIQ4c45AA)lqm-ab~w
z$8Zao#&E`;8lrrEed_fKeIgr?3pSL(SAX6>o1qpcnqeA<*-X{Dkiw#dHZ5iSmg6Kf
z42a7H0#Se>YR3126HGfi{lK7)Zcs#rn2BzAh_=gW-h*hCp@LGjCJ@PG5s0hhegaA4
z|6d#}Ly5+A@ri1cL+#&s<PE*~wMJABJ&I&d5RN~TB1|W1g<fuPO2}jL=#9eL8z^Q%
z%Xk6!?hl80Wb*}tUIay902uHF0044<L;%SE=m0?E76AHe{(mI8VI&~_Ge`jFvp)=g
zAI0MU2zY_=$^dXTKs4pU#H0)a0E2wk0{H-f+j1vju>mN4NGE7nnJ)lY0<(&E?ZN9X
z#T;^2r(PH7=gv#^$>BjkFQYecPX;oci9!U0@FsQ$xB`Dcpg<@P3tkZ@1sXxy1H$bk
z50pK~5pE^__XuD!0&+@q!A*uPARIwI-dDgE1l%o!VBf9JG=L)jz=K8sK;Hl9)mNQJ
z1^~#NYdHXb>%vv%dgyx3rE!^_zI>Ybv~BXo$!YW(2mm#J7*hZMeGCvqVb3JGr!iMr
z{h#fxmg!LGSpqTObDyYnjoTHCid1p98UT_9%8CMnVUx{#a3x5TgeV;eSq6$M*>dFK
z;1Usoz$7-P*3f9UQ4=YYhK_-iO}+xfN|h;B!ObtAR-KTrW-VH^nF8E(eW6Yai%R*;
zzb#vhi<l@4ZHDul63`?IWg<30kk3b^BQLZGKGysl=E(LHyF!<hqrxcYywG@K@)c*I
zNzx=skt)`93{*5MbZ_k<#KR|mU<=A4Bd4OEq^4zIWMWpt&cR8q63)Y`3g(@Yn$&C1
zs9lW?nX0QUY`~{lw7TUc1Py!u06GEyVgcYeK;RFMoB*#SKwJR;SbNF%#FUqSI;@3>
zZo!nf3cjT?x%Iti%a8!_3(&qPGgiAxd8(({*nw=7mE4B3V#d<QOC*Ws5+c|V9TXQj
zdfPJT;>xyf4tQ)4wrTSX;_fY5T|E96Hu7RA;YRYEB~cI>OK>~Bf_+at6nd5$+*8Ps
z3q{yR#~FA5^pFZ#txpkKj++--At?lbXw;I4+x-KfhyTtG|C`w=MJnwfX}y|O(Eu7W
zn~0Ib5+g(8RVK}PV5bjMq^-f3#a^NAxu)9lI!z|8aBrC0Zr7McP1(DbfX7vScXX5@
ztr)tABr$rSomX+ALp_(ywqt=MrGOEz0AMY%mc<LUIzBQO&z{omu2OJ_V8F{M=g?ZU
zx(i|QAeA*qoJj^6%tgYfKawq_M&5H`#EUMN)?Nc2X41#*iO*p%+gIT%QNj_Z?dpc#
zRO)mG4^JD$_XClyf+k?Y*mY;TYb`wa7)yj`wOT{$PN2r7Jz+gkCQyk!LVil)?*Li*
zM5$a(&JpX968tXZSx3(sZemTo7A%}2P5R{VBRvpRGQ2s$mklRM-6J;a0!UclWRn^W
z_6Xs->2KG}QeUX*>IeJRwi^eaA~}(9m=cv^+cpG0h5FzB`MSCj?qEx3AuaSBB(y;}
zc6<_qli_ix?uyubp#>oapO}AxpOUsZF=`-;0gPZMj+*Ejxeff&a$#8v<C+~fd0!_Z
zK44|w7vHeKOOxw4AU?~9c$`=zoY53Fe#Vx43ZMZLO^;4uQnN$UC<_K*@p9mzAY9>q
zjY)!i5(Q8hhExubbGBK?Tjf~<8=|JThf)~F8|u2s_w+J@f?$b3FAIG7bvP^VY-|lj
z=lbOK07_{Q$hT-~)FMsKN=t^isjslsJ#845!Sb^D!BHZtK?Mt~<RRJj3&)ij=g{a5
zOGq&pK3%<NCot|_qpEQjcMv4taMZ{I;V5W;$gQ=Fs#hBV0?o?wb$QvN=!kQe95O`|
zgu#Deth<ek>rfuyGK<Z}GFt=D4kOvA?i_sbYrQG9hmu2R3pQyJwgxqr^1Zog<YMXJ
zjI{$v!j-KX0}<Gz9q<W{eLD0>HHqpW;QP!&67<yvN3eJ{2egF|a}=1Yp+;cVk$`B7
zzs6;Z=C7@75|pQh66-3)C2k2t^n)kb%KPd8sAR~Bn2bzOe_G(gB1qz?2Cfw4GW9Va
zW?tkLx<QF6SD*~@XZDQ=K9$Fr@C-DgaBfbKu)p!^F^}$QR7*A*?-`O(qEwK|huE<!
zAusm@<Y5Z7syWH3F_8>h!C;w0I_&^$ibHrdM{GuSW16t!EO+h2ML5*$2&E_U61sR-
z2+^w194U?kp{E7;zg-NPO$lh2ELIxhp1$%K8xG7W13=n1U@JLOURE>3&wRrP9GZGT
ze`;}c=B}u?rMj9j;N<DCQc=avU|x&%qR3)+(ivp*%ZdMhXSyf&{BpivPIQ)H@FY@e
zYuVgJ#2Q9efy5sI9AgLBC-jTP?t)_hX`tX!q%ahUV&)UKYr3$~<Wq17fx)t6t#S{b
zLS2lO*%Y;*rt}pla0Y=6dnhjky4+JUoK&Wdbl5TnU^jHYVnq)(9ZuYAN$UwDn=eai
z)z`>f&E@Vz{mbej=7PW!lMy!NO5J*?&CFxX3^j63HibM{V%ADFkU6mV-F0#aYsB9i
zTW^s*SyP??7~!B8YP%&X!cs--@d0)T4AJB$u0NZ_T$*IT<*7kzrcday2o`VQ5NEfF
z_E~a5kX6<;n_b4tPc?Gez5$`FHt5(zO6m7~({`!lAFH%{aeH8qXD1o%q=5shc{FDo
z0m2$1+b=;3R$v@*9v~AA3kH9*$q5|#mi#aaMBw1N3yOT|?Fs07HOg&=`y9O-#JX)E
zy}{y8B)<&u2AZCw`=f#o#1|C7F(r~7s9`x`wFnM0M381;ED_-9j--WH!bQ4=6!3Ky
z)b5TZ6G@);VvRw8JU(y578|r(bQup!km3Sb>Jqo?>kSMg+iF0dCYM3}>^|;Hn^Ar#
zE=^Alwc4mjc+4*kH4kD?uDGPdUVK_-lpHsA)eD{UTvk#KR~be07byuw@Tmo|g+xFY
z*|HC*GSs6KS0hI`#OP=6sq)~LPVsLhH({r)=clNoxhiurJFn5aRNui1$&yKlx(zV5
zV7a_z+gGWoMTDA-RR~0Ym8r_!oT@xKy<~}@A(yM9_Mylk@SxfOn3!k-sl3DK6QiM|
zC%~vl>;ugp;CILpq}mK}IVFfUbq5=PFg;pKIqOn_aw}YQQ7Q}1@T{W0TjzM5b8ZLo
z&=<S2#w3~O<VgndbEQ7hiNbdVHTz+kCTjIU!X?GHyj)-eyA85u$KmYk$->O#P(~>%
z`{Wh;B+e`?WuENY<fOm_@n9CB)-Lw>J|E%a$QHZ1+L$A%Yh9I^nwF`_eKoFj7xtAC
ziEMRi9zC#1tRA+q6?xKd43jx)UPuvRct+0JnvZ-HpT(Gcs$+h5#WUlwh?Ao|2iz4S
z5y<37jOMs%91hKeGZVoqCA-D-#alQ15|@WpyCmYu1GZL<B|EcY;7Mbdae-{k)DhD{
zQ>ni*r`uPp)Kz}!HJDlo?qYtW+w0{%C!A^?3I|-mPIN{b!KmsSKg18mz6lSAD8jz+
zL{MXjs(h5rsGWAivB0n_d89&{IM=7El<JFGznuAQRpdJi$2?1?jj=F8J>`suPoxkw
z%5xNIyRzA+E#+Ccg7xcMEu&PWlRQt+S-alAe4H2cxWUa+t^CpqSE#X8wNXcB(t0;v
z$bkyEBB{95W>I7Hft!yj$jkS6{tHp$eGfn3zhoKo=k_yK_0sFlSqt%ZE6*YQx`Dq=
zH=)kU&j`jTrhMrNaR&j&fJDRxwH{Tt1wIKMwYSa2RVI;X8KYazr!yI0?5*0T{RKb?
zPcsCfYYeY;(`57uC?FNxv{q>)<3qWOJJHX?#@9^Yc*AwJH4zwSb0EW8kDl{*c=O0{
z{6^KdNcg(LKnZ&U8Wtflkbtn8Dz3WuhEo*LV(qem|5M`qCTUAz$;mnYV1@%L=eM=k
zkVVn{lAJ`OA9#Z3h){@PR`*>VT`A;${sa!aUqk-$HsVq7Y~BSbb`NXNkU&=<_5|7W
zcPv=93=2-2cEv}Td5Pm<kS`n5lD&-3f9O`*rpG~Z%|&dWwAjrez<DYIPj5GY4!nVf
zKONT6<ay1~oSnqkn;x&w^pJwQtVuS8F+T?nvAI;icxH-*JZLT@3EHVIS#QkT-=wbh
z){6z*AdtK>W!;-A<fc~Rsw46}Su}72H)N;SS2!tjS5sV%Z3jA7|B>rP!XC@Y$yLx~
zRYu9Wa5ibDL-90K_xxEp?>k*~b9pcJq9@MCFYUB^;F}YcW0I4J`;}#@<OP5H!S?$r
z#>kf{!>LlmNsAz#F`?IxR|QGGx7aJAB-t-|lq^;5_;3V(I$s3Uy65ODCr7c^jcWJ(
zkoZ%)NsWF)2vg_p^XGuG$3DyP>1C~tr(ts^m%PUW4qPbq_T#PAJ~#Dhu|?B-tA>pM
zkJ4f(j6Vr&g`F$0l)Mkg5j<Vvo-bM2Mm~jerJFMQJkL`dgoQ7*04_ErWq`pMR}|xW
z#*5rVz)9N7p?MBw^!5#-OGtwm{CryRXQ%nHa5izekD~GwY1%cfF_}3TbHU(dJpL4&
z<ujDtCW(t~p3zW46_g;By#xFBG?>?wwEc5ROi#K^a0z1_l2_@jHKUXsTygA4m56w_
zn&D8>R_gqf8FenR<UNP$OdC|pRq|Qt#OgAG(~I`%3YSMIE_`Gkj!h^ofm7EhrSeke
z`2tG1xH~?0jIhRC&Q-}fl=VqIFpsr-j_PiW?v=g9&sFiSXz=uidwv6T>zWILrrw<h
zySl$IzB_Yzdf2k&CG?{6$x|86uQ^M68+Xihhf*g#=91HV<|#=nB{_zAN?Uks!tHvU
zaSF~vsZ<$>x`n;nM#piz7K<fXr)cBqF><^vp<$Q`tSRBx;5uf_=~fa%$lift<LP-)
z6_xmH+a<rrK6?7<Up-RE%U55kKX&$%Y;A->N7X8Z@`3s;!2N4H(myqAp$kTLh@><r
zpF(F)X))5p%A6<R@tr{ZWUh1*P<W`Dw~LFD|9-+W`8aTXY~*O;{s`}ZMGuesBt%Ic
zMI{VU-XD$j=Vyrr;-+543(CwiibMjFq3CR#*)cvm4j<PoE;zPbtp)SU#h#dbf_<~6
zA|g4fM5)tcecvv_K6!e0O}kf;k@r47II(zDYLbY}LJhTJAZe2lTAo<>2{*EZJ(k$D
zCW@Rj7?WXGQl8GDZkB!8`D!G16_cLU;<tAr<W7I2swE@J-q%oBj43lhFo?H&B^1nx
ztc$u2_wTaog9ax48~;zg9Q4LJ{~LUcp8etf;N8CcY*+g~OMYjk{Yb|9_H3LzH+O=4
z6eRTA>GkaRb~U#8#~q$Y$L3Rx@(5FF#K1LlE70aE;b$4lOhL5w%`A>Xq7YY9@wD$%
zv`A1n1f!^=r7SGI!{gl+)dNnHCV?;Zsx)e`r;4x9_yl6NI)ogApo_2;z63#s;E+n}
z@d?0{Z)C=#J>v<50!q1DvT;)@k*eV%qtEtj$T4)uP%D=BG-;@$x>juPU|yN9q-m1n
zTU_P^Q71=}3$K{#f8Dr;wtCU48J>(6s27yn-CtEOB(4%7^n=TrABOGoJ%8??A>TC=
z%DtHzT9-52GyvSYB6Wp#<(oGcpA22-s0qqdYN?dIie#Gxd`V+#tnI)#6yjnlIqh32
z2j82z*5EOM@KC5D&j-{)a|}QBzs*&=SgQST&XE5#XLPf7t9RYrARY+gx+p)b#jEv|
z*Pw7{{&hETOg?t)m|8V7|C&2xv=uu<(*Zk56VDe?9Ts|U40yLxT9t*ngF`*gVpxML
zg2ZbP4g4`UOB|JG7FW1Ey*V5JTj0SJ4uL}v98C_jNE(z=UHJQlLwzxyI;Mc_8MwB>
zv*M=#Pn>-WrSQdw3h~O^AZI0mzL^uu`2;wJe$fX+FpjDbUyVpVi!y5#tX9K_S_RJn
z&Y{rqB^sP3Dp$BW!qrQ*kDm|U6$pQV=7aTv!JU7NPDN-=i6E~^p@uxwB8|361bNg7
zHS9CApZF;fQmY^ZtWZMYJSD6!zA}Mx=sRt-5ca5yrn=#k$a}NdHQ9@%iu06W`2T$u
z<VKlJbCI&VAYThBBr1rPd2vm7YJOr-y;UYE_3<=SQ-Yu@#61IvcIIYYTw9TrpWte+
z$&rd0K6u@6vg-G$lO2E^ReQGC7aL+h@4(P>2qfR|l@6ZmyVKD6-IsAr2#R&yYIzpg
ze+N|A?qJ*)!b>?5<K+2NMNE}4hVVuu0DJNXycqY<J6)1V@d_C!R;H#YCIQOjmgCja
zs?W?!Fd_*vYtFPC$1ZnFYrM5Q(IiQj*?b$k9{+o(v72z=zieXcfi6Ph?Mvf<p;kPe
zcXIRkhg)?L{24{#ORTm)Nky+9r%8~rC%-Pzm|0woH{q@+wbhddvT_~UE-^`R4IgEV
zXGxcWFQXKPttv#}G#Zo^=1Fquh;*~soG)jxHfM~<uqD$`tJAP*C^$JeEuBnsEAwqC
zdh+ayF&QHz1Ur#6IhdFJ8wnv!*!{NCN{Ju^L{PvUrFp}o3MADAheGQ{PJb?-DlnlA
zUxRn8$JfwNDLN!sDmf$)Y=f7=+W;p@V=*(h6!;tTb<~V3P01Y;KyTq?@H<E_m>U{d
z%Ipp<I*QQF6|>v5e0Xg6J&Q&s9VZ(+YrP9~&~?s~k<&j34FzkH@Y5t!(xD2d`U4KK
z#_G?&62Ar&;BK*kG%CkBj=3B?@@Aj5q@Jtuyf=Tfsw9xD^Kmu8#VUieu1;d8km-%`
z%$N-<iQXiW>y3aNg(e6^9_3P%$Xz8wH9n!pt-_tT@~aZg(uQD+_C0$#N|8xb5=5qw
zr~CoHj|)G>KQ7f4=UX;-`-nfMmJH!T3&GmK$}h6!F`*IFevUkw9(7?2o<<MW;6iPN
zJZB;Z1iAUXveGoZU>jUb{_tW+HS&Q;9mFmWNL{VA8nt#TP+A|t#cRW#`I2%_h#$v4
z$0wfJfdj{2)k5el)c@FL9qoIs*$;|`Ld&pa_oi)&*pc43{AcV1cu!zvWtsWk?7}ky
z8A9@xIFK^Rbn(w}6SH!-T6r_$&s+vufLN59y#3@2DJe^SVSmQ<)RgYy=>R7qSc@O@
z!U0cqq~@eR<WcpgMQ$M06^Qg6m4)&3M%~aMq(^cP5?_?`AeX?q-9da$@JoV)idgDf
zHpvaYf|kNB;djGJp;urqN*(3W1B1<}X0ld-vC_t3iWQxP-k};w1o638mbu<ymhyFH
z$BhN$tW-NOf&x0ZEorlp_P*(~NhQ5#I0kit=xw{kf!9BTGP|OH52J;eQ?EWk)FxRf
z84wAM=;e-pf-j!bJz3eODbRXU2lx?%Naz=u9}Uiou6&cmfo=3+^^RGy`c8yC!o|Oz
z7Xv>dP@9^eEVY(dOZ*`Zy@4p*CK7!mDF?}sQWKr8mWL#9nQUIt<cw3hb<xF}?OKBc
zw_}VVziq541-i^+a5hp%m2HNY3TBbcnC~z41N+20u?G{V(W-37A>*?x1zFt_`ipb8
zPN^KKtP*Mz9x<#`ip5GfoKwsee8m%A5{mANCxU?4QE1FujjvuCT6+t>m5D$f;vg%^
zcdpr27Aiy53xwN{qY+<wGx%;dy}r@2EtYp6wx`|`HvS}oCMUg|Uk8T>ghdEkR}R%7
ziwW_IVL@F<F}+#jm#&{g>5)Qyz&@6?E2=Z@qu>zC8VY(p>f9B5G_|vCbMQV4zkDya
z8EhG}UAr`<BVFXXrQ+T41w}0}cYxE+@?>~F_Gf!wFQ`8QjanT4S6cEPxl-3pJn{ef
z_M_1`W)^cD-^2DKt%{HTK7}@e7?ZPUEg7&6Ln=8}&r?YuNG0XzxhlDrI5AD1Hj(%|
z3fNKFgoOx-16myvTPnyaY)u8MMq3G5G&sUgc$Y{`CsK&|k9s;46njq)Pb_Wwbn5(R
z>%71feEfrmTf~O1iX>{aBs2ouhu4U7s81lORI1ePna!I&&BFmDN_$EmcISnlmoV~B
zB!=%HHvbnJGCV#0bB9s`Q=7a{9_025z|z(FjcI*T*!!6ew*)tX%qY(}@7TgK`n3XN
z0Mf%BBQ)-z;OON&ICI1k;(3lyq$tHhK0Vgf1hS(HXQa}QUYrqnyn{65TE1GQCS^*C
zAx@Q6C#|h@Y?f82Bu(~lYY)C0)9&$uS8fE}HUV~&?i2?qk*f8TCQ5+Ye1ws+g3sTa
zLqAd&;Miz7x2kMfZJ-iXNw`e58V~Y~6n$wPBy@Ok)oM?!zyT?B#U@&aUznw0@KjQ;
z1N(N>8oe}7C(%>a6*P!4!V8Y9Bjr!aM=N!+Nz;m5nBMQJ(SZ#s%RcF_O-rQBn>@LL
zW*eb4Sk=0GtBRIoD4kYxQwP!(Y8@7(b@E&)#ZRFWQAlWsW3TRSdrOF<vg+k3y9GFd
zcQnB}K%(z5Jh~R28k_q3gjCH)of<~8Qr_hAdkb@-H?$J!ko1*E+XEfr^J_M}#68Zx
z@8^}B6f*2MJ^hPo`LBm(U;j#Upr~t$ZSMZK8khF#i!IzkFYlMxOQd>)qfJaD5@Qnm
zV$uR-X2}}yeI!sw5UXJhM<?lC(kGuC#UfdmzrNq<N13cwU|nCnc<Br=U@v9H&_vNp
z$-gw(8|E5j40UH}lumsEHdas0;8G7!DVHem#GQ4)k5S1_Q_<9i$thRs-LJ07M1E2P
zMt>ztnK5lfKO}la<P-HrpG2CJMidaitHF5*Ew+S~d3ubjPA96!iDYGZx|$5me+v#P
zC2F})h{`4NtLGR4Ld2t%a?6W^8*t^VbOgTiuc&lT@P(mPfK)0a+|pwHGQ4WUVHKiA
z1Ohc8Sx`Nvh>Q}`3rI<%f^?#T1lYfdwOTQx)rcXD1`=zuV1H>Ll8avJnE8gz)sz-n
z(k8ntX*F-Iyg<=st5Y0Rj+E8cedyaGZ)&VOruU$}RKsPwnc04lgBBuO&50I@JwmN$
z`4;3;jyTL-%4yu(IQd8+<;aJXL*C*<tuiOA0%$mK)Ig&!z{W48so`fG%V`@ft=xr~
z)-9}eCj}mq+PH0|U4|~d)bao{cZ5EGC2ZJb%C|iTc#;;>Ct298mFXWTa4C#9S=kn0
z)cW)axEXJT%SlmvG`7XTlpr`a^F~rspWJ9f$EYJs@~FNsXEV7tC=5G;w-PX8smGu`
z4ns+&vvfp~L(p{ek%G`Ep-_6%dSSK~O9D=W2gc%m`eAJ$=pi2-V+X*ZWL${@n+6B0
z6ud-UkF?$W$PJ*reDSgwVjHkP&etG$F4`Socf{9&r<sR;d2KW0_{-zJ`M<UU5#77L
z9(^?>m+%7{6flqfBBZt;IHfOVZat@eo02O6wOeBjH8eK#27BDc!9*VdZ?}$H-rLw4
zy&PmG<9+yQ(n0Jnd>HotaQx8V`*5(OarzU+Q^xx{zoYg}uGkLnihdyI6@ovV^}Tp+
zOAxIEgUc0D8}SBeKnUhgGT{&LRo3>W(?{zWV^@_|aRfz=cbR<SI-rAcWcV<C_~>w+
zl_y3y9X$DHyNBNkazx63K4Q&VR(hSIqi|2+<6|bjlAacp9vaBz>S#=Lw$dXbS=ZlX
z9vA@Hu*At?TWC@1b3$TC1#?9VoX5S7w`HA%CWO9L31_p~@Gk~}1E4TGun;HzK*qny
zs4lThj2LL|2Lln$Lq!9jf!jnBIMiyMagS{_?_7OQE`E=4KfA~9X2<cgl-(n+=X#T4
zM;i4K<!w>pDGEcDLRdrHk#vAUHM$O)Cz;!rIP9BisExKL7B0h8w=9H81_#PtjxjKS
zO2B-{{B?RpCi4Z8`6~V5`H!KMK<wLf4BJq#>_1Fiw>bn>4fg578il>ic>|5mHNPo;
zqp|IUjkH*S{NATj*@T+&H#NO{13>uOtiXL`9Dek7{1`3-e*o%QQ8^M02qkU2@}d&!
zV-vw@X<^(t>{`uo=Mf0fF^QnHsj4Zcej}7)Xhpfq0E)F}@EfuVo39Pxes&K_x@?&x
znT6dT>Upux+$4!myLr}K`P97Ykri$<JkDmA&?WPoyE4M;vra%!AUZaFQ+fq#$L+Qx
zutwPATy_m@UsKbV9ZIt}YV(gBN9Ss$+=k3&e<sHHj7$MP+C<0Rx2E}*9`dIocTao&
zCgq-jKO>$nn|G#>$Qw=Nn}`oaqnOPUZc&cLp>nKIXtgwoWH_qex{Jgc-BlwFz<HWH
z31U*JH6{fli=cehVD1|1!JDs>3ewZ<q@=~|^1;u9R6b9ft4h%go;dv-<!w$ny@)us
zo_lmsezVe1z^K3|?o81W2DJqM4Lf%37~tIHqQq2<B?XK>Y`g?SFB}a;gCKt&{z~rs
zr+Kug;*Lr^3%A3f%GtM{$hh^|Eoqu@|EMEz9r1SMQzcGvSblU?9u;;c@8_tV(^6u)
z;wj&O=zx6~4ZHR`b{$iU9I-N}hdk=XO1c5&=>CJU0IS+q&NR_qe1<nmxfL1Tbo+WB
z>jSuM*@imS)w}OL1O0ti2gYxV-@wGwl!GSx_{{;xA9c7pBSN%JGe~Q9!)}nUNFi5H
zX50#SPrPg>Dypm`k-}l8^Z#$h^GNaw5r4T{N@a0z*h*5ob2wf(I=?58{(kN~Qn$nV
z7mfCpmr8Anz}F$75hi@h@<fD_K~a#cd;X&O*4gXisID!Jm@S`G98r@59HGozb016Y
zJzb%2MdYlfXA;=iVQ)j1|F8O)T!nHK$cxfhL@=f%o92Mqv?3XWy)`1O+Q&o6Y$5*N
z?nx>oLhd*9yXiBCj3||ePzm!xHc1)I1LpSWWLipA`LFLD7_ivo%hjTIuDF=kFz%K>
zv^$q%y8SR-#bq-z)4y!SuVhsOD}XfG>2f|?tuBw=bPH|DO69@*`2K@+Z;gPBohtR5
zxpU^JRP*M}U!YbmSWxMx+Pp5{Bf6Kmzr8|MrV~+e;+k}wlAO@x?P`gRq0q4$+m3zp
z`{D@-r2ecPSUO{wC3!Cl?7rRv#*)UhT+IO)FxOoIwD!S^`>=h7f`{-Oxwzd9kpE0_
zlU~6z>d*cZpHP~t_n2fxLtgg7Uy`B+U!0s>g<bj%7#&~D@o$~utNx>PS7zp^*)@Lv
z``}Q}4Vz)49CioYc&Gv6{G(Hj9r1B{+_+D{nEyKtQREw~j4~)xipo^xePYlJvVAa5
zCeM55Pt1&@M{;lE<v(FaEA(>l0SguM>i&_ZzsgW$yaNBzC)K#<^=J02tEIfo7_QyF
z&b~z(O$<tm1k$K%=Rr~QIGI$IbZ8LqKUJU^Ebi86XO=k2)H9}Oi)@WjY1s6YgONU#
zS;tjs3ao8bO@Wfz&$^yAPD2xj3|gkJ*c+~Ldi}w2UD0T+SjKP2Hqq(k?6zDZcpg=B
zywVYt$!wjge@wS9csWJ~3zinKIaVl;R@6dF!TBl4wbC`W6fL3fxu*4vVzb^=UQV9F
z`{2~7xuh`b68LxUCs&}-QeX{KxJr6lJtaMW*ek7|Bbw=rT`O25(IVR9AAhWvWQZ+3
zCPfU^%@I3}Ea6*1B|eg?F+WP3R+3LA@gNH6{1=r3^8{D4Tw<_1iumTYqXJuVc}-O5
zk9%iPD9aNy<9F}HCevG<19sTbEX@lVJ~ZS7o23?O(+g-?i6<+~<++d#5uUS@Ba;!{
zNhG-(lJc;1N>Qh1u@FQHgZk80DSa}vlcW^T^`g&NqkQGXEmHKNs@@r;Lw_a;OWkdd
z65;Zc5F}W1T##}wIr(6U05mo6ed00V1pe%RJ)_#XFg<;moLpTHkenyv+9seg^3+Ok
zy4!l)!I9<?E&}#()Sj<W+4E6N;g0DBHDcy(tjyn-jK`U*$6(#pA?gevgE1WTRttxZ
zcZNEHoaF#uQhRZ?NjtYRRz>bErnGc|mMYL_3Hx9yc3(K|r)ih`xrnAKMK15&Y*(j@
z7yCu*zv{u4xF17CWku{iy5pl#!T|!~>KH0qg=yAURuz+Ze`QWyE!t<FggsmuOVfl5
z8>4dSe<WEMyj-J$1<8uoxmKtqt!NfXIQ4ZW^kH`~fH~1n%Nl%5JwW5Aw$N(_03p}(
zP1!5vhy$+y62{v@*}JbDpRTM>o)i?`7WFI~*nFq#!DJuC57(#eLnuHpT#~$c4WmIz
zU9+Wn+UNfjO<1wQVg7tnyP<y%V~3X$9d6q!-~z1>9sSvV70ijXYp^xTQ5`;ubzR?j
zJ12nmU#f4r9yl_<M<<g|6uEi85eI<QiLEx#rSqLp%zkQ0;+Jrnwp<Tne1OEvSeBCV
z>pKOS9%n71u$<X*hSziM|9{xND)Yi6b(8qD5eT=tAB3nRGZo0QU;Kdo@S^UxATM^y
zGKst#V`2X8KOo8cU5<<4?|R8#t>_nEF*a`C8DP!WR!Q1DGNSFuYerH;Y<nE00(iB7
zZp8ikA_-7n#)4os2%NTEGq8az6mMtIQh-$~<)~iK{RBlZhV!-k6S1bp{zhyf6wWys
z!afRrh(XQ)zU)Y{^Rdy8_GOL6^mjb0kNji>tG{n0cD-^LA8V@J9C}~RN7${3WkRgg
z-v>rDI){Vbcy=EizJOmiG7L1oQuDMBM4JAwmrg;6t~cIwbQo|~1#b2xxRypnySCo^
z*pJ<5#tv4mN_Eed@|^yhIo;dYsat31@^%i~U$)s&$N>1<CR2_K|A_y1bok2@Az6gt
z_#Qp>c3Ppgm|=S5yetYC9$wrd2++1a1#rPMNS%sq;I8Ng!f9IPy3n-OA(J(Ghwsg!
z!%g{b)BY<=JeE{QT}}4=C-f&I%AM@$%IzckN-6K73YK+ke>!RypNM~mAI8gmMRa9X
ztP0JWV~X!r9lf|j^Z4<nFz$QN9m764QvW#}^yAhURL=qn-mUTcuIs+jQr&E+3!-&X
zEuW7vJA+rq0_vS;2ql#=)LK$2R+#5{|1%)PH*NB<KOZwi6*MD-H5Pvi=0aoGC*Kr%
z*5@O`j%lH3;N7BG8|sptvVNxQXRut#Jb57B6~}v3ZA&Z(+Z_ItyX2IugYA!``XCLv
znwB$Tnl4i<GWZAB)5Y##$(H#~b>t@$*M|bdk%e;zmLxUCiHX^km)o2I{vVvpe2jXF
z&|iyX`L8zyqI&#9J34H`tw)CW$6n(?++Uco4Rl>|Z40l96}hXj4t`RW;0*36(^T#l
zYp13^B1UVkGh#zNOHlKe{Z~WF!8L8UU-&gxUib)z^;Lo;d&u$vAkvGC<w`3iP85q&
zsNbrIDKbQ1dmKRY6659)y;d|gQkoAf1xq<mI-1ml>)(G$e`-ZAD4ljd?(*kRF1~8I
z_{-~cZaP0xwo!7Su<(3}>N9wA@=t{YFOoq4#qCWwI{cw~_3?jp47A}H{TZ_qcOGe2
z4Xj6uek|=4>c|*zhw|Zh$<1s1gmYxVSo%&@!tVW(;`e_-Po~q7$E?~<NT^F@de~Bv
zK~9fM`15`O;r#A|WCksnF7_KA*XQp|XxsV_EO^wAnR+gnQ72=t=&N#HtQr$Jh<-la
z&4W&(UdCk6^WahZTeMk-EAqB~M~@^lo{gtCDD=PL2M>?<y_@2bX!Ho$xA(OZZVkpW
zX*8zh<oA=}Z=Dn}UDrN(#a=>UZ8E(gQ)1A`Xpy5bId_qO#h|eSCvT-&X9uan5IvbX
zc=mpJn+TDMkK4D`6_CR07Fu-Eo$CSi2gxxrx?_^Ryh(Vpk+%uqtQI;CZZlaOGoq8f
z8fuhnh7uW(@>}%Fk49_*rPtX5TP$5^=>n3>qs(Ti^)ycQz(H9!jl>|uOpHIDr=@~=
z@hVverSf_DY_UGK==EC*8H{WJ{Wf}Pbwc9WWTgj{TMT)O+vxSx@zgZ7p6wDiH3oN<
zGC*4(R=cuZVhd&K!?uK8e_xzzX{4M(=LrNU;r39O^-{KnnLIV#99cCcSw!FIllF^!
zvgnN06V5X>SH=Fqz4+QCkLi(P0#gX_3zHe1ESWGp5?AeuCwx9<Y$UzMw{nj2M9`fE
zy_^9D_s6d=90|85KhSdsXO>M&q_wG0n*^622m$L#z95-Fg9X=Se*D=@qatZ4EJ<d?
z!E0&)Veg7RlW2@2Arj%nx+Y{!J%T1q>65ewwT#}hj{kZ8*YX;?u>3-md&Q`&*mo^=
zW^7GNJiM&qPRj2sfqhIfZryCMhMaLHWqkaj32eZgO<lR@E2%H0(UpKayJgXo;39Bg
zcI~3p#zmlE_JT!KVb$Brr3kPq5RFnKdNf4a3(`OuF+yp8c>Un)9I~UgHE#TfiO=iF
z939)}i2XG#{mm7FIlV563%r{>{_%Li3kCYx%oJJ%vjDJ%s4Fta|4h=~_zH0D8<{b2
z&v?RlA*Ebl+W9SaTY;3PIb>8gKo5C+6a|w;Wj(XK<36*dQiM%kuQ=%>&0L<ZcG51=
znHOnJ^?XEt{Z9sgv=PA(X^*rYl|Ai=d=8)f;3oW$?_G<D547rvIlVMeat2#4{aWy&
zfB>K>JFt$j0{a3xE9(4I)I~r!$R{dW5p{vf&T2ltqWPtdK}^Z^WBXMK(o_n=*h03D
zEo2MXa<-f;XUi)?fnJ-Jw4;tX?ZrM7mH10#GDpt<X`_+?qfP_+6irNzj?S~N5tSrU
zPb-0HVEZ;FE~zGBOqH=x*k-nwZT6d|0iCIQJB<A{`)&5ymFIjD=iH$TiY!#aIR4||
zAOL92;S?HY;7R~|?7W2&`x>AvGrqC2uuFaaO?W3%?qQeF|85*h(UU;?jAwi|;lpU)
z3CGcOEdZMKM-S8zEW6cJM9BR#lQNEel}|aI(A^dp*aB$1qnCMG3hWKP1bf5e$f4qB
zGEH>cIMh?4wfHeDIe{l5T)UbCUCosA)2g}TqpfUU-%-(Hi{sPm|1O;Q&RuI+pij}a
zR0mc4rS@^{p;hFo!kbf!SI9#Q-XTr>%`v|{@Zj#1n+{l2&>8qPobSEc$amw}K0IUq
zAE-2Z8O9kvkAuD0G9z7{jqiE-JnKtAYq#PtHU{LHILwXj4mJJ?fweoH@x3VBRr4u8
zi6{x3M#<<5N<r_SEOZ`aqYLOF$~m!I`s@9d|16qwv)<^Na@T9Nz6F4?(2Ib(|6&-H
zfF1w^VBR|c<s-mz`%eJa4e&F>o#MRPW@CoKOcm2<Nc{ciUo>t*jy7?&ruAdR=rI*2
zCXPaj=`^Lc0el(NLsVi5&SSwHo@7H5j6P_vkds(>dM&6jVlH-V8i&pwz*vZ#`gg3)
zW6?Sr4AS~hgGF1iVTlwOc8`RS&5khz?|CRw6{O1)X@C2~3s5_H&4Ft?ZOFStgDQXU
zJV7TfEO))s<Yg-gh8x`nASO9|7#|}$pDxb$Py%(KpylC-&lHxgpK3DAQ6=mtFNx$f
zgwB=59C2Y|Ew8U?2YK9@_Md7?LkkK+sNBi@Z?xWGCLaQCG*4-`gnHuz;-w^{9{Tlh
zQj>4PioY%8v`7x2#7bh`nXk=hPqrkI40x@da%{a8R1<A<$yr<lUA6J%+HaC?9)WYy
zhyGkFXdCI`+5(TcNgA`CIrA23t;3L?e20rYr20qsm4`!SBYw`!_Mo5ZHf<$E#dU|r
zgPWu=yWJVLtu^zF*6z$rR)qiV8VCS<j`D3v&&PdK&msw876AC^wYggFJq<1W^O}bq
z(|0ceP{9BIAmA4xXLgx`lF14vx@jULzI!N(tFTKFaJd2;M9<~65;v}kaKOMx7_}>$
ztH9C~baTQ?8Wn;I3Q?8|#nOR&zA~sdr`u|BH2@%1;CtCZIHwh-Pe|>-F>4tp%P6;r
z`8n)0o*q!bfe3qgE=~p*#6*!(C5<_vGega4R@$sk%TOe7-PUV10o#4hZPh&6nG6}t
zCJKP(IqW==EwVYu5?f5<15B0%qvdHH(rc;YmatHMRZ{5J?#X5)E7}`x>oPUT@gh&Q
z>F<AdayF1$_Up5x&Xb*#$R)pis;>0)>kKT`3D(MS-S}JA`bWv7REk~Kdi};p-puE$
zeAin0;HC4F-CS!3dC?`KW7gy3`L*8|7bwWH9)MB-irq*SD&jDZjuQoo!Op9?Y*8XX
zhY1H`ESg}#Lk{Y4n2`Lid+M*@H?GP%T|4Z_31R)@Dm%kAWJuT7w%x~chU8^8dl@I`
zy7soSF_eEs<u;DGvOqT13_AqI9J`7tLl?^CdhHFrpR)!^&T9Uy-t&`eS8|!IH#XfJ
zlBb>o=N)t}Tn#O7<v2m8BpTa(OPAW-AsKdu9N+ELjXIQx6(V{B)&l_N0Dz|tZ9FCo
zr^~nRUE$%awY_X}kw&)F=c-I70R3W6ne)Rq1h{Z#xp9x?0-Vt|2;HRwI-OA8YP?|t
z7yuSd2$1&%fF6VE6A{uFG7kUxi3CdhY|4pV_-i?libU>-EJ8${$QD3$!WK+~Nd)+L
zm0le5@iSz0{_bO!0Sp?1Vd@#R!i3cFDORmkjeu5G)vDBL6J}Dam0B}Qt$HmoST(5E
zAfQ#NMlB>bI9m8LtJSDgi(D;gh2(0`tOiFu9ZNKE=FUk9i{$15s<krkgL@Y9@U}xz
zChE3B;z7Gyqh~$@)0~$(BSc1RQ=_Sx+lNS@+%lcP8L+yHSm^@IA=ee^3r(xE4H{?}
z;#Hm1mYEv0&U70*sjtiC;v}e*le?Dr-p>GdPW6USdh;nnM*t${3*3j>>ZEOo?Zi-p
z=|?Qp&bi>COj+2nU2@qKSNkJ)(|P>(zV?k8*DUjycCUCz*i%8h>uw0R2_Y$kGCz~k
z2nJubI`zW(9i-Dh?<WS0?V&aG0x;R)mR9XLG<J@)(fu2IC<{$tH`RMOO|!v8JG|)?
zCzm1%98=<b-QIVpCxnp~4tT34hJ<fF3ql_S|Gh{<tU**ngC5JCS+T_g+mLKQ(MV{c
zZ_TqA6-QnQdBY}5W?l+PaT)0Fxp1ePw##jIeBq{6z3%eDIJQc)8tv37{QdX8xVlDV
zRX1(d595RhWn4(5jh)@H`VhCY-`w8aKRiA?zr6AVLXmjt#DPPgX8Rhg!{(^SB-XEf
z)kR=3vK3C)>_BFb>9V4VQXt=Dc11qhtbqJEZZ@cpor9B0kzyrEl_^)DlADJY2Io_y
znqQ58T6Keqt<o^>)-gcYXW~7bx`rwH#|MHD6vGJ`oxx<WIb0rJAQXuuQkh(#BvopS
zR;QmHs4H%}?~Wl48jL2hg|gc04yViQ@%sGK+9M8F8LH42uY%YPe!pLaWrR070i=)G
zs4x9HbFU1%JJf8Cx19F5dvo>sk9Avv=Xt-+RkyTzOk5JUpSBnH&y<=DyNw)%PfpX8
zxMP{-D#pD;v5{}deuUxFnB)}G@`sqYjd6hk2TgC$))2+}VS&rRXKeFN9~JZMF1Tcy
zMix#U9Zn9rpcWa7VthJNbZ~Cr1n&71LKE4pprU7XGmLzk7A-|%Lg&*2{}uWODnjNP
zJKd%CZ5TYj62&$;#oW85(cKV|#d|SFA+}}9Vc(<14$Kf-@zD)U!Gd6E?glFjPGn|w
zVAf&}560tkyt!eP85+L(a-hg{hJ##3hMDKVZ*sd@oev58(`@>4$7bm)6-+AO+>+u9
zhsUKDIDw_O#(WF8FfZ4o7lrR}wHyD@lbp0MN}xf()9C4stUljuwO?dTve7M(wDkc>
zzM*$Dv^@7@Ke-a@B%0}2>Jm>{W;TUvn!Cg6+^3t)&G*x{_jmXAy}#A5pTF4cc%oP5
z(=j)*Kc3ZPGDbh#`7{`Mej1Fw{;#xIkPiDqG{eNaW;#ajMX%jczxoWTCw`syyTJAr
zLe?;Z!GV_O;5*ecbGOjN7`_t237;}u0=B?yb7}#ylQg!dNF<;C%>c$Q{a;*v27Yrj
zr?FU3*dg&FneH+PWwxCwNj-(W=B^_mPn>*L#`2mqms2h=)jl(wKr~B~BEDuR<w!i!
zQ055c!8sr>NOsRd=<sM1G|m{Ux&se{xB}{~a{y~u^mj_}1&5sE6wf08QT&K{mes=>
zucp!ZEy{U}s<}{AQ!w*JuHZskj*xM{B)$0(Pl32{*ME$QYB8RXPvamJ0g9-y2BEf*
zEY%>0vJ$-GBrC$HC~Q(Kw0|mTM=yNhjjk1Iu49*}C5U^OQDJth2)#rVLe_9lst>9c
zAWcQ@olvo+Ou*{Xat}BDZysp|afow4ee+<?g+Jy{RN0|sh3q)A#-?2s#{kd#-7VD^
z13-Tij(6kOH?6qWvzZeY|NaQ|aD@+zi*S%ME--MK#u1QbxZt@Xu2tiL1c2AVktRm!
zN{S*b9Gp8C{SV|(6eslXcTWq0L~!ldAwW%bHvUIu&{v#{O;7V_7=1a5qknaOK5za#
Ha}-<w9thdY

literal 0
HcmV?d00001

diff --git a/src/static/fonts/JetBrainsMono-Regular.woff2 b/src/static/fonts/JetBrainsMono-Regular.woff2
new file mode 100644
index 0000000000000000000000000000000000000000..585887339efd032b6b715466ae72d86e306bec79
GIT binary patch
literal 21168
zcmV)FK)=6tPew8T0RR9108+335C8xG0O80008&f<0RR9100000000000000000000
z0000QfessnP#l4pat2^OQ&d4zUI2w65eN!_+&F=(E(?Yh00A}vBm;~Z1Rw>400*NC
z3<n#G#Rr&PWzO9Wu#0`YeKz5acRQ%o;Pw1Sgs^cSkYP`=|Nk=*)EL8u>OjnDrQ41$
zku4jAdY(h=YH?Q9T~KMlzwZ!Tk6XX@GiB;<r=~C!ArOneAOsc=7BHYo1okgfGykS_
zoU5lvL`L95+G*CC-Y;S}Ez@h>(kgcy_S%vf9>QZB<#m3B{T@3lCUU1K#MJYCtJ$}?
zluNjuAA8m}JT`ar&x}3FT@2*rhYB_4_2Kz#{<-&|0(J~hQBlzuJw-*#O=b@(5Uba^
zHkPf+^t&t<?Ogre>tCx-;2-K@@9z=b1e`<x2bPA79{`6@K*4F%`u<c~euw}`6uSpI
zS9)2q4EJsZ|JQ%VC*yjvnk1`P&9nC8$$YZ1c2-t)-f6PZq_gIeB+csFpCn1rX_92!
zlgv-9r^%X6v(n`L+`lwwlKYb+Y0@M~l9l_DBsc&40fy`}t=|Z=$z$#DUiVHe;JmfL
zzkj`>%nW1TPo1Xnd~xr4?(X<U%LE%sC_oik2Mf1i!FcpF|9hQp_ezGDd!CHp>9fTB
zZqWrE$bKIz`BR7;xv^WhHUA)2yId_#9~xMfeT!)>eKnuNmkuIu8}0HwYZ3&Z>~b%H
zAeesM^^=>A?+&pfh**#a5D1!Im38kjcb>bf9h{f*z{867@VuM;A5&8$iAk!KMiCqc
zBB;n(cfw`M;R1?R0S6jUab_$#vN}wfZN@UA>C4z=?2iAE{TtJ%U1pBAmN{J8ecgyR
z!>u)yNGP-*ZVex{ZC|!Mofo4MEB=3-ezi}w=YM^+XJ&!8XeNIFps2Ry`<|XG>B)*^
zJ0L?6Tgl(Z9~I|=JQ!Q{A1g3~D91z0)dFBUXHLIOxphHMl=Yr1x;^WEEo-*l{GGa<
z%gaGlTPP&LHF=P(ceXF|_WlbwI6|6>eSugWp)e*y7qU<k3T+U^VFdn@Ez7j(ca`_`
z)RswS90Nu~@xhom<skbtT|J=gmj0@0wR5ZkBSpBqV-SpCq+^c>bxC3hFAePbnyORU
zmDH(?!$~jepmzX;SR_rQv@*7a54fDp8J1-8v?hM;OU)aU-CpY)$f3>(;}IDnj0mRK
z?XCar(F4+D7$bqV@fE^s8O#yF7jI3pimHY+fag+O{C{D5*))w1LI`1m@u&2DY2O3U
zDP2gqQ7n_&?|a&5O>5AYZ6)by6gvV2R0N`+TfSHRtbzd00RR9LrU=*|;KBugkPv~p
zNCXnm2x2877-t*;nM?$7as=6m5h#@-s8olbK?8y&tq4B&fZ(gI2q_^YV2Fa0fgu&7
z8VqSAlfaN^q#XkSfD1?7s6?8W3cbpL#%kz+1pwco$g6t|umKRp^3a@rB<TARg3<+a
zpd15ri(Uh$1vOf206wA))ug;yKGzr>`OZBjAM;=RdIr=lk&NW-Ci1F`)N9h;f&5u8
zg0w1q!SXYZq1;*R8dw+eUtR$qg}LLKBBygShq4FAHvc98ted>Vz#4><0Yk=LQb7mi
zjwH^0uO~tKI0*qzfO7?T(db$+(1Bj5E9*|cd4Z1}lx#3M;me+&FhIZtnw;3=OfD2o
z5hSG;lF@jQQ#KV+5h>P|(F2e>$V75k?wJIM04c->E|Vtv1BB>Bb@6Yohul-ZUQiGa
z5SY*-C7p!Js3cVnR%9ZXWK1V*kI3idchoA<Gjm6yB2sy<yL=|_V9-|q*3Q8|BMGuN
zCPbx$BPXp{R8ZLn@wKR`7J+X@{!c940^T=NR0(%g5Lzuqu!5^LC@F3eK<AHt^Fjk0
z=)sUNQ|2sLv%}}enUFgXZ+?P=2oot<tOR4pq)3xNE?2%nrIadEsnwuKt0|^wGs7%%
zb?UazV#}<w#yT5qw#^Q^?6Kb={f;{Blyfe+?5Z1Xx#PYePyFIHfB4G_ul(ab?|k&d
zcOzoaY8px%eN+aE!xu?p3RjJrr{2qCw%UDs1HvdyQt3=KmoF4c<w~_fW<t5s=(y+j
z!ExCUbU5_F%l4D@J;Hi@0NWkgceZ)9I@@IH-($k8`P41yB-Kc{EO#v5SuR@2EjFAN
z&G*b#&6HWm`6B<1JVNdy*~EV%8;Lsn&k@h?AL3ky&%m3oe~RA-AODruEG!*+6a5-K
z51j)h%vFC`|Ga$Qk0?wqrvErP0()yO@5X%<xglq_6Zy$DaqzF})hZ1ZeaSDG<uUm9
z%NI`Ip*c9?|Jwd#PJU>7!(67pWa>`7$vjTR=2#iwQU2ljZhHlX(a`<O59nZS&~4HW
z`<ve1Tf1tP=@i|P*V$+C2t4^-7E%8`;t%XG>j}|*58Q2cj>tr$xfr^6UQgpj_n^Q2
z+umt6nlDY$&umnU3{<EKb*ip_x|X^AQ(afS%3jf2S-inDdfmIauQZn*{Rd^N^p*_4
z*TPrWZRXAVec)$SS96i0(#VRLK2uRBU#FMXPnWJGoury<Cz|#t0rvZcYhM}b!RNB-
zuqRPJ@<+~y$J6^c9VS9JghH|1z2H@#2qXv2<*<F_7ktz=-@kYhulv2=q29eC;Evq3
zjV%{i1?SR9@}@E?cfTP!Z70GKOP6O^udH*sz{1XapLx`m$rPGfm~AqGhSy-2e%0N&
zMF&jYM?l-rO#FwVj@290tg4l|l2u?uWOzW18eUmq$TK(~g$%C*NkaYlEnHOG7Ae&J
zah<};%<l&KY<F&}>2W4<QHD)}Kc&`+B@y_P>dee>yx`W&xEfY&izAV{5s9{NAycQ)
zeNzvc0!gLzs+H0zYE<jhLctV3{Lhmhp848e`*<(vMLmTHWQ2?j{r$AQQgBCMh6@4~
zx-eL6Ito2#q9f^<s&i*4yOn_U^Dg<ehbGdr=ZDdP<`*d(artfn69l4n&j+ajY3z18
ztDVLQMP;-6&0+arw`xLzyRz*+q4<y9czuk_$jr>j?99pB%yYLk+VR%&@YE>>=KKKK
z=-WZcKtX384VpLgU_W{T<7N8H$@fQ+$r%3sxt7$CdeT4|NfT*~^1oQ9mq|zujBh83
z^ZZg!kUN86-x}$XhBd1du;i<?q#0Uye0L}c6Yj?-l1cS$0)LH94<pcw7rad)U!Cck
zJGY*z!){+?Q{Wdy^2U2jfJi!tNL{vzVnSNxrDk2xr@v4NDrF^Rk|pW-{pgQ?&&@hu
zs(Jp<%&qHfU;dj0awQ7n$YA-N=zgM75&gbUK^gt=>sBE2#dblXe^2N;?*Yf(_KlOk
zM8Bt}onURs6n^|8bPr@5s{0E!sY0~KiR~y4(bZn8WAYHqmGJMW(SFyd;ct8{<Cg-@
z7kDYudFOkw$uUK}@2)NfYJ>Q$N{x1bPWPSXV}BiGu}XJ=T*`uEg%9{@vy`_4yl{<{
zZ)XJzmCrnzR`TUjN%-PlihA|8CVy=v9HU*jaZY9eqAm_4p@cn7b>Eh|q{h{5(diPK
zEbVV2EXDH4N~g2Z6>PnyW5ZN{j1}$Y)IM#X&eFax`{d;HRB%921eDkVZxaCV^RoaC
z<YeLo6EMId6R_UR{(O_YAQm{RjeH<(d92#{RJmZ;snN=H7M7TqeR}dnAI&co6<%Fv
zrx|aFt7esn$oPNa|6Ru7_4`~6H4wH_{7D|*pS{a;D4M@<G-b#nA|GX)J|r>MoeFOo
z6ww_=#h>aQe_-}cRhPq&8eLH*+!<_MIUmPwsR75q@ZkHfn&17j5p<>RZ!h7$?a*B<
zg#G;+H-OoDeO~pWfpi|-YyFD?7mr4Gh`r!?RQ(z&d%3>{^DFj*^jnF@dqk)A3fNyq
zc!)jf_HFtZ-(-GQo1d{eWtX}3>F(J{OJ*e_KE%E--1=RVe#F;fY&F+m^rL(oIjqi3
z^CPzY!ItW_6_K_ZokO>iP7NoQ5k}Z{T*sjA@x}KY(R`0hE6*>kom!=x{%n|4jWEKt
z>^2&Gi%-UHfcX|1UDlp!pO$E6tv6=JjyS@a8?LeEGJWBr#OilXkiO(2c39mE%@<be
zU^PC*ib$(N=g}2@bWk{r@EuFnJs#76<H|px=D?Ddhu;x-d1a?RP}qNt@EuFZEiT${
zZ284(HY`b5bgq56sGX!T8$aTAEQaAiT`JLny@`3`?ipHSFFLF)L9<{159ZQ6q&h}J
z(?6&4<=tc5zq5Xy6GQ;y-c)*H*ZXN~-T<~tokV1qQJSvt$T&o-Ddl}kgvZ?iJMDHp
zjo7+=XPOaATXs?+GE>#sHb9AVTEFagFmZPu6oc~ld(#feBll8jv^K5Xvnatlia|l{
zHdAy8^zFoUiY;x|HQE_Fy{%QqZg21dZ57ZJR(dC(2i6qmtZM^wmo?U5bxxW)=m?KI
z#F2^iQPDG=rXw9EH#kM-KHMUXR#A&}!P64c;$|Pxy!nsgR3kHHBJ*uSYcv^&^0ZBp
z<@nz<!7AT4!32z!OViT#Svi$QQ?<N$nyE{Lt?LDTiFWAjB8sWLVf+FN71n2eBY?WT
z?L`Hyrl19-Y+lyQ)=Hm_V2rnP*t#2Fr|d~-&A7TtrOXqD)m3Rqyn%yuwZ2kBntD2q
zwj$x7Al6~T38v(55DV)m$LuKwPN6UInZ*ICG&v^gK|iX+)X)ZH_*i|r2AMVqZx;YB
z>#&bcY)bJSpbxrfno@Z;VEi~VY55W_Ok<OX^a91aZ|ztr!bUvB&>Ys)@t}y+9n@ED
z+$rLj#sPcJ#2DfS_0hONL>fZ+2U=qzglBjkfv(`?jxH?2b}CSSsg;K{1t^rM<ghvk
zO@L0fH*gt|I;9qLpsUBh_0`+K2~=h2>r^OQWz79Y1qyGbHskwO#zht0>(3C8Dz6r_
zKTwG@NleGJ)*{kL`9Gmia;(!?U`JzPL<!hfK(h;={c?;;R7Nc8hY~N1dM2hb%+Bjr
zPwvT00WEdlhtKH<7~T6JvXoLXF|GmWT*)I-MoEX&(P>O{fdeG^1*&VJQH6du;&A^H
z9GXM_N&YMtl~<Y!4F*WZE9;?XG(d*=>>mT9I?1&A4A0>nL=mwM0W6!uXu^F$z{tll
z=|DpYULp@GM!^$%4hRmzYftC3I6d##6mN#`g8;q{@~H{(vth|~+CmbB7bs~i-y>0m
zlQ2F<jfnh?6rIb8O!<Zuw5YmQfYL9{gy+Yq1ah`3PUwt5<cmFXMmBy@vGb@?-JP57
z1iH4RFZ5jPN39oY5wt@8ZFv!pMOdj|fdupy$h@u~6EA(Z1NNKYk?Glz*HwErDk{2`
z7apa3IhsT>x0vof7p&$hqHFU7Gh;ZcE=9v2t?@`3b7V^2Q_-VsGdf$gLI9D5hOIUY
z5rr;}cGabBBBcw4@u}I8N-OQ$W!2OQrI2=7Jvb{pf+w1)q;yv(km8mpPyhv<(O`Vi
zH3-eoUQ$IwYA`Kml2f0BWF?PT2#to_B(1*(HRsQkM$RBX2T;i~kg(c2ya*K<CXet_
zUHdmADtzXwY;YT({>H2)g2rq*C+zO{9(jFKnN(q1r1c_oIw>B0!}gDZ$|qT$r}KD}
zl^9;&A732azPbk_{`h6%byjm&cfJ5D;{(4S0INof_#}o)ElUfghIKS<9H*;CNI}z*
znsvt*;2R$IP?HBuX@IZt*l<|4WdKVwGzqEdmrq?X9adqf3hKGLSUQSW870}G0)584
zT_#YWrcZJ&Ct#)alj2FjGOMO$D25~y_2A0(2%}LkrFK%G_@Iz^J*gt1ct3-i@z=h2
zk84e8*=0qh>w7I|z2K{PZfqh7M9h^biyVy^;4M7<xhOKai2otNvqTWt_jrqIW2?jE
z6}oTw;Z!zo@fzS?c(lRAE^Z>=BoP;#L}Vvltve5&*BcZ<w}>E#EUt?5H#}@I31ooY
zhzHw@CywSdhyi=d$OIKNJzkaNuEiC81@74loF6z#26zegWpMV6n+RaTbDVj0*}wvE
zHb_LqG_5%!@83tM>B&Z!bnXyZI2X^A+2gSL3~>_ZV~Xo>!FzNcaR15;uHSfekOl|%
z6U_xucicoE8c1qMM2=cID>bxEF*L#<qNL0F^g9~4&u`4{h%m`Ny7p<Eww9*>hH(kX
zXL;2SDV!6eUr}Fs$8CN^1P&cbj*L@HpBYj+wnVKt>Z*NM*oDs@GrWPw9KJ_@enzeH
z;VbhL;W@(<xgUnubNaLV9WXkl;3F)qiu4%OAp0-_^hm0P!|G%-58?B9#uk};CKY8x
zqEsIEB!D2++8;b|?)5rgSnl^!uONG63(x~pi1)H)5Z+^kt0I5w#H@GtpH;2^cUsIP
zpZ5TOd&euhFPY{pN)nTQ0dT2sQ4Csq3Pp<vCvvyKUK8stD{&eN#hFVN=r*pXPiM_-
z6fQ~0nK~-Vvy-7CY7JUT+V<zDd^Ec$p>rL@O-1o8Vs9$yb6kyGLOu}}N<_|kI^7j@
z>n?i){x}zV<SF)EBE<mLQDVqrgM>H0H7V^K)@^iPiH6+4!*w|UA~XmUBXLi?7^SkH
z=Y9--E!YxRH5UV#q*%_`rYll>QCQs?%@t(dc-YyIFl7xYMjW1cED>=9a6lqUI?GCz
zP<Xv%Fqe>FVy&t6Xq{TOWTs>DKb{|_tC6j;lSKhtK*2&LbmoB0OF{0ix(3a8WE39x
zeZi4Plt_oHY^IUY78E_*Of-T0+5TW2VMqBKiZsq}CDTMYiyTFIz)I!@=#1ou!&`Vy
zrrh-DTL`(@!oHIaEaM{=YG4f)OnM!%ky0_NHFLxSsR&--YLh?<^Q15UI*F_X&ErBR
zoscZwVRZ=231~VV31LSjO-V)14CS|Cj_V&sprxsyQEsy{M&HmeWNWY!#-L-8NfOqC
z<`~q%i*2_7m?br>^QdjnduJ|Pt70r4A5dM+7SR!;Id5~!5vaPMJ!86HoNCoRVCmgT
zwQltX)&?Mg^M*=gaaE+BkiuCRF+hEi%FKABWe!6rvB!)|$|V(LU2BfI;rBO0Ob6dQ
zdH)6<cmnMHJx&qgN3sEkpkil*ssQanqVe+B?1kK6_PshFUo%{h`|^ACYVG8$6K`b+
zIpP8>?M7Vpfx_&DY?nZs`uG;nTEK;4Pj33A5<B%yu~VU5-LN|qO;pG=TD+~PA~<lZ
zaHDXLiq6e7+aHSI-IUo5=|bF-L}ckm**!>0*WLKvUAt4fTvt%FEnLM=f?Wk|MHGT0
zbFPTCNaRjf9h+tg+-Z>*mmQg$krq@Uy2pE*I*6PfLkqk$DkKxi#T_J^98c?HPn!_Y
zv-1@90DxZiCjva)iJBfb7{m2hIS1Hi$F>78PU#60!o#WqHX16*>T?4LJgSo&&;qmp
zq0KuqvmOq>>>HjU9N2xJa7Dj;yUt#99DNYW@~_!|HAy+Sc)`b*eVZKzA~iv45ez>o
zl>nRg=`VPIN|%}XDw{};Z$#<Ulrc-Ow3PO=#_VMq(q+l@rCO{-M=UWNLRSzr5N!NV
z&e?ccjX(|gsk3^tN&;!Z>aJ;4!ODq@U3O%$Qd&^i;eIRA=ss}I9Wo@AD-~!t{6cA&
z3KOjm{|y1VWtKxG?^zJ);xq#-s3p|Z?(B!w;A`@03lKgqvh+p)S_*&FOL4OVQiusB
zdhL3-<fJR^z90LkAgP?`qebwl-n5%Vka%JmJ35u7reVH|&MjH%CUo_AgcST4V+jBE
zV5R@f&hR|q*lq<{08a_W;5-Y>7f+n9Ivve?cnWcrFMHa6V=bt|^|hywql#aQ89}{d
zEwj}+C#b7*)2igoA?gx09>$;DrmHl^i^RE_x?D|1?Dq(tvrEKYQ9a+nOo`q}1)2wU
zIqMY#s6$-PVRc!Wc`zNKC-vFW8$gY0A7NU>u@+Rv)C*JsrZ;0r-a{uICYzm1(?N6K
zoWY!S`bsl<JKy_!$P%z5qa{W6bygS{Wkz&LUAt*_*DhKs0T)~tA*X$$nQ&NMdt+w8
zu!<JHQ@8EyiI-0T#A#t&(R}NC<=Z1W%>HUc8=s^ewGeF1Oi(*)pEtv%9fDd+Z=yeR
zBn$G6t5R*!0*h#?X4?(z&@*PW6aWnzFOF;fq65o@4EVfbLo^*$&9fde9sHTF)<k4J
zsMFbP?1*dicBKZt<y00;g=O+8#Y_b+8Y)9AJ5DwDv^EcF`mCBdN=wwQDtSB#9M>hZ
zpTSjFToq|D%y#Co4A3Mo%Vs>6G!wx^*keW}&PPRAedmqM5Y!x*gDudsxND@7W4n1%
zs+#R3MM7>QZVny3eL)5A>{IqquoLFWmxbyvTov!cu{Z3E9j)bB`Dje=Jjb3>BaAm-
zgI8^`(kcEG)*b7}w`PGBbzC#X7-!y;-^BtpSK?2zQmR9pIwFkeAh}Zihy>?ir>+9k
z!<YeQa!iNnL?3rpU4^C&9K<6`)^(UhNJTGCJ$`88f(=l9bt?M!=Qzeg=UH1ETj}(Q
z3$`+3G>m4ay7x81Q;}*!hdZopfu<U4WRGDoBC$R#C_~aR7DwKXQ^sIbP9;$#v>UH{
zGnHU@qBN*mP=R2XlWS&X$y!&kEk&fPXva`TE(21-DSJh^zGHVxc`0SCGtq)9C3U)@
zyBT`F9!LtwIaGK?E~J1u$qF3-DigKSj8_1ofFu*S%V(*_V51kduTjToX0@PlUdyga
z6muUDa5Dt4wkKn(Kt)jXkZnAyic})1g7DVpH8v{VQ-v1XDQJoyda^8JL=r8!g^}mD
z>|W+@_-`#60T7q&p*h4Dr~t}S&{RkIsX&yd8BaP)0WMz-sFoXvNSC_Kqg2`9AU1i#
z2`;hWsp7OEPk}gP9Wg2LW;13y(Xn~TcyNl8A!=w?!5@C|m5aPLSq3tl6^DnbBIQ6n
z&lf5Klr8ds8Gjy`ESy{HF(cEtOhs8e4$p5$dn_$*D3d8xAOVvD+L+x904AW6xn1B}
zyUb57P@w*-@D!xlG&enQS{TRL)+weXDQ{GWk#?oHW?S$4W14uIfHTnnMCp()4?>f^
zcB<bU<x|n7I4<C3H6#4M>A+!Pk*b&;eX*&^{A^TLz18z9RBSz)uoZ6e^3KI+?j=Mc
zK_k#;Jj58pHNoRdcNTaN<8BCUsiI0|4Mbb$iF-GGCj8bMEO8qD#_B3HPxS@nGPHB`
z2dvht^!Hx?fPf0Nr~-|H2xP2NfRg0WHRG|ujDsNG!y?rF&5{-rbJTM$p=71!u_4^N
z*+G4Cs7;BuI6bO#iJ$(#A{1Q_38}t(S}Lpc<JsAr;s;|eD2N54W@&z~Lq9Qh|F~sG
zcCOZ{HH7rmALF&q(O`CCrPF}}p3hFWIZ!;#N$?DZC=@5>NHZP=CJtOLc>bp<Cay+J
zkKDl@hZntQMjJWuJ~;nNfVZ~VNQyHRU>U+a<s_BUFbqKBKtnNmrv?}gG9v{ix*L|b
zppM<J^#ulInJ5<D!Rhh)(?@Y}C4V_VLPHW_D<r{53sT_NEJev_)r@D8CJH2(N5~OH
zCSpKE*TRQCgQyYU3?j$ksz?zKYMFS-0EtD&oAE@{goD7?W7cdORFu`{L-jC{Y@i1J
zIV=+r1!xQe*b_Vx3WC9Wb}9~1O`4H9+CCoGvMI2;^qW*}aw%}e0Yt&zD;|U<cnwF!
zb;g)YapCY$;OHtIr3Rg4aaE*1@TN>B8K3~+x6F7tV*EjS*<(f~+D1iLJ^nteg@wtl
zRe^i9nO;_ae8Dw6%{4xt=}b7$Ylq0*`ukLc_sIr%#94!S%I2y_qrq7-6=i_Dgws2$
z4x{k|W#<`NWTK2zl+~|takk>)nE}*-qX6;%+w)}4cz_}cS-TT}918g{5gI_YJ(-?g
zOjCUq(=N|rkJ@htEe~#g*y?bfX-BnO<3Q>ii4|^IWgW(?Bqh5@({=tG4bIiKL#pXB
zdFn`7poy)3nfRtPl3mH)$4=-vTQ%qXc)+WYNNvFwCYO?lX;~p7S7H1KSiW&73CA`A
zb&v)Tdq(t<%gx)x-yj6+ge!mqU|4g4gx-LhgdsQM(YbK~{>By^DEb4rfE%nV*Cyd2
z6g^AkVN$$Y>9-qY;Gjc7asci2h;1BzEzd$!92GDDHe7^B#%iuX51Zg+;I~y~%$ZIq
zkUeN>gH?feLXDd7Xk<nKwb)}uCRC=PtgBd+^zhr{_6x?xc$ijv<|PUhA+jwgkM$TE
zAS=(bh0O#=$Al9j?5cRp;_t9-BF|(z+(7Uh0g@FcyeDXft<H}31`yz;`o*dD{a?oF
z%Ha%IfDCzjVJ%cla3nRlJ)MO46lb>>syFz5*w|!=DN4y^N{~T^bz}w>-=ou*fgHGk
z*5caLYRwfC?$}Ry)`dj7QdeK_x8ILso`Z?RYKjv`Hum)L!hvudX(JObnVwV|lQq0(
zh>RgEgS8%^2gJldLPntfcz7El;BBDgA>(&U^FQ1(slM0qn!PhkZ&OCR{w%fRBt#|5
z=G|%LpwU0H=?&A#=T%!v2G5`pD!Cvh{XHsrc{Pl_!SzHM1{bVoQzFJc9^Tl|8_g0w
zVS`lijGro!F31j$bQY^3=~P4YRzk!!CTZ`HDJ$cN&~QOa*pZQmfQlKje?8dXnYiHx
z+zM`Pf!H8A8OISIt@u~>UB)&TO<)PTdTL-z8#O(y?KhCz@ZB2{ORP7?tT&uFZdFrT
z)9bc}Q_VF~l#mtiL`oRhz=$d#HCgKrc?Bssvo)Hj+XsIRSTvI?q5;s(9Y!qS!^4Q=
z!aFfQ0S*8FZJ+>@1K0o%e+F=tu4*BC=fS`X$DIeV@pl8LfIb26Xn>Rz{qk<*h_)!o
z8VP_!K1?I}Spl=wm;{vM#zBQJO$qBm2K3}8*@VI%=S4<iBCEtiSaiXQ#KbfnOuFzC
zWEuc!6!&M`zi`?v+qKmSjzA>bBK(PM!n5Mp@%TIe&xaSxlSCIW$9{2qn9%s9s{aXe
zfz3;>p5UqQivR*aAiu<zXTh`iXx_Y_-@EwY86W`wHJLm>b^PAfyn4mI3{=~%B>?dI
zUAf<WZy^!izrQut^w+;WBOed|VF0;50U+z#t0Zhcl0{ht|6}{V#SU5JQ#1(|hpo54
zO5e@5S+~^|SQtP>jiup$fD3KtLLVkfnK5U>mYq>}_=Mbf5b@;2kG}wcg7sQsQ&`xZ
zI)sQKAr)(^agxYnm_RN|wp^vkD3z;JrCx(ZO<HY?F?vGr))F6l@zK|q5FJuWbTQGs
zFxV13(o75p!5ni_Pc(=&mZt@?O|oC74qcYf1O*FhXg~`b=)jl(Lq@Dwuw+FK_5>U_
za^Yl{Ghd^5^AW^Ng>a$9h!93BQnW;I;w4CzEJdmqISS>;SFFH@B6X_OsMSoNg{zWE
zNEP<jYlmHS+lhdv)${>?bOOMb0F(>ZeE`=ZpkW6v>i_@)s=nz!zaZYiMwmz*z?NPG
zpLC(UX_POf9YX?07NDhRI#ydtd2EkuV-tC+qU0f@6+12!BFRaFBeGyeOi(=N=<N<C
zUA(;Q`#nB4gk8FFLw0x1ZO=ZxGHfPVr^3CIyO=~F)3^i=<r`Rf?88h?dUO8_<j9pG
z?8E0-cm?#3EmW;f5m%Qhi=B`Zf*@-&Qi$9BIibMsnCZbLblWA_h|1cnYKtA%vD;(L
zVy2uGS+`WI+FpY_r7Zh>aFf4h+v!}*o$ko!>a})GB^<TSer9%jFCz^HdwYIfWmyNh
z%PcGUv0rWRZp(I6q`4moCWSJ%K)@;L6l1wY=eGpl8&=iP5fP@C0Q>@lz~0l=5z6F2
zE?q+OO;S<5E=x@Mo5XT;QjS$X5Zx#j9-wD$s&B>HH%Rfmo*CCZOIt*1ns?(K(bXXy
zfi@=~5@#c$x#&*0ZLjsnd%VY-OGfsVwwa3)XmZbQz%3{vsG^UMpR&B=#aov|b(ydt
z7D*Z1%k@*|m`;X~HFj&%gdmQTvFV$<iX0Sp%rINHBzi#ztO6E3Ky!yIIG8ae7Sq2U
z5|jNgH*fu(iwF1CgP1Kjkqun=G4*aZzYzS32VZgHl)^ez#ftW@_g1s<%)@#_LLdo1
zievRqYFlBnplu$M^8d?G=h|rbjSN?=Fep#*b%=z+?O_{Og}W`uXVAftrl6irW28H8
zT!$|oUQYqSRF5Oz1RJNdvC!Lh&k@B?9>s(rM!^WbW}+6dFbIoZfDi=<B>)Fy!VyUU
zv=4x0Lm?j(gq6)BZb=)!@hIS~%q(2B%Uj%Tg2n!DR4nbA%ab8Fxw@<!rxR-nsHBCG
zucfakP5Wm|A3c}eke0S6ohfj41<9Bj$3||Cc3h*iJS3}L3BuOGibi)pQ|S;Uc5e<4
z+?x<<JgGW0l?k3u05m?gAk_V>ixC7`8q<L~{0tpY4wH4ZhyoCffKAuXy1Q8JZVnzR
zs}`#ZvIaA{VOU>>*m+rzwIx;OW1=co;M*_@Q_a{0*DZ!!T4&3U8X+ZHi`=@w!{h<@
zl;VhXA~HEqx;8`^?<pIhZ#by1>>u!1W@q+j8}f)AvYu6d3`?(j6?W}kZVN(#a%8or
z0+!wO>1A%b(?iBNv96?c1uD|SRv!sT5v1|q5SIo#lr7i_Vj*!WcuxgaHiH9(Pwklr
zz8KeI2w`{bdqG$}acDofSR;n17q*(6#Sf0O`SUHr4v5_XRmkgq04Pk;x>4;}=!QiI
zg~2kJTq*%ok~GXBlbw9<AkmZ%fN<n(zY?)*Ck}N{5xFE7sTl<zM3OwJTrc2ED-;n&
zp=L=z)tERioK}W6J{+UfA*;~<xTO+XaICmep{uHS`zPoWc3ire=DLf_XUYw@1OF)E
z%amB7p-LFQf)H(kA%{U{MD>f;&e_Q){0|7LWDqzJ(j5?(0AA^y9Trb*xr?=GXmi?@
zy(}|ghp57)iaTLPf7DnP_9BnLiW<^m8uXMrc-OnPhY0R60-b=HuJbLt!h!{F;A~6B
z7Aw+Ta(v9lSR3#YbS5tNDfU?q)W)sJI~3SP8{uu1)67VoNV(l<kDh?eUy<7NUsHiW
zD!6zl&M%65Jfle;klJ`ZuDj~e>qbUiT}x{^Dq&EJF$K*Iv<U28zh`ha_dUn@Q*}hh
zL}f}H=BVw|+!H3#WyRarATZj-NXJbQv%N5X*ocp*eh_>w4)hg#JmS62T{^hw%G5rk
zNGWS8*>V}~j}BseU#Hzl^J>AGU7}R|wQSn&d-BJsjNhtP?2(&UjIhxtK)&O#%{l_;
z6vGPCpzUjlK&!$vP^~5mOnL27*fG8CkGfFkK5FbViz(>hVIhwdJc3?{YrQ^_Zn2C^
z^D9NFq7h+rt5%evd~O++*_d?RULzjywli8B9$Keffh4(RWc{YAU^lMlLT%~tr8a|N
zT{2*n8un<>T9nHJsmBc?+KHPWp(0VmJ}-trT{{{O#JaaZ;p*<34C{95huHThdJ3#F
z57QIdzvS8)g9c1f?w#cqk2Ctgq0hNzQr?u&c4;ZD^i<+&qMI4eGe~%GichZ7^wCQ)
zTu(G*e+K<C>zVw6Xv1qkT#X?qgVam=9o+rux)#=Udv6;_tcR_6`zBs`w4~}APwksP
zzO%FM3Nkg%%W$_}jOgd-JLRKQ*v#D-6Q;aUOV3KV$Vvtz*%U*rk{ODLN33A9Z7{rR
z9kfyF*X%kAqZNgz&bPKLgFtYpLy&4U<VuDdF6}y6vA7v5GVV_yZo&#zLzLnoHLf%J
zxN3u&SX~p`b6rd|znkdV<}wHU{ZZp=BR%KP_LocLt4MM6mXdrtMi}A=@^L^U*Xui#
znXOPpsZ)+fl_EdNEG=W662)Z0po0WZLtAT?%Y2W_-N&(*M(&go>Pf>WZP}<(kbBx(
zElyXBNneTRs-lH*h$uaXvK4)L4ct+8>>^RXNKMx*%a3(|`!nT;dYCt?bYOTA4tOh4
zLdnD|Ib&RxjvBJBp;BYVuH~ll_oaUqo>w1U?MfThq|+u+k?@4`iD9wMEyFI;csZZQ
z+5Dqc(i*=t8WIw^OC!g|p-S~#$TQ*Dri3UIF1V;GX(P;BGHQb#(!sTCTmcD1Byvgu
z<IYgkj<SB#l1nrT*Qu*JQXTKRr>Cowxwo~qDb3&eqEKLd%5^#`jYIqBW!xtge7OUI
z`T})?o$X|TOt7w0O!FRB%P3XpG&d=k#&0c{yST_cIB@fmKp%5UPaFCMd)z!eYmYwM
zQN3Vc;7F5>x(j5uyT#2PXVKQ)EZ}!*ItD{@c-VX~8T8iv>>vH<yXRsm@&6Of_ups3
zAB~z=w2_|`#zyRY?e>&pLE?xM$#<-eHb0*(kfFDpJ1Hj`5)&z7&Q_~McN`<y8Ua{m
zQ)MRF?Rc^~Ik{ub9yji&Hb-n$ukO{}b|_kv$LSOOT#8>cbshvb30(;oXmcQEdt^?{
zM%E)v36^T+^n5(6HL1&rz!Hy^w3pWO&SY$glWsDVThnPSBecfM#7nd(rI`gLAWUQZ
z!>CDoMQCwI3mJcF?j~fPX<Q~G6q1z9)A^=K&G{_?G5fn!GoJ-}HU5~XSWj5NVtieM
z*el47_S0{1re(zJdo_$$@L|@pzGMmm*JsA;7GmGnQRitN7}>QDaT2A`j?~^`hnq8;
znJ?+07|w6!XF4d2d!fgar%4a5=MFzu|1jTZ!=1l<lq_M;`gJWs!6P0WN(~u2)410l
zEhxB^CDV=S<&){5H3F353VlH!Yg5XHU#^fZwUTDi=N!Tz5FXN_bIza^JLUA+yc*E<
z^pBeL?bB3$qeIptsN9rM@*#p1o^YpqrtUuRb-EZjTX%M4v-WN8x+8yQXZ3?nzE2y}
zwxAzZzDg>7^Cn}fJabY$Ss6i<DnV8RnT&Beh1?=Yo4rWcN}8jx;zX&kM5`kJ^@J#@
zpX>!X&)bi4G0ogt$&5D9EaQwELRhSMzpz2v|760tO^32hb~l}zd$<JMC<5|s+xq<`
zP|sSb(6mUYLC~iti&nyf4b4kkPghY2CM0I=>^L_~$;v#+85}FK%B+jrq#n?bPaFZa
z>RiTvB=@<(oaq^j;+cS#Ti4(whN{MX(%Bf2p^BNWR?OKErYu*Fr)8MAY{-J1rodzy
zI_2}^JeAxjpP}=7j<T;wqHVVk?Wj==lpt2r2sxTbCQZ>IMp;TvdJJHLF#%b#7+kea
znYz8;n8}Q|0zB5o5zBJLnhP_rMrhI}3Qkm?Nx4c9OWjz#zRgZOo$*mlckal~CpQ$H
zGrh{sT;xkA+2Y27B$G*9W?;Epy2Qn`d=&Ts^>mHy*=FX0O!&Vw{%nm~*l)|UW&)j}
z?LSFhAbwvjJ`+0V@QX;9J~yYF6{d|hWxGqP8y^eZvwTjq1f-E@2ZFPFMpy)4dYy)`
zea>EoGHv=Ki56r#o%Nz(Ek!GYj#=r-XildktTQagir|zdq@K-HphioLP#X=ZdH~QU
zOLr>*BYkrDnOECs@%Wiqz0>R4UtSmvk4}?9`+&qmtFL^G;up(uY^pF4$*-S6chHzB
zrOOz1k-NmGeMnBBclx556)?o+x6}9Ye?Qtx!BcNvsuIh6TVKpY1|E4QM9H^yRWOL%
zd`xx^-zy9dueXtLXk+eCHXipIqpnw513UO*BY3j5c3$}{vzs#f#}C+7KNYq6%p=J9
zmY4YvDZ5<K&PkmZ?;DLzjb4q!Z&My>Vb&cq@70LarzU<~$)g2TeNbxM+4!o_L>Q79
z;dDCsJdWtp@m-UB6RvP$`vh{q7De5@r5ev<qO7^);{%gxI{cFf;pVE^h7s<^HAvRm
zI+vR~donrKo9CGs-Z`8jD>9(38+{RwpBtKZb|_2w<uBeRBIRVjh?)yzW%1){6n4vp
zy6EHg*3+9ofAWND^9!!}nZDPh1)<?@iaY8n<%M=v0i3ivwYVf;KonJxQgRWThuR3e
z(dIzsmCeu-CY1^|>1P5dD>7fE4C4+$8LE*HL`1F#;S7Qi1_Oa3PJ|d?Wg!fv2&aF2
z1B2HBr0iWOhDv!}Sm#>V?aR!=OV!C|%llUkpR+cqw6!Fk)Yh3M);do;;jj~YT#oyC
zz$#0a;{0P-`mf69@J`x!M>JmaMnW=({Ct2e|4V4H-h3S#iO7M~^oxCT*h9mN_DP_;
zYXzS`5Tn<q*U*c1{vd^=Y?<E3kdzI>_z6TFKS;BZOIxRd>S0FLx=mX*5I#R=>TYk0
z2HnHVM-CdehG#gR9^{o`ql;pm%oq-`iZp6C)40t6(_14mS}9heR+mQSXcpwdvwrKC
zk{C;&<A#diS-*C?^F}O%P8)z5D>7Fmr#vDLh4BhNcj6JC1BV8LKpco<40`kkFa#8E
z?wY0Y7T3ou;`<fHE4ny8pzku|`^{A@<^QsZKUT(}4?b8$uNys>%z_$utAF7n3IFX=
zulToc?T_r?r;>W5Izr&;8haa?R}}TEFi<uVLRk$ffP9$gTTj%;RF%f6>8<ta2NG8Y
z<CsQEpt|*7>*3}@YZA}0qY9O(8XO~35zLe3S|ywp0wZ<xwrOA7{uUy&n=pj386a;%
zFjG(j)x&op%KsNVggRU?JZ&A?+^d?d{_rC$N$CxwMf(x(WW|<BHI*q$fCD8_%A_eO
z!Ozz59BkNPHz>;^rFczuGYB$j%xKVK8hNo4zfqrUV|(Hbqoy({1Ft(SCqJPte+=AM
zr4=2usZ6R-Z!sAS7Go-tTG!kTUYr=pnfvl<!%Ve$a`5XpFRRWDp~^Q@uI9Xr6i&2t
zEfbKOkclHGv!|rEj(c0np#wvmCIQ>28m}E4A|wPrG+1|WYE#FL?+Y1+@cphI>o3+0
z&YU{$;rl|TQ}BMzBcL|?c_3%G<m4@L^E*eEN<u$hHbj826`Sd;jIG#5ga2?Uih?e8
zeMMl8MsYE4G%g~TWU9ee5sBCO=LBPuUW8^_)D-4L<z;^;mPtzPVJ9an)`=Mr+D17X
zMgMTH$>j!6o6A_B+nJNdTgGydxB`w9zbOT7UXGU=Ks_#8kg+f)kvFJhyK;I2F<W*j
z&&bU^p3spXbme9ng}})&kGG-esWE1l=}(wql8(@J(pMjkYzx=NJKQ>)#QHFt)M+pa
z(uZIcAZ0}s%2Z*zk5Gl`WJIL9VN8WQAJb|L76Ms|SV)5w)A5-x6%7sGrZPdSl~ekP
zk7p$p$HUtq^>LrsYe&-46Q=Yq!%QqS9rfA-ZY@d?NV}HC+Zl*i5`{+FK$6P3uo~qK
zeyh;aee4r6+nsQx##+~OVU-!iO5Gh7luI#6*VL%9crcd-FUrI2O2S4NXMZ4JMdT}#
zVYClZhJfLL2X+XnEmz^V*`)kyu{_z_2nz@Sj#&^BZo#=@@$>qAx<7(@9ky-sw(JSE
zdAI4?n?cWE`k=T$L?zT4O$<%4kb&B^@U(DkJV1IZ#)*c?O1*;#c=PkGAQ(f49>av_
zp#K^T#M1I{H)ZkFHUztvCIf=0wU`A9g8=>Y{5^EycgJYpKkEAcF%za^50bH@+Lq1+
z5E*9HHgCP7I63yjsMyxOR(wKBsZ~&5kv>00r=fY}IR|M#2t7pVk0K4BNJb)`i3>^u
zVx`uNZTIcS`=gEZJ^mKk4*oqGn}NKYAX~_gpu8ZCG$l!qd77A88Hn&QrM?P}V07Rf
z1CC=WG07P81OQk&C_dg&b)w}!nkH-07g}rc7zwkfk95*#Zg&#tGZAKRloK_!-2U(Q
zu>n$4xEin~&ngs=?tr83w_>3&JJX{JY<AkTqQZrf6S2&d>&i9?|1Aj3&Z%}*_Q}`K
zO-fFj164<b<!ou2*;m&Z*@hNXL7A5HiIO?%A3<Wl0m<kzxC3y41m(N$%kQt*Di<Bw
z4rh6h*KYRJ3`S~O>Eat1{356U1R)o;T^NkLorP7p7*|DOYbck=z!9@v*Ts*h%%s5N
zyh#c2YP?9S(&zIZ4aJRzx@EDHBLu@jPsF~3sT_3`DDDgR@9naW59-1Mo2#b04pg%d
zMRiz?VG*&CHp<2BGKryZe=(^-5hYI0TBC*1>&>{Ss7$OyEGqr$w+6@cY|vyab6Uua
z^u~?M#$S?uAyH!=4aBUxx{lf~6Gl+8MvIw|`MlJ2cYv2i1l6-U`?E^1tmQL0tAf)8
zb1MW;y+}|udGdULaZ$Mu0`vcfXcxJv1ois4hPBz*Go7ZnK>n3g|G4tX-OX1t&R5Fg
zyJN@4pR+8Vezf_zP5W%pjHBS-Vfg(urg*xq<~)j?hckV(6NeyY6tj!y6^w4Sg$C0u
zYM5?wF)ve<E4N&c`TZ`uusG2px1gX$)*x!gyku&YkyUUsd%TDCT2CN3t9<M!lRoy{
z7Xxe+T*wq`E0C~mUNRoR%1OA4HkS!A*@mcBW_V#uY^(vt-;h}ekkc1UmzG9%&YAns
zb{bSy|Msj~5iT+j7CmOOqD%rFSQAx{M9oCy3=n*_!+rFWn+7?o$imU@e!-Z`W)nhM
z^-6>!5hpWnP(&|azB)U;xT&*7iK;{OO0c2Fu{392o#=w-)gk##;L4g%SH*J69isu^
z2#Ht`d6*Qe`%<2`s*Nrj^FHgC)S*IypsuanTHDzHidfPzy)H&+c(IY=!s!1y<r17*
zXspmk8z@Q_Yt&O7%<ZQrw;wyS1gBVYO<I}rmoop`&X(J<L{(wHsgNtbrer`$7M4Er
z_kZN&QbI1MDfZ-B!$jqbrl`k6Au36+WoM+sBeYhcTA8;>f}#v))1uZOEz;JxpvWv%
zQz$rtpEm^8)M&Blnx^V4^v!ItZsLR-VjdS8mSGFTv&%g-R3z4ffzOszY?~EX!WM4e
z^EU{oF?f<2GrL_lztHM<FFcF^&L?J%6SMHw3-}-N`Lp;uvO0JIdzIAKmPNR&2<CAD
zCOU)`4}lPDrkO8dbLCubGp3nMYAs(ydG@tA)rxVw%h_=`XSICBGquU?@1+)FAgx6{
zvaFET7IqP8<p)+%2Vu_v%i^<>yDN=@=W}>}fAw!)rnl&%#te5h&z;d-G%imEkxlX+
z1Ip=C4XKk#ExK9D%3NkQmf*UR^9_OEhO^T(Y}x2h&;LLTB<lq~@%cYF2`<A{FFS1x
zbYN$4d4Vo>eQwU4oOH%hQ}CE$b}EC)ILCfx|8e8{SB2Vs?f}|9m~_r+o^>sj{A^{I
z=?ors#5hwk!QT&0O<#<`lT8mYl`G?LP;NRG;bh6U;MR>kIp&}Y1_y=r1bV1Or8Yw7
zq>NwH6*CT2aE89!)<(G|jOj`${EGQ8rqqjYgWf@G!UxqTosz%$Mv+PtN$~AJ5Go}>
zf`J^XOy&McDgIe#|5q-Rk<FzmvZ>1(o<<Rero9shM&6lrh$jEjIUo(D0sPeCKIR5I
z73UvTyWavhZ-?W>-XyO_{7aCMe<=;G<zFhq+a_6hQhRn)FY{jP9*5gd5FckN_C>fG
z?0vbvJ!@H-xB15MfjZlk#qlb3U^FLH(c>9#%X`A~DC%ccViQBj@*ekqN6{1VkEUg_
z7sYK`>IT+qzJUi-2ES0^;IlS6hVeGohKKX5F0m)<hGJMO&CCp(j5ykbjYXyI5zerY
zrCJ~G$Kh~JpkuR=!-`SOw&zd7+9D1TM{97sYTw^vYbUIgfi+bJ```AU%N}ANd#>o@
zN#?;I1crL&h!g0=MpXj?l-?v6&T5kbdYhZ4deiyp{{#P*-*|rWUGhnXmSVoW)>B@@
zlbr;z+u)Edz4rW8F}d7%j{y!Rhsyoq@5*bLaf7A@9VBYLd_`^FxaDxqg<Ih|*1^PS
z{y7){;DwNS`e$mJ9|&Ixl;>VJtj-N%0Gh8&vBwNXQ(Jbx9rGA6wUvVZ3H(Gk+YH+C
zLXqR}c<R)XM|5Es!CKOM-uBW2AM-D%E~)=`S@oViWTPaIvw6ll=AC*TCH0>wqUdL-
zl%IQ5mNJ%Kl%3fs?p-35n)yPk$QUr@1adg7`rdiK(8?dZ8+L<sMg#kpeLxc5_W>-J
z;4C{BYR_%Ao~HLfTPjUPdBQ}9!|nLekMAIUuJa&*;%AD83e{TCgu3>uWWQC+{vV2c
zoq5_~<7qpB8`OO1J{`|`D1-`JoqtA<e>&gi1!wq@9#-fKI+H&A_<8BHKw^An7u?mj
zHANQDaey(#bhsOh$<Ung2V-Ovy>qBtW%K?fwHI3lwW*@lYmB+n=O+I5$d4z`b;B`e
zx<Ld_yp)}U^5w6HJ1?8VtulMdSNY<nLi@jQsOCa0&5{CHwI|ra6aN<Dbu|kDfxM#y
z3;`&4m#V)y(agY3F!p(?MR<ERgs0#ieS|&u$?dBAbKGMs)r2oa41T2H2zKX~a1rBn
ztm=f$g&Q2j_JA_c#p0lq!xD4n*uz0yA#2C;%A>POjVO?fO7?f+M){KN-N96FzCN|z
z9SZ1V&usR;PSt)=`EzEk-TpxakNdveK0kAqg`$=wJedqM68cDs(r#~2>FY>SNyw*J
z6=e>}ajTuc%N!QUV?~W`I$Wv4dr+-?-uK+FERKwuJ_>C*ct}U%Ti-pY5}o|z20Hz%
zA>d`xL3r-5^+5gEDr-S{yq;$@XV-zU1E86h1z7n-BvOzCZxK|hQwEa0geT#Nf5{Gp
z-MrlD=IDBj#H~I5@WPSr3BlXq_uD_PKk6NWhBIhoZa1+<CQo9IOE$OK_tIH4i0G94
zcEcR_%}d!$Xj+*(A!ru-#V%M`1E9a=6%PU!-5#&LHX1Gywhu{<?*Boq>JyEtYaeIv
z=PQjqtlkMbpd8fq@gR;y%RBt~1jdXMI~OI%wH74+PQ6p>1n=}BMuh*tvdM$%MQwR`
zsEwE17WeyqrG0<rWb>x{BQ5PkMMXTsLq}6muG93xe~cQH{4&)KP{DSNP{`RX5FC*R
zg_0w{sCPjqsktm6AeZegfAjON-7XZYo9ati7`lK?s#gFnBOQ17>y$6tCZU^JDv}or
zYGrwSNq6!`4fd4d8g9NQbrOWzRYj2(_eMD;vaik;5-QP_w=w~<QDd}NQPF4kXHmF6
ziBPlEq%j)<Oslp$R05pQu5?j`1o`@Qpg^afBSi!eDN^{yN4#-^M*mO0QOLD(#*w9x
zJX?NG7ra&~Yl6U#lJL9p_ceCYvSu#7t>ty@*B9W0uQPWR*3RWGdD@reEnTvFIsX8?
ztXLf_C=xoCI|m1~!N${Oyp#d|dUycte<|At{McBK7=v|i92vI+NU77eah}K9$0>k~
zN<*xaUZA6X_?L<KTn-gj<tVEm%$xPz_TcP|88hMaTS)R9S>!*o$lIRKeX%g;yO~`H
zV8YR1dDN)I5LAa5qfE3W))J9oQ%Fx@!ldF!<F-NXPeV#yYD`2EtSEjLJq|_8IDwNm
zZVNHuNr4pkxJhzA9-aq)n$1Hea5r2&x;d8jcit!EvCZ^e%eX9eb~1#l@C(nV#_5F0
z@}`;YS^usA^U**LWu71OGuQ{SEPhv9uaCP9ST$LE;g(X|T;`hPGMC|{TME9j;6!Wa
zoZPkoHB;Z+<c~IYg(zoYp=+(OUD{G8nkStlod@o7lCvw^Ju0=WB=(pSlV4h7g+jI7
zUs&u^G2Ge5vN;R<nHl!Nz0aiYhC41!>#s-3?KNRf-m{FASD(GKpDKC=)!{d3O(7R_
zH&qAVr_87DQ(&`R9TaNKJ(2f+658p`7vz^@RHd3ze3^Qk-5X8fta(@EXetl$JgpuU
zme;zVfT!pc=9COgNTnuv(@c7s$Cz{ha1xL0_W%8gvN%&Wk$!M(9-luTv`_s0+Uz{x
zE;f+FU0nvW#nxv-Te=J`cjqhWJS~~AvP2fp_332(N~zJvFc3!$C=Sf8H6zOTN-?xr
zaxB9+Ad>?)^V!M-99+4r8Rc=8(iOhWM67$avg*^9RffCNkG#Ad`TH+9ug?6%%HL-G
zpsQ0Il_z=^t3Palxee}5xZGxUPD5Ff=2v42<@l6)BHKnq&Q#H03MXHb_AA`JjG{d_
z&S}!@9RSYEEH6wGOVSEOZ@3BHz!qzvs@0Gjt(vY5Rh>hbd6iPhfz<jQG9~e273wRq
z6KrX#K;mbRI`1aD<1e+DvjsRM6;JuUFW2Vm7LT2{cT9T+^wxjEL*Y%#)n0lMr6)dG
zkWk#RKMJSI-hy}6zbznR_QR~eeJC$})=u~{1VKN^%-aEX%ml;;e;o7L90FFCG%Lf~
zL#@UXhu!w<$JPzI*$4e66%wBr!NNYdV|#H~7vaU3$wQF@+T{TvZ}J#CQ@S%sw>F(k
z$thm7y0QA~Tlu&|rJvQ;d8f<!$MQRYU}1-BM?c11U&p|Q|0$o-1Q_!FnfovWV$L??
zq5Mlq4}b*0ICDqOUwI4vl3-4{RnaX!$c24{|E+6hvEL{8qCU8lw(~|Vc_mAyLHOoG
z9xCI-q~S$>d&j){#O^i`7>`tCQ`W;=*!cb{NaVbvRI19rSM!biO8X7HK)F@(GQoDc
zsIcOtBRQ$|nUf(7ptAs#Fe2S01Mc`>@nOdMU!NK{!*5<3%mJ`Eho^;X0|2)o%Z1cl
zF>HS9Rm#LruKnrdurIP)R_<=+J3I4Yi|e5P@w^NHj4q-@@7ZVFx01wnZ-KWOx9VWr
zIt_1w-$#tFW1}DVm5B=m1CZS0LuTC2Z9}hbOxTs}73a-s4fFW(vCs39YMzgMy(?Hd
z60QA$=@?V;DBd`|aW0Q7?iVe2ThRN5A2xxddc!<GJ~_);E{(ot-VaQc2S`o{3iTNX
zQyUddh2D{g8xiD@@m0-*a};xwr=B2S!~tRp=KyE81`?afRdaIZ>$cPm^n<Ia`;M!l
zS%vdpdOo-c+gZ8{TuCVH9Z)G>2wsq=^d!4-YHIkUA}CiXKDD2E0+q}jE{7K&)8Q19
zKZF$)`X;00(=WBZ+8t4{%e$I;=_cNtFq|&vlT^AjN_R43<<yR|Z&f$0UKI_2nSRye
z78@+8CE+xdr?s4&6jHoub%WvT+f(h3sCGp=-BtssOPwwW?A+-WpM5LdGl!W2-sqkA
zWlaW^`JA#Jni=EGFJ3rQonD*tc^uo@>@eNmwbl7yQheX|B^5^A_O_tLqgxcZi0_#~
zFiNiMn-=Ho{H4g>727ZMksoVUN0qXsE2BPV)$a<}n2=`?dVbb!o9r03yC)-!3+rmV
zWa%3DWFr#$q6f7}$q(|n+S@@-`?`1wh{?x<#O@#NEA*rs0-<F|k}89^+XU5^)KIvj
z+DFuy6d+X$ZMg}=WjO3B-x_vhV!PHek|8!86DaMEEsi}Dywn41D_}iuj%~&=AiDN{
zvB!stduh3Qx2{Ddo1N_6Z`(U%1CDK+0=#*wAJ(66`u~{~0rRoowR0@3)TactA!R6x
z!xBf+!jA;6LW1k)iI8fW4xZ+v3j{j##n&dLk1zYX3IrMKT|*}3^Eje_NKe@eA$n6b
z)zMH|C@5?>NmHY5R-O_}KXxCT&oWLo>lG}bB+CqZ<;u1<Eh`Dl4O%IDdvXFdx1u5M
zzu(NWkI%PsW(ZlwgESrLXJ-if3Yy*Pssuv*jj#k|w~;mRoQhlI92a+pto;_rCkkrM
zB;R;${l85=4xRX&8Mo_s&3H=l+yCrSDEhf@$|r_aPIg0%F<>kbVitahc*!S{*36s=
z-dH2qU`}*Cn692rT@bmgNNtx^lmxYQdyzu$IQ@s+>|KotP(t`?7dRz$Nx8h7w1*}5
zENzsqaXrZy{;_*a!c%L%F=A1PrBI+#|G)-*+navDR;ykV5OI3h=^_3qsjHYk%OHU;
z(eCtjrd-W`1;V>yAbh`@o8biixs!3}kDF89sgd}u3H<s9dKY1aiwG=jHgwVV*sfdj
zoyUu-FXi|*r0kd7pE0s(Kbw7H^V|{s|3MsDHhvrCadWx6JT5nnH#Yvqw}9lMT(5a1
zotsNvM_wRW*wq`2_k#PgV!gF(y`XvFC%wMj-g>Xw;|7w58b=fg*3<{5p98Y860EHg
z+=T$3?qi;R<FvO@V8p|D#czq+857_BE)vkS-ibLu!a}=Sx+Xk`$Ak|Ycw-wN`402g
z*ME7ln?S}<8RfauRbpaux}?zCs#dqqJI&OuopQh8FDW9%S$*WH?;LZnY-hOru3$Tx
zuby6pePP418LYfplaBq|5-wz(tN4ZO@YPTO2mnno$xf}KS%^)6I$3RvP5d)96*P_X
zW0SmNlTFmt@`<0>JbgVHQ>x~wxz9`E^TSlW%2)X+U-eSGR4>)b4+MogQsywmlp1PD
zO!3k$=UfFSHdbaAQ$j6qiu5%8ky3rc$~;O+Wk}P;(sISSQl<*h{OnxRTs2qC4Rh}S
zRrpn5YL!~0R{2fRmL`9#7P@<h9?a?Gvlzt2395<BotQ77KU+Ceadr?|FIj%jIymc{
z&V~13-O4)DJ$*lk?rU=BFEE*%*jo(h$UM1~0a`p(Ks$n^tyZX7zf`%(z=G*3-?88t
zox@wEAa2sa;F4coS0NzlSwL2`>^MO*t3~dK6{>lMEZ8wYpl%H3g-K}Pz~bqdDqs9q
zw{+IKs{5*9!IO?`G7sJ-Rt~L9o@@_OvGPazYaN*K)p&L0t5+_!%pf4~0Ikvo&!fYD
zATKZOG@yB2Gqg0D@x@cbc;wkD)G8h5Llc{xtajhfzd%5-!C+23@_>3oJ!~;Z&`6DV
z$g9qg|AxBzy!>%gU@{lQ<8UQoxdK#1N-C!cs-zlfrHM3&Ceu`!CZ_+@gl})(=5D>D
zv#l$>>I(pt1-l#0{E=en0vUh>=qy?Xs}0l$-vD?66)^o~uY-2WpB#$8PSd>*$|sZm
z(Q*)wTa}&5oCAt98A_9oOQKqb?xmaqP(O;;%Mg2U5K3xwkR~a!9y|`lfx6iVH6o=_
zl!Rtg28OaBb}&qlLE2`W6817wEgV`2n47VO=B|Ali%ciG7E46xGon?(?l<TTpWH}2
zwl4Wvu+od}<Y;T5CwEiNuvNR3*w|sJ`#uv-tQ!{^Sfe%<O;c3uFP>9R=4`u)A#dip
zlH=5C_-Y$|!|f6twU<J57`ENU#)Qx^yGg#$v_^Hw4-(?D%fTXrv9^E{r=B~kEqCZL
zbYxN=AR9LFK`>GkCY_Iljm2_vjc92@Nv*2CAlXV)L1e;*b>z`>s!$0N_pnlit3(XO
zG;&Qbwrr^F$0rh}J_1umN1iqZ{WUxD+7N>V8_|M4-q%<8WJ^oXU7fknI!0{xse0|^
z^doCnnYxT7Py3+$7Ls}0Z_r>PTJXo}zEWjN{~03NQ%mxMSTn=O=Td*x?6qk!&=38@
zW|&t1Jbi3igX^Dn-hT^nN;AV=4QPS_00{7Vm^G(8@=+2bb>Bv2x>m04$6Lb=IbkNU
z!M#v1@;FnvpAzg5iUuSyH5pte$b7>hIT(ftwm`Fyf}Ar#m=6Rl7H57;KLAIm4FF?H
zP`X7R0v?EiR;vuZF%Patfp*8xCd*|FSUwtU2nTU0gs?GXBfw@ALTtoZ{z%F^jZ6&j
zX9jy<<lDf9+{XI@buT*U1ORGFZq38*E*Uq_=a!Hm05+yUfSm>p{Qi7+l}4ZVyHxo`
zKYkY5q$;~@WMuTVsy3A&AxfN(--aXA0)&bC(eOf18>!lnE$&9cSFMC_*t(NT_8Emu
z;*uQsDu47;sg|R_X1HQ)afIv$UCedyy8XxEFV1@?`qAJ%<Y{7-%<_wVe21~+Lp<vS
z&=RPx4J5E34NmaEFkV;0ylCCiUlKlbePAMw(<o+*-??o=nB@1hr}P?KBM)jFUa;Fo
z+~X4@{*uF6I=^2vPZ}Qb!`SldBu?>3`9_->r(0>rcEjozK3sR(0lsY)g)q8vxT>bQ
zB`Gq}wr^2n|Fh92R>|R(==(Ihuv)a&X@B$WP{TFGvA*QT#O6=wGJTyYq1&l4Y`doV
z>%^{5#h^NlVG6)hjpyjcAX?BDcJn=7@+E_*=*J*hyuL3XO%m3Nv2S;r1iH)nb%(wL
zf&hG-NT<cv=%e{V<Ki)(0Ccbd1H$3}I2qCSG6I{7UPhruSTAD`YT#uoxLfx!4Op4+
zGEE3&zEltX_>82{%+SD!mmvDwD%=~&09*jcYE&suEl#5Xm6VEPD50cKrcvYWRckc}
z=Be2>_-uV=Ydbw=MH;TJBvPZELY<vNDp9<WT%>vhwpw7v4z?P79+LT-LX%4E%cUz(
zPs%wSZz63+cN>Ja@cQ%c?hUXZ{nLsRl00o~KB0}$E43!7uS}Aw^P)bUR0kzn$hl9Z
z-Yk?WQ4~55p{c_8+7(25yHtBXLFw&lQux6YHETc51PApjmtB9o8G*WFc8&D?A0(Xs
zM^~e`qR?JN_F2S<Krv^pxhOH<n(JH%xp8;HO}E^h&EWe-E9LEuyA<wQY`+71{L6Qq
zgXax;pv;gU!QI+We;Y$WsQA2c)vEM}CRHQG8?kEZ!F6*8T%YKnM$KAisma(_vm^Y<
z@meLDXtF6L={40sDgKixO}Y*lGELK_-Sl}B7XEQu&O8n+#<Mh-84mtmShGokXc8@)
z^wB4u8PbO>JG-&48Q&%s%%uxW7zvL}IM9X;a^(vnW)K&L92V)KOZxnz-w`|Qa@rXh
z;Jyx0X=5ESg-W9{m@GDj%i{}#BC$j&lPi?2Dz!%I=I-IC(;K{uCU3LFYO_0heE9|d
zAsC5qF}zt$(ej#YMOb>h^vaDVSGH9OY!Q(X+o$D#)ko&&(y80bC`Nf+g<-KdTpnK_
z6p1BLnOvb%sWn=i-e5GDS1Y^6(RVplJo^l<&%f^3e-DVm6Nn@-g-W9{m@GDj%i{}#
zBC$j&lPi=ewMMIp1)|LN$ghSB`z^h}Xfi_<tIh6ky4)VG&u^y>cNTC1v8a(EH~s#6
zI$KYpR;N2OM_QNTu+!N!R`Sj60?rG^^j}?k|EJy#AoJ$9)fd-%xSxe6fhRpoMS-pD
ze?^C#qKEaE({0OKb8LGz!9QZS$hU02WO3SbCB?Mzf9$0jMXM<F;O!OOS@U?m&Tu*T
zLfro|fvbL6l{LGxRB;kaNOIa0bI4#><g<~hlK2WI@I?Eq=CD%~iJrv|^QDy2o0g+R
zrt^7%e=~gqTSAuiHhV}P+X#4q5yLf_Vjf-d=x-P);+?vLlgO1FhrJJXZfZ}!hF=|z
z8Y_yUxeYNlIFng8fJKWt|7g5S$6My@ZUNT=KMoZ6PDoH{5t!vNeNJJk)#Z@Df8nOT
zbZnL`QbE@UmzE4230{|C;0zAc_gL;gAI$4@v^w~Li*5NY?n+W)%z;)JPs_1CuzTgO
zRlg{lWuq;Tb@d5`@<tzOc=_bXak3F?CYmW6=5jphn8gfq+dLe;<vwX0qR;0yw>P)9
z$AA1|-#_nk+WoKRGqbD~2cB-%GYtLu>C@?2_S5Nt?*Gc$E1}gsR_)0wyksi{oak+`
z<R^DT)$n!ZV}a@)C}Beq<{ESe*S=Owq`rkBM)j2%Hu#kJ7*GXno?|q0odhvQ#UlCq
zR|pu@^nVEd0&F>%gBYziERf`yOnsS@I9tsPSuusOraPe`Pn^q19ph`!98WpM?DttH
z1Z^{7MDZ<a0jI+=4`q(vC1?i(2FdPq2pt}cg2t(%H8){^5LckT>kELjBAPox^%bk^
zN{Z)^fhc~&T$uZZS6|Je@>|s}(Wxk*s^(ze6)ECET#k@*KqI~35=%hoa<2(BEz(ou
zAXZW_&=XbIAk>zU(JTZ}R*Lu16{U454zpCWHcut!h=otQQM3}xY3!I8gSf}?31-2H
z(PPv=2^$(pmBIc6NYkqHW~lg0oq*j-@g8pc{~&1w@f_#O<<<ReYjju+v3;N08|b2m
zgW1h-bqes@dA@RiVF2j&J!(WKu^m+EDe0lrUo@c}E_8-u9L<snje&zykAO_#g6D}r
zeNku<0ABYBPmH8(a1=>oFXct>f0{>5#OdL4PYZ*@aP6s|!d-ZQ{nHwBig?}hv?M0g
T=ND-DucNQ`tADQ-AuI&|D5jKI

literal 0
HcmV?d00001

diff --git a/src/static/img/dp-world-logo.svg b/src/static/img/dp-world-logo.svg
new file mode 100644
index 0000000..d6913db
--- /dev/null
+++ b/src/static/img/dp-world-logo.svg
@@ -0,0 +1,214 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Generator: Adobe Illustrator 25.4.1, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   version="1.0"
+   id="Layer_1"
+   x="0px"
+   y="0px"
+   width="218.26666"
+   height="135.73265"
+   viewBox="0 0 258.30374 203.59898"
+   xml:space="preserve"
+   sodipodi:docname="DP_World_2021_logo.svg"
+   inkscape:version="0.92.4 (5da689c313, 2019-01-14)"><metadata
+   id="metadata65"><rdf:RDF><cc:Work
+       rdf:about=""><dc:format>image/svg+xml</dc:format><dc:type
+         rdf:resource="http://purl.org/dc/dcmitype/StillImage" /><dc:title></dc:title></cc:Work></rdf:RDF></metadata><defs
+   id="defs63" /><sodipodi:namedview
+   pagecolor="#ffffff"
+   bordercolor="#666666"
+   borderopacity="1"
+   objecttolerance="10"
+   gridtolerance="10"
+   guidetolerance="10"
+   inkscape:pageopacity="0"
+   inkscape:pageshadow="2"
+   inkscape:window-width="1366"
+   inkscape:window-height="705"
+   id="namedview61"
+   showgrid="false"
+   fit-margin-top="0"
+   fit-margin-left="0"
+   fit-margin-right="0"
+   fit-margin-bottom="0"
+   inkscape:zoom="0.84911243"
+   inkscape:cx="99.391606"
+   inkscape:cy="16.047852"
+   inkscape:window-x="-8"
+   inkscape:window-y="-8"
+   inkscape:window-maximized="1"
+   inkscape:current-layer="Layer_1" />
+<style
+   type="text/css"
+   id="style2">
+	.st0{fill:url(#SVGID_1_);}
+	.st1{fill:url(#SVGID_00000139258596182005202240000000998050819215149192_);}
+	.st2{fill:#0F0F18;}
+	.st3{fill:url(#SVGID_00000066495001078125671360000015275470603087945623_);}
+	.st4{opacity:0.5;fill:url(#SVGID_00000144296532413494711020000007966654371741023134_);}
+</style>
+<g
+   id="g58"
+   transform="translate(-70.84813,-10.70102)">
+	<linearGradient
+   id="SVGID_1_"
+   gradientUnits="userSpaceOnUse"
+   x1="73.645798"
+   y1="98.500999"
+   x2="258.58371"
+   y2="51.303299">
+		<stop
+   offset="0"
+   style="stop-color:#5EB77D;stop-opacity:0.3"
+   id="stop4" />
+		<stop
+   offset="0.6"
+   style="stop-color:#5EB77D"
+   id="stop6" />
+		<stop
+   offset="0.9641"
+   style="stop-color:#5EB77D;stop-opacity:0.3627"
+   id="stop8" />
+		<stop
+   offset="1"
+   style="stop-color:#5EB77D;stop-opacity:0.3"
+   id="stop10" />
+	</linearGradient>
+	<path
+   class="st0"
+   d="M 214.5,93.4 C 197.8,99.6 179.2,100.3 162,96.1 147.8,92.8 134.7,86.1 121.2,81.3 99.7,73.6 88.9,81.3 74.9,97.4 80.5,83.7 92.5,68 116.5,70 c 15.9,1.3 30.4,5.9 42,7.5 54.5,7.5 93.5,-23.3 92.7,-55.7 2.9,16.1 4.5,54.1 -36.7,71.6 z"
+   id="path13"
+   inkscape:connector-curvature="0"
+   style="fill:url(#SVGID_1_)" />
+	
+		<linearGradient
+   id="SVGID_00000015325242540316613450000000312388739388504509_"
+   gradientUnits="userSpaceOnUse"
+   x1="152.68311"
+   y1="123.5069"
+   x2="269.15881"
+   y2="83.401199">
+		<stop
+   offset="0"
+   style="stop-color:#0F0F18;stop-opacity:0.1"
+   id="stop15" />
+		<stop
+   offset="0.6"
+   style="stop-color:#0F0F18;stop-opacity:0.95"
+   id="stop17" />
+		<stop
+   offset="1"
+   style="stop-color:#0F0F18;stop-opacity:0.3"
+   id="stop19" />
+	</linearGradient>
+	<path
+   style="fill:url(#SVGID_00000015325242540316613450000000312388739388504509_)"
+   d="m 204.6,135.6 c -25,1.6 -46.8,-10.9 -58.4,-31 39.3,34.8 116.7,7.4 113.1,-50 12.1,37.6 -15.4,78.5 -54.7,81 z"
+   id="path22"
+   inkscape:connector-curvature="0" />
+	<g
+   id="g38">
+		<path
+   class="st2"
+   d="m 56.4,174.8 c -13.1,0 -20.1,0 -20.1,0 v 39.1 c 0,0 7.2,0 20.1,0 12.9,0 20.2,-9.4 20.2,-19.5 0,-10.2 -7.1,-19.6 -20.2,-19.6 z m 0,30.3 c -6.9,0 -10.8,0 -10.8,0 v -21.7 c 0,0 3.8,0 10.8,0 7,0 10.9,5.2 10.9,10.9 -0.1,5.6 -4,10.8 -10.9,10.8 z"
+   id="path24"
+   inkscape:connector-curvature="0"
+   style="fill:#0f0f18" />
+		<path
+   class="st2"
+   d="m 343.5,174.8 c -13.1,0 -20.1,0 -20.1,0 v 39.1 c 0,0 7.2,0 20.1,0 12.9,0 20.2,-9.4 20.2,-19.5 0,-10.2 -7.1,-19.6 -20.2,-19.6 z m 0,30.3 c -6.9,0 -10.8,0 -10.8,0 v -21.7 c 0,0 3.8,0 10.8,0 7,0 10.9,5.2 10.9,10.9 0,5.6 -4,10.8 -10.9,10.8 z"
+   id="path26"
+   inkscape:connector-curvature="0"
+   style="fill:#0f0f18" />
+		<path
+   class="st2"
+   d="m 80.6,174.8 c 0,0 14.4,0 22.9,0 8.5,0 15,6 15,14.6 0,8.6 -6.6,14.7 -15.1,14.7 -8.5,0 -13.5,0 -13.5,0 v 9.8 h -9.3 z m 9.3,8.4 v 12.1 H 103 c 8.1,0.1 8.1,-12.2 0,-12.1 z"
+   id="path28"
+   inkscape:connector-curvature="0"
+   style="fill:#0f0f18" />
+		<path
+   class="st2"
+   d="m 184.6,174.8 -8.1,23.9 -8.7,-23.9 c -0.1,0 -11.7,0 -11.8,0 l -8.7,23.9 -8.1,-23.9 h -9.4 l 12.3,39.1 h 9.3 l 10.6,-29.2 10.6,29.2 h 9.3 l 12.3,-39.1 z"
+   id="path30"
+   inkscape:connector-curvature="0"
+   style="fill:#0f0f18" />
+		<path
+   class="st2"
+   d="m 240.4,174.8 h 24 c 4.2,0 8,1.2 10.8,4 5.9,5.7 4.7,17 -2.5,21 l 7.2,14.1 h -10.2 l -5.5,-11.7 h -14.6 v 11.7 h -9.3 v -39.1 z m 9.3,8.5 v 10.4 h 14.1 c 3.6,0.1 5.7,-2 5.8,-5.2 0,-3.5 -2.2,-5.2 -5.8,-5.1 z"
+   id="path32"
+   inkscape:connector-curvature="0"
+   style="fill:#0f0f18" />
+		<path
+   class="st2"
+   d="m 284.3,174.8 h 9.3 v 30.1 h 25.9 v 8.9 h -35.2 z"
+   id="path34"
+   inkscape:connector-curvature="0"
+   style="fill:#0f0f18" />
+		<path
+   class="st2"
+   d="m 214.9,174.3 c -12.6,0 -21.3,7.9 -21.3,20 0,12.1 8.7,20 21.3,20 12.6,0 21.3,-7.9 21.3,-20 -0.1,-12.1 -8.7,-20 -21.3,-20 z m 0,30.8 c 0,0 0,0 0,0 0,0 0,0 0,0 v 0 c -7.1,0 -12,-4.3 -12,-10.8 0,-6.5 4.9,-10.8 12,-10.8 v 0 c 0,0 0,0 0,0 0,0 0,0 0,0 7.1,0 12,4.3 12,10.8 0,6.5 -5,10.8 -12,10.8 z"
+   id="path36"
+   inkscape:connector-curvature="0"
+   style="fill:#0f0f18" />
+	</g>
+	
+		<linearGradient
+   id="SVGID_00000165934167110435584950000002565868080169731713_"
+   gradientUnits="userSpaceOnUse"
+   x1="137.82719"
+   y1="44.1465"
+   x2="226.8519"
+   y2="44.1465">
+		<stop
+   offset="0"
+   style="stop-color:#E72F64"
+   id="stop40" />
+		<stop
+   offset="0.9"
+   style="stop-color:#E72F64;stop-opacity:0.1"
+   id="stop42" />
+	</linearGradient>
+	<path
+   style="fill:url(#SVGID_00000165934167110435584950000002565868080169731713_)"
+   d="m 158.6,77.5 v 0 C 157.1,41 189.8,10.9 226.9,16.9 185.4,-2.9 138,27.1 137.9,73.3 c 7.5,1.7 14.5,3.4 20.7,4.2 z"
+   id="path45"
+   inkscape:connector-curvature="0" />
+	<g
+   id="g56">
+		
+			<linearGradient
+   id="SVGID_00000000907424882148723390000013523049299162079409_"
+   gradientUnits="userSpaceOnUse"
+   x1="173.65829"
+   y1="84.307198"
+   x2="179.7261"
+   y2="54.668301">
+			<stop
+   offset="0"
+   style="stop-color:#68102F"
+   id="stop47" />
+			<stop
+   offset="0.15"
+   style="stop-color:#67102F;stop-opacity:0.75"
+   id="stop49" />
+			<stop
+   offset="1"
+   style="stop-color:#68102F;stop-opacity:0"
+   id="stop51" />
+		</linearGradient>
+		<path
+   style="opacity:0.5;fill:url(#SVGID_00000000907424882148723390000013523049299162079409_)"
+   d="m 158.6,77.5 v 0 C 157.1,41 189.8,10.9 226.9,16.9 185.4,-2.9 138,27.1 137.9,73.3 c 7.5,1.7 14.5,3.4 20.7,4.2 z"
+   id="path54"
+   inkscape:connector-curvature="0" />
+	</g>
+</g>
+</svg>
\ No newline at end of file
diff --git a/src/static/index.html b/src/static/index.html
new file mode 100644
index 0000000..1cf7866
--- /dev/null
+++ b/src/static/index.html
@@ -0,0 +1,229 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta name="description" content="IoT Device Web Configurator - Network, Protocol, and I/O Configuration">
+    <link rel="icon" href="data:,">
+    <title>IoT Web Configurator</title>
+    <!-- v1.4.6.10 ①: 외부 Google Fonts CDN 제거. 본 앱은 LAN 전용 IoT 장비에 직접 접속하는
+         오프라인 환경에서 사용 — 외부 CDN은 (a) DNS 타임아웃까지 매달려 첫 페인트 수초 지연,
+         (b) 폰트 폴백으로 디자인 열화 트리거. style.css의 --font-family 폴백 체인이 시스템 폰트
+         (-apple-system / Segoe UI 등)로 안전 동작. Inter / JetBrains Mono를 정식 사용하려면
+         .woff2 파일을 src/static/fonts/에 추가 후 style.css의 @font-face 블록 활성화. -->
+    <link rel="stylesheet" href="css/style.css">
+    <!-- v1.5.4: modulepreload hints — browser fetches critical modules in parallel
+         before app.js fully parses, reducing import waterfall latency -->
+    <link rel="modulepreload" href="js/app.js">
+    <link rel="modulepreload" href="js/state.js">
+    <link rel="modulepreload" href="js/api.js">
+    <link rel="modulepreload" href="js/utils.js">
+    <link rel="modulepreload" href="js/icons.js">
+    <link rel="modulepreload" href="js/constants.js">
+    <link rel="modulepreload" href="js/page-dirty.js">
+    <link rel="modulepreload" href="js/nav-guard.js">
+    <link rel="modulepreload" href="js/pages/home.js">
+</head>
+<body>
+    <!-- v1.5.0 P1: Skip-to-content accessibility (WCAG 2.4.1) -->
+    <a href="#main-content" class="skip-link">Skip to main content</a>
+
+    <!-- v1.5.0 P1: Sidebar nested 4-group + 13 leaf (v1.11.14: system/network/interface-protocol/firmware) -->
+    <aside class="sidebar" id="sidebar" role="navigation" aria-label="Main navigation">
+        <div class="sidebar__header">
+            <a href="#" class="sidebar__logo" data-page="home" id="logo-home">
+                <img class="sidebar__logo-img" src="img/dp-world-logo.svg" alt="DP World">
+                <span class="sidebar__logo-cap">CONFIGURATOR</span>
+            </a>
+        </div>
+
+        <nav class="sidebar__nav" id="sidebar-nav" aria-label="Configuration pages">
+            <!-- Group: System (v1.11.14 — Dashboard + Log) -->
+            <div class="nav-group" data-group="system">
+                <button type="button" class="nav-group__toggle"
+                        aria-expanded="true" aria-controls="leaves-system">
+                    <span class="nav-group__icon" id="icon-grp-system"></span>
+                    <span class="nav-group__label">System</span>
+                    <span class="nav-group__chevron" id="icon-chev-system" aria-hidden="true"></span>
+                </button>
+                <ul class="nav-group__leaves" id="leaves-system">
+                    <li><a href="#" class="nav-item nav-item--leaf" data-page="home" id="nav-home">
+                        <span class="nav-item__icon" id="icon-nav-home"></span>
+                        <span class="nav-item__label">Dashboard</span>
+                    </a></li>
+                    <li><a href="#" class="nav-item nav-item--leaf" data-page="log" id="nav-log">
+                        <span class="nav-item__icon" id="icon-nav-log"></span>
+                        <span class="nav-item__label">Log</span>
+                        <span class="nav-item__dirty" id="dirty-log" aria-hidden="true"></span>
+                    </a></li>
+                </ul>
+            </div>
+
+            <!-- Group: Network -->
+            <div class="nav-group" data-group="network">
+                <button type="button" class="nav-group__toggle"
+                        aria-expanded="true" aria-controls="leaves-network">
+                    <span class="nav-group__icon" id="icon-grp-network"></span>
+                    <span class="nav-group__label">Network</span>
+                    <span class="nav-group__chevron" id="icon-chev-network" aria-hidden="true"></span>
+                </button>
+                <ul class="nav-group__leaves" id="leaves-network">
+                    <li><a href="#" class="nav-item nav-item--leaf" data-page="wifi" id="nav-wifi">
+                        <span class="nav-item__icon" id="icon-nav-wifi"></span>
+                        <span class="nav-item__label">Wi-Fi</span>
+                        <span class="nav-item__dirty" id="dirty-wifi" aria-hidden="true"></span>
+                    </a></li>
+                    <!-- AP: nav leaf -->
+                    <li><a href="#" class="nav-item nav-item--leaf" data-page="wifi-ap" id="nav-wifi-ap">
+                        <span class="nav-item__icon" id="icon-nav-wifi-ap"></span>
+                        <span class="nav-item__label">Wi-Fi AP</span>
+                        <span class="nav-item__dirty" id="dirty-wifi-ap" aria-hidden="true"></span>
+                    </a></li>
+                    <li><a href="#" class="nav-item nav-item--leaf" data-page="ethernet" id="nav-ethernet">
+                        <span class="nav-item__icon" id="icon-nav-ethernet"></span>
+                        <span class="nav-item__label">Ethernet</span>
+                        <span class="nav-item__dirty" id="dirty-ethernet" aria-hidden="true"></span>
+                    </a></li>
+                    <li><a href="#" class="nav-item nav-item--leaf" data-page="server-setting" id="nav-server-setting">
+                        <span class="nav-item__icon" id="icon-nav-server-setting"></span>
+                        <span class="nav-item__label">Server Setting</span>
+                        <span class="nav-item__dirty" id="dirty-server-setting" aria-hidden="true"></span>
+                    </a></li>
+                    <!-- v1.8.0: Apply & Status 는 Advanced/Debug 보기 전용 (User 모드 숨김). -->
+                    <li class="advanced-only"><a href="#" class="nav-item nav-item--leaf" data-page="net-apply" id="nav-net-apply">
+                        <span class="nav-item__icon" id="icon-nav-net-apply"></span>
+                        <span class="nav-item__label">Apply &amp; Status</span>
+                    </a></li>
+                </ul>
+            </div>
+
+            <!-- Group: Interface & Protocol -->
+            <div class="nav-group" data-group="interface-protocol">
+                <button type="button" class="nav-group__toggle"
+                        aria-expanded="true" aria-controls="leaves-interface-protocol">
+                    <span class="nav-group__icon" id="icon-grp-interface"></span>
+                    <span class="nav-group__label">Interface &amp; Protocol</span>
+                    <span class="nav-group__chevron" id="icon-chev-interface" aria-hidden="true"></span>
+                </button>
+                <ul class="nav-group__leaves" id="leaves-interface-protocol">
+                    <!-- v1.5.0 P3: register→general, NEW sensor-io, can→can-bus -->
+                    <li><a href="#" class="nav-item nav-item--leaf" data-page="general" id="nav-general">
+                        <span class="nav-item__icon" id="icon-nav-general"></span>
+                        <span class="nav-item__label">General Settings</span>
+                        <span class="nav-item__dirty" id="dirty-general" aria-hidden="true"></span>
+                    </a></li>
+                    <li><a href="#" class="nav-item nav-item--leaf" data-page="sensor-io" id="nav-sensor-io">
+                        <span class="nav-item__icon" id="icon-nav-sensor-io"></span>
+                        <span class="nav-item__label">Sensor I/O</span>
+                        <span class="nav-item__dirty" id="dirty-sensor-io" aria-hidden="true"></span>
+                    </a></li>
+                    <li><a href="#" class="nav-item nav-item--leaf" data-page="can-bus" id="nav-can-bus">
+                        <span class="nav-item__icon" id="icon-nav-can-bus"></span>
+                        <span class="nav-item__label">CAN-BUS</span>
+                        <span class="nav-item__dirty" id="dirty-can-bus" aria-hidden="true"></span>
+                    </a></li>
+                    <li><a href="#" class="nav-item nav-item--leaf" data-page="opcua" id="nav-opcua">
+                        <span class="nav-item__icon" id="icon-nav-opcua"></span>
+                        <span class="nav-item__label">OPC UA</span>
+                        <span class="nav-item__dirty" id="dirty-opcua" aria-hidden="true"></span>
+                    </a></li>
+                    <li><a href="#" class="nav-item nav-item--leaf" data-page="modbus" id="nav-modbus">
+                        <span class="nav-item__icon" id="icon-nav-modbus"></span>
+                        <span class="nav-item__label">Modbus</span>
+                        <span class="nav-item__dirty" id="dirty-modbus" aria-hidden="true"></span>
+                    </a></li>
+                </ul>
+            </div>
+
+            <!-- Group: Firmware (v1.11.14 — own collapsible group, leaf=Update) -->
+            <div class="nav-group" data-group="firmware">
+                <button type="button" class="nav-group__toggle"
+                        aria-expanded="true" aria-controls="leaves-firmware">
+                    <span class="nav-group__icon" id="icon-grp-firmware"></span>
+                    <span class="nav-group__label">Firmware</span>
+                    <span class="nav-group__chevron" id="icon-chev-firmware" aria-hidden="true"></span>
+                </button>
+                <ul class="nav-group__leaves" id="leaves-firmware">
+                    <li><a href="#" class="nav-item nav-item--leaf" data-page="firmware" id="nav-firmware">
+                        <span class="nav-item__icon" id="icon-nav-firmware"></span>
+                        <span class="nav-item__label">Update</span>
+                    </a></li>
+                </ul>
+            </div>
+        </nav>
+
+        <div class="sidebar__footer">
+            <!-- v1.7.0: 전역 미저장/미적용 배지 — 클릭 시 Pending Changes 패널 -->
+            <button type="button" class="pending-badge hidden" id="pending-badge"
+                    data-pending-badge
+                    aria-label="No pending changes" title="View pending changes"></button>
+            <button class="btn btn--primary btn--full" id="btn-save-all">
+                <span>💾</span> Save All
+            </button>
+            <div class="sidebar__actions">
+                <button class="btn btn--outline btn--sm" id="btn-import">
+                    <span>📥</span> Import
+                </button>
+                <button class="btn btn--outline btn--sm" id="btn-export">
+                    <span>📤</span> Export
+                </button>
+            </div>
+            <!-- v1.8.0: Advanced/Debug 보기 토글 — apply 머신(step·watchdog·drift·journal·
+                 force·Apply&Status·미적용 배지) 노출. 보안 경계 아님(누구나 켤 수 있는 표시 스위치). -->
+            <label class="view-toggle" for="advanced-view-toggle">
+                <input type="checkbox" id="advanced-view-toggle" class="view-toggle__input" data-no-dirty>
+                <span class="view-toggle__label">Advanced / Debug view</span>
+                <span class="view-toggle__hint">Shows apply steps, watchdog, and diagnostics. Not a security boundary.</span>
+            </label>
+            <div class="sidebar__version">
+                <span class="sidebar__version-name" id="app-name"></span>
+                <span class="sidebar__version-num" id="app-version"></span>
+            </div>
+        </div>
+    </aside>
+
+    <!-- Mobile Header -->
+    <header class="mobile-header" id="mobile-header">
+        <button class="mobile-header__menu" id="btn-menu" aria-label="Open menu">☰</button>
+        <span class="mobile-header__title">IoT Configurator</span>
+        <button type="button" class="pending-badge hidden" id="pending-badge-mobile"
+                data-pending-badge
+                aria-label="No pending changes" title="View pending changes"></button>
+        <button class="btn btn--primary btn--sm" id="btn-save-mobile" aria-label="Save changes">💾</button>
+    </header>
+
+    <!-- Overlay for mobile sidebar -->
+    <div class="sidebar-overlay" id="sidebar-overlay"></div>
+
+    <!-- Main Content -->
+    <main class="main" id="main-content" role="main">
+        <!-- Loading Spinner -->
+        <div class="loading" id="loading">
+            <div class="loading__spinner"></div>
+            <p>Loading configuration...</p>
+        </div>
+
+        <!-- v1.8.0: Simple Apply host — "Applying…" 진행 + eth1 평이 재접속 배너.
+             ★ page-container 밖이라 페이지 전환에도 살아남는다(eth1 confirm 지속). -->
+        <div class="apply-flow-host" id="apply-flow-host"></div>
+
+        <!-- Page Sections (rendered by JS modules) -->
+        <div class="page-container" id="page-container" style="display:none;"></div>
+    </main>
+
+    <!-- Toast Container — v1.7.1 Task 4: live region for screen readers -->
+    <div class="toast-container" id="toast-container" role="status" aria-live="polite" aria-atomic="false"></div>
+    <!-- M-9: assertive SR-only mirror for error/warning toasts. The polite
+         #toast-container governs all visual toasts; this hidden region is only
+         populated (via toast.js) for error/warning so AT interrupts immediately. -->
+    <div id="toast-sr-assertive" role="alert" aria-live="assertive" class="sr-only"></div>
+
+    <!-- Hidden file input for import -->
+    <input type="file" id="file-import" accept=".json" style="display:none;">
+
+    <!-- Theme Toggle (floating) -->
+    <button class="theme-toggle" id="btn-theme" title="Toggle dark/light mode" aria-label="Toggle theme">🌙</button>
+
+    <script type="module" src="js/app.js"></script>
+</body>
+</html>
diff --git a/src/static/js/api.js b/src/static/js/api.js
new file mode 100644
index 0000000..368cc88
--- /dev/null
+++ b/src/static/js/api.js
@@ -0,0 +1,258 @@
+/**
+ * api.js — API Client Module
+ * 
+ * Handles all HTTP communication with the Python backend.
+ * Matches the 4-endpoint REST API from the Java Spring Boot server.
+ */
+
+const API_BASE = 'setting';
+
+/**
+ * GET /setting/get-device
+ * @returns {Promise<Object|null>} Device config or null if not set
+ */
+export async function getDevice() {
+    const res = await fetch(`${API_BASE}/get-device`);
+    if (res.status === 204) return null;
+    if (!res.ok) throw new Error(`Failed to load device config: ${res.status}`);
+    return res.json();
+}
+
+/**
+ * POST /setting/device
+ * @param {Object} data - Device configuration object
+ * @returns {Promise<{success: boolean, message: string, warnings: string[]}>}
+ */
+export async function saveDevice(data) {
+    const res = await fetch(`${API_BASE}/device`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(data),
+    });
+    if (!res.ok) {
+        const err = await res.json().catch(() => ({ message: `Save failed: ${res.status}` }));
+        if (res.status === 400 && Array.isArray(err.errors) && err.errors.length > 0) {
+            throw new Error('Invalid value: ' + err.errors.slice(0, 3).join(' · '));
+        }
+        throw new Error(err.message || `Save failed: ${res.status}`);
+    }
+    return res.json();
+}
+
+/**
+ * GET /setting/get-protocol
+ * @returns {Promise<Object|null>} Protocol config or null if not set
+ */
+export async function getProtocol() {
+    const res = await fetch(`${API_BASE}/get-protocol`);
+    if (res.status === 204) return null;
+    if (!res.ok) throw new Error(`Failed to load protocol config: ${res.status}`);
+    return res.json();
+}
+
+/**
+ * POST /setting/protocol
+ * @param {Object} data - Protocol configuration object
+ * @returns {Promise<Object>} Saved protocol config (with inactive protocols removed)
+ */
+export async function saveProtocol(data) {
+    const res = await fetch(`${API_BASE}/protocol`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(data),
+    });
+    if (!res.ok) {
+        const err = await res.json().catch(() => ({}));
+        if (res.status === 400 && Array.isArray(err.errors) && err.errors.length > 0) {
+            throw new Error('Invalid value: ' + err.errors.slice(0, 3).join(' · '));
+        }
+        throw new Error(err.message || err.error || `Failed to save protocol config: ${res.status}`);
+    }
+    return res.json();
+}
+
+/**
+ * GET /setting/log-files
+ * @returns {Promise<Object>} { files: [...], total_size: number }
+ */
+export async function getLogFiles() {
+    const res = await fetch(`${API_BASE}/log-files`);
+    if (!res.ok) throw new Error(`Failed to load log files: ${res.status}`);
+    return res.json();
+}
+
+/**
+ * POST /setting/log-download
+ * @param {string[]} files - Array of filenames to download
+ * @returns {Promise<Blob>} tar.gz archive blob
+ */
+export async function downloadLogFiles(files) {
+    const res = await fetch(`${API_BASE}/log-download`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ files }),
+    });
+    if (!res.ok) {
+        const err = await res.json().catch(() => ({ error: `Download failed: ${res.status}` }));
+        throw new Error(err.error || `Download failed: ${res.status}`);
+    }
+    return res.blob();
+}
+
+/**
+ * GET /setting/log-stats
+ * @returns {Promise<Object>} Log directory disk usage stats
+ */
+export async function getLogStats() {
+    const res = await fetch(`${API_BASE}/log-stats`);
+    if (!res.ok) throw new Error(`Failed to load log stats: ${res.status}`);
+    return res.json();
+}
+
+/**
+ * POST /setting/log-compress
+ * @returns {Promise<Object>} { success, compressed, message }
+ */
+export async function compressLogFiles() {
+    const res = await fetch(`${API_BASE}/log-compress`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: '{}',
+    });
+    if (!res.ok) throw new Error(`Compression failed: ${res.status}`);
+    return res.json();
+}
+
+/**
+ * POST /setting/log-delete
+ * @param {string[]} files - Array of filenames to delete
+ * @returns {Promise<Object>} { success, deleted, message }
+ */
+export async function deleteLogFilesApi(files) {
+    const res = await fetch(`${API_BASE}/log-delete`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ files }),
+    });
+    if (!res.ok) throw new Error(`Delete failed: ${res.status}`);
+    return res.json();
+}
+
+/**
+ * GET /api/mac
+ * @returns {Promise<string|null>} WiFi MAC address or null if unavailable
+ */
+export async function getMac() {
+    try {
+        const res = await fetch('api/mac');
+        if (!res.ok) return null;
+        const data = await res.json();
+        return data.mac || null;
+    } catch {
+        return null;
+    }
+}
+
+/**
+ * GET /api/system-status
+ * @returns {Promise<Object>} Aggregated device status snapshot
+ */
+export async function getSystemStatus() {
+    const res = await fetch('api/system-status');
+    if (!res.ok) throw new Error(`Failed to load status: ${res.status}`);
+    return res.json();
+}
+
+/**
+ * POST /api/action/test-connections
+ * @returns {Promise<{results: Array}>} Per-endpoint reachability results
+ */
+export async function testConnections() {
+    const res = await fetch('api/action/test-connections', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: '{}',
+    });
+    if (!res.ok) throw new Error(`Connection test failed: ${res.status}`);
+    return res.json();
+}
+
+/**
+ * POST /api/action/restart-dpworldapp
+ * @returns {Promise<{restarted: boolean, running: boolean, pid?: number}>}
+ */
+export async function restartDpworldapp() {
+    const res = await fetch('api/action/restart-dpworldapp', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: '{}',
+    });
+    if (!res.ok) throw new Error(`Restart failed: ${res.status}`);
+    return res.json();
+}
+
+/**
+ * GET /api/support-bundle
+ * @returns {Promise<Blob>} Diagnostics zip blob
+ */
+export async function getSupportBundle() {
+    const res = await fetch('api/support-bundle');
+    if (!res.ok) throw new Error(`Bundle download failed: ${res.status}`);
+    return res.blob();
+}
+
+// ── Firmware OTA API (v1.5.0 Phase 4a) ───────────────────────────────────────
+
+/** GET /api/firmware/status → rich status snapshot (drives the whole UI). */
+export async function getFirmwareStatus() {
+    const res = await fetch('api/firmware/status');
+    if (!res.ok) throw new Error(`status ${res.status}`);
+    return res.json();
+}
+
+/** POST /api/firmware/preflight → { ok, checks:[...] } */
+export async function preflightFirmware() {
+    const res = await fetch('api/firmware/preflight', { method: 'POST', body: '{}' });
+    if (!res.ok) throw new Error(`preflight failed: ${res.status}`);
+    return res.json();
+}
+
+/**
+ * POST /api/firmware/upload (raw ZIP body) → { ok, components:[...] }
+ * Uses XHR for upload-progress events.
+ * @param {File} file
+ * @param {(loaded:number,total:number)=>void} [onProgress]
+ */
+export function uploadFirmware(file, onProgress) {
+    return new Promise((resolve, reject) => {
+        const xhr = new XMLHttpRequest();
+        xhr.open('POST', 'api/firmware/upload');
+        xhr.upload.onprogress = (e) => {
+            if (e.lengthComputable && onProgress) onProgress(e.loaded, e.total);
+        };
+        xhr.onload = () => {
+            let r;
+            try { r = JSON.parse(xhr.responseText); } catch { r = {}; }
+            if (xhr.status === 200 && r.ok) resolve(r);
+            else reject(new Error(r.error || `upload failed (${xhr.status})`));
+        };
+        xhr.onerror = () => reject(new Error('upload network error'));
+        xhr.send(file);
+    });
+}
+
+/** POST /api/firmware/flash → { ok } (starts background flash) */
+export async function startFlash() {
+    const res = await fetch('api/firmware/flash', { method: 'POST', body: '{}' });
+    const r = await res.json().catch(() => ({}));
+    if (!res.ok) throw new Error(r.error || `flash failed: ${res.status}`);
+    return r;
+}
+
+/** POST /api/firmware/restore-check → { ok, result:{restored,reason,...} } */
+export async function restoreCheck() {
+    const res = await fetch('api/firmware/restore-check', { method: 'POST', body: '{}' });
+    const r = await res.json().catch(() => ({}));
+    if (!res.ok) throw new Error(r.error || `restore-check failed: ${res.status}`);
+    return r;
+}
diff --git a/src/static/js/app.js b/src/static/js/app.js
new file mode 100644
index 0000000..bf9d1b0
--- /dev/null
+++ b/src/static/js/app.js
@@ -0,0 +1,904 @@
+/**
+ * app.js — Main Application Entry Point
+ * 
+ * Orchestrates page navigation, data loading/saving, theming,
+ * and import/export functionality.
+ */
+
+import { getDevice, getProtocol, saveDevice, saveProtocol, getMac } from './api.js';
+import { APP_NAME, APP_VERSION } from './constants.js';
+import { showToast } from './toast.js';
+import { state, setDevice, setProtocol, buildDevicePayload, buildProtocolPayload, commitChangesAsBaseline } from './state.js';
+import { clearAllFieldErrors, setPageError, clearAllPageErrors, focusErrorField } from './validator.js';
+import { getDirtyPages, clearAllDirty, markDirty } from './page-dirty.js';
+import { attachDirtyTracking } from './dirty-tracker.js';
+import { renderSsidPage } from './pages/ssid.js';
+import ssidPage from './pages/ssid.js';
+// v1.5.0 P2: wifi.js (ssid.js rename)
+import wifiPage from './pages/wifi.js';
+// v1.5.0 P2 T2: ethernet.js NEW (eth + LTE interface IP)
+import ethernetPage from './pages/ethernet.js';
+import { renderNetworkPage } from './pages/network.js';
+import networkPage from './pages/network.js';
+// v1.5.0 P2 T3: server-setting.js (network.js rename)
+import serverSettingPage from './pages/server-setting.js';
+import { renderIoPage } from './pages/io.js';
+import ioPage from './pages/io.js';
+import { renderLogPage } from './pages/log.js';
+import logPage from './pages/log.js';
+import { renderRegisterPage } from './pages/register.js';
+import registerPage from './pages/register.js';
+// v1.5.0 P3 T1: general-settings.js NEW (Equipment + Protocol + Odo, A/D ports 제거)
+import generalSettingsPage from './pages/general-settings.js';
+// v1.5.0 P3 T2: sensor-io.js NEW (RS485 + Analog + Digital ports 통합)
+import sensorIoPage from './pages/sensor-io.js';
+// v1.5.0 P3 T3: can-bus.js NEW (CAN bus config + CAN mapping 통합)
+import canBusPage from './pages/can-bus.js';
+import { renderModbusPage } from './pages/modbus.js';
+import modbusPage from './pages/modbus.js';
+import { renderOpcuaPage } from './pages/opcua.js';
+import opcuaPage from './pages/opcua.js';
+import { renderCanPage } from './pages/can.js';
+import canPage from './pages/can.js';
+import { renderFirmwarePage } from './pages/firmware.js';
+import firmwarePage from './pages/firmware.js';
+import homePage, { setNavigate as setHomeNavigate } from './pages/home.js';
+// v1.6.0: Network Apply & Status page
+import netApplyPage from './pages/net-apply.js';
+import wifiApPage from './pages/wifi-ap.js';  // AP: page import
+// v1.5.0 P1: Lucide SVG icons + sidebar nested
+import { icon } from './icons.js';
+// v1.5.0 P1: nav-guard — navigation dirty modal
+import { confirmNavigation } from './nav-guard.js';
+// v1.7.0: Pending Changes — 전역 미저장/미적용 배지 + 패널
+import { initPending, refreshUnapplied, getUnapplied, applyNeededCta, openPanel as openPendingPanel, renderBadge as renderPendingBadge } from './pending.js';
+// v1.8.0: Advanced/Debug 보기 토글 상태 (User 기본 / Advanced 노출)
+import { isAdvanced, setAdvanced, onAdvancedChange, initFromStorage as initViewModeStorage } from './view-mode.js';
+// v1.8.0: Simple Apply — User 모드 Save=즉시 적용 (네트워크) + eth1 평이 재접속 확인
+import { runSimpleApply, resumeIfConfirming } from './apply-flow.js';
+import { confirmModal } from './confirm-modal.js';
+
+const DEBUG = location.hostname === 'localhost' || location.hostname === '127.0.0.1';
+let _deviceMac = null;
+
+const PAGE_RENDERERS = {
+    ssid: renderSsidPage,
+    network: renderNetworkPage,
+    io: renderIoPage,
+    log: renderLogPage,
+    register: renderRegisterPage,
+    modbus: renderModbusPage,
+    opcua: renderOpcuaPage,
+    can: renderCanPage,
+    firmware: renderFirmwarePage,
+};
+
+const PAGES = {
+    home: homePage,
+    wifi: wifiPage,             // v1.5.0 P2: canonical Wi-Fi page id
+    ssid: wifiPage,             // v1.5.0 P2 alias — legacy id redirects to wifi
+    'wifi-ap': wifiApPage,  // AP: page
+    ethernet: ethernetPage,     // v1.5.0 P2 T2: canonical Ethernet page id
+    io: ioPage,                 // v1.5.0 P2 T2: legacy + RS485/CAN 잔존
+    'server-setting': serverSettingPage,  // v1.5.0 P2 T3: canonical Server Setting page id
+    network: serverSettingPage,           // v1.5.0 P2 T3 alias — legacy id redirects to server-setting
+    log: logPage,
+    general: generalSettingsPage,   // v1.5.0 P3 T1: canonical General Settings page id
+    register: generalSettingsPage,  // v1.5.0 P3 T1 alias — legacy id redirects to general
+    'sensor-io': sensorIoPage,      // v1.5.0 P3 T2: canonical Sensor I/O page id (no legacy alias — genuinely new)
+    'can-bus': canBusPage,          // v1.5.0 P3 T3: canonical CAN-BUS page id
+    can: canBusPage,                // v1.5.0 P3 T3 alias — legacy id redirects to can-bus
+    modbus: modbusPage,
+    opcua: opcuaPage,
+    firmware: firmwarePage,
+    'net-apply': netApplyPage,  // v1.6.0: Network Apply & Status
+};
+let activePage = null;
+let detachDirtyTracking = null;
+
+// v1.8.0 Task 4: 네트워크 도메인 페이지 id 집합. Save 시 이 중 하나라도 dirty 였다면
+// "네트워크 변경" 으로 보고 User 모드에서 자동 apply 를 트리거한다 (netmodel.NETWORK_DEV_KEYS
+// 의 프론트 대응).
+// v1.8.1 (review I-1): 'opcua'/'modbus' 추가 — 이 페이지들이 opc_ua_server_ip/port,
+//   modbus_server_ip/port (모두 netmodel.NETWORK_DEV_KEYS) 를 편집한다. 누락 시 OPC-UA/Modbus
+//   엔드포인트 변경이 User 모드 Save 에서 자동 적용되지 않고(드리프트 폴백은 503/파일부재 시 fail-open)
+//   "저장됨" 토스트만 뜬 채 재부팅 전까지 OS 에 반영 안 되던 결함.
+const NETWORK_PAGES = new Set(['wifi', 'ssid', 'ethernet', 'server-setting', 'network', 'opcua', 'modbus']);
+
+// v1.8.2 (review prod-safety): 연결을 끊을 수 있는 "파괴적" 네트워크 페이지. eth1(관리 IP)·Wi-Fi
+//   변경은 인터페이스 재설정으로 현 세션이 끊길 수 있어 User 모드에서도 적용 전 평이한 확인을 둔다.
+//   server-setting/opcua/modbus 는 엔드포인트(목적지)만 바꿔 인터페이스 재설정이 없으므로 비파괴적 —
+//   확인 없이 즉시 적용(단순 흐름 유지).
+const DISRUPTIVE_NETWORK_PAGES = new Set(['wifi', 'ssid', 'ethernet', 'network']);
+
+// Config pages owned by the imported device/protocol payload. An Import overwrites
+// these in-memory; flag them dirty so the nav-guard and beforeunload fire (otherwise
+// an imported-but-unsaved config is silently lost on navigate/reload). Canonical ids only
+// (no home/firmware/net-apply — those don't hold importable config).
+const IMPORTABLE_CONFIG_PAGES = [
+    'wifi', 'ethernet', 'server-setting', 'general',
+    'sensor-io', 'can-bus', 'opcua', 'modbus', 'log',
+];
+
+// ─────────────────────────────────────────────────────────────
+// v1.5.0 P1: Sidebar nested infrastructure
+// (sidebar group toggle + localStorage + keyboard nav + icon 주입)
+// ─────────────────────────────────────────────────────────────
+
+const SIDEBAR_LS_KEY = 'wc.sidebar.groups';
+
+/**
+ * v1.5.0 P1: Sidebar icon 주입 — 모든 icon-* 슬롯에 inline SVG 채움.
+ */
+function injectSidebarIcons() {
+    const map = {
+        // v1.11.15: System group icon — real Lucide 'monitor' glyph (added to icons.js).
+        'icon-grp-system':       { name: 'monitor',      size: 16 },
+        'icon-chev-system':      { name: 'chevron-down', size: 14 },
+        'icon-grp-firmware':     { name: 'package',      size: 16 },
+        'icon-chev-firmware':    { name: 'chevron-down', size: 14 },
+        'icon-grp-network':      { name: 'globe',        size: 16 },
+        'icon-grp-interface':    { name: 'plug-zap',     size: 16 },
+        'icon-chev-network':     { name: 'chevron-down', size: 14 },
+        'icon-chev-interface':   { name: 'chevron-down', size: 14 },
+        'icon-nav-home':         { name: 'home',         size: 18 },
+        'icon-nav-wifi':         { name: 'wifi',         size: 16 },  // v1.5.0 P2
+        'icon-nav-ethernet':     { name: 'ethernet-port', size: 16 },  // v1.5.0 P2 T2
+        'icon-nav-server-setting': { name: 'server',       size: 16 },  // v1.5.0 P2 T3
+        'icon-nav-general':      { name: 'sliders-horizontal', size: 16 },  // v1.5.0 P3 T6
+        'icon-nav-sensor-io':    { name: 'cable',              size: 16 },  // v1.5.0 P3 T6
+        'icon-nav-can-bus':      { name: 'route',              size: 16 },  // v1.5.0 P3 T6
+        // icon-nav-register / icon-nav-can removed — nav entries migrated to general/can-bus (P3 T6)
+        'icon-nav-opcua':        { name: 'link',         size: 16 },
+        'icon-nav-modbus':       { name: 'share-2',      size: 16 },
+        'icon-nav-log':          { name: 'file-text',    size: 18 },
+        'icon-nav-firmware':     { name: 'package',      size: 18 },
+        'icon-nav-net-apply':    { name: 'plug-zap',     size: 16 },  // v1.6.0
+        'icon-nav-wifi-ap':      { name: 'wifi',         size: 16 },  // AP: nav icon
+    };
+    Object.entries(map).forEach(([id, spec]) => {
+        const el = document.getElementById(id);
+        if (el) el.innerHTML = icon(spec.name, { size: spec.size });
+    });
+}
+
+function loadSidebarState() {
+    try {
+        const raw = localStorage.getItem(SIDEBAR_LS_KEY);
+        return raw ? JSON.parse(raw) : { system: true, network: true, 'interface-protocol': true, firmware: true };
+    } catch (e) {
+        return { system: true, network: true, 'interface-protocol': true, firmware: true };
+    }
+}
+
+function saveSidebarState(state) {
+    try {
+        localStorage.setItem(SIDEBAR_LS_KEY, JSON.stringify(state));
+    } catch (e) { /* ignore quota */ }
+}
+
+function applySidebarState(state) {
+    document.querySelectorAll('.nav-group__toggle').forEach(btn => {
+        const groupEl = btn.closest('.nav-group');
+        if (!groupEl) return;
+        const groupKey = groupEl.dataset.group;
+        const expanded = state[groupKey] !== false;  // default expanded
+        btn.setAttribute('aria-expanded', String(expanded));
+    });
+}
+
+function initSidebarGroups() {
+    const state = loadSidebarState();
+    applySidebarState(state);
+
+    document.querySelectorAll('.nav-group__toggle').forEach(btn => {
+        btn.addEventListener('click', e => {
+            e.preventDefault();
+            const expanded = btn.getAttribute('aria-expanded') === 'true';
+            const newState = !expanded;
+            btn.setAttribute('aria-expanded', String(newState));
+            const groupEl = btn.closest('.nav-group');
+            if (groupEl) {
+                state[groupEl.dataset.group] = newState;
+                saveSidebarState(state);
+            }
+        });
+
+        btn.addEventListener('keydown', e => {
+            if (e.key === 'Enter' || e.key === ' ') {
+                e.preventDefault();
+                btn.click();
+            }
+        });
+    });
+}
+
+function initSidebarKeyboardNav() {
+    const sidebar = document.getElementById('sidebar-nav');
+    if (!sidebar) return;
+
+    sidebar.addEventListener('keydown', e => {
+        const target = e.target;
+        if (!target.classList || !target.classList.contains('nav-item')) return;
+
+        const allLeaves = Array.from(sidebar.querySelectorAll(
+            '.nav-item:not(.nav-item--disabled):not([style*="display:none"])'
+        ));
+        const idx = allLeaves.indexOf(target);
+        if (idx < 0) return;
+
+        if (e.key === 'ArrowDown') {
+            e.preventDefault();
+            const next = allLeaves[(idx + 1) % allLeaves.length];
+            if (next) next.focus();
+        } else if (e.key === 'ArrowUp') {
+            e.preventDefault();
+            const prev = allLeaves[(idx - 1 + allLeaves.length) % allLeaves.length];
+            if (prev) prev.focus();
+        } else if (e.key === 'Escape') {
+            e.preventDefault();
+            const groupEl = target.closest('.nav-group');
+            if (!groupEl) return;
+            const btn = groupEl.querySelector('.nav-group__toggle');
+            if (btn) {
+                btn.setAttribute('aria-expanded', 'false');
+                const st = loadSidebarState();
+                st[groupEl.dataset.group] = false;
+                saveSidebarState(st);
+                btn.focus();
+            }
+        }
+    });
+}
+
+// ─── Initialization ─────────────────────────────────────────
+document.addEventListener('DOMContentLoaded', async () => {
+    initTheme();
+    initVersion();
+    initViewMode();
+    initNavigation();
+    // v1.7.1 Task 2: dashboard issue deep-links navigate via showPage (Dashboard is
+    // read-only, so nav-guard is unnecessary here).
+    setHomeNavigate((pageId) => showPage(pageId));
+    initSidebar();
+    injectSidebarIcons();
+    initSidebarGroups();
+    initSidebarKeyboardNav();
+    initActions();
+    initUnsavedWarning();
+    await loadAllData();
+    updateTabVisibility();
+    showPage('home');
+    // v1.7.0: Pending Changes 초기화 — 배지 wiring + 미적용 캐시·폴링.
+    // baseline 은 loadAllData 의 setDevice/setProtocol 에서 이미 잡혔다.
+    initPending({
+        rerender: () => showPage(state.currentPage),
+        navigate: (p) => showPage(p),
+        saveAll: () => handleSaveAll({ skipConfirm: true }),
+    });
+    // ★ C1 (v1.8.1): 진행 중 apply 를 새 로드에서 이어받는다. eth1 관리 IP 변경은 현 연결을 끊어
+    //   재접속(=새 페이지 로드)을 강제하는데, 그 새 로드엔 runSimpleApply 호출 지점이 없어
+    //   CONFIRM_WAIT 배너가 사라지고 확정 못 하면 TTL 만료 → 자동 롤백 → 운영자(새 IP) 단절.
+    //   모드 무관(배너는 #apply-flow-host = page-container 밖, 평이 언어). fire-and-forget.
+    resumeIfConfirming();
+});
+
+// ─── Data Loading ───────────────────────────────────────────
+async function loadAllData() {
+    try {
+        if (DEBUG) console.log('[App] Loading data from API...');
+        const [device, protocol, mac] = await Promise.all([
+            getDevice(),
+            getProtocol(),
+            getMac(),
+        ]);
+        if (DEBUG) console.log('[App] Raw device response:', device);
+        if (DEBUG) console.log('[App] Raw protocol response:', protocol);
+        if (DEBUG) console.log('[App] Device MAC:', mac);
+        _deviceMac = mac;
+        setDevice(device);
+        setProtocol(protocol);
+        state.isDirty = false;
+        if (DEBUG) console.log('[App] Data loaded. state.device:', state.device);
+        if (DEBUG) console.log('[App] Data loaded. state.protocol:', state.protocol);
+    } catch (e) {
+        console.error('[App] Failed to load config:', e);
+        showToast('Failed to load configuration. Check server connection.', 'error');
+        // Use defaults
+        setDevice(null);
+        setProtocol(null);
+    } finally {
+        document.getElementById('loading').style.display = 'none';
+        document.getElementById('page-container').style.display = 'block';
+    }
+}
+
+// ─── Page Navigation ────────────────────────────────────────
+function showPage(pageId) {
+    // v1.8.0 Task 3: Apply & Status 는 Advanced 전용. User 모드 진입 시 Dashboard 로 리다이렉트
+    // (직접 deeplink·이전 모드에서 머문 경우 모두 차단). nav 숨김(.advanced-only)과 이중 가드.
+    if (pageId === 'net-apply' && !isAdvanced()) {
+        pageId = 'home';
+    }
+    const prevPage = state.currentPage;   // v1.7.0: net-apply 이탈/진입 drift 재계산용
+    // Collect current page data before destroying DOM (prevents data loss on tab switch).
+    // v1.5.5.7: 현재 page 가 dirty 일 때만 collect — Discard 직후 state 복원이
+    // 이 collector 에 의해 DOM 의 stale 값으로 덮어쓰여 무효화되던 결함 차단.
+    // Save / dirty 아닌 nav / initial load 모두 정상 (collector 자체가 noop 또는
+    // handleSaveAll 안의 collectAllPagesData 가 별도로 호출).
+    if (
+        state.pageDirty[state.currentPage] &&
+        window.__pageCollectors?.[state.currentPage]
+    ) {
+        window.__pageCollectors[state.currentPage]();
+    }
+
+    // 신규 인터페이스: destroy 호출
+    if (activePage?.destroy) {
+        activePage.destroy();
+    }
+    if (detachDirtyTracking) {
+        detachDirtyTracking();
+        detachDirtyTracking = null;
+    }
+
+    state.currentPage = pageId;
+
+    // Update nav active state
+    document.querySelectorAll('.nav-item').forEach(el => {
+        el.classList.toggle('active', el.dataset.page === pageId);
+    });
+
+    // Render page
+    const container = document.getElementById('page-container');
+    container.innerHTML = '';
+    container.style.animation = 'none';
+    void container.offsetHeight;
+    container.style.animation = '';
+
+    const page = PAGES[pageId];
+    if (page && page.render && page.mount) {
+        // 신규 인터페이스
+        page.render(container);
+        page.mount(container);
+        activePage = page;
+    } else {
+        // 레거시: 함수 직접 호출
+        const renderer = PAGE_RENDERERS[pageId];
+        if (renderer) renderer(container);
+        activePage = null;
+    }
+
+    detachDirtyTracking = attachDirtyTracking(container, pageId);
+
+    // v1.7.0: net-apply 진입/이탈 시 미적용(drift) 재계산 — 그 페이지에서 Apply/confirm/rollback 하면
+    // drift 가 변하므로 전역 배지를 최신화한다. (apply_engine 이벤트 훅 없이 페이지 전환으로 흡수.)
+    if (pageId === 'net-apply' || prevPage === 'net-apply') {
+        try { refreshUnapplied(); } catch (_) {}
+    }
+
+    // Close mobile sidebar
+    document.getElementById('sidebar').classList.remove('open');
+    document.getElementById('sidebar-overlay').classList.remove('show');
+}
+
+function initNavigation() {
+    document.querySelectorAll('.nav-item').forEach(el => {
+        el.addEventListener('click', async (e) => {
+            e.preventDefault();
+            // Block disabled leaves (e.g. Firmware placeholder)
+            if (el.classList.contains('disabled') || el.classList.contains('nav-item--disabled')) return;
+            const pageId = el.dataset.page;
+            const currentPage = state.currentPage;
+            // v1.5.0 P1: nav-guard — confirm navigation if current page is dirty
+            if (currentPage && currentPage !== pageId) {
+                const ok = await confirmNavigation(currentPage);
+                if (!ok) return;
+            }
+            showPage(pageId);
+        });
+    });
+    document.getElementById('logo-home')?.addEventListener('click', async (e) => {
+        e.preventDefault();
+        const currentPage = state.currentPage;
+        if (currentPage && currentPage !== 'home') {
+            const ok = await confirmNavigation(currentPage);
+            if (!ok) return;
+        }
+        showPage('home');
+    });
+}
+
+/**
+ * Update sidebar tab visibility based on protocol settings.
+ * Called when Register page changes protocol or can_input.
+ */
+export function updateTabVisibility() {
+    const protocol = state.protocol?.protocol || 'NONE';
+    const canInput = state.protocol?.can_input || 'off';
+
+    const modbusTab = document.getElementById('nav-modbus');
+    const opcuaTab = document.getElementById('nav-opcua');
+    const canTab = document.getElementById('nav-can-bus');
+
+    if (modbusTab) modbusTab.classList.toggle('disabled', protocol !== 'MODBUS');
+    if (opcuaTab) opcuaTab.classList.toggle('disabled', protocol !== 'OPC_UA');
+    if (canTab) canTab.classList.toggle('disabled', canInput !== 'on');
+}
+
+// ─── Mobile Sidebar ─────────────────────────────────────────
+function initSidebar() {
+    const btn = document.getElementById('btn-menu');
+    const sidebar = document.getElementById('sidebar');
+    const overlay = document.getElementById('sidebar-overlay');
+
+    if (btn) {
+        btn.addEventListener('click', () => {
+            sidebar.classList.toggle('open');
+            overlay.classList.toggle('show');
+        });
+    }
+    if (overlay) {
+        overlay.addEventListener('click', () => {
+            sidebar.classList.remove('open');
+            overlay.classList.remove('show');
+        });
+    }
+}
+
+// ─── Unsaved Changes Warning ────────────────────────────────
+function initUnsavedWarning() {
+    window.addEventListener('beforeunload', (e) => {
+        if (state.isDirty) {
+            e.preventDefault();
+            e.returnValue = '';
+        }
+    });
+}
+
+// ─── Actions: Save, Import, Export ──────────────────────────
+function initActions() {
+    // Save All
+    const saveBtn = document.getElementById('btn-save-all');
+    const saveMobile = document.getElementById('btn-save-mobile');
+    if (saveBtn) saveBtn.addEventListener('click', handleSaveAll);
+    if (saveMobile) saveMobile.addEventListener('click', handleSaveAll);
+
+    // Import
+    const importBtn = document.getElementById('btn-import');
+    const fileInput = document.getElementById('file-import');
+    if (importBtn) importBtn.addEventListener('click', () => fileInput?.click());
+    if (fileInput) fileInput.addEventListener('change', handleImport);
+
+    // Export
+    const exportBtn = document.getElementById('btn-export');
+    if (exportBtn) exportBtn.addEventListener('click', handleExport);
+}
+
+/**
+ * Validate ALL pages' state before saving.
+ * Iterates PAGES map calling each page's validate().
+ * Returns array of error objects: { field, page, message }
+ */
+function validateBeforeSave() {
+    const allErrors = [];
+
+    clearAllFieldErrors();
+    clearAllPageErrors();
+
+    const seen = new Set();
+    for (const page of Object.values(PAGES)) {
+        if (page && typeof page.validate === 'function' && !seen.has(page)) {
+            seen.add(page);
+            allErrors.push(...page.validate());
+        }
+    }
+
+    if (allErrors.length > 0) {
+        // Mark sidebar error indicators
+        const errorPages = new Set(allErrors.map(e => e.page).filter(Boolean));
+        errorPages.forEach(pageId => setPageError(pageId, true));
+
+        // Navigate to first error page and focus field
+        const firstError = allErrors[0];
+        if (firstError.page && firstError.page !== state.currentPage) {
+            showPage(firstError.page);
+        }
+        // Focus after potential page switch (give DOM time to render)
+        setTimeout(() => focusErrorField(firstError), 50);
+    }
+
+    return allErrors;
+}
+
+let _saving = false; // Global lock to prevent concurrent saves
+
+/**
+ * v1.7.0 — Save All 확인 단계를 Pending Changes 패널로 위임.
+ *
+ * 기존 showSaveAllConfirm 의 단순 "페이지명 나열 + Save/Cancel" 모달을 풍부한 Pending 패널
+ * (필드별 old→new diff + per-page/전체 되돌리기 + 전체 저장)로 대체한다. 실제 저장은 패널의
+ * [전체 저장] 버튼 → 주입된 saveAll (= handleSaveAll({skipConfirm:true})) 이 수행한다.
+ *
+ * handleSaveAll({skipConfirm:false}) 계약 보존: 이 경로는 패널을 열고 false 를 반환(이번 호출은
+ * 직접 저장하지 않음 — 사용자가 패널에서 확정). skipConfirm:true 경로는 종전대로 즉시 저장.
+ */
+function showSaveAllConfirm(_dirtyPages) {
+    openPendingPanel();
+    return Promise.resolve(false);
+}
+
+async function saveSelfContainedPages(dirtyPagesBeforeSave) {
+    for (const pageId of dirtyPagesBeforeSave) {
+        const page = PAGES[pageId];
+        if (page && typeof page.saveSelfContained === 'function') {
+            await page.saveSelfContained();
+        }
+    }
+}
+
+/**
+ * v1.5.4.3 U1 fix: exported + returns boolean (true on full success, false otherwise).
+ * skipConfirm=true skips the dirty-pages confirm modal — used by nav-guard's Save button
+ * (which is itself a confirm-level dialog; double-modal is the wrong UX).
+ */
+export async function handleSaveAll({ skipConfirm = false } = {}) {
+    // Prevent concurrent save operations
+    if (_saving) return false;
+
+    // v1.5.0 P4b T3: Show confirm modal listing dirty pages if pageDirty matrix available
+    if (!skipConfirm) {
+        const dirtyPages = getDirtyPages();
+        if (dirtyPages.length > 0) {
+            const proceed = await showSaveAllConfirm(dirtyPages);
+            if (!proceed) return false;
+        }
+    }
+
+    _saving = true;
+    let saveSucceeded = false;
+
+    const btn = document.getElementById('btn-save-all');
+    const mobileBtn = document.getElementById('btn-save-mobile');
+    if (btn) { btn.disabled = true; btn.innerHTML = '<span>&#8987;</span> Saving...'; }
+    if (mobileBtn) mobileBtn.disabled = true;
+
+    try {
+        // Collect ALL pages' form data before saving (not just current page)
+        collectAllPagesData();
+
+        // Validate ALL pages' state
+        const errors = validateBeforeSave();
+        if (errors.length > 0) {
+            const errorPages = new Set(errors.map(e => e.page).filter(Boolean));
+            const msg = errorPages.size > 1
+                ? `Validation failed in ${errorPages.size} pages: ${errors[0].message}`
+                : `Validation failed: ${errors[0].message}`;
+            showToast(msg, 'warning');
+            return false;
+        }
+
+        const dirtyPagesBeforeSave = getDirtyPages();
+        const devicePayload = buildDevicePayload();
+        const protocolPayload = buildProtocolPayload();
+
+        // Save sequentially (not parallel) to avoid SQLite DB locking conflicts.
+        // v1.4.6.9 H7: 두 save의 성공 여부를 분리해 partial-failure 시 정확한 상태 보고.
+        // 이전 패턴은 saveDevice 결과만 check하고 saveProtocol throw도 deviceRes false로 보였음 —
+        // 또 saveProtocol throw 시 catch 분기로 빠져서 state.isDirty가 그대로 유지 (정상)이지만,
+        // saveProtocol이 200으로 success:false 응답하면 그게 silent 통과되던 path를 명시 처리.
+        const deviceRes = await saveDevice(devicePayload);
+        const protocolRes = await saveProtocol(protocolPayload);
+
+        const deviceOk = !!(deviceRes && deviceRes.success === true);
+        const protocolOk = !!(protocolRes && protocolRes.success === true);
+
+        if (deviceOk && protocolOk) {
+            await saveSelfContainedPages(dirtyPagesBeforeSave);
+            clearAllPageErrors();
+            const warnings = [
+                ...(Array.isArray(deviceRes.warnings) ? deviceRes.warnings : []),
+                ...(Array.isArray(protocolRes.warnings) ? protocolRes.warnings : []),
+            ];
+            // v1.8.0 Task 4: clearAllDirty 전에 "네트워크 페이지가 dirty 였는지" 포착.
+            // v1.8.2: 파괴적(eth1/Wi-Fi) 변경 여부도 함께 포착 — User 모드 적용 전 확인 게이트용.
+            const dirtyNetworkPages = dirtyPagesBeforeSave.filter(p => NETWORK_PAGES.has(p));
+            const networkPageWasDirty = dirtyNetworkPages.length > 0;
+            const disruptiveChange = dirtyNetworkPages.some(p => DISRUPTIVE_NETWORK_PAGES.has(p));
+            clearAllDirty();
+            // v1.5.5.6: Save 성공 → 현재 state 를 새 Discard baseline 으로 채택
+            commitChangesAsBaseline();
+            // v1.7.0: Save(DB) 직후 미적용(drift) 재계산 — 네트워크 키 저장은 미적용 카운트를 올린다.
+            // v1.7.1 fix: 미적용>0 이면 Apply-needed CTA 만 표시 (이중 토스트 방지).
+            //   CTA 자체가 "Saved. Apply needed …" 를 전달하므로 generic success toast 는 억제.
+            //   미적용==0 (또는 drift 조회 실패) 이면 generic toast 를 그대로 표시.
+            let needApply = false;
+            try {
+                await refreshUnapplied();
+                needApply = getUnapplied() > 0;
+            } catch (_) { /* drift 조회 실패는 Save 성공에 영향 주지 않음 */ }
+
+            // v1.8.1 (review I-1/minor): 자동 apply 판정은 "이번 Save 가 네트워크 페이지를 건드렸는가"
+            //   로 결정론적으로 한다. 이전엔 `|| needApply`(전역 drift 캐시)도 OR 했으나, 그 캐시는
+            //   이번 Save 와 무관할 수 있어 (이전 미적용 잔여) 비네트워크 Save 에 apply 가 오발하거나,
+            //   반대로 drift 조회 실패(503/파일부재) 시 네트워크 Save 를 놓쳤다. needApply 는 이제
+            //   Advanced CTA 메시징 용도로만 쓴다.
+            const networkChanged = networkPageWasDirty;
+
+            const warnHead = () => {
+                const head = warnings.slice(0, 3).join(' · ');
+                const tail = warnings.length > 3 ? ` (+${warnings.length - 3} more)` : '';
+                return `Saved with warnings: ${head}${tail}`;
+            };
+
+            if (!isAdvanced() && networkChanged) {
+                // v1.8.0 ★ User 모드: Save=즉시 적용. 기존 apply 라우트(fields:{}) 자동 트리거 +
+                // "적용 중…"→평이 결과. eth1 관리 IP 변경 시 평이 재접속 확인 배너(절대 숨기지 않음).
+                if (warnings.length > 0) showToast(warnHead(), 'warning');
+                // v1.8.1 (review minor): 적용 종료 후 drift 재계산 — Advanced 배지/요약의
+                //   stale 'Unapplied N'(이미 적용됐는데 미적용으로 표시) 방지.
+                const triggerApply = () => runSimpleApply({
+                    onResult: () => {
+                        refreshUnapplied()
+                            .then(() => { try { renderPendingBadge(); } catch (_) {} })
+                            .catch(() => {});
+                    },
+                });   // fire-and-forget — 자체 진행/결과 토스트 + eth1 배너
+                if (disruptiveChange) {
+                    // v1.8.2 (review prod-safety): 파괴적 변경(eth1/Wi-Fi)은 수동 flow 의 명시 Apply
+                    //   클릭 게이트가 사라졌으므로, 적용 전 평이 확인을 둔다. 취소 시 저장은 유지하고
+                    //   적용만 미룬다(재부팅 시 반영). 비파괴적 변경은 종전대로 즉시 적용.
+                    confirmModal({
+                        title: 'Apply network changes now?',
+                        message: "Saving will reconfigure this device's network connection. "
+                            + "This page may briefly lose its connection while the change is applied.",
+                        confirmLabel: 'Apply now',
+                        cancelLabel: 'Save only',
+                    }).then((ok) => {
+                        if (ok) triggerApply();
+                        else showToast('Saved. Network changes take effect on the next reboot, '
+                            + 'or Save again to apply now.', 'info');
+                    });
+                } else {
+                    triggerApply();
+                }
+            } else if (isAdvanced() && needApply) {
+                // Advanced 모드: 기존 v1.7.1 동작 보존 — Apply-needed CTA (수동 Apply&Status 동선).
+                // v1.8.1 (review I-2): 이 분기도 저장 경고를 노출(이전엔 CTA 만 떠 warnings 누락 — User 분기와 비대칭).
+                if (warnings.length > 0) showToast(warnHead(), 'warning');
+                applyNeededCta();
+            } else if (warnings.length > 0) {
+                showToast(warnHead(), 'warning');
+            } else {
+                // 비네트워크 Save (또는 변경 없음): "저장됨 ✓".
+                showToast('Configuration saved successfully.', 'success');
+            }
+            saveSucceeded = true;
+        } else {
+            // v1.4.6.9 H7: 어느 쪽이 실패했는지 명시. state.isDirty는 그대로 유지 (재시도 가능).
+            const failedParts = [];
+            if (!deviceOk) failedParts.push('device');
+            if (!protocolOk) failedParts.push('protocol');
+            const msg = (deviceRes?.message || protocolRes?.message
+                || `Save failed: ${failedParts.join(' + ')}`);
+            showToast(msg, 'warning');
+        }
+    } catch (e) {
+        console.error('Save failed:', e);
+        showToast('Save failed — ' + e.message, 'error');
+    } finally {
+        _saving = false;
+        if (btn) { btn.disabled = false; btn.innerHTML = '<span>&#128190;</span> Save All'; }
+        if (mobileBtn) mobileBtn.disabled = false;
+    }
+    return saveSucceeded;
+}
+
+/**
+ * Collect form data from ALL pages that have been rendered and registered.
+ * Each page module registers a collector via window.__pageCollectors.
+ * Only the currently displayed page will have DOM elements; others use state as-is.
+ */
+function collectAllPagesData() {
+    if (!window.__pageCollectors) return;
+    // Collect from the currently displayed page (it has active DOM elements)
+    if (window.__pageCollectors[state.currentPage]) {
+        window.__pageCollectors[state.currentPage]();
+    }
+}
+
+// Expose for page modules to register their data collectors
+window.__pageCollectors = {};
+
+function handleImport(e) {
+    const file = e.target.files[0];
+    if (!file) return;
+
+    const reader = new FileReader();
+    reader.onload = (ev) => {
+        try {
+            const data = JSON.parse(ev.target.result);
+
+            // Schema validation: ensure recognizable format
+            const isFormatA = data.device && typeof data.device === 'object';
+            const isFormatB = data.wifi || data.ssid_list || data.eth;
+            const isFormatC = 'wifi_ip' in data || 'eth_ip' in data || 'WIFI_SSID' in data;
+            if (!isFormatA && !isFormatB && !isFormatC) {
+                showToast('Import failed — Unrecognized configuration file format.', 'error');
+                return;
+            }
+
+            // Confirm before overwriting — show meta info if available
+            let confirmMsg = 'Current settings will be overwritten with the imported file.';
+            if (data.meta) {
+                const m = data.meta;
+                const parts = [];
+                if (m.equipment) parts.push(`Equipment: ${m.equipment}`);
+                if (m.protocol) parts.push(`Protocol: ${m.protocol}`);
+                if (m.mac) parts.push(`MAC: ${m.mac}`);
+                if (m.exported_at) parts.push(`Exported: ${m.exported_at.slice(0, 19).replace('T', ' ')}`);
+                if (parts.length) confirmMsg += `\n\n${parts.join('\n')}`;
+            }
+            confirmMsg += '\n\nContinue?';
+            if (!confirm(confirmMsg)) {
+                return;
+            }
+
+            // v1.4.6.8 C3: showPage가 새 DOM replace 전에 current-page collector를 호출하므로
+            // import으로 막 set된 state.device/protocol을 stale DOM 값이 overwrite. import 동안
+            // collector를 일시 detach → showPage(→mount()) 가 새 collector 등록 → 안전 복원.
+            const pageId = state.currentPage;
+            const prevCollector = window.__pageCollectors ? window.__pageCollectors[pageId] : null;
+            if (window.__pageCollectors) {
+                window.__pageCollectors[pageId] = null;
+            }
+            try {
+                if (isFormatA) {
+                    // Format 1: Web configurator export format { device: {...}, protocol: {...} }
+                    setDevice(data.device);
+                    if (data.protocol) setProtocol(data.protocol);
+                } else if (isFormatB) {
+                    // Format 2: Already nested device-only (no wrapper)
+                    setDevice(data);
+                } else {
+                    // Format 3: Flat format from Java app.jar (wifi_ip, WIFI_SSID, etc.)
+                    setDevice(data);
+                }
+                clearAllPageErrors();
+                showPage(state.currentPage); // Re-render — mount() 가 collector 재등록
+                updateTabVisibility();
+                // Imported config is unsaved — flag dirty so nav-guard/beforeunload fire
+                // (otherwise the imported-but-unsaved config is silently lost).
+                state.isDirty = true;
+                IMPORTABLE_CONFIG_PAGES.forEach(p => markDirty(p));
+                showToast('Configuration imported successfully.', 'success');
+            } catch (importErr) {
+                // 안전 복원 (mount() 가 호출 안 된 path)
+                if (window.__pageCollectors && prevCollector) {
+                    window.__pageCollectors[pageId] = prevCollector;
+                }
+                throw importErr;
+            }
+        } catch (err) {
+            showToast('Import failed — Invalid JSON file format.', 'error');
+        }
+    };
+    reader.readAsText(file);
+    e.target.value = ''; // Reset
+}
+
+function handleExport() {
+    collectAllPagesData();
+
+    const devicePayload = buildDevicePayload();
+    const protocolPayload = buildProtocolPayload();
+
+    // Equipment & protocol come from the Register page (state.protocol)
+    // Keep raw values for meta (informational), sanitize separately for filename
+    const equipmentRaw = state.protocol?.equipment || 'STS';
+    const protocolRaw = state.protocol?.protocol || 'NONE';
+
+    // Sanitize for filename safety: keep [A-Za-z0-9_-], cap at 32 chars
+    const sanitizeForFile = (s, fallback) => {
+        const cleaned = String(s).replace(/[^A-Za-z0-9_-]/g, '').slice(0, 32);
+        return cleaned || fallback;
+    };
+    const equipmentForFile = sanitizeForFile(equipmentRaw, 'STS');
+    const protocolForFile = sanitizeForFile(protocolRaw, 'NONE');
+
+    // MAC suffix: last 4 hex chars (uppercase, no colons), padded to 4
+    const macSuffix = _deviceMac
+        ? _deviceMac.replace(/[^0-9a-fA-F]/g, '').slice(-4).toUpperCase().padStart(4, '0')
+        : 'XXXX';
+
+    // Single timestamp shared by dateStr (filename) and exported_at (meta)
+    const now = new Date();
+    const dateStr = now.toISOString().slice(0, 10);
+
+    const data = {
+        meta: {
+            mac: _deviceMac,
+            equipment: equipmentRaw,
+            protocol: protocolRaw,
+            exported_at: now.toISOString(),
+        },
+        device: devicePayload,
+        protocol: protocolPayload,
+    };
+
+    const blob = new Blob([JSON.stringify(data, null, 2)], { type: 'application/json' });
+    const url = URL.createObjectURL(blob);
+    const a = document.createElement('a');
+    a.href = url;
+    a.download = `${equipmentForFile}_${protocolForFile}_${macSuffix}_${dateStr}.json`;
+    a.click();
+    URL.revokeObjectURL(url);
+    showToast('Configuration exported successfully.', 'success');
+}
+
+// ─── Theme ──────────────────────────────────────────────────
+function initTheme() {
+    const saved = localStorage.getItem('theme') || 'dark';
+    document.documentElement.setAttribute('data-theme', saved);
+    updateThemeIcon(saved);
+
+    document.getElementById('btn-theme')?.addEventListener('click', () => {
+        const current = document.documentElement.getAttribute('data-theme');
+        const next = current === 'dark' ? 'light' : 'dark';
+        document.documentElement.setAttribute('data-theme', next);
+        localStorage.setItem('theme', next);
+        updateThemeIcon(next);
+    });
+}
+
+function updateThemeIcon(theme) {
+    const btn = document.getElementById('btn-theme');
+    if (btn) btn.textContent = theme === 'dark' ? '🌙' : '☀️';
+}
+
+// ─── App Version ────────────────────────────────────────────
+function initVersion() {
+    const nameEl = document.getElementById('app-name');
+    if (nameEl) nameEl.textContent = APP_NAME;
+    const verEl = document.getElementById('app-version');
+    if (verEl) verEl.textContent = APP_VERSION;
+}
+
+// ─── v1.8.0: Advanced/Debug view ────────────────────────────
+/**
+ * Advanced/Debug 보기 토글 초기화.
+ *  - localStorage 에서 hydrate → body.advanced 클래스 반영(.advanced-only/.user-only CSS 구동).
+ *  - 사이드바 footer 토글 wire (change → setAdvanced).
+ *  - 변경 시: body 클래스 갱신 + 현재 페이지 재렌더(Dashboard watchdog 게이팅) +
+ *    pending 배지 재렌더(미적용 카운트 모드 분기). User 모드에서 net-apply 에 머물러 있으면 home 으로 리다이렉트.
+ */
+function initViewMode() {
+    initViewModeStorage();
+    reflectAdvancedClass();
+
+    const toggle = document.getElementById('advanced-view-toggle');
+    if (toggle) {
+        toggle.checked = isAdvanced();
+        toggle.addEventListener('change', () => setAdvanced(toggle.checked));
+    }
+
+    onAdvancedChange(() => {
+        reflectAdvancedClass();
+        const tog = document.getElementById('advanced-view-toggle');
+        if (tog) tog.checked = isAdvanced();
+        // User 모드 진입 시 Advanced 전용 페이지(net-apply)에 머물러 있으면 Dashboard 로 이동.
+        if (!isAdvanced() && state.currentPage === 'net-apply') {
+            showPage('home');
+        } else {
+            // 현재 페이지 재렌더 — Dashboard watchdog 카드 등 모드 종속 표면 갱신.
+            showPage(state.currentPage);
+        }
+        // 전역 배지 재렌더 — User=미저장만 / Advanced=미저장+미적용.
+        try { renderPendingBadge(); } catch (_) {}
+    });
+}
+
+/** body.advanced 클래스를 현재 모드에 맞춰 토글 (CSS .advanced-only/.user-only 구동). */
+function reflectAdvancedClass() {
+    document.body.classList.toggle('advanced', isAdvanced());
+}
diff --git a/src/static/js/apply-flow.js b/src/static/js/apply-flow.js
new file mode 100644
index 0000000..c8f096b
--- /dev/null
+++ b/src/static/js/apply-flow.js
@@ -0,0 +1,307 @@
+/**
+ * apply-flow.js — v1.8.0 Task 4 ★ Simple Apply (User 모드, 네트워크)
+ *
+ * Spec §1.2 / §4: User 모드에서 Save 성공 + 네트워크 변경이면 **자동으로 apply 를 트리거**해
+ * "적용 중… → 적용됨 ✓" 한 동작으로 만든다. 상태머신 step·§용어·watchdog·journal 은 노출하지 않는다.
+ *
+ *  - 기존 라우트 그대로 사용: POST /api/network/apply {dry_run:false, fields:{}} (drift-apply).
+ *  - 경량 status 폴링 (net-apply.js epoch 패턴 미러) → terminal 시 평이한 결과 1줄.
+ *  - terminal 매핑(엔진 status → User 카피):
+ *      COMMITTED       → "Network settings applied." (success)
+ *      NOOP            → "Saved — nothing to apply." (success)
+ *      ROLLED_BACK     → "Could not apply — reverted to the previous settings." (warning)
+ *      FAILED_VALIDATION → "Could not apply — settings rejected. Reverted." (warning)
+ *      FAILED_CRITICAL → "Apply failed — device needs attention. (Advanced view for details)" (error)
+ *
+ * ★ 안전 불변식: eth1(웹/SSH 접속 경로) 관리 IP 변경은 스스로 끊길 수 있어 confirm-or-rollback 이
+ *   안전상 필수 → User 모드에서도 **반드시 노출**(평이한 언어). 절대 숨기지 않는다(숨기면 lockout).
+ *   재접속 후 확정 = 기존 delegated `data-net-confirm` 계약 재사용.
+ *
+ * 순환 import 회피: view-mode 를 import 하지 않는다(이 모듈은 호출 주체가 User 모드 판정 후 부른다).
+ */
+
+import { showToast } from './toast.js';
+import { escapeHtml } from './utils.js';
+
+const SIMPLE_POLL_MS = 1000;   // 경량 폴링 주기
+const TERMINAL = ['COMMITTED', 'ROLLED_BACK', 'FAILED_CRITICAL', 'FAILED_VALIDATION', 'NOOP'];
+
+/**
+ * 폴링용 setTimeout 래퍼. Node(테스트/헤드리스)에선 unref 해 진행 중 poll 타이머가
+ * 런타임 종료를 막지 않게 한다(브라우저 setTimeout 은 number 반환 → unref 없음 → no-op).
+ * 운영(브라우저) 동작에는 영향 없음.
+ */
+function _schedule(fn) {
+    const t = setTimeout(fn, SIMPLE_POLL_MS);
+    if (t && typeof t === 'object' && typeof t.unref === 'function') t.unref();
+    return t;
+}
+
+// epoch 가드 — 중복 호출/재방문 시 stale tick 자가 폐기 (net-apply.js I-2 패턴).
+let _epoch = 0;
+let _timer = null;
+let _currentApplyId = null;
+let _hostBound = null;   // eth1 confirm 위임 리스너가 바인딩된 host
+let _inFlight = false;   // I-2: 진행 중 재진입 가드 — 동시 두 번째 apply POST 차단
+
+/** Test-only / 정리: 진행 중 폴링 중단 + 상태 리셋. */
+export function _resetApplyFlow() {
+    _epoch++;
+    if (_timer) { clearTimeout(_timer); _timer = null; }
+    _currentApplyId = null;
+    _inFlight = false;
+    // I-4: 진행/eth1 배너 DOM 도 정리 — 중단 후 stale "Keep this address" 버튼 잔존(잘못된 확정) 방지.
+    _clearHost(_hostBound || (typeof document !== 'undefined'
+        ? document.getElementById('apply-flow-host') : null));
+    if (_hostBound) {
+        _hostBound.removeEventListener('click', _onConfirmClick);
+        _hostBound = null;
+    }
+}
+
+/** 현재 User-mode 적용 흐름이 진행 중인지 (net-apply.js 가 이중 폴링 회피 판정에 사용). */
+export function isInFlight() {
+    return _inFlight === true;
+}
+
+// 비-terminal(진행) 상태 — resume 판정용.
+const IN_FLIGHT_STATES = ['VALIDATING', 'SNAPSHOT', 'WRITING', 'APPLYING', 'VERIFYING', 'CONFIRM_WAIT'];
+
+/**
+ * ★ C1 (v1.8.1): 재접속/새 로드 후 진행 중 apply 를 이어받아 eth1 confirm 배너를 다시 띄운다.
+ *   eth1 관리 IP 변경은 본질적으로 현 연결을 끊어 **새 페이지 로드**를 강제한다 — 그 새 로드엔
+ *   runSimpleApply 호출 지점이 없어(=Save 시점에만) CONFIRM_WAIT 배너가 사라지고, 확정 못 하면
+ *   TTL 만료 → 자동 롤백 → 운영자(새 IP 접속 중) 단절. 이를 막기 위해 app.js init / 모드전환 /
+ *   net-apply 이탈 시 본 함수를 호출 — 빈 id 로 현재 apply 상태를 조회해 진행 중이면 폴링 재개.
+ *   net-apply.js(Advanced 페이지)가 활성일 땐 그쪽이 소유하므로, 그 페이지가 정리(destroy)될 때
+ *   다시 본 함수로 핸드백한다.
+ * @param {Object} [opts]
+ * @param {HTMLElement} [opts.host]
+ * @returns {Promise<string|null>}  재개한 state (없으면 null)
+ */
+export async function resumeIfConfirming(opts = {}) {
+    if (_inFlight) return null;   // 이미 본 모듈이 흐름을 소유 중
+    const host = opts.host || (typeof document !== 'undefined'
+        ? document.getElementById('apply-flow-host') : null);
+    let s;
+    try {
+        // 빈 id → 엔진은 현재/마지막 apply 를 반환(apply_engine.status(None) — UNKNOWN 가드 우회).
+        s = await _api('api/network/apply/status?id=');
+    } catch (e) {
+        return null;   // apply 없음 / 엔드포인트 불가 — 재개할 것 없음
+    }
+    if (!s || !IN_FLIGHT_STATES.includes(s.state)) return null;
+    _inFlight = true;
+    _currentApplyId = s.apply_id || null;
+    if (host && _hostBound !== host) {
+        if (_hostBound) _hostBound.removeEventListener('click', _onConfirmClick);
+        host.addEventListener('click', _onConfirmClick);
+        _hostBound = host;
+    }
+    if (s.state === 'CONFIRM_WAIT') _renderEth1Banner(host, s.confirm_remaining_s);
+    else _renderApplying(host);
+    _poll(host, null);   // terminal 까지 폴링 이어감 (fire-and-forget)
+    return s.state;
+}
+
+async function _api(path, opts) {
+    const res = await fetch(path, opts);
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) throw new Error(body.error || `${path}: ${res.status}`);
+    return body;
+}
+
+/**
+ * 엔진 terminal status → User 평이 결과 { kind, text }.
+ * kind: 'success' | 'warning' | 'error' (toast type 와 동일).
+ * @param {string} state  엔진 terminal state
+ * @param {Object} [status]  전체 status payload (country_pending 등 부가 신호 — 선택)
+ */
+export function mapTerminal(state, status) {
+    switch (state) {
+        case 'COMMITTED':
+            // v1.8.1: country-code 변경은 deferred(재부팅 후 적용). 엔진은 COMMITTED+country_pending
+            //   으로 알린다 — "적용됨" 으로 오인시키지 말 것(운영자가 재부팅 필요를 모름).
+            if (status && status.country_pending) {
+                return { kind: 'success', text: 'Saved. The Wi-Fi region change takes effect after the next reboot.' };
+            }
+            return { kind: 'success', text: 'Network settings applied.' };
+        case 'NOOP':
+            return { kind: 'success', text: 'Saved — nothing to apply.' };
+        case 'ROLLED_BACK':
+            return { kind: 'warning', text: 'Could not apply — reverted to the previous settings.' };
+        case 'FAILED_VALIDATION':
+            return { kind: 'warning', text: 'Could not apply — the settings were rejected. Reverted to the previous settings.' };
+        case 'FAILED_CRITICAL':
+            return { kind: 'error', text: 'Apply failed — the device needs attention. Turn on Advanced / Debug view for details.' };
+        default:
+            // M-6: 알 수 없는/비terminal 엔진 상태를 사용자 카피에 그대로 노출하지 않는다(평이 언어 정책).
+            return { kind: 'warning', text: 'Apply finished with an unexpected result. Turn on Advanced / Debug view for details.' };
+    }
+}
+
+/**
+ * eth1 관리 IP 변경 평이 재접속 배너 (CONFIRM_WAIT). ★ 절대 숨기지 않음.
+ * delegated `data-net-confirm` 계약 재사용 — 재접속 후 [Keep this address] 로 확정.
+ * @param {HTMLElement} host
+ * @param {number|string} remaining  남은 초
+ */
+function _renderEth1Banner(host, remaining) {
+    if (!host) return;
+    // M-9: 배너가 이미 떠 있으면 카운트다운 숫자만 textContent 로 교체(전체 재빌드 회피 —
+    //   버튼/포커스 보존). textContent 경로는 XSS 안전이라 escape 불필요.
+    const existing = host.querySelector('[data-eth1-reconnect]');
+    if (existing) {
+        const countEl = existing.querySelector('[data-eth1-count]');
+        if (countEl) countEl.textContent = String(remaining ?? '?');
+        return;
+    }
+    const secs = escapeHtml(String(remaining ?? '?'));
+    const applyId = escapeHtml(_currentApplyId || '');
+    host.innerHTML = `
+        <div class="info-banner info-banner--warning apply-flow__eth1" data-eth1-reconnect role="alert">
+            <strong>Connection address changed.</strong>
+            If you changed this device's IP, this page will lose its connection.
+            Reconnect at <span class="text-mono">http://&lt;new IP&gt;:9090</span> within
+            <span data-eth1-count>${secs}</span>s and keep this address — otherwise it reverts automatically.
+            <button class="btn btn--primary btn--sm" data-net-confirm="${applyId}">Keep this address</button>
+        </div>`;
+}
+
+/** 진행 중 표시 (단순 스피너 1줄 — step/§용어 없음). */
+function _renderApplying(host) {
+    if (!host) return;
+    host.innerHTML = `
+        <div class="info-banner apply-flow__progress" role="status" aria-live="polite">
+            Applying network settings…
+        </div>`;
+}
+
+/** host 비우기 (terminal·정리 시). */
+function _clearHost(host) {
+    if (host) host.innerHTML = '';
+}
+
+// eth1 [Keep this address] 위임 핸들러 — 기존 confirm 라우트 호출. 재렌더에도 살아남음.
+function _onConfirmClick(event) {
+    const btn = event.target.closest && event.target.closest('[data-net-confirm]');
+    if (!btn) return;
+    const applyId = btn.getAttribute('data-net-confirm') || _currentApplyId;
+    _doConfirm(applyId);
+}
+
+async function _doConfirm(applyId) {
+    try {
+        await _api('api/network/apply/confirm', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ apply_id: applyId || _currentApplyId }),
+        });
+        // v1.11.10 (review #28): the confirm IS the terminal user action — invalidate the
+        // still-running poll BEFORE clearing the host. Without this, the next status tick
+        // reads the now-COMMITTED apply and fires a 2nd (duplicate) success toast on top of
+        // this confirm toast. Bumping _epoch makes that tick fail its `epoch !== _epoch`
+        // guard and resolve null silently; we then terminate the flow ourselves so a later
+        // Save can apply again (the running tick no longer reaches the in-flight reset).
+        _epoch++;
+        if (_timer) { clearTimeout(_timer); _timer = null; }
+        _inFlight = false;
+        // M-7: 확정 성공 시 배너 즉시 제거 — 다음 폴링 tick(최대 1s) 을 기다리지 않는다.
+        _clearHost(_hostBound);
+        showToast('Address kept — network settings applied.', 'success');
+    } catch (e) {
+        showToast('Could not keep the address — ' + e.message, 'error');
+    }
+}
+
+/**
+ * User 모드 단순 적용 실행.
+ * @param {Object} [opts]
+ * @param {HTMLElement} [opts.host]   진행/eth1 배너를 그릴 컨테이너 (기본: #apply-flow-host)
+ * @param {Function}    [opts.onResult]  terminal 결과 콜백 ({kind,text}) — 테스트/추가 UI 용
+ * @returns {Promise<{kind,text}|null>}  terminal 결과 (시작 실패 시 null)
+ */
+export async function runSimpleApply(opts = {}) {
+    const host = opts.host || document.getElementById('apply-flow-host') || null;
+    const onResult = typeof opts.onResult === 'function' ? opts.onResult : null;
+
+    // I-2: 이미 적용이 진행 중이면 두 번째 apply 를 시작하지 않는다(동시 엔진 세션/혼란 방지).
+    //   _saving 가드(handleSaveAll)가 1차 방어이나, 동기 이중 호출까지 막기 위해
+    //   가드 직후 즉시 in-flight 로 표시(첫 await 이전).
+    if (_inFlight) {
+        showToast('Network settings are already being applied — please wait.', 'info');
+        return null;
+    }
+    _inFlight = true;
+
+    // eth1 confirm 위임 리스너를 host 에 1회 바인딩 (재방문 누적 방지).
+    if (host && _hostBound !== host) {
+        if (_hostBound) _hostBound.removeEventListener('click', _onConfirmClick);
+        host.addEventListener('click', _onConfirmClick);
+        _hostBound = host;
+    }
+
+    let started;
+    try {
+        started = await _api('api/network/apply', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ dry_run: false, fields: {} }),
+        });
+    } catch (e) {
+        _inFlight = false;   // 시작 실패 → 가드 해제(재시도 가능)
+        // eth1-safety (v1.8.1): 409 "apply in flight" 는 이미 apply(가능성으로 eth1 CONFIRM_WAIT)가
+        //   대기 중이라는 뜻 — 죽은 에러 대신 그 흐름을 이어받아 confirm 배너를 띄운다.
+        const resumed = await resumeIfConfirming({ host });
+        if (resumed) return null;
+        showToast('Could not start applying network settings — ' + e.message, 'error');
+        return null;
+    }
+    _currentApplyId = started.apply_id || null;
+    _renderApplying(host);
+
+    return _poll(host, onResult);
+}
+
+function _poll(host, onResult) {
+    if (_timer) { clearTimeout(_timer); _timer = null; }
+    const epoch = ++_epoch;
+
+    return new Promise((resolve) => {
+        async function tick() {
+            let s;
+            try {
+                s = await _api(`api/network/apply/status?id=${encodeURIComponent(_currentApplyId || '')}`);
+            } catch (e) {
+                // 폴링 일시 실패 — eth1 IP 변경 중 단절 가능. epoch 유효하면 재시도.
+                if (epoch === _epoch) _timer = _schedule(tick);
+                return;
+            }
+            if (epoch !== _epoch) { resolve(null); return; }  // stale generation
+
+            if (s.state === 'CONFIRM_WAIT') {
+                _renderEth1Banner(host, s.confirm_remaining_s);
+                _timer = _schedule(tick);
+                return;
+            }
+
+            if (TERMINAL.includes(s.state)) {
+                _epoch++;   // 이후 어떤 tick 도 무효화
+                _timer = null;
+                _inFlight = false;   // I-2: 진행 종료 — 다음 Save=apply 허용
+                _clearHost(host);
+                const result = mapTerminal(s.state, s);
+                showToast(result.text, result.kind);
+                if (onResult) onResult(result);
+                resolve(result);
+                return;
+            }
+
+            // 진행 중 — 단순 표시 유지 후 재예약.
+            _renderApplying(host);
+            if (epoch === _epoch) _timer = _schedule(tick);
+        }
+        // 첫 tick 즉시 (테스트·반응성 — net-apply 는 1s 지연이나 여기선 즉시 첫 조회).
+        tick();
+    });
+}
diff --git a/src/static/js/components/crud-table.js b/src/static/js/components/crud-table.js
new file mode 100644
index 0000000..2964846
--- /dev/null
+++ b/src/static/js/components/crud-table.js
@@ -0,0 +1,70 @@
+/**
+ * crud-table.js — Shared CRUD Table Component
+ * 
+ * Reusable dynamic table with add/delete row functionality.
+ * Used by modbus.js, opcua.js, can.js to eliminate code duplication (C-1 fix).
+ */
+
+import { escapeHtml } from '../utils.js';
+
+/**
+ * Create a CRUD table inside a container element.
+ * 
+ * @param {HTMLElement} tbody - The <tbody> element to populate
+ * @param {Object} options
+ * @param {Array<Object>} options.columns - Column definitions: { key, label, width, type, options, placeholder, defaultValue }
+ *   - type: 'input' (default), 'select'
+ *   - options: for 'select' type, array of option values
+ * @param {Array<Object>} options.data - Initial row data
+ * @returns {{ collectData: () => Array<Object> }} - Methods to interact with the table
+ */
+export function populateCrudTable(tbody, { columns, data }) {
+    // Populate initial rows
+    data.forEach(rowData => addRow(tbody, columns, rowData));
+
+    return {
+        addEmptyRow: () => addRow(tbody, columns, {}),
+        collectData: () => collectTableData(tbody, columns),
+    };
+}
+
+function addRow(tbody, columns, data) {
+    const tr = document.createElement('tr');
+
+    const cells = columns.map(col => {
+        const fieldKey = escapeHtml(col.key);
+        if (col.type === 'select') {
+            return `<td>
+                <select class="form-select form-select--sm" data-field="${fieldKey}">
+                    ${col.options.map(v => `<option value="${escapeHtml(v)}" ${data[col.key] === v ? 'selected' : ''}>${escapeHtml(v)}</option>`).join('')}
+                </select>
+            </td>`;
+        }
+        // Default: input
+        const val = data[col.key] ?? col.defaultValue ?? '';
+        const style = col.width ? `style="width:${col.width};"` : '';
+        const maxAttr = col.maxLength ? `maxlength="${parseInt(col.maxLength, 10) || ''}"` : '';
+        const placeholder = escapeHtml(col.placeholder || '');
+        return `<td><input class="form-input form-input--mono" data-field="${fieldKey}" value="${escapeHtml(val)}" placeholder="${placeholder}" ${maxAttr} ${style}></td>`;
+    });
+
+    tr.innerHTML = cells.join('') + `
+        <td class="col-action">
+            <button class="btn btn--ghost btn--icon row-delete" title="Delete" aria-label="Delete row">🗑</button>
+        </td>
+    `;
+
+    tr.querySelector('.row-delete').addEventListener('click', () => tr.remove());
+    tbody.appendChild(tr);
+}
+
+function collectTableData(tbody, columns) {
+    const rows = tbody.querySelectorAll('tr');
+    return Array.from(rows).map(tr => {
+        const rowData = {};
+        columns.forEach(col => {
+            rowData[col.key] = tr.querySelector(`[data-field="${col.key}"]`)?.value ?? '';
+        });
+        return rowData;
+    });
+}
diff --git a/src/static/js/components/ip-input.js b/src/static/js/components/ip-input.js
new file mode 100644
index 0000000..c9fbfb0
--- /dev/null
+++ b/src/static/js/components/ip-input.js
@@ -0,0 +1,101 @@
+/**
+ * ip-input.js — Shared IP Octet Input Component
+ * 
+ * Renders 4-octet IP address fields with:
+ * - Numeric-only enforcement (0-255)
+ * - Auto-tab on 3 digits
+ * - Full-IP paste support
+ * - Consistent data-ip / data-idx attributes for validation
+ */
+
+import { escapeHtml } from '../utils.js';
+
+/**
+ * Render HTML for a 4-octet IP input group.
+ * @param {string} id - Unique identifier (e.g. 'wifi_ip', 'eth_ip')
+ * @param {string} value - Current IP value (e.g. '192.168.1.1') or ''
+ * @param {string} [label='IP'] - Accessible label prefix for aria-label
+ * @returns {string} HTML string
+ */
+export function renderIpOctets(id, value, label = 'IP') {
+    const octets = (value || '').split('.');
+    return `
+        <div class="ip-input-group" data-ip-group="${id}" role="group" aria-label="${label}">
+            <input class="form-input ip-octet" data-ip="${id}" data-idx="0" id="${id}_0" maxlength="3" placeholder="0" value="${escapeHtml(octets[0] || '')}" aria-label="${label} octet 1">
+            <span class="ip-dot">.</span>
+            <input class="form-input ip-octet" data-ip="${id}" data-idx="1" id="${id}_1" maxlength="3" placeholder="0" value="${escapeHtml(octets[1] || '')}" aria-label="${label} octet 2">
+            <span class="ip-dot">.</span>
+            <input class="form-input ip-octet" data-ip="${id}" data-idx="2" id="${id}_2" maxlength="3" placeholder="0" value="${escapeHtml(octets[2] || '')}" aria-label="${label} octet 3">
+            <span class="ip-dot">.</span>
+            <input class="form-input ip-octet" data-ip="${id}" data-idx="3" id="${id}_3" maxlength="3" placeholder="0" value="${escapeHtml(octets[3] || '')}" aria-label="${label} octet 4">
+        </div>`;
+}
+
+/**
+ * Attach event listeners for all .ip-octet elements within a container.
+ * Call this once after rendering the page HTML.
+ * @param {HTMLElement} container - Parent element containing ip-octet inputs
+ */
+export function setupIpOctets(container) {
+    container.querySelectorAll('.ip-octet').forEach(el => {
+        el.addEventListener('input', (e) => {
+            let v = e.target.value.replace(/\D/g, '');
+            // Strip leading zeros (e.g. '09' → '9') but keep single '0'
+            if (v.length > 1 && v.startsWith('0')) v = String(parseInt(v, 10));
+            e.target.value = v;
+
+            // Visual feedback: red border when out of range (0-255)
+            const num = parseInt(v, 10);
+            const outOfRange = v !== '' && (isNaN(num) || num > 255);
+            e.target.classList.toggle('form-input--error', outOfRange);
+
+            // Auto-tab to next octet only when valid 3 digits
+            if (v.length === 3 && !outOfRange) {
+                const idx = parseInt(e.target.dataset.idx, 10);
+                if (idx < 3) {
+                    const next = container.querySelector(
+                        `.ip-octet[data-ip="${e.target.dataset.ip}"][data-idx="${idx + 1}"]`
+                    );
+                    if (next) next.focus();
+                }
+            }
+        });
+
+        el.addEventListener('paste', (e) => {
+            const text = (e.clipboardData || window.clipboardData).getData('text').trim();
+            const parts = text.split('.');
+            if (parts.length === 4 && parts.every(p => /^\d{1,3}$/.test(p))) {
+                e.preventDefault();
+                const ipKey = el.dataset.ip;
+                parts.forEach((p, i) => {
+                    const octetEl = container.querySelector(
+                        `.ip-octet[data-ip="${ipKey}"][data-idx="${i}"]`
+                    );
+                    if (octetEl) {
+                        const num = parseInt(p, 10);
+                        octetEl.value = String(num);
+                        octetEl.classList.toggle('form-input--error', num > 255);
+                    }
+                });
+            }
+        });
+    });
+}
+
+/**
+ * Collect 4 octets back into a single "x.x.x.x" string.
+ * Returns empty string if all octets are empty.
+ * @param {string} id - Same identifier used in renderIpOctets
+ * @returns {string}
+ */
+export function collectIpValue(id) {
+    const octets = [];
+    let hasValue = false;
+    for (let i = 0; i < 4; i++) {
+        const el = document.querySelector(`.ip-octet[data-ip="${id}"][data-idx="${i}"]`);
+        const v = el ? el.value.trim() : '';
+        octets.push(v);
+        if (v) hasValue = true;
+    }
+    return hasValue ? octets.join('.') : '';
+}
diff --git a/src/static/js/components/port-input.js b/src/static/js/components/port-input.js
new file mode 100644
index 0000000..0fa34c7
--- /dev/null
+++ b/src/static/js/components/port-input.js
@@ -0,0 +1,36 @@
+/**
+ * port-input.js
+ *
+ * Shared port input behavior. 6번째 자리 입력 자체를 원천 차단 (maxlength=5) 하고,
+ * 범위 검증은 보조 표시 (1~65535 외 값은 form-input--error 로 visual feedback).
+ */
+
+import { isValidPort } from '../validator.js';
+
+const MAX_PORT_DIGITS = 5;  // 65535 = 5자리
+
+export function setupPortInputs(container, selector = 'input[id$="_port"]') {
+    if (!container) return;
+
+    container.querySelectorAll(selector).forEach(el => {
+        el.setAttribute('inputmode', 'numeric');
+        el.setAttribute('pattern', '[0-9]*');
+        el.setAttribute('maxlength', String(MAX_PORT_DIGITS));
+
+        const syncValidity = () => {
+            // non-digit 제거 + 5자 초과 paste/programmatic 입력 강제 trim
+            // (maxlength 는 키 입력은 막지만 setValue/paste 일부 케이스 우회 가능)
+            const digitsOnly = el.value.replace(/\D/g, '').slice(0, MAX_PORT_DIGITS);
+            if (el.value !== digitsOnly) el.value = digitsOnly;
+
+            const invalid = digitsOnly !== '' && !isValidPort(digitsOnly);
+            el.classList.toggle('form-input--error', invalid);
+            if (invalid) el.setAttribute('aria-invalid', 'true');
+            else el.removeAttribute('aria-invalid');
+        };
+
+        el.addEventListener('input', syncValidity);
+        el.addEventListener('change', syncValidity);
+        syncValidity();
+    });
+}
diff --git a/src/static/js/confirm-modal.js b/src/static/js/confirm-modal.js
new file mode 100644
index 0000000..6ad0de2
--- /dev/null
+++ b/src/static/js/confirm-modal.js
@@ -0,0 +1,112 @@
+/**
+ * confirm-modal.js — v1.7.1 Task 4
+ *
+ * Shared, accessible confirmation modal. Replaces scattered native confirm()
+ * calls with a focus-trapped, keyboard-dismissable dialog that matches the
+ * nav-guard / pending visual language.
+ *
+ * Usage:
+ *   import { confirmModal } from './confirm-modal.js';
+ *   const ok = await confirmModal({
+ *     title: 'Revert network settings?',
+ *     message: 'Roll back to the last-known-good configuration.',
+ *     confirmLabel: 'Revert',
+ *     cancelLabel: 'Cancel',
+ *     danger: true,          // optional — styles the confirm button as destructive
+ *   });
+ *   if (ok) { ... }
+ *
+ * Resolves true on confirm, false on cancel / Esc / backdrop click.
+ * Focus is trapped inside the dialog and restored to the trigger on close.
+ */
+
+function escapeHtml(s) {
+    return String(s == null ? '' : s).replace(/[&<>"']/g, ch => ({
+        '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;'
+    }[ch]));
+}
+
+/**
+ * @param {Object} opts
+ * @param {string} opts.title
+ * @param {string} opts.message
+ * @param {string} [opts.confirmLabel='Confirm']
+ * @param {string} [opts.cancelLabel='Cancel']
+ * @param {boolean} [opts.danger=false]
+ * @returns {Promise<boolean>}
+ */
+export function confirmModal(opts = {}) {
+    const {
+        title = 'Confirm',
+        message = '',
+        confirmLabel = 'Confirm',
+        cancelLabel = 'Cancel',
+        danger = false,
+    } = opts;
+
+    return new Promise((resolve) => {
+        const trigger = document.activeElement;
+
+        const wrap = document.createElement('div');
+        wrap.className = 'nav-guard__backdrop';
+        wrap.setAttribute('role', 'dialog');
+        wrap.setAttribute('aria-modal', 'true');
+        wrap.setAttribute('aria-labelledby', 'confirm-modal-title');
+        wrap.innerHTML = `
+            <div class="nav-guard__modal" role="document">
+                <h2 id="confirm-modal-title" class="nav-guard__title">${escapeHtml(title)}</h2>
+                <p class="nav-guard__desc">${escapeHtml(message)}</p>
+                <div class="nav-guard__actions">
+                    <button type="button" class="btn ${danger ? 'btn--danger' : 'btn--primary'}" data-action="confirm">${escapeHtml(confirmLabel)}</button>
+                    <button type="button" class="btn btn--ghost" data-action="cancel">${escapeHtml(cancelLabel)}</button>
+                </div>
+            </div>`;
+
+        const onKeydown = (e) => {
+            if (e.key === 'Escape') {
+                e.preventDefault();
+                close(false);
+            } else if (e.key === 'Tab') {
+                trapTab(e, wrap);
+            }
+        };
+
+        function close(result) {
+            wrap.remove();
+            document.removeEventListener('keydown', onKeydown);
+            if (trigger && typeof trigger.focus === 'function') {
+                try { trigger.focus(); } catch (_) { /* ignore */ }
+            }
+            resolve(result);
+        }
+
+        wrap.querySelector('[data-action="confirm"]').addEventListener('click', () => close(true));
+        wrap.querySelector('[data-action="cancel"]').addEventListener('click', () => close(false));
+        // Backdrop click (outside the modal box) cancels.
+        wrap.addEventListener('click', (e) => { if (e.target === wrap) close(false); });
+
+        document.addEventListener('keydown', onKeydown);
+        document.body.appendChild(wrap);
+
+        // Focus the confirm button so keyboard users land inside the dialog.
+        const confirmBtn = wrap.querySelector('[data-action="confirm"]');
+        if (confirmBtn) confirmBtn.focus();
+    });
+}
+
+/** Tab/Shift+Tab focus trap within the modal. */
+function trapTab(e, modalRoot) {
+    const focusable = modalRoot.querySelectorAll(
+        'button, [href], input, select, textarea, [tabindex]:not([tabindex="-1"])'
+    );
+    if (focusable.length === 0) return;
+    const first = focusable[0];
+    const last = focusable[focusable.length - 1];
+    if (e.shiftKey && document.activeElement === first) {
+        e.preventDefault();
+        last.focus();
+    } else if (!e.shiftKey && document.activeElement === last) {
+        e.preventDefault();
+        first.focus();
+    }
+}
diff --git a/src/static/js/constants.js b/src/static/js/constants.js
new file mode 100644
index 0000000..f9149be
--- /dev/null
+++ b/src/static/js/constants.js
@@ -0,0 +1,97 @@
+/**
+ * constants.js — Centralized Default Values and Magic Numbers
+ *
+ * Replaces hardcoded magic strings/numbers across page modules.
+ */
+
+/**
+ * Application identity — the single source of truth for the displayed version.
+ * Bump APP_VERSION on every release and add a matching CHANGELOG.md entry.
+ */
+export const APP_NAME = 'DP World Smart Solutions';
+export const APP_VERSION = 'v1.11.16';
+
+/**
+ * v1.7.0 — pageId → 표시명 (Pending Changes 패널·배지에서 사용).
+ * page-dirty matrix / computeChanges 페이지 귀속과 동일 id 집합.
+ */
+export const PAGE_DISPLAY_NAMES = {
+    home: 'Dashboard',
+    wifi: 'Wi-Fi',
+    'wifi-ap': 'Wi-Fi AP',
+    ssid: 'Wi-Fi',
+    ethernet: 'Ethernet',
+    io: 'Sensor / IO',
+    'server-setting': 'Server Setting',
+    network: 'Server Setting',
+    general: 'General',
+    'sensor-io': 'Sensor / IO',
+    'can-bus': 'CAN Bus',
+    register: 'General',
+    can: 'CAN Bus',
+    opcua: 'OPC-UA',
+    modbus: 'Modbus',
+    log: 'Log',
+    firmware: 'Firmware',
+    'net-apply': 'Apply & Status',
+};
+
+/**
+ * v1.7.1 Task 2 — Dashboard issue type → target page id (deep-link).
+ * Each dashboard issue carries a `type`; home.js renders its action as a
+ * clickable control that navigates to the page where the operator fixes it.
+ * Values are canonical page ids from the PAGES map (app.js). Unmapped types
+ * fall back to a non-clickable note.
+ */
+export const DASHBOARD_ISSUE_PAGES = {
+    runtime: 'home',          // dpworldapp stopped / startup failed/hung — restart/inspect on Dashboard
+    telemetry: 'home',        // 8989 telemetry unavailable — Dashboard runtime card
+    positioning: 'home',      // GNSS module health — visible on Dashboard
+    'gnss-drift': 'firmware', // GNSS firmware drift — firmware/maintenance
+    interface: 'general',     // equipment interface / protocol selection
+    'interface-can': 'can-bus',
+    'interface-opcua': 'opcua',
+    'interface-modbus': 'modbus',
+    server: 'server-setting', // protocol server endpoint
+    disk: 'log',              // free space / rotate logs
+    'net-drift': 'net-apply', // OS vs runtime network drift — apply & status
+    'net-apply': 'net-apply', // apply watchdog critical / country pending
+    // D7: Wi-Fi signal poor → network Wi-Fi configuration page
+    'wifi-signal': 'wifi',
+};
+
+export const DEFAULTS = {
+    CAN_TYPE: 'extended',
+    CAN_BAUDRATE: 250,
+    RS485_MODE: 'half',
+    RS485_BAUDRATE: 9600,
+    RS485_DATABITS: '8',
+    RS485_STOPBITS: '1',   // v1.4.6.1 B-3: io.js/state.js fallback + dha baseline 일치
+    WIFI_SECURITY: 'wpa/wpa2',
+    WIFI_COUNTRY_CODE: 'AE',
+    LOG_SAVE: 'on',
+    LOG_MAX_SIZE: 100,
+    LOG_MAX_DAYS: 1,
+    LOG_AUTO_COMPRESS: 'off',
+    LOG_COMPRESS_SIZE_MB: 50,
+    LOG_COMPRESS_AGE_DAYS: 7,
+    LOG_AUTO_CLEANUP: 'off',
+    LOG_CLEANUP_MAX_FILES: 50,
+    LOG_CLEANUP_MAX_SIZE_MB: 200,
+};
+
+/** Home dashboard auto-refresh interval (ms). */
+export const DASHBOARD_REFRESH_MS = 10000;
+
+export const CAN_BAUDRATES = ['NONE', 100, 250, 500, 1000];
+export const CAN_BAUDRATE_LABELS = {
+    'NONE': 'NONE',
+    100: '100kb/s',
+    250: '250kb/s',
+    500: '500kb/s',
+    1000: '1M/s',
+};
+export const RS485_BAUDRATES = [4800, 9600, 19200, 38400, 57600, 115200];
+// v2: 'float' (idt); reader accepts (case-insensitive) float not float64. ODT_OPTIONS unchanged.
+export const IDT_OPTIONS = ['integer', 'float', 'boolean', 'unsignedInteger', 'short', 'unsignedShort'];
+export const ODT_OPTIONS = ['integer', 'float64', 'boolean', 'string'];
diff --git a/src/static/js/country-codes.js b/src/static/js/country-codes.js
new file mode 100644
index 0000000..0211fc9
--- /dev/null
+++ b/src/static/js/country-codes.js
@@ -0,0 +1,264 @@
+/**
+ * country-codes.js — WiFi regulatory country codes for the SSID page.
+ *
+ * COUNTRY_CODES: the 205 ISO 3166-1 alpha-2 codes recognized by this device's
+ * WiFi module — a Quectel module on the Qualcomm QCNFA765 chipset — extracted
+ * from the module's /lib/firmware/regdb.bin. The module firmware validates the
+ * country code against regdb.bin at association time, so only these are offered.
+ *
+ * CONTINENT_GROUPS assigns every code to one of five continents (for browsing
+ * only); FREQUENT_COUNTRY_CODES is the pinned "Frequently used" group.
+ *
+ * The Web Configurator only persists the chosen code to board_config;
+ * dpworldapp performs the actual regulatory apply. Default is AE — see
+ * DEFAULTS.WIFI_COUNTRY_CODE in constants.js.
+ */
+
+/** code → English country name. 205 entries, keyed alphabetically. */
+export const COUNTRY_CODES = {
+    AD: 'Andorra',
+    AE: 'United Arab Emirates',
+    AF: 'Afghanistan',
+    AG: 'Antigua and Barbuda',
+    AI: 'Anguilla',
+    AL: 'Albania',
+    AM: 'Armenia',
+    AR: 'Argentina',
+    AS: 'American Samoa',
+    AT: 'Austria',
+    AU: 'Australia',
+    AW: 'Aruba',
+    AX: 'Åland Islands',
+    AZ: 'Azerbaijan',
+    BA: 'Bosnia and Herzegovina',
+    BB: 'Barbados',
+    BD: 'Bangladesh',
+    BE: 'Belgium',
+    BF: 'Burkina Faso',
+    BG: 'Bulgaria',
+    BH: 'Bahrain',
+    BI: 'Burundi',
+    BL: 'Saint Barthélemy',
+    BM: 'Bermuda',
+    BN: 'Brunei Darussalam',
+    BO: 'Bolivia',
+    BR: 'Brazil',
+    BS: 'Bahamas',
+    BT: 'Bhutan',
+    BW: 'Botswana',
+    BY: 'Belarus',
+    BZ: 'Belize',
+    CA: 'Canada',
+    CD: 'Congo (Democratic Republic)',
+    CF: 'Central African Republic',
+    CG: 'Congo',
+    CH: 'Switzerland',
+    CI: "Côte d'Ivoire",
+    CK: 'Cook Islands',
+    CL: 'Chile',
+    CM: 'Cameroon',
+    CN: 'China',
+    CO: 'Colombia',
+    CR: 'Costa Rica',
+    CW: 'Curaçao',
+    CX: 'Christmas Island',
+    CY: 'Cyprus',
+    CZ: 'Czechia',
+    DE: 'Germany',
+    DK: 'Denmark',
+    DM: 'Dominica',
+    DO: 'Dominican Republic',
+    DZ: 'Algeria',
+    EC: 'Ecuador',
+    EE: 'Estonia',
+    EG: 'Egypt',
+    ES: 'Spain',
+    ET: 'Ethiopia',
+    FI: 'Finland',
+    FJ: 'Fiji',
+    FK: 'Falkland Islands',
+    FM: 'Micronesia',
+    FO: 'Faroe Islands',
+    FR: 'France',
+    GA: 'Gabon',
+    GB: 'United Kingdom',
+    GD: 'Grenada',
+    GE: 'Georgia',
+    GF: 'French Guiana',
+    GG: 'Guernsey',
+    GH: 'Ghana',
+    GI: 'Gibraltar',
+    GL: 'Greenland',
+    GP: 'Guadeloupe',
+    GR: 'Greece',
+    GT: 'Guatemala',
+    GU: 'Guam',
+    GY: 'Guyana',
+    HK: 'Hong Kong',
+    HM: 'Heard Island and McDonald Islands',
+    HN: 'Honduras',
+    HR: 'Croatia',
+    HT: 'Haiti',
+    HU: 'Hungary',
+    ID: 'Indonesia',
+    IE: 'Ireland',
+    IL: 'Israel',
+    IM: 'Isle of Man',
+    IN: 'India',
+    IQ: 'Iraq',
+    IS: 'Iceland',
+    IT: 'Italy',
+    JE: 'Jersey',
+    JM: 'Jamaica',
+    JO: 'Jordan',
+    JP: 'Japan',
+    KE: 'Kenya',
+    KH: 'Cambodia',
+    KN: 'Saint Kitts and Nevis',
+    KR: 'Korea, Republic of',
+    KW: 'Kuwait',
+    KY: 'Cayman Islands',
+    KZ: 'Kazakhstan',
+    LA: "Lao People's Democratic Republic",
+    LB: 'Lebanon',
+    LC: 'Saint Lucia',
+    LI: 'Liechtenstein',
+    LK: 'Sri Lanka',
+    LS: 'Lesotho',
+    LT: 'Lithuania',
+    LU: 'Luxembourg',
+    LV: 'Latvia',
+    LY: 'Libya',
+    MA: 'Morocco',
+    MC: 'Monaco',
+    MD: 'Moldova',
+    ME: 'Montenegro',
+    MF: 'Saint Martin (French part)',
+    MH: 'Marshall Islands',
+    MK: 'North Macedonia',
+    MM: 'Myanmar',
+    MN: 'Mongolia',
+    MO: 'Macao',
+    MP: 'Northern Mariana Islands',
+    MQ: 'Martinique',
+    MR: 'Mauritania',
+    MS: 'Montserrat',
+    MT: 'Malta',
+    MU: 'Mauritius',
+    MV: 'Maldives',
+    MW: 'Malawi',
+    MX: 'Mexico',
+    MY: 'Malaysia',
+    NA: 'Namibia',
+    NC: 'New Caledonia',
+    NF: 'Norfolk Island',
+    NG: 'Nigeria',
+    NI: 'Nicaragua',
+    NL: 'Netherlands',
+    NO: 'Norway',
+    NP: 'Nepal',
+    NU: 'Niue',
+    NZ: 'New Zealand',
+    OM: 'Oman',
+    PA: 'Panama',
+    PE: 'Peru',
+    PF: 'French Polynesia',
+    PG: 'Papua New Guinea',
+    PH: 'Philippines',
+    PK: 'Pakistan',
+    PL: 'Poland',
+    PM: 'Saint Pierre and Miquelon',
+    PR: 'Puerto Rico',
+    PT: 'Portugal',
+    PW: 'Palau',
+    PY: 'Paraguay',
+    QA: 'Qatar',
+    RE: 'Réunion',
+    RO: 'Romania',
+    RS: 'Serbia',
+    RU: 'Russian Federation',
+    RW: 'Rwanda',
+    SA: 'Saudi Arabia',
+    SE: 'Sweden',
+    SG: 'Singapore',
+    SH: 'Saint Helena',
+    SI: 'Slovenia',
+    SJ: 'Svalbard and Jan Mayen',
+    SK: 'Slovakia',
+    SM: 'San Marino',
+    SN: 'Senegal',
+    SR: 'Suriname',
+    ST: 'Sao Tome and Principe',
+    SV: 'El Salvador',
+    SX: 'Sint Maarten (Dutch part)',
+    TC: 'Turks and Caicos Islands',
+    TD: 'Chad',
+    TF: 'French Southern Territories',
+    TG: 'Togo',
+    TH: 'Thailand',
+    TN: 'Tunisia',
+    TR: 'Türkiye',
+    TT: 'Trinidad and Tobago',
+    TW: 'Taiwan',
+    TZ: 'Tanzania',
+    UA: 'Ukraine',
+    UG: 'Uganda',
+    UM: 'United States Minor Outlying Islands',
+    US: 'United States',
+    UY: 'Uruguay',
+    UZ: 'Uzbekistan',
+    VA: 'Holy See (Vatican City State)',
+    VC: 'Saint Vincent and the Grenadines',
+    VE: 'Venezuela',
+    VG: 'Virgin Islands (British)',
+    VI: 'Virgin Islands (U.S.)',
+    VN: 'Viet Nam',
+    VU: 'Vanuatu',
+    WF: 'Wallis and Futuna',
+    WS: 'Samoa',
+    YE: 'Yemen',
+    YT: 'Mayotte',
+    ZA: 'South Africa',
+    ZM: 'Zambia',
+    ZW: 'Zimbabwe',
+};
+
+/**
+ * Continent grouping — every COUNTRY_CODES key appears in exactly one group.
+ * `codes` are ordered so the dropdown renders alphabetically by country name.
+ */
+export const CONTINENT_GROUPS = [
+    { region: 'Africa', codes: [
+        'DZ','BW','BF','BI','CM','CF','TD','CG','CD','CI','EG','ET','TF','GA',
+        'GH','KE','LS','LY','MW','MR','MU','YT','MA','NA','NG','RE','RW','SH',
+        'ST','SN','ZA','TZ','TG','TN','UG','ZM','ZW',
+    ] },
+    { region: 'Americas', codes: [
+        'AI','AG','AR','AW','BS','BB','BZ','BM','BO','BR','CA','KY','CL','CO',
+        'CR','CW','DM','DO','EC','SV','FK','GF','GL','GD','GP','GT','GY','HT',
+        'HN','JM','MQ','MX','MS','NI','PA','PY','PE','PR','BL','KN','LC','MF',
+        'PM','VC','SX','SR','TT','TC','US','UY','VE','VG','VI',
+    ] },
+    { region: 'Asia', codes: [
+        'AF','AM','AZ','BH','BD','BT','BN','KH','CN','GE','HK','IN','ID','IQ',
+        'IL','JP','JO','KZ','KR','KW','LA','LB','MO','MY','MV','MN','MM','NP',
+        'OM','PK','PH','QA','SA','SG','LK','TW','TH','TR','AE','UZ','VN','YE',
+    ] },
+    { region: 'Europe', codes: [
+        'AX','AL','AD','AT','BY','BE','BA','BG','HR','CY','CZ','DK','EE','FO',
+        'FI','FR','DE','GI','GR','GG','VA','HU','IS','IE','IM','IT','JE','LV',
+        'LI','LT','LU','MT','MD','MC','ME','NL','MK','NO','PL','PT','RO','RU',
+        'SM','RS','SK','SI','ES','SJ','SE','CH','UA','GB',
+    ] },
+    { region: 'Oceania', codes: [
+        'AS','AU','CX','CK','FJ','PF','GU','HM','MH','FM','NC','NZ','NU','NF',
+        'MP','PW','PG','WS','UM','VU','WF',
+    ] },
+];
+
+/**
+ * Pinned "Frequently used" group — the default (AE, first) followed by
+ * confirmed deployment sites. Rendered above the continent groups. Every
+ * entry is also present in COUNTRY_CODES / CONTINENT_GROUPS.
+ */
+export const FREQUENT_COUNTRY_CODES = ['AE','SA','DO','PH','IN','KR','US','DE'];
diff --git a/src/static/js/dirty-tracker.js b/src/static/js/dirty-tracker.js
new file mode 100644
index 0000000..a27db71
--- /dev/null
+++ b/src/static/js/dirty-tracker.js
@@ -0,0 +1,41 @@
+/**
+ * dirty-tracker.js
+ *
+ * Page-level dirty tracking for form controls. Page modules still own state
+ * updates; this module only synchronizes the sidebar dirty indicator.
+ */
+
+import { markDirty } from './page-dirty.js';
+
+const DIRTY_SELECTOR = 'input, select, textarea';
+
+export function attachDirtyTracking(container, pageId) {
+    if (!container || !pageId) return () => {};
+
+    const onUserEdit = (event) => {
+        const target = event.target;
+        if (!target || typeof target.matches !== 'function') return;
+        if (!target.matches(DIRTY_SELECTOR)) return;
+        // v1.5.5.10: transient (non-config) controls opt out of dirty tracking via
+        // `data-no-dirty` on the control or any ancestor. e.g. the Log → Files 탭의
+        // 파일 선택 체크박스는 다운로드용 일시 UI 상태이지 설정 변경이 아니므로
+        // page-dirty / nav-guard 모달을 트리거하면 안 됨.
+        if (typeof target.closest === 'function' && target.closest('[data-no-dirty]')) return;
+        markDirty(pageId);
+    };
+
+    // v1.5.5.11: CAPTURE phase (3rd arg `true`) — NOT bubble.
+    // 이유: data-no-dirty 가드는 `target.closest()` 로 조상에 data-no-dirty 가 있는지 본다.
+    // 그런데 log.js 의 파일 체크박스 change 핸들러는 renderLogFilesSection() → section.innerHTML
+    // 로 목록을 즉시 re-render 하여 event.target(체크박스) 을 DOM 에서 분리(orphan)시킨다.
+    // bubble-phase 였다면 onUserEdit 가 그 re-render 이후에 실행되어 orphan 된 target 의
+    // closest() 가 null → 가드 무력화 → 오트리거. capture-phase 는 target 자신의 핸들러보다
+    // 먼저 실행되므로 target 이 아직 attached 상태 → closest() 정상 동작. (v1.5.5.10 미해결분.)
+    container.addEventListener('input', onUserEdit, true);
+    container.addEventListener('change', onUserEdit, true);
+
+    return () => {
+        container.removeEventListener('input', onUserEdit, true);
+        container.removeEventListener('change', onUserEdit, true);
+    };
+}
diff --git a/src/static/js/firmware-logic.js b/src/static/js/firmware-logic.js
new file mode 100644
index 0000000..89f1c13
--- /dev/null
+++ b/src/static/js/firmware-logic.js
@@ -0,0 +1,147 @@
+/**
+ * firmware-logic.js — pure, DOM-free logic for the Firmware page.
+ *
+ * No `document`, `window`, or fetch here — only deterministic functions of their
+ * inputs, so the state machine and formatting can be unit-tested headlessly.
+ * firmware.js imports these; keep this file free of side effects.
+ *
+ * MERGE: copy alongside pages/firmware.js (imported as '../firmware-logic.js').
+ */
+
+// ─── formatting ───────────────────────────────────────────────
+export function fmtBytes(n) {
+    if (!n) return '0 B';
+    const u = ['B', 'KB', 'MB', 'GB'];
+    let i = 0, v = n;
+    while (v >= 1024 && i < u.length - 1) { v /= 1024; i++; }
+    return `${v.toFixed(i === 0 ? 0 : 1)} ${u[i]}`;
+}
+
+export function fmtDuration(sec) {
+    if (sec == null || sec < 0) return '—';
+    const s = Math.round(sec);
+    return s >= 60 ? `${Math.floor(s / 60)}m ${s % 60}s` : `${s}s`;
+}
+
+// average transfer rate + ETA from cumulative status (sent/total/elapsed)
+export function rate(o) {
+    if (!o || !o.elapsed_s || o.sent <= 0) return null;
+    const bps = o.sent / o.elapsed_s;
+    if (bps <= 0) return null;
+    const eta = Math.max(0, o.total - o.sent) / bps;
+    return { bps, eta };
+}
+
+export function fmtRate(o) {
+    const r = rate(o);
+    // never show "~0s left" mid-transfer — floor to 1s (the byte transfer is the
+    // only thing this ETA covers; device-side commit/reboot are reported separately)
+    return r ? `${fmtBytes(r.bps)}/s · ~${Math.max(1, Math.round(r.eta))}s left` : '';
+}
+
+// True once the byte transfer is finished and the device is doing the (indeterminate,
+// not-ETA-able) flash-write + commit. The transfer-based ETA must NOT show "0s left"
+// here — there can be up to ~2 min of device-side work + a reboot still to come.
+export function isCommitting(s) {
+    if (!s) return false;
+    const ph = (s.phases || []).find(p => p.key === 'commit');
+    if (ph && ph.state === 'active') return true;
+    const o = s.overall;
+    return !!(o && o.total > 0 && o.sent >= o.total);
+}
+
+export function buildDateOf(comps) {
+    const dates = (comps || []).map(c => c && c.build_date).filter(Boolean);
+    return dates.length ? dates[0] : null;
+}
+
+// ─── slot helpers (single source of truth — dedups 3 prior copies) ──
+export function slotTarget(slot) {
+    if (!slot) return '?';
+    return slot.after || (slot.before === 'A' ? 'B' : slot.before === 'B' ? 'A' : '?');
+}
+
+export function slotLabel(slot) {
+    return 'slot ' + slotTarget(slot);
+}
+
+// ─── view state machine (client knows more than the server post-reboot) ──
+// `latches` = { sawReboot, backOnline, configChecked } from the page.
+export function computeView(state, latches) {
+    const l = latches || {};
+    if (state === 'flashing') return 'flashing';
+    if (state === 'failed') return 'failed';
+    if (l.configChecked) return 'done';
+    if (l.sawReboot) return l.backOnline ? 'rebooted' : 'rebooting';
+    return state; // idle | staged | done
+}
+
+// override server phases for client-known post-flash views
+export function phaseView(view, phases) {
+    if (view !== 'rebooted' && view !== 'done') return phases;
+    return (phases || []).map(p => {
+        if (view === 'done') return { ...p, state: 'done', tier: 'ok' };
+        if (p.key === 'config') return { ...p, state: 'active', tier: 'warn' };
+        return { ...p, state: 'done', tier: 'ok' }; // rebooted: all-but-config done
+    });
+}
+
+const VIEW_LINES = {
+    idle: 'Ready — upload a firmware ZIP to begin.',
+    staged: 'Firmware staged — run pre-flight, then flash.',
+    flashing: 'Flashing…',
+    rebooting: 'Device rebooting — reconnecting…',
+    rebooted: 'Firmware written — verify config below.',
+    done: 'Update complete.',
+    failed: 'Update failed — see log.',
+};
+
+export function viewLine(view, message) {
+    return VIEW_LINES[view] || message || '';
+}
+
+// ─── installer-style wizard (one step at a time) ──────────────
+// The internal 8 backend phases collapse into these 6 user-facing steps.
+export const WIZARD_STEPS = [
+    { key: 'upload', label: 'Upload' },
+    { key: 'preflight', label: 'Pre-flight' },
+    { key: 'flash', label: 'Flash' },
+    { key: 'reboot', label: 'Reboot' },
+    { key: 'verify', label: 'Verify' },
+    { key: 'done', label: 'Done' },
+];
+
+// Which wizard step is active. Before flashing the user navigates between
+// 'upload' and 'preflight' (userStep); once flashing starts the device state
+// (view) drives it and it cannot be reversed.
+export function wizardStep(view, userStep) {
+    if (view === 'flashing' || view === 'failed') return 'flash';
+    if (view === 'rebooting') return 'reboot';
+    if (view === 'rebooted') return 'verify';
+    if (view === 'done') return 'done';
+    return userStep === 'preflight' ? 'preflight' : 'upload';
+}
+
+// Per-node state for the top progress map.
+export function wizardStepperState(current, view) {
+    const idx = WIZARD_STEPS.findIndex(s => s.key === current);
+    return WIZARD_STEPS.map((s, i) => {
+        let state;
+        if (view === 'failed' && s.key === 'flash') state = 'error';
+        else if (i < idx) state = 'done';
+        else if (i === idx) state = current === 'done' ? 'done' : 'active';
+        else state = 'pending';
+        return { key: s.key, label: s.label, state };
+    });
+}
+
+// ─── upload-step NEXT gate ────────────────────────────────────
+// The upload step's NEXT button must be DISABLED while a firmware-ZIP upload is
+// in flight. A status poll tick can call updateNavState() mid-upload and observe
+// a stale `staged` state left by a PRIOR upload — so the in-flight `uploading`
+// flag must override the staged check, or NEXT could be clicked while bytes are
+// still streaming. NEXT is enabled only when NOT uploading AND the new upload has
+// reached `staged`.
+export function navNextDisabled(uploading, staged) {
+    return !!uploading || !staged;
+}
diff --git a/src/static/js/icons.js b/src/static/js/icons.js
new file mode 100644
index 0000000..36edee7
--- /dev/null
+++ b/src/static/js/icons.js
@@ -0,0 +1,135 @@
+/**
+ * src/static/js/icons.js — v1.5.0 Phase 1
+ *
+ * Local inline Lucide SVG icons (ISC license, https://lucide.dev/license).
+ * 49 icons covering the v1.5.0 IA redesign + v1.4.6.11 emoji → SVG migration.
+ *
+ * Usage:
+ *   import { icon } from './icons.js';
+ *   container.innerHTML = `${icon('home', {size: 20})} Home`;
+ *   button.innerHTML = icon('save', {size: 16, aria: 'Save'}); // role=img + <title>Save</title>
+ *
+ * All icons share Lucide canonical wrapper:
+ *   <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" .../>
+ *
+ * Copyright (c) for portions of Lucide are held by Cole Bemis 2013-2022 as part of Feather
+ * (MIT). All other copyright (c) for Lucide are held by Lucide Contributors 2022.
+ * Permission to use, copy, modify, and/or distribute this software for any purpose with or
+ * without fee is hereby granted, provided that the above copyright notice and this permission
+ * notice appear in all copies. THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS. ISC License — https://lucide.dev/license
+ */
+
+/* eslint-disable */
+
+const escapeAttr = (s) => String(s)
+    .replace(/&/g, '&amp;')
+    .replace(/"/g, '&quot;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;');
+
+const ICONS = {
+    // Navigation / Layout
+    'home': '<path d="M3 9.5 12 3l9 6.5V21a1 1 0 0 1-1 1h-5v-7h-6v7H4a1 1 0 0 1-1-1z"/>',
+    'menu': '<line x1="4" y1="6" x2="20" y2="6"/><line x1="4" y1="12" x2="20" y2="12"/><line x1="4" y1="18" x2="20" y2="18"/>',
+    'chevron-down': '<polyline points="6 9 12 15 18 9"/>',
+    'chevron-right': '<polyline points="9 18 15 12 9 6"/>',
+    'x': '<line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/>',
+
+    // Network / Communication
+    'wifi': '<path d="M5 12.55a11 11 0 0 1 14.08 0"/><path d="M1.42 9a16 16 0 0 1 21.16 0"/><path d="M8.53 16.11a6 6 0 0 1 6.95 0"/><line x1="12" y1="20" x2="12.01" y2="20"/>',
+    'ethernet-port': '<path d="m15 20 3-3h2a2 2 0 0 0 2-2V5a2 2 0 0 0-2-2H4a2 2 0 0 0-2 2v10a2 2 0 0 0 2 2h2l3 3z"/><path d="M6 8v1"/><path d="M10 8v1"/><path d="M14 8v1"/><path d="M18 8v1"/>',
+    'globe': '<circle cx="12" cy="12" r="10"/><line x1="2" y1="12" x2="22" y2="12"/><path d="M12 2a15.3 15.3 0 0 1 4 10 15.3 15.3 0 0 1-4 10 15.3 15.3 0 0 1-4-10 15.3 15.3 0 0 1 4-10z"/>',
+    'radio-tower': '<path d="M4.9 16.1C1 12.2 1 5.8 4.9 1.9"/><path d="M7.8 4.7a6.14 6.14 0 0 0-.8 7.5"/><circle cx="12" cy="9" r="2"/><path d="M16.2 4.7a6.14 6.14 0 0 1 .8 7.5"/><path d="M19.1 1.9a14.14 14.14 0 0 1 0 14.2"/><path d="M9.7 17.9 12 22l2.3-4.1"/>',
+    'radio': '<path d="M4.9 16.1C1 12.2 1 5.8 4.9 1.9"/><path d="M7.8 4.7a6.14 6.14 0 0 0-.8 7.5"/><circle cx="12" cy="9" r="2"/><path d="M16.2 4.7a6.14 6.14 0 0 1 .8 7.5"/><path d="M19.1 1.9a14.14 14.14 0 0 1 0 14.2"/><path d="M9.7 17.9 12 22l2.3-4.1"/>',
+    'flag': '<path d="M4 15s1-1 4-1 5 2 8 2 4-1 4-1V3s-1 1-4 1-5-2-8-2-4 1-4 1z"/><line x1="4" y1="22" x2="4" y2="15"/>',
+    'server': '<rect x="2" y="2" width="20" height="8" rx="2" ry="2"/><rect x="2" y="14" width="20" height="8" rx="2" ry="2"/><line x1="6" y1="6" x2="6.01" y2="6"/><line x1="6" y1="18" x2="6.01" y2="18"/>',
+    'link': '<path d="M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71"/><path d="M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71"/>',
+    'cable': '<path d="M4 9a2 2 0 0 1 2-2h6a2 2 0 0 1 2 2v6a2 2 0 0 0 2 2h2a2 2 0 0 1 2 2v3"/><path d="M3 5h3"/><path d="M5 8V3"/><path d="M19 19h2"/><path d="M19 22v-5"/>',
+    'route': '<circle cx="6" cy="19" r="3"/><path d="M9 19h8.5a3.5 3.5 0 0 0 0-7h-11a3.5 3.5 0 0 1 0-7H15"/><circle cx="18" cy="5" r="3"/>',
+    'smartphone': '<rect x="5" y="2" width="14" height="20" rx="2" ry="2"/><line x1="12" y1="18" x2="12.01" y2="18"/>',
+    'plug-zap': '<path d="M6.3 20.3a2.4 2.4 0 0 0 3.4 0L12 18l-6-6-2.3 2.3a2.4 2.4 0 0 0 0 3.4z"/><path d="m2 22 3-3"/><path d="M7.5 13.5 10 11"/><path d="M10.5 16.5 13 14"/><path d="m18 3-4 4h6l-4 4"/>',
+
+    // Data
+    'bar-chart-3': '<path d="M3 3v18h18"/><path d="M18 17V9"/><path d="M13 17V5"/><path d="M8 17v-3"/>',
+    'clipboard-list': '<rect x="8" y="2" width="8" height="4" rx="1" ry="1"/><path d="M16 4h2a2 2 0 0 1 2 2v14a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2V6a2 2 0 0 1 2-2h2"/><path d="M12 11h4"/><path d="M12 16h4"/><path d="M8 11h.01"/><path d="M8 16h.01"/>',
+    'list': '<line x1="8" y1="6" x2="21" y2="6"/><line x1="8" y1="12" x2="21" y2="12"/><line x1="8" y1="18" x2="21" y2="18"/><line x1="3" y1="6" x2="3.01" y2="6"/><line x1="3" y1="12" x2="3.01" y2="12"/><line x1="3" y1="18" x2="3.01" y2="18"/>',
+    'share-2': '<circle cx="18" cy="5" r="3"/><circle cx="6" cy="12" r="3"/><circle cx="18" cy="19" r="3"/><line x1="8.59" y1="13.51" x2="15.42" y2="17.49"/><line x1="15.41" y1="6.51" x2="8.59" y2="10.49"/>',
+    'file-text': '<path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z"/><polyline points="14 2 14 8 20 8"/><line x1="16" y1="13" x2="8" y2="13"/><line x1="16" y1="17" x2="8" y2="17"/><polyline points="10 9 9 9 8 9"/>',
+    'folder': '<path d="M22 19a2 2 0 0 1-2 2H4a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h5l2 3h9a2 2 0 0 1 2 2z"/>',
+    'package': '<line x1="16.5" y1="9.4" x2="7.5" y2="4.21"/><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/>',
+    'box': '<path d="M21 8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16Z"/><path d="m3.3 7 8.7 5 8.7-5"/><path d="M12 22V12"/>',
+    'puzzle': '<path d="M19.439 7.85c-.049.322.059.648.289.878l1.568 1.568c.47.47.706 1.087.706 1.704s-.235 1.233-.706 1.704l-1.611 1.611a.98.98 0 0 1-.837.276c-.47-.07-.802-.48-.968-.925a2.501 2.501 0 1 0-3.214 3.214c.446.166.855.498.925.968a.979.979 0 0 1-.276.837l-1.61 1.61a2.404 2.404 0 0 1-1.705.707 2.402 2.402 0 0 1-1.704-.706l-1.568-1.568a1.026 1.026 0 0 0-.877-.29c-.493.074-.84.504-1.02.968a2.5 2.5 0 1 1-3.237-3.237c.464-.18.894-.527.967-1.02a1.026 1.026 0 0 0-.289-.877l-1.568-1.568A2.402 2.402 0 0 1 1.998 12c0-.617.236-1.234.706-1.704L4.23 8.77c.24-.24.581-.353.917-.303.515.077.877.528 1.073 1.01a2.5 2.5 0 1 0 3.259-3.259c-.482-.196-.933-.558-1.01-1.073-.05-.336.062-.676.303-.917l1.525-1.525A2.402 2.402 0 0 1 12 1.998c.617 0 1.234.236 1.704.706l1.568 1.568c.23.23.556.338.877.29.493-.074.84-.504 1.02-.968a2.5 2.5 0 1 1 3.237 3.237c-.464.18-.894.527-.967 1.02Z"/>',
+
+    // Actions
+    'save': '<path d="M19 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h11l5 5v11a2 2 0 0 1-2 2z"/><polyline points="17 21 17 13 7 13 7 21"/><polyline points="7 3 7 8 15 8"/>',
+    'download': '<path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="7 10 12 15 17 10"/><line x1="12" y1="15" x2="12" y2="3"/>',
+    'upload': '<path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="17 8 12 3 7 8"/><line x1="12" y1="3" x2="12" y2="15"/>',
+    'trash-2': '<polyline points="3 6 5 6 21 6"/><path d="M19 6v14a2 2 0 0 1-2 2H7a2 2 0 0 1-2-2V6m3 0V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2"/><line x1="10" y1="11" x2="10" y2="17"/><line x1="14" y1="11" x2="14" y2="17"/>',
+    'refresh-cw': '<polyline points="23 4 23 10 17 10"/><polyline points="1 20 1 14 7 14"/><path d="M3.51 9a9 9 0 0 1 14.85-3.36L23 10"/><path d="M20.49 15a9 9 0 0 1-14.85 3.36L1 14"/>',
+    'radar': '<path d="M19.07 4.93A10 10 0 0 0 6.99 3.34"/><path d="M4 6h.01"/><path d="M2.29 9.62A10 10 0 1 0 21.31 8.35"/><path d="M16.24 7.76a6 6 0 1 0-8.49 8.49"/><path d="M9 12a3 3 0 1 0 5.83-1"/><path d="M16 12h.01"/>',
+
+    // Status
+    'check-circle-2': '<path d="M22 11.08V12a10 10 0 1 1-5.93-9.14"/><polyline points="22 4 12 14.01 9 11.01"/>',
+    'x-circle': '<circle cx="12" cy="12" r="10"/><line x1="15" y1="9" x2="9" y2="15"/><line x1="9" y1="9" x2="15" y2="15"/>',
+    'alert-triangle': '<path d="m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3Z"/><line x1="12" y1="9" x2="12" y2="13"/><line x1="12" y1="17" x2="12.01" y2="17"/>',
+    'activity': '<polyline points="22 12 18 12 15 21 9 3 6 12 2 12"/>',
+    'hourglass': '<path d="M5 22h14"/><path d="M5 2h14"/><path d="M17 22v-4.172a2 2 0 0 0-.586-1.414L12 12l-4.414 4.414A2 2 0 0 0 7 17.828V22"/><path d="M7 2v4.172a2 2 0 0 0 .586 1.414L12 12l4.414-4.414A2 2 0 0 0 17 6.172V2"/>',
+
+    // Tool/Config
+    'wrench': '<path d="M14.7 6.3a1 1 0 0 0 0 1.4l1.6 1.6a1 1 0 0 0 1.4 0l3.77-3.77a6 6 0 0 1-7.94 7.94l-6.91 6.91a2.12 2.12 0 0 1-3-3l6.91-6.91a6 6 0 0 1 7.94-7.94l-3.76 3.76z"/>',
+    'settings': '<path d="M12.22 2h-.44a2 2 0 0 0-2 2v.18a2 2 0 0 1-1 1.73l-.43.25a2 2 0 0 1-2 0l-.15-.08a2 2 0 0 0-2.73.73l-.22.38a2 2 0 0 0 .73 2.73l.15.1a2 2 0 0 1 1 1.72v.51a2 2 0 0 1-1 1.74l-.15.09a2 2 0 0 0-.73 2.73l.22.38a2 2 0 0 0 2.73.73l.15-.08a2 2 0 0 1 2 0l.43.25a2 2 0 0 1 1 1.73V20a2 2 0 0 0 2 2h.44a2 2 0 0 0 2-2v-.18a2 2 0 0 1 1-1.73l.43-.25a2 2 0 0 1 2 0l.15.08a2 2 0 0 0 2.73-.73l.22-.39a2 2 0 0 0-.73-2.73l-.15-.08a2 2 0 0 1-1-1.74v-.5a2 2 0 0 1 1-1.74l.15-.09a2 2 0 0 0 .73-2.73l-.22-.38a2 2 0 0 0-2.73-.73l-.15.08a2 2 0 0 1-2 0l-.43-.25a2 2 0 0 1-1-1.73V4a2 2 0 0 0-2-2z"/><circle cx="12" cy="12" r="3"/>',
+    'sliders-horizontal': '<line x1="21" y1="4" x2="14" y2="4"/><line x1="10" y1="4" x2="3" y2="4"/><line x1="21" y1="12" x2="12" y2="12"/><line x1="8" y1="12" x2="3" y2="12"/><line x1="21" y1="20" x2="16" y2="20"/><line x1="12" y1="20" x2="3" y2="20"/><line x1="14" y1="2" x2="14" y2="6"/><line x1="8" y1="10" x2="8" y2="14"/><line x1="16" y1="18" x2="16" y2="22"/>',
+    'gauge': '<path d="m12 14 4-4"/><path d="M3.34 19a10 10 0 1 1 17.32 0"/>',
+    'factory': '<path d="M2 20a2 2 0 0 0 2 2h16a2 2 0 0 0 2-2V8l-7 5V8l-7 5V4a2 2 0 0 0-2-2H4a2 2 0 0 0-2 2Z"/><path d="M17 18h1"/><path d="M12 18h1"/><path d="M7 18h1"/>',
+    'building-2': '<path d="M6 22V4a2 2 0 0 1 2-2h8a2 2 0 0 1 2 2v18Z"/><path d="M6 12H4a2 2 0 0 0-2 2v6a2 2 0 0 0 2 2h2"/><path d="M18 9h2a2 2 0 0 1 2 2v9a2 2 0 0 1-2 2h-2"/><path d="M10 6h4"/><path d="M10 10h4"/><path d="M10 14h4"/><path d="M10 18h4"/>',
+
+    // Security / Vision
+    'eye': '<path d="M2 12s3-7 10-7 10 7 10 7-3 7-10 7-10-7-10-7Z"/><circle cx="12" cy="12" r="3"/>',
+    'eye-off': '<path d="M9.88 9.88a3 3 0 1 0 4.24 4.24"/><path d="M10.73 5.08A10.43 10.43 0 0 1 12 5c7 0 10 7 10 7a13.16 13.16 0 0 1-1.67 2.68"/><path d="M6.61 6.61A13.526 13.526 0 0 0 2 12s3 7 10 7a9.74 9.74 0 0 0 5.39-1.61"/><line x1="2" y1="2" x2="22" y2="22"/>',
+    'lock': '<rect x="3" y="11" width="18" height="11" rx="2" ry="2"/><path d="M7 11V7a5 5 0 0 1 10 0v4"/>',
+
+    // Theme
+    'moon': '<path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>',
+    'sun': '<circle cx="12" cy="12" r="4"/><path d="M12 2v2"/><path d="M12 20v2"/><path d="m4.93 4.93 1.41 1.41"/><path d="m17.66 17.66 1.41 1.41"/><path d="M2 12h2"/><path d="M20 12h2"/><path d="m6.34 17.66-1.41 1.41"/><path d="m19.07 4.93-1.41 1.41"/>',
+
+    // System
+    'terminal-square': '<path d="m7 11 2-2-2-2"/><path d="M11 13h4"/><rect x="3" y="3" width="18" height="18" rx="2" ry="2"/>',
+    'cpu': '<rect x="4" y="4" width="16" height="16" rx="2" ry="2"/><rect x="9" y="9" width="6" height="6"/><line x1="9" y1="2" x2="9" y2="4"/><line x1="15" y1="2" x2="15" y2="4"/><line x1="9" y1="20" x2="9" y2="22"/><line x1="15" y1="20" x2="15" y2="22"/><line x1="20" y1="9" x2="22" y2="9"/><line x1="20" y1="14" x2="22" y2="14"/><line x1="2" y1="9" x2="4" y2="9"/><line x1="2" y1="14" x2="4" y2="14"/>',
+    'monitor': '<rect width="20" height="14" x="2" y="3" rx="2"/><line x1="8" x2="16" y1="21" y2="21"/><line x1="12" x2="12" y1="17" y2="21"/>',
+    'book-open': '<path d="M2 3h6a4 4 0 0 1 4 4v14a3 3 0 0 0-3-3H2z"/><path d="M22 3h-6a4 4 0 0 0-4 4v14a3 3 0 0 1 3-3h7z"/>',
+};
+
+/**
+ * Render an inline SVG icon.
+ *
+ * @param {string} name     ICONS key
+ * @param {Object} [opts]
+ * @param {number} [opts.size=16]
+ * @param {string} [opts.class=""]
+ * @param {string} [opts.aria]    if set → role="img" + <title>; else aria-hidden="true"
+ * @returns {string} SVG HTML string, or '' if name unknown
+ */
+export function icon(name, opts = {}) {
+    const body = ICONS[name];
+    if (!body) {
+        if (typeof console !== 'undefined') console.warn('[icon] unknown:', name);
+        return '';
+    }
+    const size = Number(opts.size) || 16;
+    // XSS-safe: strip dangerous chars from class option
+    const cls = (typeof opts.class === 'string' ? opts.class : '').replace(/[<>"']/g, '');
+    let ariaAttrs, titleElement;
+    if (opts.aria) {
+        ariaAttrs = `role=\"img\"`;
+        titleElement = `<title>${escapeAttr(opts.aria)}</title>`;
+    } else {
+        ariaAttrs = `aria-hidden=\"true\"`;
+        titleElement = '';
+    }
+    return `<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"${size}\" height=\"${size}\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" class=\"icon ${cls}\" ${ariaAttrs}>${titleElement}${body}</svg>`;
+}
+
+/** All ICONS keys (for testing/introspection). */
+export const ICON_NAMES = Object.keys(ICONS);
diff --git a/src/static/js/nav-guard.js b/src/static/js/nav-guard.js
new file mode 100644
index 0000000..b6f0627
--- /dev/null
+++ b/src/static/js/nav-guard.js
@@ -0,0 +1,166 @@
+/**
+ * src/static/js/nav-guard.js — v1.5.0 Phase 1
+ *
+ * Navigation dirty guard — page 이동 시 unsaved changes 검사 + 모달 (Save / Discard / Cancel).
+ *
+ * Promise-based API:
+ *   const ok = await confirmNavigation('register');  // current page id 전달
+ *   if (ok) showPage(targetPage);
+ *
+ * Modal 디자인:
+ *   - role="dialog" + aria-modal="true" + aria-labelledby
+ *   - focus trap (Tab/Shift+Tab wrap)
+ *   - Esc → Cancel (resolve false)
+ *   - Save 클릭 → clearDirty(currentPage) + resolve true (Phase 4에서 collector 통합)
+ *   - Discard 클릭 → clearDirty(currentPage) + resolve true
+ */
+
+import { state, discardPageChanges } from './state.js';
+import { clearDirty } from './page-dirty.js';
+import { showToast } from './toast.js';
+
+/**
+ * @param {string} currentPageId  source page id (이동 전)
+ * @returns {Promise<boolean>}    true → proceed navigation, false → stay on current page
+ */
+export function confirmNavigation(currentPageId) {
+    // Phase 1: page-level dirty 확인. 안 dirty면 즉시 proceed.
+    if (!state.pageDirty[currentPageId]) {
+        return Promise.resolve(true);
+    }
+
+    return new Promise((resolve) => {
+        // v1.5.2 C4 (H13 WCAG 2.4.3): capture trigger element to restore focus on close
+        const trigger = document.activeElement;
+        const modal = _buildModal(currentPageId, (proceed) => {
+            // Restore focus to the element that triggered navigation
+            if (trigger && typeof trigger.focus === 'function') {
+                try { trigger.focus(); } catch (_) {}
+            }
+            resolve(proceed);
+        });
+        document.body.appendChild(modal);
+        _trapFocus(modal);
+
+        // Focus first button (Save)
+        const saveBtn = modal.querySelector('[data-action="save"]');
+        if (saveBtn) saveBtn.focus();
+    });
+}
+
+function _buildModal(currentPageId, resolve) {
+    const wrap = document.createElement('div');
+    wrap.className = 'nav-guard__backdrop';
+    wrap.setAttribute('role', 'dialog');
+    wrap.setAttribute('aria-modal', 'true');
+    wrap.setAttribute('aria-labelledby', 'nav-guard-title');
+    wrap.innerHTML = `
+        <div class="nav-guard__modal">
+            <h2 id="nav-guard-title" class="nav-guard__title">Unsaved changes</h2>
+            <p class="nav-guard__desc">
+                You have unsaved changes on <strong>${_escape(currentPageId)}</strong>.
+                What would you like to do?
+            </p>
+            <div class="nav-guard__actions">
+                <button type="button" class="btn btn--primary" data-action="save">Save</button>
+                <button type="button" class="btn btn--outline" data-action="discard">Discard</button>
+                <button type="button" class="btn btn--ghost" data-action="cancel">Cancel</button>
+            </div>
+        </div>
+    `;
+
+    const close = (proceed) => {
+        wrap.remove();
+        document.removeEventListener('keydown', escHandler);
+        resolve(proceed);
+    };
+
+    wrap.querySelector('[data-action="save"]').addEventListener('click', async () => {
+        // v1.5.4.3 U1 fix: 실제로 save를 수행 (이전엔 clearDirty만 하고 변경사항 소실).
+        // app.js → nav-guard.js 정적 import 가 이미 있어 순환을 피하려 dynamic import.
+        const saveBtn = wrap.querySelector('[data-action="save"]');
+        const discardBtn = wrap.querySelector('[data-action="discard"]');
+        const cancelBtn = wrap.querySelector('[data-action="cancel"]');
+        const origLabel = saveBtn.textContent;
+        saveBtn.disabled = true;
+        if (discardBtn) discardBtn.disabled = true;
+        if (cancelBtn) cancelBtn.disabled = true;
+        saveBtn.textContent = 'Saving...';
+        try {
+            const app = await import('./app.js');
+            const ok = await app.handleSaveAll({ skipConfirm: true });
+            if (ok) {
+                clearDirty(currentPageId);
+                close(true);
+            } else {
+                // Save 실패 또는 validation error — handleSaveAll이 이미 toast로 사유 표시.
+                // 모달 유지 + 버튼 복원 → 사용자가 수정 후 재시도 가능.
+                saveBtn.disabled = false;
+                if (discardBtn) discardBtn.disabled = false;
+                if (cancelBtn) cancelBtn.disabled = false;
+                saveBtn.textContent = origLabel;
+            }
+        } catch (e) {
+            showToast('Save failed — ' + (e && e.message ? e.message : 'unknown error'), 'error');
+            saveBtn.disabled = false;
+            if (discardBtn) discardBtn.disabled = false;
+            if (cancelBtn) cancelBtn.disabled = false;
+            saveBtn.textContent = origLabel;
+        }
+    });
+    wrap.querySelector('[data-action="discard"]').addEventListener('click', async () => {
+        // Page-scoped restore: discard only the current page's owned state slice.
+        // Other dirty pages keep their edits and sidebar dirty dots.
+        discardPageChanges(currentPageId);
+        if (typeof window !== 'undefined' && window.__pageCollectors) {
+            window.__pageCollectors[currentPageId] = null;
+        }
+        clearDirty(currentPageId);
+        if (currentPageId === 'general' || currentPageId === 'register') {
+            try {
+                const app = await import('./app.js');
+                app.updateTabVisibility?.();
+            } catch (_) {}
+        }
+        close(true);
+    });
+    wrap.querySelector('[data-action="cancel"]').addEventListener('click', () => {
+        close(false);
+    });
+
+    const escHandler = (e) => {
+        if (e.key === 'Escape') {
+            e.preventDefault();
+            close(false);
+        }
+    };
+    document.addEventListener('keydown', escHandler);
+
+    return wrap;
+}
+
+/** Focus trap: Tab/Shift+Tab 가 modal 내부에서 순환. */
+function _trapFocus(modalRoot) {
+    modalRoot.addEventListener('keydown', (e) => {
+        if (e.key !== 'Tab') return;
+        const focusable = modalRoot.querySelectorAll(
+            'button, [href], input, [tabindex]:not([tabindex="-1"])'
+        );
+        if (focusable.length === 0) return;
+        const first = focusable[0];
+        const last = focusable[focusable.length - 1];
+        if (e.shiftKey && document.activeElement === first) {
+            e.preventDefault();
+            last.focus();
+        } else if (!e.shiftKey && document.activeElement === last) {
+            e.preventDefault();
+            first.focus();
+        }
+    });
+}
+
+function _escape(s) {
+    return String(s).replace(/[&<>"']/g, ch => ({
+        '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;'
+    }[ch]));
+}
diff --git a/src/static/js/page-dirty.js b/src/static/js/page-dirty.js
new file mode 100644
index 0000000..f3fa968
--- /dev/null
+++ b/src/static/js/page-dirty.js
@@ -0,0 +1,91 @@
+/**
+ * src/static/js/page-dirty.js — v1.5.0 Phase 1
+ *
+ * Per-page dirty state matrix helpers.
+ * state.pageDirty matrix와 sidebar UI (.nav-item.has-dirty) 동기화.
+ *
+ * v1.4.6.x state.isDirty boolean은 backward-compat로 유지하되 markDirty/clearDirty가
+ * matrix 갱신 + 합산 boolean 업데이트.
+ */
+
+import { state } from './state.js';
+
+/**
+ * v1.7.0 — dirty 변경 옵저버.
+ * pending.js 가 onDirtyChange(renderBadge) 로 구독한다.
+ * page-dirty 는 pending 을 import 하지 않는다 (순환 import 회피).
+ */
+const _subs = [];
+
+/** Register a callback invoked after any markDirty/clearDirty/clearAllDirty.
+ *  Dedup: a callback already in _subs is not pushed again (guards repeated initPending). */
+export function onDirtyChange(cb) {
+    if (typeof cb === 'function' && !_subs.includes(cb)) _subs.push(cb);
+}
+
+function _notify() {
+    _subs.forEach(cb => {
+        try { cb(); } catch (e) { /* observer must never break dirty tracking */ }
+    });
+}
+
+/**
+ * Mark a page as having unsaved changes.
+ * Sidebar leaf에 dirty dot 표시 + state.isDirty = true.
+ *
+ * @param {string} pageId — state.pageDirty key (home/ssid/io/network/register/can/opcua/modbus/log/firmware)
+ */
+export function markDirty(pageId) {
+    if (!(pageId in state.pageDirty)) {
+        if (typeof console !== 'undefined') console.warn('[page-dirty] unknown pageId:', pageId);
+        return;
+    }
+    state.pageDirty[pageId] = true;
+    state.isDirty = true;  // v1.4.6.x compat
+    _syncDot(pageId, true);
+    _notify();
+}
+
+/**
+ * Clear dirty state for a page (after successful save).
+ *
+ * @param {string} pageId
+ */
+export function clearDirty(pageId) {
+    if (!(pageId in state.pageDirty)) return;
+    state.pageDirty[pageId] = false;
+    _syncDot(pageId, false);
+    // 합산 isDirty 갱신
+    state.isDirty = Object.values(state.pageDirty).some(v => v === true);
+    _notify();
+}
+
+/** True if any page has unsaved changes. */
+export function hasDirty() {
+    return Object.values(state.pageDirty).some(v => v === true);
+}
+
+/** Return array of dirty page ids. */
+export function getDirtyPages() {
+    return Object.entries(state.pageDirty)
+        .filter(([, dirty]) => dirty)
+        .map(([id]) => id);
+}
+
+/** Clear all dirty flags (after Save All). */
+export function clearAllDirty() {
+    Object.keys(state.pageDirty).forEach(k => { state.pageDirty[k] = false; });
+    state.isDirty = false;
+    document.querySelectorAll('.nav-item.has-dirty').forEach(el => {
+        el.classList.remove('has-dirty');
+    });
+    _notify();
+}
+
+/** Sync sidebar dirty dot for a single page. */
+function _syncDot(pageId, dirty) {
+    const navEl = document.querySelector(`.nav-item[data-page="${pageId}"]`);
+    if (!navEl) return;
+    if (dirty) navEl.classList.add('has-dirty');
+    else navEl.classList.remove('has-dirty');
+}
diff --git a/src/static/js/pages/can-bus.js b/src/static/js/pages/can-bus.js
new file mode 100644
index 0000000..ccc1771
--- /dev/null
+++ b/src/static/js/pages/can-bus.js
@@ -0,0 +1,134 @@
+/**
+ * can-bus.js — CAN Bus (config + mapping)
+ *
+ * v1.5.0 Phase 3 T3: io.js의 CAN bus 카드 (frame type + baud) + can.js의 mapping table 통합.
+ * 사용자 IA 명시: "CAN-BUS: Frametype + Baudrate + Mapping 한 페이지"
+ */
+
+import { state } from '../state.js';
+import { populateCrudTable } from '../components/crud-table.js';
+import { CAN_BAUDRATES, CAN_BAUDRATE_LABELS, ODT_OPTIONS } from '../constants.js';
+import { icon } from '../icons.js';
+
+const CAN_COLUMNS = [
+    { key: 'field', label: 'Field', placeholder: 'CAN1', maxLength: 4 },
+    { key: 'id', label: 'CAN ID', placeholder: '0x18FEFC28' },
+    { key: 'odt', label: 'ODT', type: 'select', options: ODT_OPTIONS },
+    { key: 'dv', label: 'DV', placeholder: '-9', defaultValue: '-9', width: '60px' },
+    { key: 'shift', label: 'Shift', placeholder: '0', defaultValue: '0', width: '60px' },
+    { key: 'expr', label: 'Expr', placeholder: 'x*0.05' },
+    { key: 'mask', label: 'Mask', placeholder: '0xff' },
+];
+
+let _crudTable = null;
+
+const canBusPage = {
+    render(container) {
+        const p = state.protocol || {};
+        const d = state.device || {};
+        const can = d.can || {};
+        const rows = p.CAN || [];
+
+        container.innerHTML = `
+            <div class="page-header">
+                <h1 class="page-header__title">${icon('route', { size: 28 })} CAN-BUS</h1>
+                <p class="page-header__desc">CAN bus configuration and frame mapping.</p>
+            </div>
+
+            <div class="card">
+                <div class="card__header">
+                    <h2 class="card__title">${icon('cable', { size: 18 })} Bus Settings</h2>
+                </div>
+                <div class="form-row">
+                    <div class="form-group">
+                        <label class="form-label">Frame Type</label>
+                        <select class="form-select" id="can_type">
+                            <option value="standard" ${can.type === 'standard' ? 'selected' : ''}>Standard</option>
+                            <option value="extended" ${can.type !== 'standard' ? 'selected' : ''}>Extended</option>
+                        </select>
+                    </div>
+                    <div class="form-group">
+                        <label class="form-label">Baud Rate</label>
+                        <select class="form-select" id="can_speed">
+                            ${CAN_BAUDRATES.map(v => `<option value="${v}" ${String(can.speed) === String(v) ? 'selected' : ''}>${CAN_BAUDRATE_LABELS[v] || v}</option>`).join('')}
+                        </select>
+                    </div>
+                </div>
+            </div>
+
+            ${p.can_input !== 'on' ? `
+                <div class="card card--info">
+                    <p>${icon('alert-triangle', { size: 16 })} Set CAN Input to <strong>ON</strong> on the General Settings page to enable mapping.</p>
+                </div>
+            ` : ''}
+
+            <div class="card">
+                <div class="card__header">
+                    <h2 class="card__title">${icon('list', { size: 18 })} CAN Mapping</h2>
+                    <button class="btn btn--outline btn--sm" id="canbus-add-btn">&#xFF0B; Add Row</button>
+                </div>
+                <div class="data-table-wrapper">
+                    <table class="data-table" id="canbus-table">
+                        <thead>
+                            <tr>
+                                <th style="width:90px;">Field</th>
+                                <th style="width:120px;">CAN ID</th>
+                                <th style="width:100px;">ODT</th>
+                                <th style="width:60px;">DV</th>
+                                <th style="width:60px;">Shift</th>
+                                <th style="width:150px;">Expr</th>
+                                <th style="width:80px;">Mask</th>
+                                <th class="col-action"></th>
+                            </tr>
+                        </thead>
+                        <tbody id="canbus-tbody"></tbody>
+                    </table>
+                </div>
+            </div>
+        `;
+
+        const tbody = document.getElementById('canbus-tbody');
+        _crudTable = populateCrudTable(tbody, { columns: CAN_COLUMNS, data: rows });
+        document.getElementById('canbus-add-btn').addEventListener('click', () => _crudTable.addEmptyRow());
+    },
+
+    mount(container) {
+        // Bus settings bindings
+        const updCan = (key, val) => {
+            if (!state.device) state.device = {};
+            if (!state.device.can) state.device.can = {};
+            state.device.can[key] = val;
+            state.isDirty = true;
+        };
+        const canType = container.querySelector('#can_type');
+        if (canType) canType.addEventListener('change', e => updCan('type', e.target.value));
+        const canSpeed = container.querySelector('#can_speed');
+        if (canSpeed) canSpeed.addEventListener('change', e => updCan('speed', e.target.value));
+
+        window.__pageCollectors['can-bus'] = collectCanBusData;
+        // Legacy alias: can.js collector also points here
+        window.__pageCollectors['can'] = collectCanBusData;
+    },
+
+    destroy() {
+        _crudTable = null;
+    },
+
+    validate() {
+        return [];
+    },
+};
+
+function collectCanBusData() {
+    if (!state.device) state.device = {};
+    if (!state.protocol) state.protocol = {};
+    state.device.can = {
+        type: document.getElementById('can_type')?.value || '',
+        speed: document.getElementById('can_speed')?.value || '',
+    };
+    if (_crudTable) {
+        state.protocol.CAN = _crudTable.collectData();
+    }
+}
+
+export default canBusPage;
diff --git a/src/static/js/pages/can.js b/src/static/js/pages/can.js
new file mode 100644
index 0000000..308ddd7
--- /dev/null
+++ b/src/static/js/pages/can.js
@@ -0,0 +1,92 @@
+/**
+ * can.js — CAN Mapping Table Page
+ * 
+ * Dynamic CRUD table for CAN frame mappings.
+ * Columns: Field, CAN ID, ODT, DV, Shift, Expr, Mask
+ * Note: No addr/ns/idt columns (differs from MODBUS and OPC-UA)
+ * 
+ * Data source: state.protocol.CAN (array)
+ */
+
+import { state } from '../state.js';
+import { populateCrudTable } from '../components/crud-table.js';
+import { ODT_OPTIONS } from '../constants.js';
+
+const CAN_COLUMNS = [
+    { key: 'field', label: 'Field', placeholder: 'CAN1', maxLength: 4 },
+    { key: 'id', label: 'CAN ID', placeholder: '0x18FEFC28' },
+    { key: 'odt', label: 'ODT', type: 'select', options: ODT_OPTIONS },
+    { key: 'dv', label: 'DV', placeholder: '-9', defaultValue: '-9', width: '60px' },
+    { key: 'shift', label: 'Shift', placeholder: '0', defaultValue: '0', width: '60px' },
+    { key: 'expr', label: 'Expr', placeholder: 'x*0.05' },
+    { key: 'mask', label: 'Mask', placeholder: '0xff' },
+];
+
+export function renderCanPage(container) {
+    const p = state.protocol || {};
+    const rows = p.CAN || [];
+
+    container.innerHTML = `
+        <div class="page-header">
+            <h1 class="page-header__title">🚌 CAN Mapping</h1>
+            <p class="page-header__desc">Manage the CAN Frame mapping table.</p>
+        </div>
+
+        ${p.can_input !== 'on' ? `
+            <div class="card card--info">
+                <p>ℹ️ Set CAN Input to <strong>ON</strong> on the Register page.</p>
+            </div>
+        ` : ''}
+
+        <div class="card">
+            <div class="card__header">
+                <h2 class="card__title"><span class="card__title-icon">📋</span> CAN Frame Mapping</h2>
+                <button class="btn btn--outline btn--sm" id="can-add-btn">＋ Add Row</button>
+            </div>
+            <div class="data-table-wrapper">
+                <table class="data-table" id="can-table">
+                    <thead>
+                        <tr>
+                            <th style="width:90px;">Field</th>
+                            <th style="width:120px;">CAN ID</th>
+                            <th style="width:100px;">ODT</th>
+                            <th style="width:60px;">DV</th>
+                            <th style="width:60px;">Shift</th>
+                            <th style="width:150px;">Expr</th>
+                            <th style="width:80px;">Mask</th>
+                            <th class="col-action"></th>
+                        </tr>
+                    </thead>
+                    <tbody id="can-tbody"></tbody>
+                </table>
+            </div>
+        </div>
+    `;
+
+    // Populate rows using shared CRUD component
+    const tbody = document.getElementById('can-tbody');
+    const table = populateCrudTable(tbody, { columns: CAN_COLUMNS, data: rows });
+
+    // Add row
+    document.getElementById('can-add-btn').addEventListener('click', () => {
+        table.addEmptyRow();
+    });
+
+    // Register data collector
+    window.__pageCollectors.can = () => {
+        if (!state.protocol) state.protocol = {};
+        state.protocol.CAN = table.collectData();
+    };
+}
+
+// ─── New Page Interface ─────────────────────────────────────
+const canPage = {
+    render(container) { renderCanPage(container); },
+    mount() {
+        window.__pageCollectors.can?.();
+    },
+    destroy() {},
+    validate() { return []; },
+};
+
+export default canPage;
diff --git a/src/static/js/pages/ethernet.js b/src/static/js/pages/ethernet.js
new file mode 100644
index 0000000..59a38de
--- /dev/null
+++ b/src/static/js/pages/ethernet.js
@@ -0,0 +1,158 @@
+/**
+ * ethernet.js — Wired interface IP configuration (eth0 + WAN uplink)
+ *
+ * v1.5.0 Phase 2: io.js의 두 wired 카드를 분리.
+ * v1.7.1 Task 3: the second card was mislabeled "LTE Interface" — the device has
+ *   no cellular modem; this is a wired uplink port. The visible label/icon are
+ *   corrected to WAN/wired. The DB keys stay `lte_*` (backend/Java contract).
+ * server endpoints (TIOT/Update/RTCM/uplink 등)는 server-setting.js 소유.
+ *
+ * Data model (nested — matches io.js state.device.eth / .lte convention):
+ *   state.device.eth = { ip, netmask, gateway }
+ *   state.device.lte = { ip, netmask, gateway, port }   ← lte_* = wired WAN keys
+ *
+ * eth_ip / eth_netmask / eth_gateway / lte_ip / lte_netmask / lte_gateway are
+ * present as DOM element IDs (ip-input component convention) and also used as
+ * string literals for test detection.
+ */
+
+import { state, bindIpGroup } from '../state.js';
+import { escapeHtml } from '../utils.js';
+import { isValidIP } from '../validator.js';
+import { renderIpOctets, setupIpOctets, collectIpValue } from '../components/ip-input.js';
+import { icon } from '../icons.js';
+
+// Field definitions — flat DOM ids map to nested state paths
+const ETH_FIELDS = [
+    { key: 'eth_ip',      label: 'IP Address',   group: 'eth', prop: 'ip' },
+    { key: 'eth_netmask', label: 'Subnet Mask',  group: 'eth', prop: 'netmask' },
+    { key: 'eth_gateway', label: 'Gateway',      group: 'eth', prop: 'gateway' },
+];
+
+const LTE_FIELDS = [
+    { key: 'lte_ip',      label: 'IP Address',  group: 'lte', prop: 'ip' },
+    { key: 'lte_netmask', label: 'Subnet Mask', group: 'lte', prop: 'netmask' },
+    { key: 'lte_gateway', label: 'Gateway',     group: 'lte', prop: 'gateway' },
+];
+
+const ethernetPage = {
+    render(container) {
+        const d = state.device || {};
+        const eth = d.eth || {};
+        const lte = d.lte || {};
+
+        container.innerHTML = `
+            <div class="page-header">
+                <h1 class="page-header__title">${icon('ethernet-port', { size: 28 })} Ethernet</h1>
+                <p class="page-header__desc">Configure the wired management and uplink interfaces. Server endpoints are configured under Network &rarr; Server Setting.</p>
+            </div>
+
+            <div class="grid-2col">
+                <div class="card">
+                    <div class="card__header">
+                        <h2 class="card__title"><span class="card__title-icon">${icon('cable', { size: 18 })}</span> Management Ethernet (eth1)</h2>
+                    </div>
+                    <div class="card__body">
+                        ${ETH_FIELDS.map(f => `
+                        <div class="form-group">
+                            <label class="form-label">${escapeHtml(f.label)}</label>
+                            ${renderIpOctets(f.key, eth[f.prop] || '')}
+                        </div>
+                        `).join('')}
+                    </div>
+                </div>
+
+                <div class="card">
+                    <div class="card__header">
+                        <h2 class="card__title"><span class="card__title-icon">${icon('cable', { size: 18 })}</span> Uplink Ethernet (eth0)</h2>
+                    </div>
+                    <div class="card__body">
+                        <p class="form-hint">Physical eth0 uplink. Endpoint ports are configured on Server Setting.</p>
+                        ${LTE_FIELDS.map(f => `
+                        <div class="form-group">
+                            <label class="form-label">${escapeHtml(f.label)}</label>
+                            ${renderIpOctets(f.key, lte[f.prop] || '')}
+                        </div>
+                        `).join('')}
+                    </div>
+                </div>
+            </div>
+        `;
+    },
+
+    mount(container) {
+        setupIpOctets(container);
+
+        // Ethernet IP bindings
+        ETH_FIELDS.forEach(({ key, group, prop }) => {
+            bindIpGroup(container, key,
+                () => state.device?.[group]?.[prop] || '',
+                (val) => {
+                    if (!state.device) state.device = {};
+                    if (!state.device[group]) state.device[group] = {};
+                    state.device[group][prop] = val;
+                    state.isDirty = true;
+                }
+            );
+        });
+
+        // LTE IP bindings
+        LTE_FIELDS.forEach(({ key, group, prop }) => {
+            bindIpGroup(container, key,
+                () => state.device?.[group]?.[prop] || '',
+                (val) => {
+                    if (!state.device) state.device = {};
+                    if (!state.device[group]) state.device[group] = {};
+                    state.device[group][prop] = val;
+                    state.isDirty = true;
+                }
+            );
+        });
+
+        // Register data collector
+        window.__pageCollectors.ethernet = collectEthernetData;
+    },
+
+    destroy() {},
+
+    validate() {
+        const errors = [];
+        const d = state.device || {};
+
+        ETH_FIELDS.forEach(({ key, group, prop, label }) => {
+            const val = d[group]?.[prop];
+            if (val && val !== '...' && !isValidIP(val)) {
+                errors.push({ field: key, page: 'ethernet', message: `${label} — Invalid IP format` });
+            }
+        });
+
+        LTE_FIELDS.forEach(({ key, group, prop, label }) => {
+            const val = d[group]?.[prop];
+            if (val && val !== '...' && !isValidIP(val)) {
+                errors.push({ field: key, page: 'ethernet', message: `${label} — Invalid IP format` });
+            }
+        });
+
+        return errors;
+    },
+};
+
+function collectEthernetData() {
+    if (!state.device) state.device = {};
+
+    state.device.eth = {
+        ip:      collectIpValue('eth_ip'),
+        netmask: collectIpValue('eth_netmask'),
+        gateway: collectIpValue('eth_gateway'),
+    };
+
+    const prevLte = state.device.lte || {};
+    state.device.lte = {
+        ...prevLte,
+        ip:      collectIpValue('lte_ip'),
+        netmask: collectIpValue('lte_netmask'),
+        gateway: collectIpValue('lte_gateway'),
+    };
+}
+
+export default ethernetPage;
diff --git a/src/static/js/pages/firmware.js b/src/static/js/pages/firmware.js
new file mode 100644
index 0000000..2bd5f33
--- /dev/null
+++ b/src/static/js/pages/firmware.js
@@ -0,0 +1,931 @@
+/**
+ * firmware.js — Firmware Update page
+ *
+ * Production page module ({ render, mount, destroy }) matching the home.js
+ * contract. Drives a graphical update flow from a single backend status poll:
+ * stepper · upload · pre-flight · per-component flash progress · reboot
+ * watchdog · config-preservation check.
+ *
+ * MERGE: drop into src/static/js/pages/firmware.js, register in app.js PAGES,
+ * add a nav-item in index.html, and append firmware.css to style.css.
+ */
+
+import { getFirmwareStatus, preflightFirmware as preflight, uploadFirmware, startFlash, restoreCheck } from '../api.js';
+import { icon } from '../icons.js';
+import { showToast } from '../toast.js';
+import { escapeHtml } from '../utils.js';
+import {
+    fmtBytes, fmtDuration, fmtRate, buildDateOf,
+    slotTarget, slotLabel, computeView, viewLine,
+    wizardStep, wizardStepperState, isCommitting, navNextDisabled,
+} from '../firmware-logic.js';
+
+const POLL_MS = 1000;
+const REBOOT_TIMEOUT_S = 180;   // after this, the reboot watchdog warns it's overdue
+
+// ─── module state ─────────────────────────────────────────────
+let pollTimer = null;
+let visHandler = null;      // visibilitychange listener (paused polling when hidden)
+let announceTimer = null;   // pending aria-live announcement timeout
+let boundListeners = [];    // {el, ev, fn} added in mount(), removed in destroy()
+let userStep = 'upload';    // wizard step the user navigated to (pre-flash only)
+let lastNavKey = null;      // current footer-nav key (re-render only on change)
+let lastStepperSig = '';    // stepper node-states signature (re-render only on change)
+let failureAck = false;     // user dismissed a flash failure → back to pre-flash steps
+let commitAnnounced = false; // one-shot SR announcement when device-side commit starts
+let last = null;            // last status snapshot
+let prevState = null;       // state on the previous poll (transition detection)
+let preflightOk = false;
+let sawReboot = false;      // latched once we observe state=rebooting
+let backOnline = false;     // device answered again after a reboot
+let configChecked = false;  // restore-check completed after our flash
+let flashMode = '';         // flash card body: '' | 'progress' | 'reboot' | 'rebooted' | 'done'
+let uploadLocked = false;   // upload blocked while a flash is in progress
+let uploading = false;      // a firmware-ZIP upload is in flight (gates the upload-step NEXT)
+let rebootStart = 0;        // performance.now() when reboot observed (elapsed display)
+let rebootOverdueAnnounced = false; // one-shot reboot-timeout announcement
+let autoPreflightDone = false; // one-shot auto pre-flight after a staged page-load
+let flashStartedAt = 0;     // performance.now() when this flash began (report duration)
+let lastConfigResult = null; // restore-check result, for the completion report
+let builtCompSig = '';      // signature of currently-built component rows
+let logLines = [];
+// v1.11.10 (review #17 MED leak): cleanup hook for an OPEN showConfirm modal. destroy()
+// previously removed the overlay without resolving its Promise or removing the document
+// keydown listener (listener leak + dangling promise) — this lets destroy() tear it down
+// cleanly. Set while a confirm is open, cleared on close/destroy.
+let _modalCleanup = null;
+
+// formatting / view helpers now live in ../firmware-logic.js (pure, unit-tested)
+
+function log(msg) {
+    logLines.push(msg);
+    if (logLines.length > 200) logLines = logLines.slice(-200);
+    const el = document.getElementById('fw-log');
+    if (el) { el.textContent = logLines.join('\n'); el.scrollTop = el.scrollHeight; }
+}
+
+// assertive screen-reader announcement for milestones (clear → set forces re-read)
+function announce(msg) {
+    const el = document.getElementById('fw-announce');
+    if (!el) return;
+    if (announceTimer) clearTimeout(announceTimer);
+    el.textContent = '';
+    // brief delay so AT registers the change even for an identical message
+    announceTimer = setTimeout(() => { el.textContent = msg; announceTimer = null; }, 30);
+}
+
+// single-timer polling control (provably no double-start)
+function startPolling() {
+    if (pollTimer) return;
+    poll();
+    pollTimer = setInterval(poll, POLL_MS);
+}
+function stopPolling() {
+    if (pollTimer) { clearInterval(pollTimer); pollTimer = null; }
+}
+
+function rebootElapsedText() {
+    const sec = rebootStart ? Math.round((performance.now() - rebootStart) / 1000) : 0;
+    return sec > REBOOT_TIMEOUT_S
+        ? `${sec}s — taking longer than expected. Check the device power & network, then reload this page.`
+        : `${sec}s — reconnecting…`;
+}
+
+// ─── stepper ──────────────────────────────────────────────────
+const STEP_ICON = { done: '✓', active: '•', error: '✕', pending: '' };
+
+function renderStepper(phases) {
+    const el = document.getElementById('fw-stepper');
+    if (!el || !phases) return;
+    el.innerHTML = phases.map((p, i) => {
+        const icon = STEP_ICON[p.state] || String(i + 1);
+        const cls = `fw-step fw-step--${p.state}`;
+        const detail = p.detail ? `<span class="fw-step__detail">${escapeHtml(p.detail)}</span>` : '';
+        return `<div class="${cls}">
+            <span class="fw-step__dot">${icon || (i + 1)}</span>
+            <span class="fw-step__label">${escapeHtml(p.label)}</span>
+            ${detail}
+        </div>`;
+    }).join('');
+}
+
+function latches() {
+    return { sawReboot, backOnline, configChecked };
+}
+
+// ─── components (built once, updated in place) ────────────────
+function buildComponents(comps) {
+    const host = document.getElementById('fw-comps');
+    if (!host) return;
+    if (!comps.length) { host.innerHTML = ''; builtCompSig = ''; return; }
+    host.innerHTML = `<div class="card__title" style="margin:var(--space-md) 0 var(--space-sm);">Components</div>` +
+        comps.map(c => `
+        <div class="fw-comp" id="fw-comp-${c.signature}">
+            <span class="fw-comp__state-icon" data-role="icon" aria-hidden="true">○</span>
+            <span class="fw-comp__sig">${escapeHtml(c.signature)}</span>
+            <div class="fw-comp__name">
+                <span class="fw-comp__role">${escapeHtml(c.role)} <small>${escapeHtml(c.name)}</small></span>
+                <span class="fw-comp__track" data-role="track" role="progressbar"
+                      aria-valuemin="0" aria-valuemax="100" aria-valuenow="0" aria-valuetext="pending, 0%"
+                      aria-label="${escapeHtml(c.role)} ${escapeHtml(c.signature)} transfer"><span class="fw-comp__fill" data-role="fill"></span></span>
+                <span class="fw-comp__hash">${escapeHtml((c.sha256 || '').slice(0, 24))}… · ${fmtBytes(c.size)}</span>
+            </div>
+            <span class="fw-comp__pct" data-role="pct">0%</span>
+        </div>`).join('');
+    builtCompSig = comps.map(c => c.signature).join(',');
+}
+
+const STATE_ICON = { pending: '○', active: '◐', done: '✓', error: '✕' };
+
+function updateComponents(comps) {
+    const sig = comps.map(c => c.signature).join(',');
+    if (sig !== builtCompSig) buildComponents(comps);
+    comps.forEach(c => {
+        const row = document.getElementById(`fw-comp-${c.signature}`);
+        if (!row) return;
+        row.className = `fw-comp fw-comp--${c.state}`;
+        const fill = row.querySelector('[data-role=fill]');
+        const pct = row.querySelector('[data-role=pct]');
+        const icon = row.querySelector('[data-role=icon]');
+        const track = row.querySelector('[data-role=track]');
+        const p = c.state === 'done' ? 100 : c.pct;
+        if (fill) fill.style.width = p + '%';
+        if (pct) pct.textContent = p + '%';
+        if (icon) icon.textContent = STATE_ICON[c.state] || '○';
+        if (track) {
+            track.setAttribute('aria-valuenow', String(p));
+            track.setAttribute('aria-valuetext', `${c.state}, ${p}%`);
+        }
+    });
+}
+
+// ─── slot badge ───────────────────────────────────────────────
+function slotBadge(slot) {
+    if (!slot) return '';
+    const before = escapeHtml(slot.before || '?');
+    const after = escapeHtml(slotTarget(slot));
+    return `<span class="fw-slot">
+        <span class="fw-slot__pill">slot ${before}</span>
+        <span class="fw-slot__arrow" aria-hidden="true">→</span>
+        <span class="fw-slot__pill fw-slot__pill--next">slot ${after}</span>
+    </span>`;
+}
+
+// ─── flash card body: build once per mode, then update in place ───
+// (rebuilding innerHTML every poll would restart the CSS width transitions
+//  and make the bars jump — so we build a skeleton once and only touch values.)
+function updateFlashArea(s, view) {
+    if (!['flashing', 'failed', 'rebooting', 'rebooted', 'done'].includes(view)) return;
+    showFlashCard();
+    const body = document.getElementById('fw-flash-body');
+    if (!body) return;
+    if (view === 'rebooting') { ensureFlashMode('reboot', body, s); updateRebootElapsed(); return; }
+    if (view === 'rebooted') { ensureFlashMode('rebooted', body, s); return; }
+    if (view === 'done') { ensureFlashMode('done', body, s); return; }
+    ensureFlashMode('progress', body, s);   // flashing | failed
+    updateFlashProgress(s, view);
+}
+
+function ensureFlashMode(mode, body, s) {
+    if (flashMode === mode) return;
+    flashMode = mode;
+    if (mode === 'progress') {
+        body.innerHTML = `
+            <div class="fw-danger">${icon('alert-triangle', {size:16})} Do not power off the device — firmware is being written. This can take up to ~2 minutes.</div>
+            ${s.backup ? `<div class="info-banner">${icon('save', {size:14})} Config backed up before flash — <span class="text-mono">${escapeHtml(s.backup.when || s.backup.path)}</span></div>` : ''}
+            <div class="fw-overall">
+                <div class="fw-overall__head">
+                    <span class="fw-overall__pct" id="fw-overall-pct">0%</span>
+                    <span class="fw-overall__meta" id="fw-overall-meta"></span>
+                </div>
+                <div class="fw-bar"><div class="fw-bar__fill" id="fw-overall-fill" style="width:0%"></div></div>
+            </div>
+            <div id="fw-comps"></div>`;
+        builtCompSig = '';
+    } else if (mode === 'reboot') {
+        body.innerHTML = `
+            <div class="fw-danger">${icon('alert-triangle', {size:16})} Do not power off — the device is rebooting onto the new firmware.</div>
+            <div class="fw-reboot">
+                <div class="loading__spinner"></div>
+                <div class="fw-reboot__title">Device is rebooting…</div>
+                <div class="fw-reboot__sub">The firmware was written and the device is restarting onto the new slot. The connection drops briefly — this page reconnects automatically.</div>
+                <div class="fw-reboot__elapsed" id="fw-reboot-elapsed"></div>
+                ${slotBadge(s.slot)}
+            </div>`;
+    } else if (mode === 'rebooted') {
+        body.innerHTML = `
+            <div class="fw-done fw-done--reboot">
+                <span class="fw-done__icon">${icon('refresh-cw', {size:32})}</span>
+                <div>
+                    <div class="fw-done__title">Firmware written — device rebooted</div>
+                    <div class="fw-done__sub">Now on ${escapeHtml(slotLabel(s.slot))}. Run the config check below to confirm settings survived.</div>
+                </div>
+            </div>`;
+    } else if (mode === 'done') {
+        body.innerHTML = buildReportHtml(s);
+        body.querySelector('#fw-report-btn')?.addEventListener('click', downloadReport);
+    }
+}
+
+// ─── completion report (#4) ───────────────────────────────────
+function reportData(s) {
+    const comps = (s && s.components) || [];
+    const slot = (s && s.slot) || {};
+    const dur = flashStartedAt ? (performance.now() - flashStartedAt) / 1000 : null;
+    return { comps, before: slot.before || '?', after: slotTarget(slot), dur, cfg: lastConfigResult };
+}
+
+function buildReportHtml(s) {
+    const d = reportData(s);
+    const cfgTxt = d.cfg ? (d.cfg.restored ? 'restored from backup' : 'preserved') : 'not checked';
+    const rows = d.comps.map(c =>
+        `<div class="fw-report__row"><span>${escapeHtml(c.signature)} · ${escapeHtml(c.name)}</span><span>${fmtBytes(c.size)}</span></div>`).join('');
+    return `
+        <div class="fw-done fw-done--ok">
+            <span class="fw-done__icon">${icon('check-circle-2', {size:32})}</span>
+            <div>
+                <div class="fw-done__title">Update complete</div>
+                <div class="fw-done__sub">Firmware written to slot ${escapeHtml(d.after)} · configuration ${escapeHtml(cfgTxt)}.</div>
+            </div>
+        </div>
+        <div class="fw-report mt-md">
+            <div class="fw-report__row"><span>Duration</span><span>${fmtDuration(d.dur)}</span></div>
+            <div class="fw-report__row"><span>Slot</span><span>${escapeHtml(d.before)} → ${escapeHtml(d.after)}</span></div>
+            <div class="fw-report__row"><span>Build date</span><span>${escapeHtml(buildDateOf(d.comps) || 'unknown')}</span></div>
+            <div class="fw-report__row"><span>Components</span><span>${d.comps.length} (${d.comps.map(c => escapeHtml(c.signature)).join(', ')})</span></div>
+            ${rows}
+            <div class="fw-report__row"><span>Config</span><span>${escapeHtml(cfgTxt)}</span></div>
+        </div>
+        <div class="fw-actions mt-md"><button class="btn btn--outline btn--sm" id="fw-report-btn">⬇ Download report</button></div>`;
+}
+
+function downloadReport() {
+    const d = reportData(last);
+    const cfgTxt = d.cfg
+        ? (d.cfg.restored ? 'restored from backup (' + (d.cfg.reason || '') + ')' : 'preserved')
+        : 'not checked';
+    const ts = new Date().toISOString();
+    const lines = [
+        'DPW Firmware Update Report',
+        '==========================',
+        'Timestamp:  ' + ts,
+        'Result:     SUCCESS',
+        'Slot:       ' + d.before + ' -> ' + d.after,
+        'Build date: ' + (buildDateOf(d.comps) || 'unknown'),
+        'Duration:   ' + fmtDuration(d.dur),
+        'Config:     ' + cfgTxt,
+        '',
+        'Components flashed:',
+        ...d.comps.map(c => '  ' + String(c.signature).padEnd(4) + ' ' + c.name +
+            '  ' + fmtBytes(c.size) + '  sha256=' + (c.sha256 || '')),
+        '',
+    ];
+    const blob = new Blob([lines.join('\n')], { type: 'text/plain' });
+    const url = URL.createObjectURL(blob);
+    const a = document.createElement('a');
+    a.href = url;
+    a.download = 'fw-update-report_' + ts.slice(0, 19).replace(/[:T]/g, '-') + '.txt';
+    document.body.appendChild(a);
+    a.click();
+    document.body.removeChild(a);
+    URL.revokeObjectURL(url);
+}
+
+function updateFlashProgress(s, view) {
+    const o = s.overall || { sent: 0, total: 0, pct: 0, elapsed_s: 0 };
+    const fill = document.getElementById('fw-overall-fill');
+    const pct = document.getElementById('fw-overall-pct');
+    const meta = document.getElementById('fw-overall-meta');
+    const committing = view === 'flashing' && isCommitting(s);
+    if (fill) {
+        fill.style.width = o.pct + '%';
+        fill.className = 'fw-bar__fill'
+            + (view === 'failed' ? ' fw-bar__fill--error' : '')
+            + (committing ? ' fw-bar__fill--busy' : '');   // pulse: device still working
+    }
+    if (pct) pct.textContent = committing ? '⏳' : o.pct + '%';
+    if (meta) {
+        if (committing) {
+            meta.textContent = `writing to flash & committing — do not power off (up to ~2 min) · ${slotBadgeInline(s.slot)}`;
+        } else {
+            const r = fmtRate(o);
+            meta.textContent = `${fmtBytes(o.sent)} / ${fmtBytes(o.total)} · ${o.elapsed_s}s${r ? ' · ' + r : ''} · ${slotBadgeInline(s.slot)}`;
+        }
+    }
+    if (s.components && s.components.length) updateComponents(s.components);
+}
+
+function updateRebootElapsed() {
+    const el = document.getElementById('fw-reboot-elapsed');
+    if (!el) return;
+    const sec = rebootStart ? Math.round((performance.now() - rebootStart) / 1000) : 0;
+    el.textContent = rebootElapsedText();
+    el.classList.toggle('fw-reboot__elapsed--overdue', sec > REBOOT_TIMEOUT_S);
+}
+
+function slotBadgeInline(slot) {
+    if (!slot) return '';
+    return `slot ${escapeHtml(slot.before || '?')}→${escapeHtml(slotTarget(slot))}`;
+}
+
+// ─── pre-flight ───────────────────────────────────────────────
+function renderPreflight(pf) {
+    const host = document.getElementById('fw-checks');
+    if (!host) return;
+    if (!pf) { host.innerHTML = '<p class="text-muted">Run pre-flight to validate the device before flashing.</p>'; return; }
+    host.innerHTML = pf.checks.map(c => `
+        <div class="fw-check">
+            <span class="dash-glyph dash-glyph--${escapeHtml(c.tier)}"></span>
+            <span class="fw-check__label">${escapeHtml(c.label)}</span>
+            <span class="fw-check__detail">${escapeHtml(c.detail)}</span>
+            ${c.critical ? '' : '<span class="fw-check__opt">optional</span>'}
+        </div>`).join('');
+}
+
+// ─── poll ─────────────────────────────────────────────────────
+async function poll() {
+    let s;
+    try {
+        s = await getFirmwareStatus();
+    } catch (err) {
+        // connection dropped — expected during the reboot window
+        if (sawReboot && !backOnline) {
+            const sec = rebootStart ? Math.round((performance.now() - rebootStart) / 1000) : 0;
+            const el = document.getElementById('fw-reboot-elapsed');
+            if (el) {
+                el.textContent = rebootElapsedText();
+                el.classList.toggle('fw-reboot__elapsed--overdue', sec > REBOOT_TIMEOUT_S);
+            }
+            if (sec > REBOOT_TIMEOUT_S && !rebootOverdueAnnounced) {
+                rebootOverdueAnnounced = true;
+                announce('Device has not come back online. Check power and network, then reload this page.');
+                log('reboot watchdog: device overdue (>' + REBOOT_TIMEOUT_S + 's)');
+            }
+        } else {
+            const stamp = document.getElementById('fw-updated');
+            if (stamp) stamp.textContent = 'Status unavailable — ' + err.message;
+        }
+        return;
+    }
+
+    // device answered again after a reboot → advance to the Verify step
+    if (sawReboot && !backOnline) {
+        backOnline = true;
+        showToast('Device is back online — verify the config.', 'success');
+        announce('Device is back online. Verify the config.');
+        log('device reconnected after reboot');
+        window.scrollTo({ top: 0, behavior: 'smooth' });   // surface the Verify step
+    }
+
+    last = s;
+
+    // detect reboot transition before computing the view
+    if (s.state === 'rebooting' && !sawReboot) {
+        sawReboot = true;
+        rebootStart = performance.now();
+        rebootOverdueAnnounced = false;
+        announce('Firmware written — device is rebooting. Do not power off.');
+        log('flash committed — device rebooting');
+    }
+
+    // the failure-dismissed latch only masks while the server still reports failed;
+    // once a re-flash / re-upload moves it off 'failed', drop the latch
+    if (s.state !== 'failed') failureAck = false;
+    let view = computeView(s.state, latches());
+    if (failureAck && view === 'failed') view = 'staged';   // user dismissed the failure
+    const step = wizardStep(view, userStep);
+
+    // ── wizard: top map + single panel + footer nav ──
+    // re-render the stepper only when a node's state changes — rebuilding its
+    // innerHTML every poll would restart the active-dot pulse animation each second
+    const stepperStates = wizardStepperState(step, view);
+    const stepperSig = stepperStates.map(p => p.state).join('');
+    if (stepperSig !== lastStepperSig) { renderStepper(stepperStates); lastStepperSig = stepperSig; }
+    const navKey = step + (view === 'failed' ? ':failed' : '');
+    if (navKey !== lastNavKey) { renderNav(step, view === 'failed'); lastNavKey = navKey; }
+    showPanel(PANEL_FOR_STEP[step]);
+    updateNavState();
+    setFlashTitle(view);
+    toggleWarning(step);
+    updateSlot(s.slot);
+    updateLive(s, view);
+    setUploadLocked(view === 'flashing' || view === 'rebooting');
+
+    // one-shot screen-reader cue when device-side commit begins (long indeterminate wait)
+    if (view === 'flashing' && isCommitting(s) && !commitAnnounced) {
+        commitAnnounced = true;
+        announce('Writing firmware to flash and committing. Do not power off — up to about two minutes.');
+    }
+
+    // staged firmware → fill the upload panel + one-shot auto pre-flight
+    if (view === 'staged' && !sawReboot && s.components && s.components.length) {
+        const host = document.getElementById('fw-comps-upload');
+        if (host && !host.children.length) {
+            buildComponentsInUpload(s.components);
+            const drop = document.getElementById('fw-drop');
+            if (drop) drop.querySelector('.fw-drop__main').textContent = 'Replace firmware ZIP (click or drop)';
+        }
+        if (!preflightOk && !autoPreflightDone) { autoPreflightDone = true; doPreflight(); }
+    }
+
+    updateFlashArea(s, view);
+
+    if (view === 'failed' && prevState !== 'failed') {
+        announce('Update failed. ' + (s.message || 'See the log.'));
+    }
+    if (prevState !== 'flashing' && view === 'flashing') {
+        window.scrollTo({ top: 0, behavior: 'smooth' });
+        announce('Flash started — do not power off the device.');
+    }
+    prevState = view;
+
+    const stamp = document.getElementById('fw-updated');
+    if (stamp) stamp.textContent = viewLine(view, s.message);
+}
+
+function updateSlot(slot) {
+    const el = document.getElementById('fw-slot-badge');
+    if (el) el.innerHTML = slotBadge(slot);
+}
+
+// live progress summary in the sticky header (always visible)
+function updateLive(s, view) {
+    const stateEl = document.getElementById('fw-live-state');
+    const pctEl = document.getElementById('fw-live-pct');
+    const fill = document.getElementById('fw-live-fill');
+    const o = s.overall || { pct: 0, sent: 0, total: 0, elapsed_s: 0 };
+    const active = view === 'flashing' || view === 'rebooting' || view === 'rebooted';
+    const committing = view === 'flashing' && isCommitting(s);   // computed once
+    if (stateEl) {
+        stateEl.textContent = viewLine(view, s.message);
+        stateEl.className = 'fw-live__state' + (
+            view === 'done' ? ' fw-live__state--done'
+                : view === 'failed' ? ' fw-live__state--error'
+                    : active ? ' fw-live__state--active' : '');
+    }
+    if (fill) {
+        const full = view === 'rebooting' || view === 'rebooted' || view === 'done';
+        fill.style.width = (full ? 100 : o.pct) + '%';
+        fill.className = 'fw-bar__fill' + (
+            view === 'failed' ? ' fw-bar__fill--error'
+                : (view === 'done' || full) ? ' fw-bar__fill--done'
+                    : committing ? ' fw-bar__fill--busy' : '');
+    }
+    if (pctEl) {
+        const flashingText = committing
+            ? 'writing to flash & committing — do not power off…'
+            : `${o.pct}% · ${fmtBytes(o.sent)}/${fmtBytes(o.total)} · ${fmtRate(o) || o.elapsed_s + 's'}`;
+        pctEl.textContent =
+            view === 'flashing' ? flashingText
+                : view === 'rebooting' ? 'rebooting…'
+                    : view === 'rebooted' ? 'awaiting config check'
+                        : view === 'done' ? 'complete'
+                            : view === 'staged' ? 'ready to flash' : '';
+    }
+}
+
+function setUploadLocked(locked) {
+    if (uploadLocked === locked) return;
+    uploadLocked = locked;
+    const drop = document.getElementById('fw-drop');
+    const file = document.getElementById('fw-file');
+    if (drop) {
+        drop.classList.toggle('fw-drop--disabled', locked);
+        drop.setAttribute('aria-disabled', locked ? 'true' : 'false');
+        drop.tabIndex = locked ? -1 : 0;
+    }
+    if (file) file.disabled = locked;
+}
+
+function showFlashCard() {
+    document.getElementById('fw-flash-card')?.classList.remove('hidden');
+}
+
+// ─── wizard navigation (one step at a time) ───────────────────
+const PANEL_FOR_STEP = {
+    upload: 'upload', preflight: 'preflight', flash: 'flash',
+    reboot: 'flash', verify: 'verify', done: 'flash',
+};
+
+function showPanel(panel) {
+    document.querySelectorAll('#fw-wizard-body .fw-step-panel').forEach(p => {
+        p.classList.toggle('hidden', p.dataset.panel !== panel);
+    });
+}
+
+function stagedReady() {
+    return !!(last && last.state === 'staged' && last.components && last.components.length);
+}
+
+function setFlashTitle(view) {
+    const el = document.getElementById('fw-flash-title');
+    if (!el) return;
+    el.textContent = (view === 'rebooting' || view === 'rebooted') ? 'Restarting'
+        : view === 'done' ? 'Update complete'
+            : view === 'failed' ? 'Flash failed' : 'Flashing';
+}
+
+function toggleWarning(step) {
+    const w = document.getElementById('fw-warning');
+    if (w) w.classList.toggle('hidden', step !== 'upload' && step !== 'preflight');
+}
+
+function renderNav(step, failed) {
+    const nav = document.getElementById('fw-wizard-nav');
+    if (!nav) return;
+    let html;
+    if (step === 'upload') {
+        html = `<span class="fw-nav__hint">Choose a firmware ZIP to begin</span>
+                <button class="btn btn--primary" id="fw-nav-next" disabled>Next →</button>`;
+    } else if (step === 'preflight') {
+        html = `<button class="btn btn--outline" id="fw-nav-back">← Back</button>
+                <button class="btn btn--primary" id="fw-btn-flash" disabled>${icon('activity', {size:16})} Flash</button>`;
+    } else if (step === 'flash' && failed) {
+        html = `<button class="btn btn--outline" id="fw-nav-retry">← Back to pre-flight</button>
+                <span class="fw-nav__hint fw-nav__hint--error">Flash failed — see log</span>`;
+    } else if (step === 'flash') {
+        html = `<span class="fw-nav__hint">${icon('activity', {size:16})} Installing — do not power off the device…</span>`;
+    } else if (step === 'reboot') {
+        html = `<span class="fw-nav__hint">${icon('refresh-cw', {size:16})} Restarting the device…</span>`;
+    } else if (step === 'verify') {
+        html = `<span class="fw-nav__hint">Verify the configuration survived</span>
+                <button class="btn btn--primary" id="fw-btn-restore">${icon('check-circle-2', {size:16})} Verify config</button>`;
+    } else { // done
+        html = `<span class="fw-nav__hint">${icon('check-circle-2', {size:16})} Update complete</span>
+                <button class="btn btn--outline" id="fw-nav-startover">↻ Start over</button>`;
+    }
+    nav.innerHTML = html;
+    nav.querySelector('#fw-nav-next')?.addEventListener('click', () => gotoStep('preflight'));
+    nav.querySelector('#fw-nav-back')?.addEventListener('click', () => gotoStep('upload'));
+    nav.querySelector('#fw-nav-retry')?.addEventListener('click', () => { failureAck = true; gotoStep('preflight'); });
+    nav.querySelector('#fw-btn-flash')?.addEventListener('click', doFlash);
+    nav.querySelector('#fw-btn-restore')?.addEventListener('click', doRestoreCheck);
+    nav.querySelector('#fw-nav-startover')?.addEventListener('click', startOver);
+    updateNavState();
+}
+
+function updateNavState() {
+    const next = document.getElementById('fw-nav-next');
+    if (next) next.disabled = navNextDisabled(uploading, stagedReady());
+    const flash = document.getElementById('fw-btn-flash');
+    if (flash) flash.disabled = !preflightOk;
+}
+
+function gotoStep(step) {
+    userStep = step;
+    // run pre-flight on entry if not yet passed; mark autoPreflightDone so poll()'s
+    // own auto-preflight can't double-fire it
+    if (step === 'preflight' && !preflightOk) { autoPreflightDone = true; doPreflight(); }
+    poll();
+}
+
+function startOver() {
+    sawReboot = false; backOnline = false; configChecked = false; flashMode = '';
+    preflightOk = false; uploading = false; prevState = null; userStep = 'upload'; autoPreflightDone = false;
+    failureAck = false; lastConfigResult = null; flashStartedAt = 0; rebootStart = 0;
+    builtCompSig = ''; rebootOverdueAnnounced = false; commitAnnounced = false;
+    lastStepperSig = ''; lastNavKey = null;
+    renderPreflight(null);
+    const comps = document.getElementById('fw-comps-upload'); if (comps) comps.innerHTML = '';
+    const drop = document.getElementById('fw-drop');
+    if (drop) drop.querySelector('.fw-drop__main').textContent = 'Drop firmware ZIP here or click to choose';
+    poll();
+}
+
+// ─── actions ──────────────────────────────────────────────────
+async function doUpload(file) {
+    if (!file) return;
+    // v1.11.9 (review LOW concurrency): doUpload is async and yields at `await
+    // uploadFirmware(...)`; uploadLocked only guards an in-progress FLASH, not an
+    // in-flight UPLOAD. Without this a second gesture re-enters and starts a 2nd upload.
+    if (uploading) return;
+    if (uploadLocked) { showToast('A flash is in progress — please wait.', 'warning'); return; }
+    if (!/\.zip$/i.test(file.name)) { showToast('Please choose a .zip archive.', 'warning'); return; }
+    autoPreflightDone = true;  // doUpload runs its own pre-flight; don't double-fire from poll
+    // a new upload invalidates any prior pre-flight: gate Flash until re-checked
+    preflightOk = false;
+    // gate NEXT for the whole upload: set BEFORE any await and reflect immediately, so a
+    // poll tick mid-upload (which calls updateNavState) can't re-enable NEXT from a stale
+    // `staged` state left by a prior upload. Re-derived in the finally block once settled.
+    uploading = true;
+    updateNavState();
+    const flashBtnReset = document.getElementById('fw-btn-flash');
+    if (flashBtnReset) flashBtnReset.disabled = true;
+    const wrap = document.getElementById('fw-upbar-wrap');
+    const bar = document.getElementById('fw-upbar');
+    const drop = document.getElementById('fw-drop');
+    if (wrap) wrap.classList.remove('hidden');
+    if (drop) drop.querySelector('.fw-drop__main').innerHTML =
+        `Uploading <span class="fw-drop__name">${escapeHtml(file.name)}</span>…`;
+    log(`upload start: ${file.name} (${fmtBytes(file.size)})`);
+    try {
+        const r = await uploadFirmware(file, (loaded, total) => {
+            if (bar) bar.style.width = (loaded * 100 / total) + '%';
+        });
+        log(`identified: ${r.components.map(c => c.signature).join(', ')}`);
+        showToast(`Identified ${r.components.length} components.`, 'success');
+        buildComponentsInUpload(r.components);
+        if (drop) drop.querySelector('.fw-drop__main').textContent = 'Replace firmware ZIP (click or drop)';
+        // auto pre-flight
+        await doPreflight();
+    } catch (err) {
+        log('upload failed: ' + err.message);
+        showToast('Upload failed — ' + err.message, 'error');
+        if (drop) drop.querySelector('.fw-drop__main').textContent = 'Drop firmware ZIP here or click to choose';
+    } finally {
+        uploading = false;
+        updateNavState();   // re-derive NEXT: enabled iff the upload reached `staged`
+        if (wrap) wrap.classList.add('hidden');
+        if (bar) bar.style.width = '0%';
+    }
+}
+
+function buildComponentsInUpload(comps) {
+    const host = document.getElementById('fw-comps-upload');
+    if (!host) return;
+    const bd = buildDateOf(comps);
+    host.innerHTML =
+        `<div class="card__title" style="margin:var(--space-md) 0 var(--space-sm);font-size:var(--font-size-sm);">Identified components</div>` +
+        comps.map(c => `
+        <div class="fw-comp fw-comp--inline">
+            <span class="fw-comp__state-icon">✓</span>
+            <span class="fw-comp__sig">${escapeHtml(c.signature)}</span>
+            <span class="fw-comp__fname" title="${escapeHtml(c.name)}">${escapeHtml(c.name)}</span>
+            <span class="fw-comp__role2">${escapeHtml(c.role)}</span>
+            <span class="fw-comp__hash">${escapeHtml((c.sha256 || '').slice(0, 16))}…</span>
+            <span class="fw-comp__size">${fmtBytes(c.size)}</span>
+        </div>`).join('') +
+        (bd ? `<div class="fw-builddate">${icon('book-open', {size:14})} Firmware build date: <strong>${escapeHtml(bd)}</strong></div>` : '');
+}
+
+async function doPreflight() {
+    const btn = document.getElementById('fw-btn-preflight');
+    if (btn) { btn.disabled = true; btn.textContent = 'Checking…'; }
+    try {
+        const pf = await preflight();
+        renderPreflight(pf);
+        preflightOk = pf.ok;
+        const flashBtn = document.getElementById('fw-btn-flash');
+        if (flashBtn) flashBtn.disabled = !pf.ok;
+        log('pre-flight: ' + (pf.ok ? 'all critical checks pass' : 'blocked'));
+        if (!pf.ok) showToast('Pre-flight blocked — resolve the red checks.', 'warning');
+        else showToast('Pre-flight passed — ready to flash.', 'success');
+    } catch (err) {
+        preflightOk = false;   // failed check must NOT leave Flash enabled
+        const flashBtn = document.getElementById('fw-btn-flash');
+        if (flashBtn) flashBtn.disabled = true;
+        showToast('Pre-flight failed — ' + err.message, 'error');
+        log('pre-flight error: ' + err.message);
+    } finally {
+        if (btn) { btn.disabled = false; btn.textContent = '↻ Re-run'; }   // wizard panel label
+    }
+}
+
+async function doFlash() {
+    if (!preflightOk) { showToast('Run pre-flight first.', 'warning'); return; }
+    const ok = await showConfirm(last);
+    if (!ok) return;
+    // fresh flash → clear any latched post-reboot/done state from a prior run
+    sawReboot = false; backOnline = false; configChecked = false; flashMode = '';
+    rebootOverdueAnnounced = false; preflightOk = false; prevState = null; failureAck = false;
+    commitAnnounced = false;
+    lastConfigResult = null; flashStartedAt = performance.now();
+    const btn = document.getElementById('fw-btn-flash');
+    if (btn) btn.disabled = true;
+    log('flash requested');
+    try {
+        await startFlash();
+        showFlashCard();
+        window.scrollTo({ top: 0, behavior: 'smooth' });
+        log('flash started — backing up config, then transferring');
+        poll();   // advance the wizard to the Flash step immediately
+    } catch (err) {
+        if (btn) btn.disabled = false;
+        showToast('Could not start flash — ' + err.message, 'error');
+        log('flash start failed: ' + err.message);
+    }
+}
+
+// design-system confirm modal showing exactly what will be flashed + target slot
+function showConfirm(s) {
+    return new Promise((resolve) => {
+        const comps = (s && s.components) || [];
+        const slot = (s && s.slot) || {};
+        const target = slotTarget(slot);
+        const bd = buildDateOf(comps);
+        const rows = comps.map(c =>
+            `<div class="fw-modal__row"><span>${escapeHtml(c.signature)} · ${escapeHtml(c.name)}</span><span>${fmtBytes(c.size)}</span></div>`).join('');
+        const overlay = document.createElement('div');
+        overlay.className = 'fw-modal-overlay';
+        overlay.innerHTML = `
+            <div class="fw-modal" role="dialog" aria-modal="true" aria-labelledby="fw-modal-title">
+                <div class="fw-modal__title" id="fw-modal-title">${icon('activity', {size:16})} Flash firmware?</div>
+                <div class="fw-modal__body">The device will write these ${comps.length} component(s)${bd ? ' (built ' + escapeHtml(bd) + ')' : ''}, commit, and reboot. Config is backed up automatically first.</div>
+                <div class="fw-modal__list">${rows}</div>
+                <div class="fw-modal__slot">${slotBadge({ before: slot.before, after: target })}</div>
+                <div class="fw-modal__actions">
+                    <button class="btn btn--outline btn--sm" id="fw-modal-cancel">Cancel</button>
+                    <button class="btn btn--primary btn--sm" id="fw-modal-ok">${icon('activity', {size:16})} Flash now</button>
+                </div>
+            </div>`;
+        document.body.appendChild(overlay);
+        const trigger = document.activeElement;             // return focus here on close
+        const focusable = overlay.querySelectorAll('button');
+        const first = focusable[0], lastF = focusable[focusable.length - 1];
+        const close = (val) => {
+            _modalCleanup = null;
+            overlay.remove();
+            document.removeEventListener('keydown', onKey, true);
+            if (trigger && trigger.focus) trigger.focus();
+            resolve(val);
+        };
+        const onKey = (e) => {
+            if (e.key === 'Escape') { e.preventDefault(); close(false); return; }
+            if (e.key === 'Tab' && focusable.length) {      // trap focus inside the dialog
+                if (e.shiftKey && document.activeElement === first) { e.preventDefault(); lastF.focus(); }
+                else if (!e.shiftKey && document.activeElement === lastF) { e.preventDefault(); first.focus(); }
+            }
+        };
+        // v1.11.10 (review #17): allow destroy() to tear this modal down without leaking the
+        // document keydown listener or leaving the Promise dangling (resolves false = cancelled).
+        _modalCleanup = () => {
+            document.removeEventListener('keydown', onKey, true);
+            overlay.remove();
+            resolve(false);
+        };
+        overlay.querySelector('#fw-modal-cancel').addEventListener('click', () => close(false));
+        overlay.querySelector('#fw-modal-ok').addEventListener('click', () => close(true));
+        overlay.addEventListener('click', (e) => { if (e.target === overlay) close(false); });
+        document.addEventListener('keydown', onKey, true);
+        overlay.querySelector('#fw-modal-ok').focus();
+    });
+}
+
+async function doRestoreCheck() {
+    const btn = document.getElementById('fw-btn-restore');
+    if (btn) { btn.disabled = true; btn.textContent = 'Checking…'; }
+    try {
+        const { result } = await restoreCheck();
+        lastConfigResult = result;
+        const host = document.getElementById('fw-config-result');
+        const restored = result.restored;
+        const cls = restored ? 'fw-result--warn' : 'fw-result--ok';
+        const resultIcon = restored ? icon('refresh-cw', {size:24}) : icon('check-circle-2', {size:24});
+        const head = restored ? 'Config was reseeded — restored from backup' : 'Config preserved';
+        const extra = result.dpworldapp_restarted ? ' · dpworldapp restarted' : '';
+        if (host) host.innerHTML = `<div class="fw-result ${cls}">
+            <span class="fw-result__icon">${resultIcon}</span>
+            <span>${escapeHtml(head)} — ${escapeHtml(result.reason || '')}${escapeHtml(extra)}</span></div>`;
+        showToast(head, restored ? 'warning' : 'success');
+        announce(head + '. ' + (result.reason || ''));
+        log('config check: ' + head + ' — ' + (result.reason || ''));
+        configChecked = true;   // → view becomes 'done', stepper completes
+    } catch (err) {
+        showToast('Config check failed — ' + err.message, 'error');
+        log('config check error: ' + err.message);
+    } finally {
+        if (btn) { btn.disabled = false; btn.innerHTML = icon('check-circle-2', {size:16}) + ' Verify config'; }   // wizard nav label
+    }
+}
+
+// ─── page object ──────────────────────────────────────────────
+const firmwarePage = {
+    render(container) {
+        container.innerHTML = `
+            <div class="fw-page">
+            <div id="fw-announce" class="fw-sr-only" role="alert" aria-live="assertive"></div>
+            <div class="page-header">
+                <h1 class="page-header__title">⬆ Firmware Update</h1>
+                <p class="page-header__desc" id="fw-updated">Loading…</p>
+            </div>
+
+            <div class="card fw-sticky-card" id="fw-sticky">
+                <div class="fw-stepper" id="fw-stepper"></div>
+                <div class="fw-live" role="status" aria-live="polite">
+                    <div class="fw-live__row">
+                        <span class="fw-live__state" id="fw-live-state">Ready</span>
+                        <span class="fw-live__pct" id="fw-live-pct"></span>
+                    </div>
+                    <div class="fw-bar"><div class="fw-bar__fill" id="fw-live-fill" style="width:0%"></div></div>
+                    <div class="flex-between mt-sm">
+                        <span class="text-muted" style="font-size:var(--font-size-xs)">Active / target slot</span>
+                        <span id="fw-slot-badge"></span>
+                    </div>
+                </div>
+            </div>
+
+            <div class="info-banner info-banner--warning" id="fw-warning">${icon('alert-triangle', {size:16})} This flashes real device firmware and reboots the device. Config is backed up automatically before writing.</div>
+
+            <div class="fw-wizard-body" id="fw-wizard-body">
+                <section class="card fw-step-panel" data-panel="upload" id="fw-panel-upload">
+                    <div class="card__header"><span class="card__title"><span class="card__title-icon">${icon('package', {size:16})}</span> Upload firmware ZIP</span></div>
+                    <div class="fw-drop" id="fw-drop" tabindex="0" role="button" aria-label="Upload firmware ZIP — click or press Enter to choose a file">
+                        <span class="fw-drop__icon">${icon('package', {size:48})}</span>
+                        <div class="fw-drop__main">Drop firmware ZIP here or click to choose</div>
+                        <div class="fw-drop__sub">archive should contain main_bootloader.rom · main_boot.img · main_rootfs.ext4 · main.dtb</div>
+                    </div>
+                    <input type="file" id="fw-file" accept=".zip" style="display:none">
+                    <div class="fw-bar mt-md hidden" id="fw-upbar-wrap"><div class="fw-bar__fill" id="fw-upbar"></div></div>
+                    <div id="fw-comps-upload"></div>
+                </section>
+
+                <section class="card fw-step-panel hidden" data-panel="preflight" id="fw-panel-preflight">
+                    <div class="card__header"><span class="card__title"><span class="card__title-icon">${icon('radar', {size:16})}</span> Pre-flight checks</span>
+                        <button class="btn btn--outline btn--sm" id="fw-btn-preflight">↻ Re-run</button></div>
+                    <div id="fw-checks"></div>
+                </section>
+
+                <section class="card fw-step-panel hidden" data-panel="flash" id="fw-panel-flash">
+                    <div class="card__header"><span class="card__title"><span class="card__title-icon">${icon('activity', {size:16})}</span> <span id="fw-flash-title">Flashing</span></span></div>
+                    <div id="fw-flash-card"><div id="fw-flash-body"></div></div>
+                </section>
+
+                <section class="card fw-step-panel hidden" data-panel="verify" id="fw-panel-verify">
+                    <div class="card__header"><span class="card__title"><span class="card__title-icon">${icon('check-circle-2', {size:16})}</span> Config check</span></div>
+                    <div id="fw-config-result"><p class="text-muted" style="font-size:var(--font-size-xs)">After the device is back online, verify the configuration survived the update.</p></div>
+                </section>
+            </div>
+
+            <div class="fw-wizard-nav" id="fw-wizard-nav"></div>
+
+            <div class="card card--collapsible">
+                <div class="card__header card__header--clickable" id="fw-log-toggle">
+                    <span class="card__title"><span class="card__title-icon">${icon('file-text', {size:16})}</span> Log</span>
+                    <span class="card__collapse-icon" id="fw-log-caret">▸</span>
+                </div>
+                <pre class="fw-log" id="fw-log" style="display:none"></pre>
+            </div>
+            </div>
+        `;
+    },
+
+    mount(container) {
+        // track every listener so destroy() can remove them (no leak on re-mount)
+        const bind = (el, ev, fn, opts) => {
+            if (!el) return;
+            el.addEventListener(ev, fn, opts);
+            boundListeners.push({ el, ev, fn, opts });
+        };
+        const fileInput = container.querySelector('#fw-file');
+        const drop = container.querySelector('#fw-drop');
+        bind(drop, 'click', () => { if (!uploadLocked) fileInput?.click(); });
+        bind(drop, 'keydown', (e) => {
+            if ((e.key === 'Enter' || e.key === ' ') && !uploadLocked) { e.preventDefault(); fileInput?.click(); }
+        });
+        bind(fileInput, 'change', (e) => { const f = e.target.files[0]; e.target.value = ''; doUpload(f); });
+        ['dragenter', 'dragover'].forEach(ev => bind(drop, ev, (e) => {
+            e.preventDefault(); drop.classList.add('fw-drop--over');
+        }));
+        ['dragleave', 'drop'].forEach(ev => bind(drop, ev, (e) => {
+            e.preventDefault(); drop.classList.remove('fw-drop--over');
+        }));
+        bind(drop, 'drop', (e) => { const f = e.dataTransfer?.files?.[0]; if (f) doUpload(f); });
+
+        // Re-run pre-flight button (lives in the pre-flight panel)
+        bind(container.querySelector('#fw-btn-preflight'), 'click', doPreflight);
+        // Flash / Verify / Next / Back / Start-over buttons are in the footer nav,
+        // (re)bound by renderNav() per step.
+
+        // log collapse
+        const logCard = container.querySelector('#fw-log');
+        bind(container.querySelector('#fw-log-toggle'), 'click', () => {
+            const hidden = logCard.style.display === 'none';
+            logCard.style.display = hidden ? '' : 'none';
+            const caret = container.querySelector('#fw-log-caret');
+            if (caret) caret.textContent = hidden ? '▾' : '▸';
+        });
+
+        renderPreflight(null);
+        // pause polling while the tab is hidden; resume on return (single timer)
+        if (visHandler) document.removeEventListener('visibilitychange', visHandler);
+        visHandler = () => { if (document.hidden) stopPolling(); else startPolling(); };
+        document.addEventListener('visibilitychange', visHandler);
+        startPolling();
+    },
+
+    destroy() {
+        stopPolling();
+        if (visHandler) { document.removeEventListener('visibilitychange', visHandler); visHandler = null; }
+        boundListeners.forEach(({ el, ev, fn, opts }) => el.removeEventListener(ev, fn, opts));
+        boundListeners = [];
+        if (announceTimer) { clearTimeout(announceTimer); announceTimer = null; }
+        last = null; prevState = null; preflightOk = false;
+        sawReboot = false; backOnline = false; configChecked = false;
+        flashMode = ''; uploadLocked = false; uploading = false; rebootStart = 0; autoPreflightDone = false;
+        rebootOverdueAnnounced = false; flashStartedAt = 0; lastConfigResult = null;
+        builtCompSig = ''; logLines = [];
+        userStep = 'upload'; failureAck = false; commitAnnounced = false;
+        lastNavKey = null; lastStepperSig = '';
+        // v1.11.10 (review #17): if a confirm modal is open, tear it down cleanly first —
+        // removes its keydown listener and resolves the dangling Promise (false = cancelled).
+        _modalCleanup?.(); _modalCleanup = null;
+        document.querySelector('.fw-modal-overlay')?.remove();
+    },
+};
+
+export function renderFirmwarePage(container) {
+    firmwarePage.render(container);
+    firmwarePage.mount(container);
+}
+
+export default firmwarePage;
diff --git a/src/static/js/pages/general-settings.js b/src/static/js/pages/general-settings.js
new file mode 100644
index 0000000..3984b35
--- /dev/null
+++ b/src/static/js/pages/general-settings.js
@@ -0,0 +1,355 @@
+/**
+ * general-settings.js — General Settings Page
+ *
+ * v1.5.0 Phase 3 T1: register.js 분할 — Equipment Info + Protocol Selection + Odometer.
+ * Analog/Digital ports 제거 → sensor-io.js로 이동.
+ * Byte Order 제거 → modbus.js로 이동.
+ *
+ * Data source: state.protocol
+ */
+
+import { state, bindInput, bindRadio, bindCheckbox } from '../state.js';
+import { updateTabVisibility } from '../app.js';
+import { escapeHtml } from '../utils.js';
+import { icon } from '../icons.js';
+
+const EQUIPMENT_MEID = {
+    ITV: '1000', STS: '2000', RTG: '3000', RMG: '4000',
+    RS: '5000', ECH: '6000', MHC: '9000',
+    // v1.4.6.2 F4: FL/CR 제거 (v1.4.6.1 B-2 equipment dropdown 정합)
+};
+
+function renderToggle(label, name, currentValue) {
+    return `
+        <div class="form-group">
+            <label class="form-label">${label}</label>
+            <div class="radio-group">
+                <label class="radio-label">
+                    <input type="radio" name="${name}" value="on" ${currentValue === 'on' ? 'checked' : ''}>
+                    On
+                </label>
+                <label class="radio-label">
+                    <input type="radio" name="${name}" value="off" ${currentValue !== 'on' ? 'checked' : ''}>
+                    Off
+                </label>
+            </div>
+        </div>
+    `;
+}
+
+function renderGeneralSettingsPage(container) {
+    const p = state.protocol || {};
+
+    container.innerHTML = `
+        <div class="page-header">
+            <h1 class="page-header__title">${icon('sliders-horizontal', { size: 28 })} General Settings</h1>
+            <p class="page-header__desc">Equipment information, protocol selection, and odometer configuration.</p>
+        </div>
+
+        <!-- Card: Equipment Info -->
+        <div class="card">
+            <div class="card__header">
+                <h2 class="card__title">${icon('building-2', { size: 18 })} Equipment Info</h2>
+            </div>
+            <div class="form-row">
+                <div class="form-group">
+                    <label class="form-label">Equipment Type</label>
+                    <select class="form-select" id="reg-equipment_type">
+                        ${['RTLS', 'TIOT'].map(v =>
+                            `<option value="${v}" ${p.dev_type === v ? 'selected' : ''}>${v}</option>`
+                        ).join('')}
+                    </select>
+                </div>
+                <div class="form-group">
+                    <label class="form-label">Equipment</label>
+                    <select class="form-select" id="reg-equipment">
+                        ${['ITV', 'RS', 'ECH', 'RTG', 'RMG', 'MHC', 'STS'].map(v =>
+                            `<option value="${v}" ${p.equipment === v ? 'selected' : ''}>${v}</option>`
+                        ).join('')}
+                    </select>
+                </div>
+            </div>
+            <div class="form-row">
+                <div class="form-group">
+                    <label class="form-label">Equipment ID</label>
+                    <input class="form-input form-input--mono" id="reg-equipment_id" value="${escapeHtml(p.equipment_id || '01')}" placeholder="01">
+                </div>
+                <div class="form-group">
+                    <label class="form-label">MEID</label>
+                    <input class="form-input form-input--mono" id="reg-MEID" value="${escapeHtml(p.MEID || EQUIPMENT_MEID[p.equipment] || '1000')}" placeholder="1000">
+                </div>
+            </div>
+            <div class="form-row">
+                <div class="form-group">
+                    <label class="form-label">Version</label>
+                    <input class="form-input" id="reg-version" value="${escapeHtml(p.version || 'v1.0')}" placeholder="v1.0">
+                </div>
+                <div class="form-group"></div>
+            </div>
+        </div>
+
+        <!-- Card: Protocol Selection -->
+        <div class="card">
+            <div class="card__header">
+                <h2 class="card__title">${icon('radio', { size: 18 })} Protocol Selection</h2>
+            </div>
+            <div class="form-group">
+                <label class="form-label">Protocol</label>
+                <div class="radio-group">
+                    ${['OPC_UA', 'MODBUS', 'NONE'].map(v => `
+                        <label class="radio-label">
+                            <input type="radio" name="reg-protocol" value="${v}" ${p.protocol === v ? 'checked' : ''}>
+                            ${v}
+                        </label>
+                    `).join('')}
+                </div>
+            </div>
+
+            <div class="form-row">
+                ${renderToggle('CAN Input', 'reg-can_input', p.can_input)}
+                ${renderToggle('DR', 'reg-dr', p.dr_on)}
+            </div>
+            <div class="form-row">
+                ${renderToggle('Heading', 'reg-heading', p.heading_on)}
+                ${renderToggle('Heading IMU', 'reg-heading_imu', p.heading_imu_on)}
+            </div>
+            <div class="form-row">
+                ${renderToggle('Fix Mode', 'reg-fix_mode', p.fix_mode_on)}
+                <div class="form-group">
+                    <label class="form-label">Speed Data</label>
+                    <select class="form-select" id="reg-speed_data">
+                        ${['', 'CAN', 'GPS'].map(v =>
+                            `<option value="${v}" ${p.speed_data === v ? 'selected' : ''}>${v || '— Select —'}</option>`
+                        ).join('')}
+                    </select>
+                </div>
+            </div>
+        </div>
+
+        <!-- Card: Odometer (v1.4.6 C) — odo_on + speed/direction source fields -->
+        <div class="card">
+            <div class="card__header">
+                <h2 class="card__title">${icon('gauge', { size: 18 })} Odometer</h2>
+            </div>
+            <div class="form-row">
+                ${renderToggle('Odometer', 'reg-odo_on', p.odo_on)}
+            </div>
+
+            <div id="odo-section" style="${p.odo_on === 'on' ? '' : 'display:none;'}">
+                <h3 class="form-section-title" style="margin-top:1rem;">Odometer Speed</h3>
+                <div class="form-row">
+                    <div class="form-group">
+                        <label class="form-label">Source</label>
+                        <select class="form-select" id="reg-odo_speed_source">
+                            ${['can', 'hw'].map(v => `<option value="${v}" ${p.odo_speed?.source === v ? 'selected' : ''}>${v.toUpperCase()}</option>`).join('')}
+                        </select>
+                    </div>
+                    <div class="form-group">
+                        <label class="form-label">CAN ID (hex)</label>
+                        <input type="text" class="form-input" id="reg-odo_speed_id" value="${escapeHtml(p.odo_speed?.id || '')}" placeholder="0x56E">
+                    </div>
+                </div>
+                <div class="form-row">
+                    <div class="form-group">
+                        <label class="form-label">Shift</label>
+                        <input type="number" class="form-input" id="reg-odo_speed_shift" value="${Number(p.odo_speed?.shift) || 0}" min="0" max="63">
+                    </div>
+                    <div class="form-group">
+                        <label class="form-label">Mask (hex)</label>
+                        <input type="text" class="form-input" id="reg-odo_speed_mask" value="${escapeHtml(p.odo_speed?.mask || '')}" placeholder="0x0f">
+                    </div>
+                </div>
+                <div class="form-row">
+                    <div class="form-group" style="flex:1;">
+                        <label class="form-label">Expression</label>
+                        <input type="text" class="form-input" id="reg-odo_speed_expr" value="${escapeHtml(p.odo_speed?.expr || '')}" placeholder="x*1000" maxlength="256">
+                    </div>
+                </div>
+
+                <h3 class="form-section-title" style="margin-top:1rem;">Odometer Direction</h3>
+                <div class="form-row">
+                    <div class="form-group">
+                        <label class="form-label">Source</label>
+                        <select class="form-select" id="reg-odo_direction_source">
+                            ${['can', 'hw'].map(v => `<option value="${v}" ${p.odo_direction?.source === v ? 'selected' : ''}>${v.toUpperCase()}</option>`).join('')}
+                        </select>
+                    </div>
+                    <div class="form-group">
+                        <label class="form-label">CAN ID (hex)</label>
+                        <input type="text" class="form-input" id="reg-odo_direction_id" value="${escapeHtml(p.odo_direction?.id || '')}" placeholder="0x169">
+                    </div>
+                </div>
+                <div class="form-row">
+                    <div class="form-group">
+                        <label class="form-label">Shift</label>
+                        <input type="number" class="form-input" id="reg-odo_direction_shift" value="${Number(p.odo_direction?.shift) || 0}" min="0" max="63">
+                    </div>
+                    <div class="form-group">
+                        <label class="form-label">Mask (hex)</label>
+                        <input type="text" class="form-input" id="reg-odo_direction_mask" value="${escapeHtml(p.odo_direction?.mask || '')}" placeholder="0x0f">
+                    </div>
+                </div>
+                <div class="form-row">
+                    <div class="form-group" style="flex:1;">
+                        <label class="form-label">Expression</label>
+                        <input type="text" class="form-input" id="reg-odo_direction_expr" value="${escapeHtml(p.odo_direction?.expr || '')}" placeholder="x-7" maxlength="256">
+                    </div>
+                </div>
+            </div>
+        </div>
+    `;
+
+    // Equipment change → auto-fill MEID
+    document.getElementById('reg-equipment').addEventListener('change', (e) => {
+        const meid = EQUIPMENT_MEID[e.target.value];
+        if (meid) {
+            document.getElementById('reg-MEID').value = meid;
+        }
+    });
+
+    // Protocol change → update sidebar tab visibility
+    document.querySelectorAll('input[name="reg-protocol"]').forEach(radio => {
+        radio.addEventListener('change', (e) => {
+            state.protocol.protocol = e.target.value;
+            updateTabVisibility();
+        });
+    });
+
+    // CAN input change → update sidebar tab visibility
+    document.querySelectorAll('input[name="reg-can_input"]').forEach(radio => {
+        radio.addEventListener('change', (e) => {
+            state.protocol.can_input = e.target.value;
+            updateTabVisibility();
+        });
+    });
+
+    // Initialize tab visibility
+    updateTabVisibility();
+
+    // Register data collector
+    window.__pageCollectors.general = collectGeneralSettingsData;
+    // Legacy alias for backward compat
+    window.__pageCollectors.register = collectGeneralSettingsData;
+}
+
+function collectGeneralSettingsData() {
+    if (!state.protocol) state.protocol = {};
+    const p = state.protocol;
+
+    // Equipment info
+    p.dev_type = document.getElementById('reg-equipment_type')?.value || '';
+    p.equipment = document.getElementById('reg-equipment')?.value || '';
+    p.equipment_id = document.getElementById('reg-equipment_id')?.value || '';
+    p.MEID = document.getElementById('reg-MEID')?.value || '';
+    p.version = document.getElementById('reg-version')?.value || '';
+
+    // Protocol
+    p.protocol = document.querySelector('input[name="reg-protocol"]:checked')?.value || 'NONE';
+
+    // Toggles
+    p.can_input = document.querySelector('input[name="reg-can_input"]:checked')?.value || 'off';
+    p.dr_on = document.querySelector('input[name="reg-dr"]:checked')?.value || 'off';
+    p.heading_on = document.querySelector('input[name="reg-heading"]:checked')?.value || 'off';
+    p.heading_imu_on = document.querySelector('input[name="reg-heading_imu"]:checked')?.value || 'off';
+    p.fix_mode_on = document.querySelector('input[name="reg-fix_mode"]:checked')?.value || 'off';
+    p.speed_data = document.getElementById('reg-speed_data')?.value || '';
+
+    // v1.4.6 C: Odometer (odo_on toggle + odo_speed/odo_direction nested)
+    p.odo_on = document.querySelector('input[name="reg-odo_on"]:checked')?.value || 'off';
+    if (p.odo_on === 'on') {
+        p.odo_speed = {
+            source: document.getElementById('reg-odo_speed_source')?.value || 'can',
+            id: document.getElementById('reg-odo_speed_id')?.value || '',
+            shift: parseInt(document.getElementById('reg-odo_speed_shift')?.value, 10) || 0,
+            mask: document.getElementById('reg-odo_speed_mask')?.value || '',
+            expr: document.getElementById('reg-odo_speed_expr')?.value || '',
+        };
+        p.odo_direction = {
+            source: document.getElementById('reg-odo_direction_source')?.value || 'can',
+            id: document.getElementById('reg-odo_direction_id')?.value || '',
+            shift: parseInt(document.getElementById('reg-odo_direction_shift')?.value, 10) || 0,
+            mask: document.getElementById('reg-odo_direction_mask')?.value || '',
+            expr: document.getElementById('reg-odo_direction_expr')?.value || '',
+        };
+    } else {
+        // v1.4.6.1 B-4: odo_on=off 시 stale nested 차단
+        delete p.odo_speed;
+        delete p.odo_direction;
+    }
+}
+
+// ─── Select/Input field bindings ────────────────────────────
+const GS_INPUTS = [
+    { id: 'reg-equipment_type', key: 'dev_type' },
+    { id: 'reg-equipment', key: 'equipment' },
+    { id: 'reg-equipment_id', key: 'equipment_id' },
+    { id: 'reg-MEID', key: 'MEID' },
+    { id: 'reg-version', key: 'version' },
+    { id: 'reg-speed_data', key: 'speed_data' },
+];
+const GS_RADIOS = [
+    { name: 'reg-protocol', key: 'protocol' },
+    { name: 'reg-can_input', key: 'can_input' },
+    { name: 'reg-dr', key: 'dr_on' },
+    { name: 'reg-heading', key: 'heading_on' },
+    { name: 'reg-heading_imu', key: 'heading_imu_on' },
+    { name: 'reg-fix_mode', key: 'fix_mode_on' },
+];
+
+// ─── Page Interface ─────────────────────────────────────────
+const generalSettingsPage = {
+    render(container) {
+        renderGeneralSettingsPage(container);
+    },
+
+    mount(container) {
+        const p = state.protocol || {};
+
+        // Select/input fields → state
+        GS_INPUTS.forEach(({ id, key }) => {
+            bindInput(container, `#${id}`,
+                () => p[key] || '',
+                (val) => {
+                    if (!state.protocol) state.protocol = {};
+                    state.protocol[key] = val;
+                    state.isDirty = true;
+                }
+            );
+        });
+
+        // Radio groups → state
+        GS_RADIOS.forEach(({ name, key }) => {
+            bindRadio(container, name,
+                () => p[key] || (key === 'protocol' ? 'NONE' : 'off'),
+                (val) => {
+                    if (!state.protocol) state.protocol = {};
+                    state.protocol[key] = val;
+                    state.isDirty = true;
+                }
+            );
+        });
+
+        // v1.4.6 C: odo_on toggle → show/hide #odo-section
+        document.querySelectorAll('input[name="reg-odo_on"]').forEach(radio => {
+            radio.addEventListener('change', e => {
+                const section = document.getElementById('odo-section');
+                if (section) section.style.display = e.target.value === 'on' ? '' : 'none';
+                if (!state.protocol) state.protocol = {};
+                state.protocol.odo_on = e.target.value;
+                state.isDirty = true;
+            });
+        });
+
+        // Collectors
+        window.__pageCollectors.general = collectGeneralSettingsData;
+        window.__pageCollectors.register = collectGeneralSettingsData;  // legacy alias
+    },
+
+    destroy() {},
+
+    validate() {
+        return [];
+    },
+};
+
+export default generalSettingsPage;
diff --git a/src/static/js/pages/home.js b/src/static/js/pages/home.js
new file mode 100644
index 0000000..560f63e
--- /dev/null
+++ b/src/static/js/pages/home.js
@@ -0,0 +1,1901 @@
+/**
+ * home.js — Landing Dashboard
+ *
+ * Read-only device health page: Core App, Communication, Network, System
+ * cards plus an action panel. Polls /api/system-status every 10 s.
+ */
+
+import { getSystemStatus, restartDpworldapp } from '../api.js';
+import { showToast } from '../toast.js';
+import { escapeHtml } from '../utils.js';
+import { DASHBOARD_REFRESH_MS, CAN_BAUDRATE_LABELS, DASHBOARD_ISSUE_PAGES } from '../constants.js';
+import { icon } from '../icons.js';
+// v1.8.0 Task 6: User 모드는 watchdog/drift/critical 상세를 숨기고 "네트워크: 정상/주의" 1줄 요약만.
+// view-mode 는 leaf 모듈 — 순환 import 없음.
+import { isAdvanced } from '../view-mode.js';
+import { confirmModal } from '../confirm-modal.js';
+
+let pollTimer = null;
+let lastStatus = null;
+// v1.7.1 Task 2: injectable navigation for issue deep-links. Default clicks the
+// matching sidebar nav-item so the production nav-guard path is honored; app.js
+// overrides it with showPage. Settable to null in tests to restore the default.
+let _navigate = null;
+// v1.7.1 Task 1: freshness truth + zombie guard.
+//   _stale      — last poll failed; the rendered cards are no longer trustworthy.
+//   _lastError  — message from the failed poll (for the stamp).
+let _stale = false;
+let _lastError = '';
+let _lastReceivedAt = null;
+let _gridEl = null;  // v1.7.1 Task 2: stable grid element for delegated deep-link clicks
+// v1.11.9 (review LOW concurrency): in-flight guard for the dpworldapp restart. poll()
+// re-renders the grid (innerHTML) producing a fresh ENABLED restart button while a
+// restart is still running — without this flag a second gesture re-enters handleRestart.
+let _restartInFlight = false;
+
+const FRESHNESS_CLOCK_SKEW_MS = 10 * 60 * 1000;
+
+// ─── Formatting helpers ───────────────────────────────────────
+
+function fmtBytes(n) {
+    if (!n) return '0 B';
+    const u = ['B', 'KB', 'MB', 'GB', 'TB'];
+    let i = 0, v = n;
+    while (v >= 1024 && i < u.length - 1) { v /= 1024; i++; }
+    return `${v.toFixed(i === 0 ? 0 : 1)} ${u[i]}`;
+}
+
+function fmtUptime(sec) {
+    if (sec == null) return '—';
+    const d = Math.floor(sec / 86400);
+    const h = Math.floor((sec % 86400) / 3600);
+    const m = Math.floor((sec % 3600) / 60);
+    return d > 0 ? `${d}d ${h}h ${m}m` : `${h}h ${m}m`;
+}
+
+function fmtAge(sec) {
+    if (sec == null) return 'no log';
+    if (sec < 60) return `${Math.round(sec)}s ago`;
+    if (sec < 3600) return `${Math.round(sec / 60)}m ago`;
+    return `${Math.round(sec / 3600)}h ago`;
+}
+
+function glyph(tier) {
+    return `<span class="dash-glyph dash-glyph--${tier || 'na'}"></span>`;
+}
+
+/**
+ * v1.7.1 Task 1: relative-time freshness from the backend `generated_at`.
+ * Accepts an ISO-8601 string or epoch (s or ms). Returns "Updated Ns ago" /
+ * "Updated Nm ago" etc. — never a hardcoded "just now". Returns null when the
+ * timestamp is missing or unparseable (caller falls back to a neutral label).
+ */
+function fmtFreshness(generatedAt) {
+    if (generatedAt == null || generatedAt === '') return null;
+    let ms;
+    if (typeof generatedAt === 'number') {
+        ms = generatedAt < 1e12 ? generatedAt * 1000 : generatedAt; // epoch s vs ms
+    } else {
+        ms = Date.parse(String(generatedAt));
+    }
+    if (!Number.isFinite(ms)) return null;
+    let sec = Math.round((Date.now() - ms) / 1000);
+    if (sec < 0) sec = 0; // clock skew — clamp instead of "in the future"
+    if (sec < 5) return 'Updated just now';
+    if (sec < 60) return `Updated ${sec}s ago`;
+    if (sec < 3600) return `Updated ${Math.round(sec / 60)}m ago`;
+    return `Updated ${Math.round(sec / 3600)}h ago`;
+}
+
+function freshnessTimestampMs(value) {
+    if (value == null || value === '') return null;
+    let ms;
+    if (typeof value === 'number') {
+        ms = value < 1e12 ? value * 1000 : value;
+    } else {
+        ms = Date.parse(String(value));
+    }
+    return Number.isFinite(ms) ? ms : null;
+}
+
+function fmtReceivedFreshness(receivedAt) {
+    const ms = freshnessTimestampMs(receivedAt);
+    if (ms == null) return null;
+    let sec = Math.round((Date.now() - ms) / 1000);
+    if (sec < 0) sec = 0;
+    if (sec < 5) return 'Received just now';
+    if (sec < 60) return `Received ${sec}s ago`;
+    if (sec < 3600) return `Received ${Math.round(sec / 60)}m ago`;
+    return `Received ${Math.round(sec / 3600)}h ago`;
+}
+
+function dashboardFreshnessLabel(status) {
+    if (!status) return null;
+    const generatedMs = freshnessTimestampMs(status.generated_at);
+    const receivedMs = freshnessTimestampMs(_lastReceivedAt);
+    if (generatedMs != null && receivedMs != null) {
+        const skewMs = Math.abs(receivedMs - generatedMs);
+        if (skewMs > FRESHNESS_CLOCK_SKEW_MS) {
+            return `${fmtReceivedFreshness(receivedMs)} - device clock differs`;
+        }
+    }
+    return fmtFreshness(status.generated_at) || fmtReceivedFreshness(receivedMs);
+}
+
+function staleFreshnessSuffix(label) {
+    if (!label) return '';
+    if (label.startsWith('Updated ')) return ` (${label.replace(/^Updated /, 'last update ')})`;
+    if (label.startsWith('Received ')) return ` (${label.replace(/^Received /, 'last received ')})`;
+    return ` (${label})`;
+}
+
+function cleanTier(tier) {
+    return ['ok', 'warn', 'error', 'na'].includes(tier) ? tier : 'na';
+}
+
+function statusWord(tier) {
+    return {
+        ok: 'OK',
+        warn: 'Warning',
+        error: 'Fault',
+        na: 'Unknown',
+    }[cleanTier(tier)];
+}
+
+function tierWeight(tier) {
+    return {
+        error: 3,
+        warn: 2,
+        na: 1,
+        ok: 0,
+    }[cleanTier(tier)];
+}
+
+function dominantIssueTier(issues) {
+    return (issues || []).reduce((worst, issue) => (
+        tierWeight(issue.tier) > tierWeight(worst) ? cleanTier(issue.tier) : worst
+    ), 'ok');
+}
+
+function issueCounts(issues) {
+    return (issues || []).reduce((counts, issue) => {
+        const tier = cleanTier(issue.tier);
+        counts[tier] += 1;
+        return counts;
+    }, { error: 0, warn: 0, na: 0, ok: 0 });
+}
+
+function configFromStatus(status) {
+    return (status && status.dpworldapp_status && status.dpworldapp_status.config) || {};
+}
+
+function normalizeProtocol(protocol) {
+    const p = String(protocol || 'NONE').trim().toUpperCase().replace(/[-\s]+/g, '_');
+    if (p === 'CANBUS') return 'CAN_BUS';
+    if (p === 'CAN_BUS' || p === 'CAN') return 'CAN_BUS';
+    if (p === 'OPCUA' || p === 'OPC_UA') return 'OPC_UA';
+    if (p === 'MODBUS') return 'MODBUS';
+    return p || 'NONE';
+}
+
+function protocolLabel(protocol) {
+    return {
+        CAN_BUS: 'CAN-BUS',
+        OPC_UA: 'OPC-UA',
+        MODBUS: 'Modbus',
+        NONE: 'No active protocol',
+    }[normalizeProtocol(protocol)] || String(protocol || 'Unknown');
+}
+
+function hasConfiguredValue(value) {
+    if (value == null) return false;
+    const s = String(value).trim().toUpperCase();
+    return s !== '' && s !== 'NONE' && s !== 'OFF' && s !== 'N/A';
+}
+
+function equipmentLabel(status) {
+    const c = configFromStatus(status);
+    if (hasConfiguredValue(c.equipment) && hasConfiguredValue(c.equipment_id)) {
+        return `${c.equipment}-${c.equipment_id}`;
+    }
+    if (hasConfiguredValue(c.equipment)) return String(c.equipment);
+    return 'Unassigned equipment';
+}
+
+function positioningMode(status) {
+    const c = configFromStatus(status);
+    const speedSource = String(c.speed_data || '').toUpperCase();
+    const hasDeadReckoning =
+        speedSource.includes('ODO') ||
+        hasConfiguredValue(c.odo_speed) ||
+        hasConfiguredValue(c.odo_dir);
+    return hasDeadReckoning ? 'ZED-F9R RTK(DR)' : 'ZED-F9R RTK';
+}
+
+function isPortOnlyEndpoint(value) {
+    const s = String(value || '').trim();
+    return /^:?\d+$/.test(s);
+}
+
+function interfaceValueFromConfig(c, fallback) {
+    const configured = c.protocol_endpoint;
+    if (hasConfiguredValue(fallback) && (!hasConfiguredValue(configured) || isPortOnlyEndpoint(configured))) {
+        return String(fallback);
+    }
+    if (hasConfiguredValue(configured)) return String(configured);
+    return fallback || 'Configured';
+}
+
+function activeInterfaceStatus(status) {
+    const c = configFromStatus(status);
+    const comm = (status && status.communication) || {};
+    const protocol = normalizeProtocol(c.protocol || comm.protocol);
+
+    if (protocol === 'CAN_BUS') {
+        const can = comm.can || {};
+        const speed = c.can_speed != null
+            ? (CAN_BAUDRATE_LABELS[c.can_speed] || String(c.can_speed))
+            : '';
+        const configured = [c.can_type, speed].filter(hasConfiguredValue).join(' ');
+        return {
+            label: 'CAN-BUS',
+            tier: cleanTier(can.tier),
+            value: can.label || configured || 'Configured CAN input',
+        };
+    }
+    if (protocol === 'OPC_UA') {
+        const opc = comm.opc_ua || {};
+        return {
+            label: 'OPC-UA',
+            tier: cleanTier(opc.tier),
+            value: interfaceValueFromConfig(c, opc.endpoint || opc.label),
+        };
+    }
+    if (protocol === 'MODBUS') {
+        const modbus = comm.modbus || {};
+        return {
+            label: 'Modbus',
+            tier: cleanTier(modbus.tier),
+            value: interfaceValueFromConfig(c, modbus.endpoint || modbus.label),
+        };
+    }
+    return {
+        label: protocolLabel(protocol),
+        tier: protocol === 'NONE' ? 'na' : 'warn',
+        value: protocol === 'NONE' ? 'No active protocol' : 'Protocol configured without a health adapter',
+    };
+}
+
+function runtimeTier(status) {
+    const s = (status && status.dpworldapp_status) || {};
+    if (s.result === 'failed') return 'error';
+    if (s.result === 'hung' || s.result === 'starting') return 'warn';
+    if (s.result === 'healthy') return 'ok';
+    const app = (status && status.core_app) || {};
+    if (app.running === false) return 'error';
+    return cleanTier(app.tier || (app.running ? 'ok' : 'na'));
+}
+
+function runtimeLabel(status) {
+    const s = (status && status.dpworldapp_status) || {};
+    if (s.result_label) return s.result_label;
+    if (s.result) return s.result;
+    const app = (status && status.core_app) || {};
+    return app.running ? 'Running' : 'Stopped';
+}
+
+function positioningTier(status) {
+    const hw = (status && status.hardware_modules) || {};
+    if (hw.gnss && hw.gnss.tier) return cleanTier(hw.gnss.tier);
+    const rt = (status && status.dpworldapp_runtime) || {};
+    if (rt.available && rt.gnss_firmware) return 'ok';
+    if (rt.available) return 'warn';
+    return 'na';
+}
+
+function serverUplinkStatus(status) {
+    const srv = (status && status.communication && status.communication.protocol_srv) || {};
+    return {
+        tier: cleanTier(srv.tier),
+        value: srv.endpoint || srv.label || 'Protocol server',
+    };
+}
+
+function hasDrift(ours, theirs, normalize) {
+    if (ours == null || theirs == null) return false;
+    const a = String(ours).trim();
+    const b = String(theirs).trim();
+    if (!a || !b) return false;
+    const compareA = normalize ? normalize(a) : a;
+    const compareB = normalize ? normalize(b) : b;
+    return compareA !== compareB;
+}
+
+function pathDominantTier(status) {
+    const active = activeInterfaceStatus(status);
+    const uplink = serverUplinkStatus(status);
+    return dominantIssueTier([
+        { tier: positioningTier(status) },
+        { tier: active.tier },
+        { tier: runtimeTier(status) },
+        { tier: uplink.tier },
+    ]);
+}
+
+function dashboardHealthSummary(status) {
+    const issues = collectDashboardIssues(status);
+    const counts = issueCounts(issues);
+    const issueTier = dominantIssueTier(issues);
+    const pathTier = pathDominantTier(status);
+    const tier = tierWeight(issueTier) >= tierWeight(pathTier) ? issueTier : pathTier;
+    const copy = {
+        ok: {
+            title: 'Ready to send data',
+            detail: 'RTK position, equipment interface, runtime, and HTTP uplink look available.',
+        },
+        warn: {
+            title: 'Attention required',
+            detail: 'The data path is partly available, but one or more signals need operator review.',
+        },
+        error: {
+            title: 'Critical fault',
+            detail: 'One or more required telemetry stages are failing.',
+        },
+        na: {
+            title: 'Unknown state',
+            detail: 'Required telemetry evidence is missing or not configured.',
+        },
+    }[cleanTier(tier)];
+
+    return {
+        tier: cleanTier(tier),
+        title: copy.title,
+        detail: copy.detail,
+        counts,
+        equipment: equipmentLabel(status),
+        positioning: positioningMode(status),
+        interfaceLabel: activeInterfaceStatus(status).label,
+    };
+}
+
+function collectDashboardIssues(status) {
+    const issues = [];
+    const app = (status && status.core_app) || {};
+    const rt = (status && status.dpworldapp_runtime) || {};
+    const hw = (status && status.hardware_modules) || {};
+    const comm = (status && status.communication) || {};
+    const sys = (status && status.system) || {};
+    const dp = (status && status.dpworldapp_status) || {};
+    const network = (status && status.network) || {};
+
+    // ── dpworldapp stopped / startup result ─────────────────────
+    if (app.running === false) {
+        issues.push({
+            tier: 'error',
+            type: 'runtime',
+            text: 'dpworldapp stopped',
+            detail: 'Runtime cannot collect or forward equipment data.',
+            action: 'Restart dpworldapp or inspect service logs.',
+        });
+    }
+    if (dp.result === 'failed') {
+        issues.push({
+            tier: 'error',
+            type: 'runtime',
+            text: 'Startup failed',
+            detail: dp.result_label || 'Check dpworldapp startup phases.',
+            action: 'Open dpworldapp Status startup phases.',
+        });
+    } else if (dp.result === 'hung') {
+        issues.push({
+            tier: 'warn',
+            type: 'runtime',
+            text: 'Startup appears hung',
+            detail: dp.result_label || 'One or more startup phases did not complete.',
+            action: 'Open dpworldapp Status startup phases.',
+        });
+    }
+
+    // ── Active equipment interface ──────────────────────────────
+    const cfg = configFromStatus(status);
+    const activeProtocol = normalizeProtocol(cfg.protocol || comm.protocol);
+    const activeIface = activeInterfaceStatus(status);
+    const activeTier = cleanTier(activeIface.tier);
+    if (activeProtocol !== 'NONE' && (activeTier === 'error' || activeTier === 'warn' || activeTier === 'na')) {
+        const ifaceWord = activeTier === 'error'
+            ? 'Unreachable'
+            : (activeTier === 'warn' ? 'Needs attention' : 'Status unavailable');
+        issues.push({
+            tier: activeTier,
+            type: interfaceIssueType(activeProtocol),
+            text: `${activeIface.label} ${ifaceWord}`,
+            detail: activeIface.value || 'Active equipment interface has no live health evidence.',
+            action: `Open ${activeIface.label} settings.`,
+        });
+    }
+
+    // ── Server uplink ────────────────────────────────────────────
+    const srv = comm.protocol_srv || {};
+    const srvTier = cleanTier(srv.tier);
+    if (srvTier === 'error') {
+        issues.push({
+            tier: 'error',
+            type: 'server',
+            text: 'Protocol server unreachable',
+            detail: srv.endpoint || srv.label,
+            action: 'Verify configured server endpoint',
+        });
+    } else if (srvTier === 'warn') {
+        issues.push({
+            tier: 'warn',
+            type: 'server',
+            text: 'Protocol server degraded',
+            detail: srv.endpoint || srv.label,
+            action: 'Verify configured server endpoint',
+        });
+    } else if (srvTier === 'na') {
+        issues.push({
+            tier: 'na',
+            type: 'server',
+            text: 'Server uplink status unavailable',
+            detail: srv.endpoint || srv.label || 'Protocol server health has not reported yet.',
+            action: 'Configure or test protocol server endpoint.',
+        });
+    }
+
+    // ── D7: Wi-Fi signal poor (User-facing, clickable) ──────────
+    // Emit only when Wi-Fi signal is Poor (<= -80 dBm) and Wi-Fi is the sole
+    // active uplink (no eth0/eth1 up-with-ip). Per D3 / status-rules §Wi-Fi RSSI.
+    const wifi = network.wifi || {};
+    const wifiSignalDbm = wifi.signal_dbm != null ? wifi.signal_dbm : null;
+    if (wifiSignalDbm !== null && wifiSignalDbm <= -80) {
+        const ifaces = network.interfaces || [];
+        const ethUpWithIp = ifaces.filter(i =>
+            (i.name === 'eth0' || i.name === 'eth1') && i.up && i.ip
+        );
+        const wifiIsSoleUplink = ethUpWithIp.length === 0;
+        if (wifiIsSoleUplink) {
+            issues.push({
+                tier: 'error',
+                type: 'wifi-signal',
+                text: 'Wi-Fi signal poor',
+                detail: `Signal ${wifiSignalDbm} dBm — below reliable threshold.`,
+                action: 'Check Wi-Fi antenna placement and channel.',
+            });
+        }
+    }
+
+    // ── Disk ────────────────────────────────────────────────────
+    const rootDisk = sys.disk_root || {};
+    // D9: use frontend diskTier (80/90 thresholds) instead of backend tier
+    const rdPercent = rootDisk.percent != null ? rootDisk.percent : null;
+    // Note: diskTier is defined later in this file as a named export (function declaration,
+    // so it is hoisted); diskTierHelper is a const alias pointing to the same function.
+    const rdTier = diskTierHelper(rdPercent);
+    if (rdTier === 'error' || rdTier === 'warn') {
+        issues.push({
+            tier: rdTier,
+            type: 'disk',
+            text: `Root disk ${rdPercent ?? '?'}% used`,
+            detail: `${fmtBytes(rootDisk.free)} free on /`,
+            action: 'Free disk space or rotate logs.',
+        });
+    }
+
+    // ── Network apply faults (non-Advanced: watchdog critical + country pending) ──
+    const na = (status && status.network_apply) || null;
+    if (na && na.error) {
+        // v1.11.9 (review HIGH honesty): a network-apply subsystem INIT FAILURE
+        // (na.error set) previously fell through the `!na.error` guard with NO issue,
+        // so the header chip + Current Issues showed green during an active failure.
+        // Surface it as a warn issue so the dashboard is never falsely green.
+        issues.push({
+            tier: 'warn',
+            type: 'net-apply',
+            text: 'Network apply subsystem error',
+            detail: (typeof na.error === 'string' ? na.error : 'Network apply subsystem failed to initialise.'),
+            action: 'Open Apply & Status.',
+        });
+    } else if (na) {
+        if (na.watchdog && na.watchdog.critical) {
+            issues.push({
+                tier: 'error',
+                type: 'net-apply',
+                text: 'Network apply watchdog critical',
+                detail: 'A network apply did not converge; the live config may differ from intended.',
+                action: 'Open Apply & Status.',
+            });
+        } else if (na.country_pending) {
+            issues.push({
+                tier: 'warn',
+                type: 'net-apply',
+                text: 'Country change pending reboot',
+                detail: 'The regulatory domain change applies after a reboot.',
+                action: 'Reboot to apply the country change.',
+            });
+        }
+    }
+
+    // ── GNSS firmware drift — Advanced only ─────────────────────
+    if (isAdvanced() && rt.available && hw.gnss && hasDrift(hw.gnss.fw_version, rt.gnss_firmware)) {
+        issues.push({
+            tier: 'warn',
+            type: 'gnss-drift',
+            text: 'GNSS firmware drift',
+            detail: 'amss.bin version differs from dpworldapp runtime.',
+            action: 'Align GNSS firmware source with dpworldapp.',
+        });
+    }
+
+    // ── Network/runtime drift — Advanced only ────────────────────
+    // v1.8.1 (review I-3): drift is an apply-machine concept that User mode hides — its
+    //   deep-link targets the Advanced-only Apply & Status page (showPage redirects User
+    //   back to home → dead-end). Default Network state is based on live interface/IP/
+    //   gateway evidence; apply/runtime drift remains an Advanced diagnostic.
+    (network.interfaces || []).forEach((iface) => {
+        const dpView = _dpWorldappViewForIface(iface.name || '', rt);
+        const ipDrift = hasDrift(iface.ip, dpView.ip);
+        const macDrift = hasDrift(iface.mac, dpView.mac, _normalizeMac);
+        if ((ipDrift || macDrift) && isAdvanced()) {
+            issues.push({
+                tier: 'warn',
+                type: 'net-drift',
+                text: `${iface.name} runtime drift`,
+                detail: 'OS network state differs from dpworldapp telemetry.',
+                action: 'Compare OS interface state with runtime telemetry.',
+            });
+        }
+    });
+
+    // v1.7.1 Task 2: resolve each issue's deep-link target from its type.
+    return issues.map(issue => ({
+        ...issue,
+        targetPage: issue.type ? DASHBOARD_ISSUE_PAGES[issue.type] : undefined,
+    }));
+}
+
+/**
+ * v1.7.1 Task 2: protocol → interface issue type, so a degraded interface deep-links
+ * to the matching protocol page (or the protocol selector when none is active).
+ */
+function interfaceIssueType(protocol) {
+    if (protocol === 'CAN_BUS') return 'interface-can';
+    if (protocol === 'OPC_UA') return 'interface-opcua';
+    if (protocol === 'MODBUS') return 'interface-modbus';
+    return 'interface';
+}
+
+function renderHealthOverview(status) {
+    const summary = dashboardHealthSummary(status);
+    const kpis = [
+        { label: 'Critical', value: summary.counts.error },
+        { label: 'Warnings', value: summary.counts.warn },
+        { label: 'Unknown', value: summary.counts.na },
+        { label: 'Runtime', value: statusWord(runtimeTier(status)) },
+    ].map(kpi => `
+            <div class="dash-kpi">
+                <span class="dash-kpi__label">${escapeHtml(kpi.label)}</span>
+                <span class="dash-kpi__value">${escapeHtml(String(kpi.value))}</span>
+            </div>`).join('');
+
+    return `
+        <div class="dash-card dash-panel--wide dash-overview dash-overview--${summary.tier}">
+            <div class="dash-overview__status">
+                ${glyph(summary.tier)}
+                <div class="dash-overview__copy">
+                    <div class="dash-overview__eyebrow">Overall health</div>
+                    <div class="dash-overview__title">${escapeHtml(summary.title)}</div>
+                    <div class="dash-overview__detail">${escapeHtml(summary.detail)}</div>
+                </div>
+            </div>
+            <div class="dash-overview__meta">
+                <span>${escapeHtml(summary.equipment)}</span>
+                <span>${escapeHtml(statusWord(summary.tier))}</span>
+            </div>
+            <div class="dash-overview__kpis">${kpis}</div>
+        </div>`;
+}
+
+function renderOperatingMode(status) {
+    const active = activeInterfaceStatus(status);
+    const uplink = serverUplinkStatus(status);
+    const items = [
+        { label: 'Equipment', value: equipmentLabel(status), hint: 'Configured target' },
+        { label: 'Positioning', value: positioningMode(status), hint: 'ZED-F9R GNSS source' },
+        { label: 'Equipment Interface', value: active.label, hint: active.value },
+        // v1.5.5.9 D-1: 측정하지 않는 주기(rate) 단정 제거. 전송 방식(HTTP)만 표기하고
+        // 실제 endpoint 는 hint 로. (Data Path 노드는 reachability tier 로 건강도 표시.)
+        { label: 'Server Uplink', value: 'HTTP', hint: uplink.value },
+    ].map(item => `
+            <div class="dash-mode__item">
+                <span class="dash-mode__label">${escapeHtml(item.label)}</span>
+                <span class="dash-mode__value">${escapeHtml(item.value)}</span>
+                <span class="dash-mode__hint">${escapeHtml(item.hint)}</span>
+            </div>`).join('');
+
+    return `
+        <div class="dash-card dash-panel--wide dash-mode">
+            <h3 class="dash-card__title">${icon('activity', {size:16})} Operating Mode</h3>
+            <div class="dash-card__sub">Equipment telemetry role currently inferred from dpworldapp configuration.</div>
+            <div class="dash-mode__grid">${items}</div>
+        </div>`;
+}
+
+/**
+ * renderDataPathHealth(status) → HTML string | ''
+ *
+ * D4 (spec §2): Data Path pipeline is Advanced-only. Returns empty string in User mode.
+ * Node labels must be configured/running/reachable — NEVER 'receiving'/'flowing'.
+ */
+export function renderDataPathHealth(status) {
+    // D4: Advanced-only — pipeline arrow-graph implies data-flow which we cannot prove
+    if (!isAdvanced()) return '';
+
+    const active = activeInterfaceStatus(status);
+    const uplink = serverUplinkStatus(status);
+    const nodes = [
+        { label: 'Positioning', tier: positioningTier(status), value: positioningMode(status) },
+        { label: 'Equipment Interface', tier: active.tier, value: active.label },
+        { label: 'Runtime', tier: runtimeTier(status), value: runtimeLabel(status) },
+        // v1.5.5.9 D-1: hardcoded uplink label 대신 실제 server endpoint 표시.
+        // 건강도는 uplink.tier glyph + statusWord 로 이미 전달됨.
+        { label: 'Server Uplink', tier: uplink.tier, value: uplink.value },
+    ].map(node => {
+        const tier = cleanTier(node.tier);
+        // Sanitize labels: replace any forbidden flow-claim words
+        const safeValue = String(node.value || '').replace(/\bReceiving\b/gi, 'Enabled')
+            .replace(/\bFlowing\b/gi, 'Active');
+        return `
+            <div class="dash-path__node dash-path__node--${tier}">
+                <div class="dash-path__state">${glyph(tier)}<span>${statusWord(tier)}</span></div>
+                <div class="dash-path__label">${escapeHtml(node.label)}</div>
+                <div class="dash-path__value">${escapeHtml(safeValue)}</div>
+            </div>`;
+    }).join('');
+
+    return `
+        <div class="dash-card dash-panel--wide">
+            <h3 class="dash-card__title">${icon('radio-tower', {size:16})} Data Path</h3>
+            <div class="dash-path">${nodes}</div>
+        </div>`;
+}
+
+export function renderCurrentIssues(status) {
+    const issues = collectDashboardIssues(status);
+    const rows = (issues.length ? issues : [{
+        tier: 'ok',
+        text: 'No current issues',
+        detail: 'Dashboard signals are within expected range.',
+        action: '',
+    }]).map(issue => {
+        const tier = cleanTier(issue.tier);
+        // v1.7.1 Task 2: render the action as a clickable deep-link when we know
+        // which page resolves it. data-goto + delegated handler (no inline onclick).
+        const actionText = escapeHtml(issue.action || '');
+        const actionHtml = (issue.action && issue.targetPage)
+            ? `<button type="button" class="dash-issue__action dash-issue__action--link"
+                    data-goto="${escapeHtml(issue.targetPage)}" data-no-dirty>
+                    ${actionText} ${icon('chevron-right', {size:12})}
+                </button>`
+            : (actionText ? `<div class="dash-issue__action">${actionText}</div>` : '');
+        return `
+            <div class="dash-issue dash-issue--${tier}">
+                ${glyph(tier)}
+                <div class="dash-issue__body">
+                    <div class="dash-issue__text">${escapeHtml(issue.text)}</div>
+                    <div class="dash-issue__detail">${escapeHtml(issue.detail || '')}</div>
+                    ${actionHtml}
+                </div>
+            </div>`;
+    }).join('');
+
+    return `
+        <div class="dash-card dash-panel--wide dash-issues">
+            <h3 class="dash-card__title">${icon('alert-triangle', {size:16})} Current Issues</h3>
+            <div class="dash-issues__list">${rows}</div>
+        </div>`;
+}
+
+// ─── Card renderers ───────────────────────────────────────────
+
+function renderCoreApp(c) {
+    return `
+        <div class="dash-card">
+            <h3 class="dash-card__title">${icon('puzzle', {size:16})} Core App</h3>
+            <div class="dash-row">${glyph(c.tier)}<span class="dash-row__lbl">dpworldapp</span>
+                <span class="dash-row__val">${c.running ? 'Running' : 'Stopped'}</span></div>
+            <div class="dash-row"><span class="dash-row__lbl">Version</span>
+                <span class="dash-row__val">${escapeHtml(c.version || '—')}</span></div>
+            <div class="dash-row"><span class="dash-row__lbl">PID / uptime</span>
+                <span class="dash-row__val">${c.pid || '—'} · ${fmtUptime(c.uptime_seconds)}</span></div>
+            <div class="dash-row"><span class="dash-row__lbl">Last log</span>
+                <span class="dash-row__val">${fmtAge(c.last_log_age_seconds)}</span></div>
+            <div class="dash-row"><span class="dash-row__val dash-row__val--dim">${escapeHtml(c.last_log_line || '')}</span></div>
+        </div>`;
+}
+
+
+/**
+ * v1.5.5.2: dpworldapp 측 view → OS interface 이름 매핑 (drift 비교용).
+ *  - wlan0/wlan1 ... → WIFI_*
+ *  - eth0 → ETH0_*
+ *  - eth1 → ETH1_*
+ *  매핑되는 dpworldapp 키가 없으면 빈 객체 → drift 비교 silent skip.
+ */
+function _dpWorldappViewForIface(name, rt) {
+    if (!rt || !rt.available) return {};
+    if (name.startsWith('wlan')) return { ip: rt.wifi_ip, mac: rt.wifi_mac };
+    if (name === 'eth0') return { ip: rt.eth0_ip, mac: rt.eth0_mac };
+    if (name === 'eth1') return { ip: rt.eth1_ip, mac: rt.eth1_mac };
+    return {};
+}
+
+function renderNetwork(n, rt, status) {
+    // v1.5.5.2: 각 인터페이스 — Up/Down + IP + MAC + dpworldapp drift indicator
+    const ifRows = n.interfaces.map(i => {
+        const dp = _dpWorldappViewForIface(i.name, rt);
+        const ipDrift = driftBadge(i.ip, dp.ip, 'OS', 'dpworldapp');
+        // v1.5.5.3 fix: MAC 정규화 후 비교 (OS sysfs '92:d4:..' vs dpworldapp '92d4..').
+        const macDrift = driftBadge(i.mac, dp.mac, 'OS', 'dpworldapp', _normalizeMac);
+        return `
+            <div class="dash-row dash-row--header">
+                ${glyph(i.tier)}<span class="dash-row__lbl">${escapeHtml(i.name)}</span>
+                <span class="dash-row__val">${i.up ? 'Up' : 'Down'}</span></div>
+            <div class="dash-row dash-row--sub">
+                <span class="dash-row__lbl dash-row__lbl--sub">IP</span>
+                <span class="dash-row__val">${escapeHtml(i.ip || '—')}${ipDrift}</span></div>
+            <div class="dash-row dash-row--sub">
+                <span class="dash-row__lbl dash-row__lbl--sub">MAC</span>
+                <span class="dash-row__val">${escapeHtml(i.mac || '—')}${macDrift}</span></div>`;
+    }).join('');
+    const wifiRow = n.wifi.iface ? `
+            <div class="dash-row">${glyph(n.wifi.tier)}<span class="dash-row__lbl">WiFi SSID</span>
+                <span class="dash-row__val">${escapeHtml(n.wifi.ssid || 'Off')}</span>
+                <span class="dash-row__val--dim">${n.wifi.signal_dbm != null ? n.wifi.signal_dbm + ' dBm' : ''}</span></div>` : '';
+    return `
+        <div class="dash-card">
+            <h3 class="dash-card__title">${icon('globe', {size:16})} Network</h3>
+            ${ifRows}
+            ${wifiRow}
+            <div class="dash-row">${glyph(n.gateway.tier)}<span class="dash-row__lbl">Gateway</span>
+                <span class="dash-row__val">${escapeHtml(n.gateway.ip || '—')}</span></div>
+            <div class="dash-row">${glyph(n.dns.tier)}<span class="dash-row__lbl">DNS</span>
+                <span class="dash-row__val">${escapeHtml((n.dns.servers || []).join(', ') || '—')}</span></div>
+            ${networkApplyRows(status && status.network_apply)}
+        </div>`;
+}
+
+function diskBar(d, label) {
+    // v1.5.4.3 U4 fix: tier별 색상을 CSS 클래스로 — 인라인 hex 하드코딩 제거.
+    // 라이트/다크 테마 토큰(--success/--warning/--error)이 자동 적용된다.
+    const tier = d.tier === 'error' ? 'error' : (d.tier === 'warn' ? 'warn' : 'ok');
+    return `
+        <div class="dash-disk">
+            <div class="dash-disk__head"><span>${label}</span>
+                <span class="dash-row__val--dim">${d.percent}% · ${fmtBytes(d.free)} free</span></div>
+            <div class="dash-disk__bar"><div class="dash-disk__fill dash-disk__fill--${tier}" style="width:${d.percent}%;"></div></div>
+        </div>`;
+}
+
+
+function renderHardwareModules(hw, rt) {
+    const gnss = hw && hw.gnss ? hw.gnss : { tier: 'na', fw_version: null };
+    const wifi = hw && hw.wifi ? hw.wifi
+        : { tier: 'na', fw_version_short: null, fw_version_full: null };
+    const wifiFullAttr = wifi.fw_version_full
+        ? ` title="${escapeHtml(wifi.fw_version_full)}"` : '';
+    // v1.5.5.2: dpworldapp FW + GNSS drift indicator 통합
+    // v1.5.5.3 fix: telemetry unavailable / cache age 표시 복원 (v1.5.5.1 패턴 회귀 fix).
+    const rtAvailable = rt && rt.available;
+    let dpFwRow;
+    if (rtAvailable) {
+        const cacheNote = rt.cached
+            ? ` <span class="dash-row__val--dim">cached ${(rt.cache_age_s ?? 0).toFixed(0)}s</span>`
+            : '';
+        dpFwRow = `
+            <div class="dash-row">${glyph('ok')}<span class="dash-row__lbl">dpworldapp FW</span>
+                <span class="dash-row__val">${escapeHtml(rt.firmware || '—')}${cacheNote}</span></div>`;
+    } else {
+        // 8989 telemetry unavailable — keep a dim row so operators can see the missing source.
+        dpFwRow = `
+            <div class="dash-row">${glyph('na')}<span class="dash-row__lbl">dpworldapp FW</span>
+                <span class="dash-row__val dash-row__val--dim">telemetry unavailable (8989)</span></div>`;
+    }
+    const gnssDrift = rtAvailable
+        ? driftBadge(gnss.fw_version, rt.gnss_firmware, 'amss.bin', 'dpworldapp')
+        : '';
+    return `
+        <div class="dash-card">
+            <h3 class="dash-card__title">${icon('wrench', {size:16})} Hardware Modules</h3>
+            ${dpFwRow}
+            <div class="dash-row">${glyph(gnss.tier)}<span class="dash-row__lbl">GNSS FW</span>
+                <span class="dash-row__val">${escapeHtml(gnss.fw_version || '—')}${gnssDrift}</span></div>
+            <div class="dash-row">${glyph(wifi.tier)}<span class="dash-row__lbl">WiFi FW</span>
+                <span class="dash-row__val"${wifiFullAttr}>${escapeHtml(wifi.fw_version_short || '—')}</span></div>
+        </div>`;
+}
+
+function renderDpworldappStatus(s) {
+    // v1.5.5.2: Firmware Runtime section 제거 — 정보를 Network + Hardware Modules
+    // 카드로 분산 (사용자 요청). 본 카드는 다시 dpworldapp 운영 status 중심으로.
+    if (!s) return '';
+    const resultIcon = {
+        healthy: icon('check-circle-2', {size:14}),
+        starting: icon('hourglass', {size:14}),
+        hung: icon('alert-triangle', {size:14}),
+        failed: icon('x-circle', {size:14}),
+        unknown: '—',
+    }[s.result] || '—';
+    const phaseRows = (s.phases || []).map(p => `
+        <div class="dash-row">${glyph(p.tier)}<span class="dash-row__lbl">${escapeHtml(p.label)}</span>
+            <span class="dash-row__val">${p.duration_s != null ? p.duration_s.toFixed(1) + 's' : '—'}</span></div>`).join('');
+    const c = s.config || {};
+    const eq = c.equipment ? `${escapeHtml(c.equipment)}-${escapeHtml(c.equipment_id || '?')}` : '—';
+    const proto = c.protocol && c.protocol !== 'NONE'
+        ? `${escapeHtml(c.protocol)}${c.protocol_endpoint ? ' · ' + escapeHtml(c.protocol_endpoint) : ''}`
+        : 'NONE';
+    const canSpeedLabel = c.can_speed != null
+        ? (CAN_BAUDRATE_LABELS[c.can_speed] || String(c.can_speed))
+        : '?';
+    const canDesc = c.can_input === 'on'
+        ? `${escapeHtml(c.can_type || '?')} · ${canSpeedLabel} (on)`
+        : 'off';
+    const rotatedNote = s.detail_unavailable_reason === 'log_rotated'
+        ? '<div class="dash-row"><span class="dash-row__val dash-row__val--dim">Startup detail unavailable (log rotated)</span></div>'
+        : '';
+    return `
+        <div class="dash-card">
+            <h3 class="dash-card__title">${icon('activity', {size:16})} dpworldapp Status</h3>
+            <div class="dash-row"><span class="dash-row__lbl">Started</span>
+                <span class="dash-row__val">${escapeHtml(s.started_at || '—')}</span></div>
+            <div class="dash-row"><span class="dash-row__lbl">Result</span>
+                <span class="dash-row__val">${resultIcon} ${escapeHtml(s.result_label || s.result || '—')}</span></div>
+            <div class="dash-row"><span class="dash-row__lbl">PID / uptime</span>
+                <span class="dash-row__val">${s.pid || '—'} · ${fmtUptime(s.uptime_seconds)}</span></div>
+            <div class="dash-row dash-row--section">— Startup Phases —</div>
+            ${rotatedNote}
+            ${phaseRows}
+            <div class="dash-row dash-row--section">— Active Configuration —</div>
+            <div class="dash-row"><span class="dash-row__lbl">Equipment</span>
+                <span class="dash-row__val">${eq}</span></div>
+            <div class="dash-row"><span class="dash-row__lbl">Protocol</span>
+                <span class="dash-row__val">${proto}</span></div>
+            <div class="dash-row"><span class="dash-row__lbl">CAN bus</span>
+                <span class="dash-row__val">${canDesc}</span></div>
+            <div class="dash-row"><span class="dash-row__lbl">Speed src</span>
+                <span class="dash-row__val">${escapeHtml(c.speed_data || '—')}</span></div>
+            <div class="dash-row"><span class="dash-row__lbl">Odo speed</span>
+                <span class="dash-row__val">${escapeHtml(c.odo_speed || '—')}</span></div>
+            <div class="dash-row"><span class="dash-row__lbl">Direction</span>
+                <span class="dash-row__val">${escapeHtml(c.odo_dir || '—')}</span></div>
+        </div>`;
+}
+
+/**
+ * v1.5.5.1: drift badge — 우리 측 view (board_config / amss.bin) 와 dpworldapp 측 실측값
+ * 의 mismatch 발견 시 warning icon + tooltip.
+ *
+ * 빈 값은 silent (비교 불가, drift 아님). 둘 다 있을 때만 비교.
+ * v1.5.5.3 fix: 선택적 normalize 함수 지원 — MAC 같이 format 다른 비교 시 적용.
+ *  Tooltip 은 정규화 안 한 원본 값으로 표시 (사용자 가독성).
+ */
+function driftBadge(ours, theirs, ourLabel = 'configurator', theirLabel = 'dpworldapp', normalize) {
+    if (ours == null || theirs == null) return '';
+    const a = String(ours).trim();
+    const b = String(theirs).trim();
+    if (!a || !b) return '';
+    const compareA = normalize ? normalize(a) : a;
+    const compareB = normalize ? normalize(b) : b;
+    if (compareA === compareB) return '';
+    const tip = `${ourLabel}: ${a} · ${theirLabel}: ${b}`;
+    return ` <span class="drift-warn" title="${escapeHtml(tip)}">${icon('alert-triangle', {size:12})}</span>`;
+}
+
+/**
+ * v1.5.5.3: MAC 비교용 정규화 — lowercase + 모든 구분자 제거.
+ *  OS sysfs: "92:d4:78:cd:59:7b" / "92-d4-78-cd-59-7b" / "92.d4.78.cd.59.7b" 등
+ *  dpworldapp 8989: "92d478cd597b" (구분자 없음)
+ *  → 두 형식을 같은 12자 소문자 hex 로 정규화 후 비교.
+ */
+function _normalizeMac(s) {
+    return String(s).toLowerCase().replace(/[^0-9a-f]/g, '');
+}
+
+// v1.6.0 §9: Network apply/watchdog 요약 row — system_status.network_apply (provider 미주입/구버전이면 null)
+// v1.10.1: Advanced-only — User mode fault signals are surfaced via userApplyFaultTier in the summary.
+function networkApplyRows(na) {
+    if (!na) return '';
+    if (na.error) return '';
+    const ifaceBadges = Object.entries(na.interfaces || {}).map(([n, tier]) =>
+        `<span class="net-badge net-badge--${tier === 'ok' ? 'ok' : 'fail'}">${escapeHtml(n)}</span>`).join(' ');
+    const drift = na.drift?.dirty
+        ? `<span class="net-badge net-badge--warn">drift ${(na.drift && na.drift.fields ? na.drift.fields.length : 0)}</span>` : '';
+    const wd = na.watchdog?.critical
+        ? '<span class="net-badge net-badge--fail">watchdog CRITICAL</span>'
+        : (na.watchdog?.enabled ? '' : '<span class="net-badge net-badge--na">watchdog off</span>');
+    const country = na.country_pending
+        ? '<span class="net-badge net-badge--warn">country: reboot required</span>' : '';
+    return `<div class="dash-row"><span class="dash-row__lbl">Network</span>
+        <span class="dash-row__val">${ifaceBadges} ${drift} ${wd} ${country}</span></div>`;
+}
+
+/**
+ * v1.7.1 Task 1: single place that reflects freshness + stale state into the DOM.
+ * Sets the stamp text and a machine-detectable stale marker on the grid so the
+ * cards are not misread as "healthy" when the last poll failed (zombie guard).
+ */
+function updateFreshness() {
+    const stamp = document.getElementById('dash-updated');
+    const grid = document.getElementById('dash-grid');
+    const lastFresh = dashboardFreshnessLabel(lastStatus);
+    if (_stale) {
+        // Server unreachable — the rendered cards reflect the last good poll, but
+        // we must say so loudly and not let the operator trust them.
+        const suffix = staleFreshnessSuffix(lastFresh);
+        if (stamp) stamp.textContent = `Connection lost — status may be stale${suffix}`;
+        if (grid) grid.setAttribute('data-dash-stale', 'true');
+    } else {
+        if (stamp) stamp.textContent = lastFresh || 'Updated';
+        if (grid) grid.removeAttribute('data-dash-stale');
+    }
+}
+
+function renderCards() {
+    const grid = document.getElementById('dash-grid');
+    if (!grid || !lastStatus) return;
+    grid.innerHTML =
+        (_stale ? renderStaleBanner() : '') +
+        renderHeaderSummary(lastStatus) +
+        renderNetworkCard(lastStatus) +
+        renderDpworldappCard(lastStatus) +
+        renderGnssCard(lastStatus) +
+        renderEquipmentCard(lastStatus) +
+        renderServerUplinkCard(lastStatus) +
+        renderCurrentIssues(lastStatus) +
+        (isAdvanced() ? renderDataPathHealth(lastStatus) : '');
+    updateFreshness();
+}
+
+/**
+ * v1.7.1 Task 1: stale banner shown above the cards when polling has failed so the
+ * last-good render cannot be mistaken for live, healthy state.
+ */
+function renderStaleBanner() {
+    const reason = _lastError ? escapeHtml(_lastError) : 'the status service is unreachable';
+    return `
+        <div class="dash-card dash-panel--wide dash-stale" data-dash-stale="true" role="alert">
+            ${icon('alert-triangle', {size:16})}
+            <div class="dash-stale__copy">
+                <div class="dash-stale__title">Live status unavailable</div>
+                <div class="dash-stale__detail">Showing the last known values — ${reason}. Do not treat the cards below as current.</div>
+            </div>
+        </div>`;
+}
+
+// ─── Polling ──────────────────────────────────────────────────
+
+async function poll() {
+    try {
+        lastStatus = await getSystemStatus();
+        _lastReceivedAt = Date.now();
+        _stale = false;
+        _lastError = '';
+        renderCards();
+    } catch (err) {
+        // v1.7.1 Task 1: zombie guard — never silently keep the last "healthy"
+        // render. Mark stale and re-render so the banner + freshness reflect reality.
+        _stale = true;
+        _lastError = err && err.message ? err.message : 'connection error';
+        if (lastStatus) {
+            renderCards();
+        } else {
+            // No prior good render — show stale state in the stamp directly.
+            updateFreshness();
+            const stamp = document.getElementById('dash-updated');
+            if (stamp) stamp.textContent = 'Status unavailable — ' + _lastError;
+        }
+    }
+}
+
+// ─── Navigation (issue deep-link) ─────────────────────────────
+
+/**
+ * v1.7.1 Task 2: navigate to a page. Uses the injected handler when present
+ * (app.js → showPage), otherwise clicks the matching sidebar nav-item so the
+ * production nav-guard path is honored.
+ */
+function navigateTo(pageId) {
+    if (!pageId) return;
+    if (_navigate) { _navigate(pageId); return; }
+    const navItem = document.querySelector(`.nav-item[data-page="${pageId}"]`);
+    if (navItem) navItem.click();
+}
+
+/** Delegated click handler for issue deep-links and in-card actions (bound once per mount). */
+function onGridClick(e) {
+    const restartBtn = e.target.closest && e.target.closest('[data-action="restart-dpworldapp"]');
+    if (restartBtn) { e.preventDefault(); if (!_restartInFlight) handleRestart(); return; }
+    const link = e.target.closest && e.target.closest('[data-goto]');
+    if (!link) return;
+    e.preventDefault();
+    navigateTo(link.getAttribute('data-goto'));
+}
+
+/** Allow app.js (and tests) to inject the navigation function. */
+export function setNavigate(fn) {
+    _navigate = typeof fn === 'function' ? fn : null;
+}
+
+// ─── Dashboard V2 — pure network helpers (Task 1) ─────────────
+//
+// These are NAMED exports so jsdom unit-tests can import them directly.
+// No DOM access — pure data → data transforms.
+
+/**
+ * networkInterfaceSlots(status)
+ * Maps status.network.interfaces[] → fixed primary slots
+ * [{name, role, up, ip, mac, tier, label}].
+ * Primary equipment dashboard slots are eth0, eth1, wlan0. We intentionally do
+ * not synthesize a WAN slot because this hardware has no observed WAN interface.
+ * Per-port rules (status-rules §Per-Port State):
+ *   up && ip  → tier 'ok',   label 'Up'
+ *   up && !ip → tier 'warn', label 'Up, no IP'
+ *   !up       → tier 'na',   label 'Down'
+ */
+export function networkInterfaceSlots(status) {
+    const ifaces = (status && status.network && status.network.interfaces) || [];
+    const wifi = (status && status.network && status.network.wifi) || {};
+    const byName = new Map(ifaces.map(iface => [iface.name, iface]));
+    return ['eth0', 'eth1', 'wlan0'].map(name => {
+        const present = byName.has(name);
+        const iface = byName.get(name) || { name, up: false, ip: '', mac: '' };
+        const { up, ip, mac } = iface;
+        const role = name === 'wlan0' ? 'wifi' : 'wired';
+        let tier, label;
+        if (!present) {
+            // No live evidence about this primary interface — honesty invariant:
+            // absence of data is 'Unknown', not the definite-negative 'Down'.
+            tier = 'na';
+            label = 'Unknown';
+        } else if (up && ip) {
+            tier = 'ok';
+            label = 'Up';
+            if (role === 'wifi' && wifi.signal_dbm != null) {
+                const sig = wifiSignalLevel(wifi.signal_dbm);
+                if (sig.tier === 'error') { tier = 'error'; label = 'Up, poor signal'; }
+                else if (sig.tier === 'warn') { tier = 'warn'; label = 'Up, weak signal'; }
+            }
+        } else if (up && !ip) {
+            tier = 'warn';
+            label = 'Up, no IP';
+        } else {
+            tier = 'na';
+            label = 'Down';
+        }
+        return { name, role, up: !!up, ip: ip || '', mac: mac || '', tier, label };
+    });
+}
+
+/**
+ * wifiSignalLevel(signalDbm)
+ * Maps RSSI integer (or null/undefined) → {label, tier, bars}.
+ * Boundaries per status-rules §Wi-Fi RSSI Display:
+ *   >= -60        Strong / ok    / 4
+ *   -61 .. -69    Good   / ok    / 3
+ *   -70 .. -79    Fair   / warn  / 2
+ *   <= -80        Poor   / error / 1
+ *   null/undefined Unknown / warn / 0   ← MUST NOT collapse to Strong
+ */
+export function wifiSignalLevel(signalDbm) {
+    if (signalDbm == null) {
+        return { label: 'Unknown', tier: 'warn', bars: 0 };
+    }
+    if (signalDbm >= -60) {
+        return { label: 'Strong', tier: 'ok', bars: 4 };
+    }
+    if (signalDbm >= -69) {
+        return { label: 'Good', tier: 'ok', bars: 3 };
+    }
+    if (signalDbm >= -79) {
+        return { label: 'Fair', tier: 'warn', bars: 2 };
+    }
+    // <= -80
+    return { label: 'Poor', tier: 'error', bars: 1 };
+}
+
+/**
+ * networkOverallTier(network)
+ * Returns 'ok' | 'warn' | 'error' | 'na' per status-rules §Overall Network State.
+ *
+ * Rules:
+ *  1. At least one interface up-with-ip AND gateway.ip present → 'ok'
+ *  2. At least one interface up-with-ip AND gateway.ip absent  → 'warn'
+ *  3. No interface up-with-ip → 'error'
+ *
+ * D3 — Wi-Fi Poor single-uplink:
+ *   wifi.signal_dbm <= -80 is 'error' ONLY when wifi is the sole uplink
+ *   (no eth0/eth1 is up-with-ip); otherwise degrade to 'warn'.
+ *   eth being down must NOT alone make it 'error'.
+ */
+export function networkOverallTier(network) {
+    if (!network) return 'na';
+    const ifaces = network.interfaces || [];
+    const gateway = (network.gateway && network.gateway.ip) || '';
+    const wifi = network.wifi || {};
+
+    // v1.11.10 (review #19): an EMPTY interfaces array is "no evidence", not a
+    // definite fault — return neutral 'na' instead of falsely claiming 'error'.
+    if (ifaces.length === 0) return 'na';
+
+    // Determine which interfaces are up-with-ip
+    const upWithIp = ifaces.filter(i => i.up && i.ip);
+
+    if (upWithIp.length === 0) {
+        return 'error';
+    }
+
+    // Check if wifi signal is Poor (<= -80)
+    const signalDbm = wifi.signal_dbm != null ? wifi.signal_dbm : null;
+    const wifiPoor = signalDbm != null && signalDbm <= -80;
+
+    if (wifiPoor) {
+        // D3: is wifi the sole uplink?
+        const ethUpWithIp = upWithIp.filter(i => i.name === 'eth0' || i.name === 'eth1');
+        if (ethUpWithIp.length === 0) {
+            // wifi is the only uplink and it's poor → fault
+            return 'error';
+        }
+        // eth is usable — downgrade Poor wifi to warn (not error)
+        return 'warn';
+    }
+
+    // Normal path: at least one up-with-ip exists
+    if (gateway) {
+        return 'ok';
+    }
+    return 'warn';
+}
+
+/**
+ * v1.10.1 (Codex review CRITICAL): User-safe apply FAULT tier.
+ * A hard apply fault (watchdog CRITICAL / country reboot pending) is NOT an
+ * Advanced-only diagnostic like drift/DNS — it must surface in the default
+ * (User) Network summary. Returns 'error' on watchdog critical, 'warn' on
+ * country reboot pending, else 'ok'. Drift is intentionally EXCLUDED (Advanced).
+ */
+export function userApplyFaultTier(na) {
+    // v1.11.5 (review bug #8): a network-subsystem INIT FAILURE is surfaced by the backend
+    // fault provider as na.error → 'warn' so the Network summary is never green on a failed
+    // subsystem. A bare null/missing na just means "status not loaded yet" (server fix #2
+    // guarantees network_apply is present once /api/system-status returns), so it falls
+    // through to 'ok' — avoids a false "needs attention" flash on every healthy page load.
+    if (na && na.error) return 'warn';
+    if (na && na.watchdog && na.watchdog.critical) return 'error';
+    if (na && na.country_pending) return 'warn';
+    return 'ok';
+}
+
+/**
+ * Returns the worse of two tier strings (higher tierWeight wins).
+ * Used to combine live network tier with apply fault tier.
+ */
+function worstTier(a, b) {
+    return tierWeight(a) >= tierWeight(b) ? cleanTier(a) : cleanTier(b);
+}
+
+// ─── Dashboard V2 — Task 3: Network card DOM renderer ─────────
+//
+// Named export so jsdom tests can call renderNetworkCard(status) directly.
+// Called from renderCards() (V2 minimal layout — the legacy renderNetwork is no longer wired).
+//
+// Two-face design:
+//   User (default): port slots + per-iface IP + Wi-Fi SSID+RSSI bars +
+//                   Gateway + worstTier(networkOverallTier, userApplyFaultTier) summary line.
+//   Advanced: adds MAC, DNS row, per-iface driftBadge, networkApplyRows full badges.
+//
+// a11y (D8): every status glyph emits a visually-hidden statusWord span;
+//            RSSI bars element gets aria-label = "<level> <dBm>".
+
+function _srOnly(text) {
+    return `<span class="sr-only">${escapeHtml(text)}</span>`;
+}
+
+function _glyphWithSr(tier) {
+    return `${glyph(tier)}${_srOnly(statusWord(tier))}`;
+}
+
+function _headerIcon(name, tier = null) {
+    const clean = tier == null ? '' : cleanTier(tier);
+    const tierClass = clean ? ` dash-header__icon--${clean}` : '';
+    const sr = clean ? _srOnly(statusWord(clean)) : '';
+    return `<span class="dash-header__icon${tierClass}">${icon(name, { size: 14 })}${sr}</span>`;
+}
+
+function _statusHero(iconName, tier, label, value, detail = '') {
+    const clean = cleanTier(tier);
+    const detailHtml = detail
+        ? `<span class="dash-status-hero__detail">${escapeHtml(detail)}</span>`
+        : '';
+    return `
+        <div class="dash-status-hero dash-status-hero--${clean}">
+            <span class="dash-status-hero__icon dash-status-hero__icon--${clean}">
+                ${icon(iconName, { size: 18 })}
+                ${_srOnly(statusWord(clean))}
+            </span>
+            <span class="dash-status-hero__copy">
+                <span class="dash-status-hero__eyebrow">${escapeHtml(label)}</span>
+                <span class="dash-status-hero__value">${escapeHtml(value || 'Unknown')}</span>
+                ${detailHtml}
+            </span>
+        </div>`;
+}
+
+function _rssiBarsSvg(bars, tier, ariaLabel) {
+    // 4-bar SVG: each bar is progressively taller. Filled bars use tier colour class.
+    const heights = [4, 7, 10, 13];
+    const barWidth = 3;
+    const gap = 2;
+    const totalW = 4 * barWidth + 3 * gap; // 18
+    const maxH = 14;
+    const barEls = heights.map((h, i) => {
+        const filled = i < bars;
+        const cls = filled ? `rssi-bar rssi-bar--${tier}` : 'rssi-bar rssi-bar--empty';
+        const y = maxH - h;
+        const x = i * (barWidth + gap);
+        return `<rect class="${cls}" x="${x}" y="${y}" width="${barWidth}" height="${h}"/>`;
+    }).join('');
+    return `<svg class="rssi-bars" width="${totalW}" height="${maxH}" aria-label="${escapeHtml(ariaLabel)}" role="img">${barEls}</svg>`;
+}
+
+export function renderNetworkCard(status) {
+    const n = (status && status.network) || {};
+    const rt = (status && status.dpworldapp_runtime) || {};
+    const na = (status && status.network_apply) || null;
+    const advanced = isAdvanced();
+    const wifi = n.wifi || {};
+    const gateway = n.gateway || {};
+    const dns = n.dns || {};
+    const wifiSig = wifiSignalLevel(wifi.signal_dbm != null ? wifi.signal_dbm : null);
+    const dBmStr = wifi.signal_dbm != null ? `${wifi.signal_dbm} dBm` : 'Unknown';
+    const barsAriaLabel = `${wifiSig.label} ${dBmStr}`;
+
+    // ── Port slots row ──────────────────────────────────────────
+    const slots = networkInterfaceSlots(status);
+    const slotEls = slots.map(s => {
+        const roleClass = s.role === 'wifi' ? 'net-port--wifi' : 'net-port--wired';
+        const slotIcon = s.role === 'wifi'
+            ? icon('wifi', { size: 24, class: 'net-port__svg' })
+            : icon('ethernet-port', { size: 26, class: 'net-port__svg' });
+        const signal = s.role === 'wifi'
+            ? `<span class="net-port__signal">${_rssiBarsSvg(wifiSig.bars, wifiSig.tier, barsAriaLabel)}</span>`
+            : '';
+        return `<div class="net-port net-port--${s.tier} ${roleClass}">
+            <span class="net-port__icon">${slotIcon}</span>
+            <span class="net-port__name">${escapeHtml(s.name)}</span>
+            <span class="net-port__label">${escapeHtml(s.label)}</span>
+            ${signal}
+        </div>`;
+    }).join('');
+    const slotsRow = `<div class="net-port-panel"><div class="net-ports">${slotEls}</div></div>`;
+
+    // ── Per-interface compact rows ──────────────────────────────
+    const ifRows = '<div class="net-iface-list">' + slots.map(iface => {
+        const dp = _dpWorldappViewForIface(iface.name, rt);
+        const ipDrift = advanced ? driftBadge(iface.ip, dp.ip, 'OS', 'dpworldapp') : '';
+        const macDrift = advanced ? driftBadge(iface.mac, dp.mac, 'OS', 'dpworldapp', _normalizeMac) : '';
+        const upTier = iface.up ? (iface.ip ? 'ok' : 'warn') : 'na';
+        const ifaceIcon = iface.role === 'wifi' ? 'wifi' : 'ethernet-port';
+        const macItem = advanced ? `
+                <span class="net-iface-row__item">
+                    <span class="net-iface-row__label">MAC</span>
+                    <span class="net-iface-row__value">${escapeHtml(iface.mac || '-')} ${macDrift}</span>
+                </span>` : '';
+        return `
+            <div class="net-iface-row net-iface-row--${advanced ? 'advanced' : 'user'} net-iface-row--${upTier}">
+                <span class="net-iface-row__icon net-iface-row__icon--${upTier}">
+                    ${icon(ifaceIcon, { size: 16 })}
+                </span>
+                <span class="net-iface-row__state">
+                    ${_glyphWithSr(upTier)}
+                    <span class="net-iface-row__name">${escapeHtml(iface.name)}</span>
+                    <span class="net-iface-row__link">${escapeHtml(iface.up ? 'Up' : 'Down')}</span>
+                </span>
+                <span class="net-iface-row__item">
+                    <span class="net-iface-row__label">IP</span>
+                    <span class="net-iface-row__value">${escapeHtml(iface.ip || '-')} ${ipDrift}</span>
+                </span>
+                ${macItem}
+            </div>`;
+    }).join('') + '</div>';
+
+    // ── Wi-Fi SSID + RSSI bars ──────────────────────────────────
+    const wifiRow = wifi.ssid != null ? `
+        <div class="dash-row">
+            ${_glyphWithSr(wifiSig.tier)}
+            <span class="dash-row__lbl">Wi-Fi SSID</span>
+            <span class="dash-row__val">${escapeHtml(wifi.ssid)}</span>
+            <span class="dash-row__val--dim">${escapeHtml(dBmStr)}</span>
+            ${_rssiBarsSvg(wifiSig.bars, wifiSig.tier, barsAriaLabel)}
+        </div>` : '';
+
+    // ── Gateway ─────────────────────────────────────────────────
+    const gwTier = gateway.ip ? 'ok' : 'na';
+    const gatewayRow = `
+        <div class="dash-row">
+            ${_glyphWithSr(gwTier)}
+            <span class="dash-row__lbl">Gateway</span>
+            <span class="dash-row__val">${escapeHtml(gateway.ip || '—')}</span>
+        </div>`;
+
+    // ── Advanced-only: DNS row ───────────────────────────────────
+    const dnsRow = advanced ? `
+        <div class="dash-row">
+            <span class="dash-row__lbl">DNS</span>
+            <span class="dash-row__val">${escapeHtml((dns.servers || []).join(', ') || '—')}</span>
+        </div>` : '';
+
+    // ── Overall summary ─────────────────────────────────────────
+    // v1.10.1 (FIX A): combine live network tier with hard apply faults (watchdog
+    // critical / country reboot pending). These are NOT Advanced-only diagnostics —
+    // they are real operator-visible faults. Drift remains Advanced-only.
+    const overallTier = worstTier(networkOverallTier(n), userApplyFaultTier(na));
+    const overallWord = { ok: 'Network usable', warn: 'Needs attention', error: 'Needs attention', na: 'Unknown' }[overallTier] || 'Unknown';
+    const summaryRow = `<div class="dash-row">${_glyphWithSr(overallTier)}<span class="dash-row__lbl">Network</span>
+        <span class="dash-row__val">${escapeHtml(overallWord)}</span></div>`;
+    const applyRows = advanced ? networkApplyRows(na) : '';
+
+    return `
+        <div class="dash-card dash-card--network">
+            <h3 class="dash-card__title">${icon('globe', { size: 16 })} Network</h3>
+            ${slotsRow}
+            ${ifRows}
+            ${wifiRow}
+            ${gatewayRow}
+            ${dnsRow}
+            ${summaryRow}
+            ${applyRows}
+        </div>`;
+}
+
+// ─── Dashboard V2 — card state helpers (Task 2) ───────────────
+//
+// Pure named exports: dpworldappMinimal / gnssMinimal /
+// equipmentInterfaceMinimal / serverUplinkMinimal / dashboardHeaderSummary.
+// No DOM access. All green states require runtime evidence.
+
+/**
+ * dpworldappMinimal(status) → { running, version, tier }
+ * status-rules §dpworldapp State Rules:
+ *   running && version present → ok
+ *   running && version missing → warn
+ *   running=false              → error
+ *   core_app missing           → na
+ *
+ * version priority: dpworldapp_runtime.firmware ?? core_app.version
+ */
+export function dpworldappMinimal(status) {
+    const app = (status && status.core_app) || null;
+    if (!app) return { running: null, version: null, tier: 'na' };
+
+    const running = app.running;
+    if (running === false) return { running: false, version: null, tier: 'error' };
+
+    const rt = (status && status.dpworldapp_runtime) || {};
+    const version = rt.firmware != null ? rt.firmware : (app.version != null ? app.version : null);
+    // unit_managed: pass through from core_app (undefined when backend pre-v1.10.4)
+    const unit_managed = app.unit_managed;
+
+    let tier;
+    if (running && version) {
+        // v1.11.5: defer to backend tier when it signals a problem (e.g. stale log)
+        // rather than overriding to 'ok' purely from running+version presence.
+        tier = (app.tier === 'warn' || app.tier === 'error') ? app.tier : 'ok';
+    } else if (running && !version) {
+        tier = 'warn';
+    } else {
+        // running is null/undefined (core_app exists but running not set)
+        tier = 'na';
+    }
+
+    return { running: !!running, version, tier, unit_managed };
+}
+
+/**
+ * gnssMinimal(status) → { moduleLabel, fw, fixLabel, tier }
+ * status-rules §GNSS Card State Rules.
+ *
+ * ★ HONEST (D4):
+ *   - fixLabel is ALWAYS 'RTK unknown' — no fix-quality data exists.
+ *   - Green (tier='ok') requires runtime evidence (fw or gnss.tier from hw/runtime),
+ *     never config-only inference.
+ *
+ * fw priority: hardware_modules.gnss.fw_version ?? dpworldapp_runtime.gnss_firmware
+ * tier: reuses positioningTier() logic (module-evidence tier), but overrides
+ *       to 'na' when dpworldapp is stopped (module evidence is unobservable).
+ */
+export function gnssMinimal(status) {
+    const FIX_LABEL = 'RTK unknown';
+
+    const app = (status && status.core_app) || {};
+    // If dpworldapp is stopped, module evidence is unobservable → na
+    if (app.running === false) {
+        return { moduleLabel: 'Module unknown', fw: null, fixLabel: FIX_LABEL, tier: 'na' };
+    }
+
+    const hw = (status && status.hardware_modules) || {};
+    const gnssHw = hw.gnss || {};
+    const rt = (status && status.dpworldapp_runtime) || {};
+
+    // Firmware: prefer hw fw_version, fallback to runtime gnss_firmware
+    const fw = gnssHw.fw_version != null ? gnssHw.fw_version
+             : (rt.gnss_firmware != null ? rt.gnss_firmware : null);
+
+    // Module evidence tier via positioningTier (checks hw.gnss.tier + runtime gnss_firmware).
+    // positioningTier returns 'na' when rt.available is falsy; however, status-rules says
+    // "dpworldapp running but no GNSS evidence → Warning". Promote 'na' to 'warn' when
+    // dpworldapp is running (we know app.running !== false by this point in the function).
+    const rawTier = positioningTier(status);
+    const tier = rawTier === 'na' ? 'warn' : rawTier;
+
+    const moduleLabel = (tier === 'ok') ? 'Module seen' : 'Module unknown';
+
+    return { moduleLabel, fw, fixLabel: FIX_LABEL, tier };
+}
+
+/**
+ * equipmentInterfaceMinimal(status) → { label, tier, value }
+ * Reuses activeInterfaceStatus(status).
+ * D5: protocol 'NONE' → tier 'na' (already returned by activeInterfaceStatus — confirmed).
+ * CAN label is 'Enabled'/'Configured', never 'Receiving'.
+ */
+export function equipmentInterfaceMinimal(status) {
+    return activeInterfaceStatus(status);
+}
+
+/**
+ * serverUplinkMinimal(status) → { tier, value, mode }
+ * Reuses serverUplinkStatus(status) for tier + value.
+ * D9: endpoint null/empty → tier 'warn' (override).
+ * mode is always static 'HTTP telemetry upload'.
+ * Never claims upload rate ('1 Hz'/'upload OK').
+ */
+export function serverUplinkMinimal(status) {
+    const base = serverUplinkStatus(status);
+    const srv = (status && status.communication && status.communication.protocol_srv) || {};
+    const endpoint = srv.endpoint;
+
+    // D9: endpoint missing or null → warn
+    const tier = (endpoint != null && String(endpoint).trim() !== '')
+        ? base.tier
+        : 'warn';
+
+    return {
+        tier,
+        value: base.value,
+        mode: 'HTTP telemetry upload',
+    };
+}
+
+/**
+ * dashboardHeaderSummary(status) → { equipment, activeIface, posMode, uplink }
+ * Composes existing helpers.
+ * ★ posMode is the configured-mode label (e.g. 'ZED-F9R RTK(DR)') — NOT a health claim.
+ *   It is distinct from gnssMinimal's 'RTK unknown'. It reads as configuration.
+ */
+export function dashboardHeaderSummary(status) {
+    return {
+        equipment: equipmentLabel(status),
+        activeIface: activeInterfaceStatus(status),
+        posMode: positioningMode(status),
+        uplink: serverUplinkStatus(status),
+    };
+}
+
+// ─── Dashboard V2 — Task 4: Right-column DOM renderers ────────
+//
+// Named exports: renderHeaderSummary / renderDpworldappCard /
+//                renderGnssCard / renderEquipmentCard
+//
+// Mirror Task 3's renderNetworkCard pattern:
+//   - User (default): minimal safe info only
+//   - Advanced (isAdvanced()): extra diagnostic rows appended
+//   - a11y (D8): _glyphWithSr() for all status glyphs; escapeHtml on dynamic values
+
+/**
+ * overallStatusChip(status, stale) → HTML string
+ * Summarizes collectDashboardIssues into a compact status chip for the header bar.
+ * HONESTY: never green for config-inferred-only; only reflects real issue data.
+ * v1.11.10 (review #20): when the last poll failed (stale=true) the cards reflect a
+ *   stale snapshot — never show the green "All systems operational" chip; force WARN.
+ */
+function overallStatusChip(status, stale) {
+    const issues = collectDashboardIssues(status) || [];
+    let critical = 0, warning = 0;
+    for (const it of issues) { const t = cleanTier(it.tier); if (t === 'error') critical++; else if (t === 'warn') warning++; }
+    if (stale && !critical) return `<span class="dash-status-chip dash-status-chip--warn">${icon('alert-triangle', { size: 13 })} Status may be stale</span>`;
+    if (!critical && !warning) return `<span class="dash-status-chip dash-status-chip--ok">${icon('check-circle-2', { size: 13 })} All systems operational</span>`;
+    const tier = critical ? 'error' : 'warn';
+    const parts = []; if (critical) parts.push(`${critical} critical`); if (warning) parts.push(`${warning} warning`);
+    return `<span class="dash-status-chip dash-status-chip--${tier}">${icon('alert-triangle', { size: 13 })} Attention needed · ${parts.join(', ')}</span>`;
+}
+
+/**
+ * renderHeaderSummary(status) → HTML string
+ *
+ * One-line header bar: equipment | overall status chip | active interface | uplink.
+ * posMode is labeled as configured mode ("Mode: ZED-F9R RTK(DR)") — NOT a health/fix claim.
+ * Composed from dashboardHeaderSummary helpers.
+ */
+export function renderHeaderSummary(status) {
+    const h = dashboardHeaderSummary(status);
+    const iface = h.activeIface || {};
+    const uplink = h.uplink || {};
+
+    const ifaceTier = cleanTier(iface.tier);
+    const uplinkTier = cleanTier(uplink.tier);
+    const equipPart = `<span class="dash-header__part dash-header__equipment">${_headerIcon('factory')}<span class="dash-header__label">Equipment</span><span class="dash-header__value">${escapeHtml(h.equipment)}</span></span>`;
+    const ifacePart = `<span class="dash-header__part dash-header__iface dash-header__part--${ifaceTier}">${_headerIcon('cable', ifaceTier)}<span class="dash-header__label">I/F</span><span class="dash-header__value">${escapeHtml(iface.label || 'Interface unknown')}</span></span>`;
+    const uplinkPart = `<span class="dash-header__part dash-header__uplink dash-header__part--${uplinkTier}">${_headerIcon('server', uplinkTier)}<span class="dash-header__label">Server</span><span class="dash-header__value">${escapeHtml(statusWord(uplinkTier))} ${escapeHtml(uplink.value || 'Uplink unknown')}</span></span>`;
+
+    return `<div class="dash-header-summary">${equipPart}${overallStatusChip(status, _stale)}${ifacePart}${uplinkPart}</div>`;
+}
+
+/**
+ * renderDpworldappCard(status) → HTML string
+ *
+ * User mode: Running/Stopped + firmware version ONLY.
+ *   No PID, no uptime, no last-log-line, no startup phases, no cache-age.
+ * Advanced mode: also appends startup-phase table (reuses renderDpworldappStatus
+ *   phase rows content) + PID/uptime + last-log.
+ */
+export function renderDpworldappCard(status) {
+    const d = dpworldappMinimal(status);
+    const runTier = cleanTier(d.tier);
+    const runWord = d.running ? 'Running' : (d.running === false ? 'Stopped' : 'Unknown');
+
+    // When running outside the systemd unit, surface a muted note for honesty.
+    const supervisionNote = (d.running && d.unit_managed === false)
+        ? `<div class="dash-row"><span class="dash-row__val dash-row__val--dim">not under service supervision</span></div>`
+        : '';
+
+    // User-mode rows: icon-first status hero + firmware evidence
+    const baseRows = `
+        ${_statusHero('activity', runTier, 'dpworldapp', runWord)}
+        ${supervisionNote}
+        <div class="dash-row">
+            <span class="dash-row__lbl">FW Version</span>
+            <span class="dash-row__val">${escapeHtml(d.version || '—')}</span>
+        </div>`;
+
+    // Advanced-only extra rows: PID/uptime, last-log, startup phase table
+    let advancedRows = '';
+    if (isAdvanced()) {
+        const s = (status && status.dpworldapp_status) || null;
+        const app = (status && status.core_app) || {};
+
+        // PID / uptime
+        const pid = (s && s.pid) || app.pid;
+        const uptime = (s && s.uptime_seconds != null) ? s.uptime_seconds : app.uptime_seconds;
+        advancedRows += `
+        <div class="dash-row">
+            <span class="dash-row__lbl">PID</span>
+            <span class="dash-row__val">${pid != null ? escapeHtml(String(pid)) : '—'} · ${fmtUptime(uptime)}</span>
+        </div>`;
+
+        // Last log line
+        const lastLogAge = app.last_log_age_seconds;
+        const lastLogLine = app.last_log_line || '';
+        advancedRows += `
+        <div class="dash-row">
+            <span class="dash-row__lbl">Last log</span>
+            <span class="dash-row__val">${fmtAge(lastLogAge)}</span>
+        </div>`;
+        if (lastLogLine) {
+            advancedRows += `
+        <div class="dash-row">
+            <span class="dash-row__val dash-row__val--dim">${escapeHtml(lastLogLine)}</span>
+        </div>`;
+        }
+
+        // Startup phase table (from dpworldapp_status)
+        if (s) {
+            const resultIcon = {
+                healthy: icon('check-circle-2', { size: 14 }),
+                starting: icon('hourglass', { size: 14 }),
+                hung: icon('alert-triangle', { size: 14 }),
+                failed: icon('x-circle', { size: 14 }),
+                unknown: '—',
+            }[s.result] || '—';
+            const phaseRows = (s.phases || []).map(p => `
+        <div class="dash-row">${_glyphWithSr(cleanTier(p.tier))}
+            <span class="dash-row__lbl">${escapeHtml(p.label)}</span>
+            <span class="dash-row__val">${p.duration_s != null ? p.duration_s.toFixed(1) + 's' : '—'}</span>
+        </div>`).join('');
+            const rotatedNote = s.detail_unavailable_reason === 'log_rotated'
+                ? '<div class="dash-row"><span class="dash-row__val dash-row__val--dim">Startup detail unavailable (log rotated)</span></div>'
+                : '';
+            advancedRows += `
+        <div class="dash-row dash-row--section">— Startup Phases —</div>
+        <div class="dash-row">
+            <span class="dash-row__lbl">Result</span>
+            <span class="dash-row__val">${resultIcon} ${escapeHtml(s.result_label || s.result || '—')}</span>
+        </div>
+        ${rotatedNote}
+        ${phaseRows}`;
+        }
+    }
+
+    return `
+        <div class="dash-card">
+            <h3 class="dash-card__title dash-card__title--sr">${icon('activity', { size: 16 })} dpworldapp</h3>
+            ${baseRows}
+            ${advancedRows}
+            <div class="dash-card__action">
+                <button type="button" class="btn btn--danger btn--sm btn--full" data-action="restart-dpworldapp" data-no-dirty>${icon('refresh-cw', { size: 14 })} Restart dpworldapp</button>
+            </div>
+        </div>`;
+}
+
+/**
+ * renderGnssCard(status) → HTML string
+ *
+ * v1.11.0: Renamed to "Hardware Modules" — combines GNSS + Wi-Fi FW evidence.
+ * User mode: GNSS 'Module seen' + firmware + 'RTK unknown' + Wi-Fi FW row.
+ *   NEVER 'Positioning OK'. Wi-Fi tier is firmware-presence only (NOT link health).
+ * Advanced mode: also appends GNSS fw drift badge (amss.bin vs dpworldapp runtime).
+ */
+export function renderGnssCard(status) {
+    const g = gnssMinimal(status);
+    const tier = cleanTier(g.tier);
+    const mode = positioningMode(status);
+
+    // GNSS fw drift badge — only in Advanced mode
+    const hw = (status && status.hardware_modules) || {};
+    const gnssHw = hw.gnss || {};
+    const rt = (status && status.dpworldapp_runtime) || {};
+    const gnssDrift = (isAdvanced() && rt.available)
+        ? driftBadge(gnssHw.fw_version, rt.gnss_firmware, 'amss.bin', 'dpworldapp')
+        : '';
+
+    // Wi-Fi firmware block — tier is firmware-presence, NEVER link health
+    const wifi = hw.wifi || { tier: 'na', fw_version_short: null, fw_version_full: null };
+    const wifiTier = cleanTier(wifi.tier);
+    const wifiFullAttr = wifi.fw_version_full ? ` title="${escapeHtml(wifi.fw_version_full)}"` : '';
+
+    return `
+        <div class="dash-card">
+            <h3 class="dash-card__title">${icon('cpu', { size: 16 })} Hardware Modules</h3>
+            <div class="hw-module">
+                <div class="hw-module__head">${_glyphWithSr(tier)}${icon('radio-tower', { size: 14 })}<span class="hw-module__name">GNSS</span></div>
+                ${_statusHero('radio-tower', tier, 'GNSS', g.moduleLabel)}
+                <div class="dash-row">
+                    <span class="dash-row__lbl">Mode</span>
+                    <span class="dash-row__val">${escapeHtml(mode)}</span>
+                </div>
+                <div class="dash-row">
+                    <span class="dash-row__lbl">GNSS FW</span>
+                    <span class="dash-row__val">${escapeHtml(g.fw || '—')}${gnssDrift}</span>
+                </div>
+                <div class="dash-row">
+                    <span class="dash-row__lbl">RTK/fix</span>
+                    <span class="dash-row__val">${escapeHtml(g.fixLabel)}</span>
+                </div>
+            </div>
+            <div class="hw-module">
+                <div class="hw-module__head">${_glyphWithSr(wifiTier)}${icon('wifi', { size: 14 })}<span class="hw-module__name">Wi-Fi FW</span></div>
+                <div class="dash-row dash-row--sub"><span class="dash-row__lbl dash-row__lbl--sub">FW</span><span class="dash-row__val"${wifiFullAttr}>${escapeHtml(wifi.fw_version_short || '—')}</span></div>
+            </div>
+        </div>`;
+}
+
+/**
+ * renderEquipmentCard(status) → HTML string
+ *
+ * Active protocol + short config summary (CAN type/baudrate or endpoint).
+ * NEVER 'Receiving' (CAN = Enabled/Configured).
+ * NONE → Unknown.
+ * a11y (D8): _glyphWithSr on status glyph; escapeHtml on all dynamic values.
+ */
+export function renderEquipmentCard(status) {
+    const eq = equipmentInterfaceMinimal(status);
+    const tier = cleanTier(eq.tier);
+
+    // Short config summary line — prefer value from helper, guard against 'Receiving'
+    const rawValue = String(eq.value || '');
+    const safeValue = rawValue.replace(/\bReceiving\b/gi, 'Enabled');
+
+    return `
+        <div class="dash-card">
+            <h3 class="dash-card__title dash-card__title--sr">${icon('cable', { size: 16 })} Equipment I/F</h3>
+            ${_statusHero('cable', tier, 'Equipment I/F', eq.label || 'Unknown')}
+            <div class="dash-row">
+                <span class="dash-row__lbl">Config</span>
+                <span class="dash-row__val dash-row__val--dim">${escapeHtml(safeValue)}</span>
+            </div>
+        </div>`;
+}
+
+// ─── Dashboard V2 — Task 5: Bottom-row renderers ──────────────
+//
+// Named exports: diskTier / renderServerUplinkCard / renderSystemCard
+// renderCurrentIssues is also named-exported (see above, Task 5).
+// renderDataPathHealth is now named-exported and Advanced-only.
+
+/**
+ * diskTier(percent) → 'ok' | 'warn' | 'error' | 'na'
+ *
+ * D9 spec §2: frontend computes disk tier from raw percent using 80/90 thresholds,
+ * because the backend uses different thresholds (60/80).
+ *
+ * Boundaries (status-rules §System Card):
+ *   < 80         → ok
+ *   80 .. < 90   → warn
+ *   >= 90        → error
+ *   null/undef   → na
+ */
+export function diskTier(percent) {
+    if (percent == null || typeof percent !== 'number') return 'na';
+    if (percent < 80) return 'ok';
+    if (percent < 90) return 'warn';
+    return 'error';
+}
+
+// Internal alias so collectDashboardIssues can call it without name collision
+// with the outer `diskTier` export (hoisting is fine for function declarations,
+// but to be safe with arrow expressions we alias here).
+const diskTierHelper = diskTier;
+
+/**
+ * renderServerUplinkCard(status) → HTML string
+ *
+ * Task 5 — Server Uplink card (bottom row, minimal).
+ * Uses serverUplinkMinimal() for tier + endpoint value.
+ * Mode label is always static 'HTTP telemetry upload'.
+ * NEVER claims upload rate ('1 Hz') or 'upload OK'.
+ * endpoint missing → warn tier (D9).
+ *
+ * a11y (D8): _glyphWithSr() on status glyph; escapeHtml on dynamic values.
+ */
+export function renderServerUplinkCard(status) {
+    const u = serverUplinkMinimal(status);
+    const tier = cleanTier(u.tier);
+    const srv = (status && status.communication && status.communication.protocol_srv) || {};
+    const endpoint = srv.endpoint;
+
+    const endpointRow = endpoint
+        ? `<div class="dash-row">
+            <span class="dash-row__lbl">Endpoint</span>
+            <span class="dash-row__val">${escapeHtml(String(endpoint))}</span>
+        </div>`
+        : `<div class="dash-row">
+            ${_glyphWithSr('warn')}
+            <span class="dash-row__lbl">Endpoint</span>
+            <span class="dash-row__val dash-row__val--dim">Not configured</span>
+        </div>`;
+
+    return `
+        <div class="dash-card">
+            <h3 class="dash-card__title dash-card__title--sr">${icon('upload', { size: 16 })} Server Uplink</h3>
+            ${_statusHero('server', tier, 'Server', u.mode)}
+            ${endpointRow}
+        </div>`;
+}
+
+/**
+ * renderSystemCard(status) → HTML string
+ *
+ * Task 5 — System card (bottom row, minimal).
+ * Shows: root disk usage (tier from diskTier(percent) — D9 80/90 thresholds)
+ *        + device uptime (from status.system.uptime_seconds, NOT core_app.uptime_seconds).
+ * Does NOT show: event count, /opt disk, raw percent details.
+ *
+ * a11y (D8): _glyphWithSr() on disk tier glyph; escapeHtml on dynamic values.
+ */
+export function renderSystemCard(status) {
+    const sys = (status && status.system) || {};
+    const disk = sys.disk_root || {};
+    const percent = disk.percent != null ? disk.percent : null;
+    const tier = diskTier(percent);
+
+    // Disk summary uses the frontend 80/90 tier rule from diskTier().
+    const diskHtml = percent != null
+        ? `<div class="dash-row">
+            <span class="dash-row__lbl">Disk /</span>
+            <span class="dash-row__val">${percent}% · ${fmtBytes(disk.free)} free</span>
+        </div>`
+        : `<div class="dash-row">
+            <span class="dash-row__lbl">Disk /</span>
+            <span class="dash-row__val dash-row__val--dim">Unknown</span>
+        </div>`;
+
+    // Device uptime from system.uptime_seconds (NOT core_app.uptime_seconds)
+    const uptimeSeconds = sys.uptime_seconds != null ? sys.uptime_seconds : null;
+    const uptimeRow = `
+        <div class="dash-row">
+            <span class="dash-row__lbl">Device uptime</span>
+            <span class="dash-row__val">${uptimeSeconds != null ? fmtUptime(uptimeSeconds) : '—'}</span>
+        </div>`;
+
+    return `
+        <div class="dash-card">
+            <h3 class="dash-card__title dash-card__title--sr">${icon('bar-chart-3', { size: 16 })} System</h3>
+            ${_statusHero('gauge', tier, 'System', percent != null ? `Disk ${percent}%` : 'Disk unknown')}
+            ${diskHtml}
+            ${uptimeRow}
+        </div>`;
+}
+
+// ─── Actions ──────────────────────────────────────────────────
+
+async function handleRestart() {
+    // v1.11.9 (review LOW concurrency): poll() re-renders the grid mid-restart, yielding a
+    // fresh ENABLED button — guard re-entry with a module-level in-flight flag (the disabled
+    // button alone is insufficient). Reset in finally so a failed restart can be retried.
+    if (_restartInFlight) return;
+    const ok = await confirmModal({
+        title: 'Restart dpworldapp',
+        message: 'The telemetry runtime stops for a few seconds while it restarts. Equipment data is not collected or forwarded during the restart.',
+        confirmLabel: 'Restart', cancelLabel: 'Cancel', danger: true,
+    });
+    if (!ok) return;
+    if (_restartInFlight) return;  // re-check after the await on the confirm modal
+    _restartInFlight = true;
+    const btn = document.querySelector('[data-action="restart-dpworldapp"]');
+    if (btn) { btn.disabled = true; }
+    try {
+        const r = await restartDpworldapp();
+        if (r && r.restarted && r.running) showToast(`dpworldapp restarted${r.pid ? ' (PID ' + r.pid + ')' : ''}.`, 'success');
+        else showToast('Restart issued but app is not active — ' + ((r && r.error) || ''), 'warning');
+        // v1.11.10 (review #23): re-poll INSIDE the try so the in-flight guard (cleared in
+        // finally) stays set until the post-restart render resolves — otherwise the poll()
+        // re-render yields a fresh ENABLED button while still rendering, allowing a 2nd restart.
+        await poll();
+    } catch (err) {
+        showToast((err && err.message) || 'Restart failed.', 'error');
+    } finally {
+        _restartInFlight = false;
+    }
+}
+
+// ─── Page interface ───────────────────────────────────────────
+
+const homePage = {
+    render(container) {
+        container.classList.add('page-container--dashboard');
+        container.innerHTML = `
+            <div class="page-header">
+                <h1 class="page-header__title">${icon('home', {size:28})} Device Status</h1>
+                <p class="page-header__desc" id="dash-updated">Loading status...</p>
+            </div>
+            <div class="dash-grid" id="dash-grid"></div>
+        `;
+    },
+
+    mount(container) {
+        // v1.7.1 Task 2: single delegated listener on the stable grid element —
+        // survives poll re-renders (grid.innerHTML only) and is removed on destroy,
+        // so revisits never accumulate listeners.
+        _gridEl = container.querySelector('#dash-grid');
+        if (_gridEl) _gridEl.addEventListener('click', onGridClick);
+        poll();
+        pollTimer = setInterval(poll, DASHBOARD_REFRESH_MS);
+    },
+
+    destroy() {
+        document.getElementById('page-container')?.classList.remove('page-container--dashboard');
+        if (pollTimer) { clearInterval(pollTimer); pollTimer = null; }
+        if (_gridEl) { _gridEl.removeEventListener('click', onGridClick); _gridEl = null; }
+        lastStatus = null;
+        _stale = false;
+        _lastError = '';
+        _lastReceivedAt = null;
+        _restartInFlight = false;
+    },
+};
+
+export function renderHomePage(container) {
+    homePage.render(container);
+    homePage.mount(container);
+}
+
+export default homePage;
diff --git a/src/static/js/pages/io.js b/src/static/js/pages/io.js
new file mode 100644
index 0000000..7d591f3
--- /dev/null
+++ b/src/static/js/pages/io.js
@@ -0,0 +1,156 @@
+/**
+ * io.js — I/O Configuration Page (RS485 + CAN bus)
+ *
+ * v1.5.0 Phase 2: Ethernet and LTE cards moved to pages/ethernet.js.
+ * This file retains RS485 + CAN bus settings only (transitional state).
+ * Phase 3: RS485 → sensor-io.js, CAN → can-bus.js; io.js deleted.
+ */
+
+import { state, bindInput } from '../state.js';
+import { CAN_BAUDRATES, CAN_BAUDRATE_LABELS } from '../constants.js';
+
+// ─── Render ──────────────────────────────────────────────────
+
+export function renderIoPage(container) {
+    const device = state.device || {};
+    const can = device.can || {};
+    const rs485 = device.rs485 || {};
+
+    container.innerHTML = `
+        <div class="page-header">
+            <h1 class="page-header__title">🔌 I/O Settings</h1>
+            <p class="page-header__desc">RS485 and CAN bus communication settings. Ethernet and LTE interface IP are configured under Network &rarr; Ethernet.</p>
+        </div>
+
+        <!-- CAN + RS485 -->
+        <div class="grid-2col">
+            <div class="card">
+                <div class="card__header">
+                    <h2 class="card__title"><span class="card__title-icon">🚌</span> CAN Bus</h2>
+                </div>
+                <div class="form-group">
+                    <label class="form-label">Frame Type</label>
+                    <select class="form-select" id="can_type">
+                        <option value="standard" ${can.type === 'standard' ? 'selected' : ''}>Standard</option>
+                        <option value="extended" ${can.type !== 'standard' ? 'selected' : ''}>Extended</option>
+                    </select>
+                </div>
+                <div class="form-group">
+                    <label class="form-label">Baud Rate</label>
+                    <select class="form-select" id="can_speed">
+                        ${CAN_BAUDRATES.map(v => `<option value="${v}" ${String(can.speed) === String(v) ? 'selected' : ''}>${CAN_BAUDRATE_LABELS[v] || v}</option>`).join('')}
+                    </select>
+                </div>
+            </div>
+
+            <div class="card">
+                <div class="card__header">
+                    <h2 class="card__title"><span class="card__title-icon">🔌</span> RS485</h2>
+                </div>
+                <div class="form-group">
+                    <label class="form-label">Mode</label>
+                    <select class="form-select" id="rs485_mode">
+                        <option value="half" ${rs485.mode === 'half' ? 'selected' : ''}>Half Duplex</option>
+                        <option value="full" ${rs485.mode === 'full' ? 'selected' : ''}>Full Duplex</option>
+                    </select>
+                </div>
+                <div class="form-group">
+                    <label class="form-label">Baud Rate</label>
+                    <select class="form-select" id="rs485_speed">
+                        ${[9600, 115200].map(v => `<option value="${v}" ${String(rs485.speed) === String(v) ? 'selected' : ''}>${v}</option>`).join('')}
+                    </select>
+                </div>
+                <div class="form-group">
+                    <label class="form-label">Data Bits</label>
+                    <select class="form-select" id="rs485_databits">
+                        ${['5', '6', '7', '8'].map(v => `<option value="${v}" ${(rs485.databits || '8') === v ? 'selected' : ''}>${v}</option>`).join('')}
+                    </select>
+                </div>
+                <div class="form-group">
+                    <label class="form-label">Parity</label>
+                    <select class="form-select" id="rs485_parity">
+                        <option value="none" ${rs485.parity !== 'even' && rs485.parity !== 'odd' ? 'selected' : ''}>None</option>
+                        <option value="even" ${rs485.parity === 'even' ? 'selected' : ''}>Even</option>
+                        <option value="odd" ${rs485.parity === 'odd' ? 'selected' : ''}>Odd</option>
+                    </select>
+                </div>
+                <div class="form-group">
+                    <label class="form-label">Stop Bits</label>
+                    <select class="form-select" id="rs485_stopbits">
+                        ${['0', '1', '2'].map(v => `<option value="${v}" ${(rs485.stopbits || '1') === v ? 'selected' : ''}>${v}</option>`).join('')}
+                    </select>
+                </div>
+            </div>
+        </div>
+
+    `;
+
+    // Register data collector
+    window.__pageCollectors.io = collectIoData;
+}
+
+// ─── Data Collection ─────────────────────────────────────────
+
+function collectIoData() {
+    if (!state.device) state.device = {};
+
+    state.device.can = {
+        type: document.getElementById('can_type')?.value || '',
+        speed: document.getElementById('can_speed')?.value || '',
+    };
+
+    state.device.rs485 = {
+        mode: document.getElementById('rs485_mode')?.value || '',
+        speed: document.getElementById('rs485_speed')?.value || '',
+        databits: document.getElementById('rs485_databits')?.value || '8',
+        parity: document.getElementById('rs485_parity')?.value || '',
+        stopbits: document.getElementById('rs485_stopbits')?.value || '1',  // v1.4.5.1 m2: dha baseline 일관
+    };
+}
+
+// ─── Select field bindings ──────────────────────────────────
+const SELECT_FIELDS = [
+    { id: 'can_type',      group: 'can',   key: 'type' },
+    { id: 'can_speed',     group: 'can',   key: 'speed' },
+    { id: 'rs485_mode',    group: 'rs485', key: 'mode' },
+    { id: 'rs485_speed',   group: 'rs485', key: 'speed' },
+    { id: 'rs485_databits',group: 'rs485', key: 'databits' },
+    { id: 'rs485_parity',  group: 'rs485', key: 'parity' },
+    { id: 'rs485_stopbits',group: 'rs485', key: 'stopbits' },
+];
+
+// ─── New Page Interface ─────────────────────────────────────
+const ioPage = {
+    render(container) {
+        // Delegate to legacy render
+        renderIoPage(container);
+    },
+
+    mount(container) {
+        // Select fields → state
+        SELECT_FIELDS.forEach(({ id, group, key }) => {
+            bindInput(container, `#${id}`,
+                () => state.device?.[group]?.[key] || '',
+                (val) => {
+                    if (!state.device) state.device = {};
+                    if (!state.device[group]) state.device[group] = {};
+                    state.device[group][key] = val;
+                    state.isDirty = true;
+                }
+            );
+        });
+
+        // Legacy collector
+        window.__pageCollectors.io = collectIoData;
+    },
+
+    destroy() {},
+
+    validate() {
+        // CAN and RS485 validation delegated to can.js and register.js respectively.
+        // io.js only does existence check here.
+        return [];
+    },
+};
+
+export default ioPage;
diff --git a/src/static/js/pages/log.js b/src/static/js/pages/log.js
new file mode 100644
index 0000000..f6e265c
--- /dev/null
+++ b/src/static/js/pages/log.js
@@ -0,0 +1,747 @@
+/**
+ * log.js — Log Management Page
+ *
+ * Log configuration settings, disk usage dashboard,
+ * file listing with download/compress/delete actions.
+ */
+
+import { state, bindInput, bindRadio } from '../state.js';
+import { escapeHtml } from '../utils.js';
+import { getLogFiles, getLogStats, downloadLogFiles, compressLogFiles, deleteLogFilesApi } from '../api.js';
+import { showToast } from '../toast.js';
+import { DEFAULTS } from '../constants.js';
+import { icon } from '../icons.js';
+
+// ─── Helpers ─────────────────────────────────────────────────
+
+function formatSize(bytes) {
+    if (bytes == null || bytes === 0) return '0 B';
+    const units = ['B', 'KB', 'MB', 'GB'];
+    let i = 0;
+    let size = bytes;
+    while (size >= 1024 && i < units.length - 1) {
+        size /= 1024;
+        i++;
+    }
+    return `${size.toFixed(i === 0 ? 0 : 1)} ${units[i]}`;
+}
+
+function formatDate(isoStr) {
+    if (!isoStr) return '-';
+    return isoStr.substring(0, 10);
+}
+
+// ─── Local State ──────────────────────────────────────────────
+
+let logFiles = [];
+let logTotalSize = 0;
+let logLoading = false;
+let logError = null;
+let selectedFiles = new Set();
+let logStats = null;
+let statsLoading = false;
+// v1.11.10 (review #31 concurrency): mount-epoch guard. In-flight async loads from a
+// prior visit could resolve AFTER destroy()/re-mount and corrupt the new mount's loading
+// guard (e.g. flip logLoading=false or overwrite logStats). Each render() bumps this; each
+// loader captures it and bails after every await if it no longer matches the live mount.
+let _mountGen = 0;
+
+// ─── Render ───────────────────────────────────────────────────
+
+export function renderLogPage(container) {
+    // v1.11.10 (review #31): a fresh render starts a new mount generation so any
+    // still-pending loader from a prior visit is invalidated before it can write state.
+    _mountGen++;
+    const device = state.device || {};
+    const log = device.log || {};
+
+    const autoCompress = log.auto_compress || 'off';
+
+    container.innerHTML = `
+        <div class="page-header">
+            <h1 class="page-header__title">${icon('file-text', {size:28})} Log Management</h1>
+            <p class="page-header__desc">Configure log settings, monitor disk usage, and manage log files.</p>
+        </div>
+
+        <div class="log-tabs" role="tablist" aria-label="Log sections">
+            <button class="log-tab log-tab--active" data-tab="config" role="tab" aria-selected="true">
+                ${icon('settings', {size:14})} Configuration
+            </button>
+            <button class="log-tab" data-tab="files" role="tab" aria-selected="false">
+                ${icon('folder', {size:14})} Files
+            </button>
+            <button class="log-tab" data-tab="kernel" role="tab" aria-selected="false">
+                ${icon('file-text', {size:14})} Kernel
+            </button>
+        </div>
+
+        <!-- Tab: Configuration -->
+        <div class="log-tab-panel" data-panel="config">
+            <div class="card">
+                <div class="card__header">
+                    <h2 class="card__title"><span class="card__title-icon">${icon('settings', {size:16})}</span> Log Configuration</h2>
+                </div>
+
+                <div class="form-group">
+                    <label class="form-label">Log Save</label>
+                    <div class="radio-group">
+                        <label class="radio-label">
+                            <input type="radio" name="log_save" value="on" ${log.save !== 'off' ? 'checked' : ''}>
+                            On
+                        </label>
+                        <label class="radio-label">
+                            <input type="radio" name="log_save" value="off" ${log.save === 'off' ? 'checked' : ''}>
+                            Off
+                        </label>
+                    </div>
+                </div>
+                <div class="form-row">
+                    <div class="form-group">
+                        <label class="form-label">Max Size (MB)</label>
+                        <input class="form-input" id="log_max_size" type="number" min="1" value="${Number(log.max_size) || 100}" placeholder="100">
+                    </div>
+                    <div class="form-group">
+                        <label class="form-label">Max Duration (Days)</label>
+                        <input class="form-input" id="log_max_days" type="number" min="1" value="${Number(log.max_days) || 1}" placeholder="1">
+                    </div>
+                </div>
+
+                <div class="form-group">
+                    <label class="form-label">Auto Compress</label>
+                    <div class="radio-group">
+                        <label class="radio-label">
+                            <input type="radio" name="log_auto_compress" value="on" ${autoCompress === 'on' ? 'checked' : ''}>
+                            On
+                        </label>
+                        <label class="radio-label">
+                            <input type="radio" name="log_auto_compress" value="off" ${autoCompress !== 'on' ? 'checked' : ''}>
+                            Off
+                        </label>
+                    </div>
+                    <p class="form-hint">When enabled, non-active log files are automatically compressed every 5 minutes.</p>
+                </div>
+
+                <div class="form-group">
+                    <label class="form-label">Auto Cleanup</label>
+                    <div class="radio-group">
+                        <label class="radio-label">
+                            <input type="radio" name="log_auto_cleanup" value="on" ${(log.auto_cleanup || DEFAULTS.LOG_AUTO_CLEANUP) === 'on' ? 'checked' : ''}>
+                            On
+                        </label>
+                        <label class="radio-label">
+                            <input type="radio" name="log_auto_cleanup" value="off" ${(log.auto_cleanup || DEFAULTS.LOG_AUTO_CLEANUP) !== 'on' ? 'checked' : ''}>
+                            Off
+                        </label>
+                    </div>
+                    <p class="form-hint">When enabled, oldest <strong>compressed</strong> logs are deleted if either threshold below is exceeded. Active and uncompressed files are never touched.</p>
+                </div>
+                <div class="form-row">
+                    <div class="form-group">
+                        <label class="form-label" for="log_cleanup_max_files">Cleanup Max Files</label>
+                        <input class="form-input" id="log_cleanup_max_files" type="number" min="5" value="${log.cleanup_max_files != null ? Number(log.cleanup_max_files) || DEFAULTS.LOG_CLEANUP_MAX_FILES : DEFAULTS.LOG_CLEANUP_MAX_FILES}" placeholder="50">
+                    </div>
+                    <div class="form-group">
+                        <label class="form-label" for="log_cleanup_max_size_mb">Cleanup Max Size (MB)</label>
+                        <input class="form-input" id="log_cleanup_max_size_mb" type="number" min="50" value="${log.cleanup_max_size_mb != null ? Number(log.cleanup_max_size_mb) || DEFAULTS.LOG_CLEANUP_MAX_SIZE_MB : DEFAULTS.LOG_CLEANUP_MAX_SIZE_MB}" placeholder="200">
+                    </div>
+                </div>
+            </div>
+        </div>
+
+        <!-- Tab: Files -->
+        <div class="log-tab-panel" data-panel="files" hidden>
+            <!-- Disk Usage Dashboard -->
+            <div class="card">
+                <div class="card__header">
+                    <h2 class="card__title"><span class="card__title-icon">${icon('bar-chart-3', {size:16})}</span> Disk Usage</h2>
+                </div>
+                <div id="log_stats_section">
+                    <div class="log-files-placeholder">
+                        <div class="loading__spinner" style="width:24px;height:24px;border-width:2px;"></div>
+                        <span class="text-muted">Loading stats...</span>
+                    </div>
+                </div>
+            </div>
+
+            <!-- Log Files -->
+            <div class="card">
+                <div class="card__header">
+                    <h2 class="card__title"><span class="card__title-icon">${icon('folder', {size:16})}</span> Log Files</h2>
+                </div>
+                <!-- v1.5.5.10: data-no-dirty — 파일 선택 체크박스(다운로드/삭제용 일시 UI)는
+                     설정 변경이 아니므로 dirty-tracker / nav-guard 모달을 트리거하면 안 됨 -->
+                <div id="log_files_section" data-no-dirty>
+                    <!-- Populated by loadLogFiles() -->
+                </div>
+            </div>
+        </div>
+
+        <!-- Tab: Kernel -->
+        <div class="log-tab-panel" data-panel="kernel" hidden>
+            <div class="card" id="kernel-logs-card">
+                <div class="card__header">
+                    <h2 class="card__title"><span class="card__title-icon">${icon('file-text', {size:16})}</span> Kernel Logs</h2>
+                </div>
+                <p class="form-hint">Bundle systemd journal exports and kernel log files for diagnostic download. Includes <code>kernel.log</code>, <code>full-journal.log</code>, <code>kernel-follow.log</code>, boot history, pstore crash dumps, and a manifest.</p>
+                <button id="kernel_bundle_btn" class="btn btn--primary">
+                    Download Kernel Log Bundle
+                </button>
+            </div>
+        </div>
+    `;
+
+    // Wire tab switching
+    container.querySelectorAll('.log-tab').forEach(btn => {
+        btn.addEventListener('click', () => {
+            const tab = btn.dataset.tab;
+            container.querySelectorAll('.log-tab').forEach(b => {
+                b.classList.toggle('log-tab--active', b.dataset.tab === tab);
+                b.setAttribute('aria-selected', String(b.dataset.tab === tab));
+            });
+            container.querySelectorAll('.log-tab-panel').forEach(p => {
+                p.hidden = (p.dataset.panel !== tab);
+            });
+        });
+    });
+
+    // Wire kernel bundle button
+    container.querySelector('#kernel_bundle_btn')
+             ?.addEventListener('click', onDownloadKernelBundle);
+
+    // Load data
+    loadLogStats();
+    loadLogFiles();
+
+    // Register data collector for Save All
+    window.__pageCollectors.log = collectLogData;
+}
+
+// ─── Stats Loading & Rendering ────────────────────────────────
+
+async function loadLogStats() {
+    const section = document.getElementById('log_stats_section');
+    if (!section) return;
+
+    const gen = _mountGen;   // #31: bail if the mount changes under us
+    statsLoading = true;
+    renderStatsSection(section);
+
+    try {
+        const stats = await getLogStats();
+        if (gen !== _mountGen) return;   // stale loader from a prior mount — do not mutate state
+        logStats = stats;
+        statsLoading = false;
+        renderStatsSection(section);
+        renderLogFilesSection(document.getElementById('log_files_section'));
+    } catch (err) {
+        if (gen !== _mountGen) return;   // stale loader — leave the new mount's state intact
+        statsLoading = false;
+        logStats = null;
+        section.innerHTML = `
+            <div class="log-files-placeholder log-files-placeholder--error">
+                <span>Failed to load stats.</span>
+                <button class="btn btn--outline btn--sm" id="stats_retry_btn">Retry</button>
+            </div>
+        `;
+        section.querySelector('#stats_retry_btn')?.addEventListener('click', () => loadLogStats());
+    }
+}
+
+function renderStatsSection(section) {
+    if (!section) return;
+
+    if (statsLoading) {
+        section.innerHTML = `
+            <div class="log-files-placeholder">
+                <div class="loading__spinner" style="width:24px;height:24px;border-width:2px;"></div>
+                <span class="text-muted">Loading stats...</span>
+            </div>
+        `;
+        return;
+    }
+
+    if (!logStats) return;
+
+    const s = logStats;
+    const partTotal = s.partition_total || 0;
+    const partUsed = s.partition_used || 0;
+    const partFree = s.partition_free || 0;
+    const logsBytes = s.total_size || 0;
+    const otherBytes = Math.max(0, partUsed - logsBytes);
+    const pct = partTotal > 0 ? (partUsed / partTotal) * 100 : 0;
+    const barColor = pct >= 80 ? '#B53A3A' : (pct >= 60 ? '#B5872D' : '#3D8B5B');
+
+    section.innerHTML = `
+        <div class="disk-cap-block" style="margin-bottom:var(--space-md);">
+            <div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:var(--space-xs);">
+                <span style="font-size:var(--font-size-sm);color:var(--color-text);">/opt — where logs live</span>
+                <span class="text-mono text-muted" style="font-size:var(--font-size-xs);">${pct.toFixed(0)}% used · ${formatSize(partFree)} free of ${formatSize(partTotal)}</span>
+            </div>
+            <div style="height:14px;background:var(--color-bg-secondary,#0E1726);border:1px solid var(--color-border,#2D3A52);border-radius:4px;overflow:hidden;">
+                <div style="height:100%;width:${pct.toFixed(1)}%;background:${barColor};transition:width .3s;"></div>
+            </div>
+            <div class="text-mono text-muted" style="font-size:var(--font-size-xs);margin-top:var(--space-xs);display:flex;gap:var(--space-md);flex-wrap:wrap;">
+                <span>${icon('folder', {size:14})} Logs ${formatSize(logsBytes)}</span>
+                <span>Other ${formatSize(otherBytes)}</span>
+                <span>${icon('check-circle-2', {size:14})} Free ${formatSize(partFree)}</span>
+            </div>
+        </div>
+
+        <div class="log-stats-grid">
+            <div class="log-stat-card">
+                <div class="log-stat-card__value">${formatSize(s.total_size)}</div>
+                <div class="log-stat-card__label">Total Size</div>
+            </div>
+            <div class="log-stat-card log-stat-card--success">
+                <div class="log-stat-card__value">${s.compressed_count}</div>
+                <div class="log-stat-card__label">Compressed (${formatSize(s.compressed_size)})</div>
+            </div>
+            <div class="log-stat-card log-stat-card--info">
+                <div class="log-stat-card__value">${s.uncompressed_count}</div>
+                <div class="log-stat-card__label">Uncompressed (${formatSize(s.uncompressed_size)})</div>
+            </div>
+            <div class="log-stat-card log-stat-card--warning">
+                <div class="log-stat-card__value text-mono" style="font-size:var(--font-size-sm);">${s.active_file ? escapeHtml(s.active_file) : 'None'}</div>
+                <div class="log-stat-card__label">Active File</div>
+            </div>
+        </div>
+    `;
+}
+
+// ─── Log Files Loading & Rendering ────────────────────────────
+
+async function loadLogFiles() {
+    const section = document.getElementById('log_files_section');
+    if (!section) return;
+
+    const gen = _mountGen;   // #31: bail if the mount changes under us
+    logLoading = true;
+    logError = null;
+    selectedFiles.clear();
+    renderLogFilesSection(section);
+
+    try {
+        const result = await getLogFiles();
+        if (gen !== _mountGen) return;   // stale loader from a prior mount — do not mutate state
+        logFiles = result.files || [];
+        logTotalSize = result.total_size || 0;
+        logLoading = false;
+        renderLogFilesSection(section);
+    } catch (err) {
+        if (gen !== _mountGen) return;   // stale loader — leave the new mount's state intact
+        logLoading = false;
+        logError = err.message;
+        renderLogFilesSection(section);
+    }
+}
+
+function getCompressibleLogCount() {
+    if (!logStats) return 0;
+    const active = logStats.active_file || null;
+    return logFiles.filter(f => f.type === 'log' && f.name !== active).length;
+}
+
+function renderLogFilesSection(section) {
+    if (!section) return;
+
+    if (logLoading) {
+        section.innerHTML = `
+            <div class="log-files-placeholder">
+                <div class="loading__spinner" style="width:28px;height:28px;border-width:2px;"></div>
+                <span class="text-muted">Loading log files...</span>
+            </div>
+        `;
+        return;
+    }
+
+    if (logError) {
+        section.innerHTML = `
+            <div class="log-files-placeholder log-files-placeholder--error">
+                <span>Failed to load log files.</span>
+                <button class="btn btn--outline btn--sm" id="log_retry_btn">Retry</button>
+            </div>
+        `;
+        section.querySelector('#log_retry_btn')?.addEventListener('click', () => loadLogFiles());
+        return;
+    }
+
+    if (logFiles.length === 0) {
+        section.innerHTML = `
+            <div class="log-files-placeholder">
+                <span class="text-muted">No log files found.</span>
+                <span class="text-muted" style="font-size:var(--font-size-xs);">Log files appear when saving is enabled.</span>
+                <button class="btn btn--outline btn--sm" id="log_refresh_btn" style="margin-top:var(--space-sm);">Refresh</button>
+            </div>
+        `;
+        section.querySelector('#log_refresh_btn')?.addEventListener('click', () => refreshAll());
+        return;
+    }
+
+    const selectedCount = selectedFiles.size;
+    const selectedSize = logFiles.filter(f => selectedFiles.has(f.name)).reduce((s, f) => s + f.size, 0);
+    const allSelected = selectedCount === logFiles.length;
+    const hasSelection = selectedCount > 0;
+    const compressibleCount = getCompressibleLogCount();
+    const canCompress = compressibleCount > 0;
+
+    const summaryText = hasSelection
+        ? `${selectedCount} selected, ${formatSize(selectedSize)}`
+        : `${logFiles.length} file${logFiles.length !== 1 ? 's' : ''}, ${formatSize(logTotalSize)}`;
+
+    section.innerHTML = `
+        <div class="log-action-bar">
+            <div class="log-action-bar__left">
+                <button class="btn ${hasSelection ? 'btn--primary' : 'btn--outline'} btn--sm" id="log_download_btn" ${!hasSelection ? 'disabled' : ''}>
+                    Download Selected
+                </button>
+                <button class="btn btn--outline btn--sm" id="log_compress_btn" ${!canCompress ? 'disabled' : ''}
+                        title="${canCompress ? `Compress ${compressibleCount} non-active log file${compressibleCount !== 1 ? 's' : ''}` : 'No non-active log files to compress'}">
+                    Compress Rotated Logs
+                </button>
+                <button class="btn btn--danger btn--sm" id="log_delete_btn" ${!hasSelection ? 'disabled' : ''}>
+                    Delete Selected
+                </button>
+                <button class="btn btn--outline btn--sm" id="log_refresh_btn">
+                    Refresh
+                </button>
+            </div>
+            <span class="log-action-bar__summary text-muted">${summaryText}</span>
+        </div>
+
+        <div class="data-table-wrapper">
+            <table class="data-table log-files-table">
+                <thead>
+                    <tr>
+                        <th style="width:40px;text-align:center;">
+                            <input type="checkbox" id="log_select_all" ${allSelected ? 'checked' : ''}>
+                        </th>
+                        <th>Filename</th>
+                        <th style="width:90px;">Size</th>
+                        <th style="width:100px;">Modified</th>
+                        <th style="width:80px;">Type</th>
+                    </tr>
+                </thead>
+                <tbody>
+                    ${logFiles.map(f => `
+                        <tr>
+                            <td style="text-align:center;">
+                                <input type="checkbox" class="log-file-check" data-name="${escapeHtml(f.name)}" ${selectedFiles.has(f.name) ? 'checked' : ''}>
+                            </td>
+                            <td class="text-mono" style="font-size:13px;">${escapeHtml(f.name)}</td>
+                            <td class="text-muted" style="font-size:var(--font-size-sm);">${formatSize(f.size)}</td>
+                            <td class="text-muted" style="font-size:var(--font-size-sm);">${formatDate(f.modified)}</td>
+                            <td>
+                                <span class="log-type-badge log-type-badge--${f.type === 'tar.gz' || f.type === 'gz' ? 'archive' : 'log'}">
+                                    ${escapeHtml(f.type.toUpperCase())}
+                                </span>
+                            </td>
+                        </tr>
+                    `).join('')}
+                </tbody>
+            </table>
+        </div>
+    `;
+
+    // Event: Select All
+    section.querySelector('#log_select_all')?.addEventListener('change', (e) => {
+        if (e.target.checked) {
+            logFiles.forEach(f => selectedFiles.add(f.name));
+        } else {
+            selectedFiles.clear();
+        }
+        renderLogFilesSection(section);
+    });
+
+    // Event: Individual checkbox
+    section.querySelectorAll('.log-file-check').forEach(cb => {
+        cb.addEventListener('change', (e) => {
+            const name = e.target.dataset.name;
+            if (e.target.checked) {
+                selectedFiles.add(name);
+            } else {
+                selectedFiles.delete(name);
+            }
+            renderLogFilesSection(section);
+        });
+    });
+
+    // Event: Refresh
+    section.querySelector('#log_refresh_btn')?.addEventListener('click', () => refreshAll());
+
+    // Event: Download
+    section.querySelector('#log_download_btn')?.addEventListener('click', () => handleDownload());
+
+    // Event: Compress Rotated Logs
+    section.querySelector('#log_compress_btn')?.addEventListener('click', () => handleCompress());
+
+    // Event: Delete Selected
+    section.querySelector('#log_delete_btn')?.addEventListener('click', () => handleDelete());
+}
+
+// ─── Actions ──────────────────────────────────────────────────
+
+async function refreshAll() {
+    await Promise.all([loadLogStats(), loadLogFiles()]);
+}
+
+async function handleDownload() {
+    if (selectedFiles.size === 0) return;
+
+    const btn = document.getElementById('log_download_btn');
+    if (btn) { btn.disabled = true; btn.textContent = 'Preparing...'; }
+
+    try {
+        const blob = await downloadLogFiles([...selectedFiles]);
+        const url = URL.createObjectURL(blob);
+        const a = document.createElement('a');
+        a.href = url;
+        a.download = `logs_${new Date().toISOString().slice(0, 10)}.tar.gz`;
+        document.body.appendChild(a);
+        a.click();
+        document.body.removeChild(a);
+        URL.revokeObjectURL(url);
+        showToast('Download started.', 'success');
+    } catch (err) {
+        showToast(err.message || 'Download failed.', 'error');
+    } finally {
+        if (btn) { btn.disabled = false; btn.textContent = 'Download Selected'; }
+    }
+}
+
+async function handleCompress() {
+    if (getCompressibleLogCount() === 0) {
+        showToast('No non-active log files to compress.', 'warning');
+        return;
+    }
+
+    const btn = document.getElementById('log_compress_btn');
+    if (btn) { btn.disabled = true; btn.textContent = 'Compressing...'; }
+
+    try {
+        const result = await compressLogFiles();
+        if (result.success) {
+            showToast(result.message, 'success');
+        } else {
+            showToast(result.message || 'Compression failed.', 'warning');
+        }
+        await refreshAll();
+    } catch (err) {
+        showToast(err.message || 'Compression failed.', 'error');
+    } finally {
+        if (btn) { btn.disabled = false; btn.textContent = 'Compress Rotated Logs'; }
+    }
+}
+
+async function handleDelete() {
+    if (selectedFiles.size === 0) return;
+
+    const count = selectedFiles.size;
+    if (!confirm(`Delete ${count} selected file${count !== 1 ? 's' : ''}? This cannot be undone.`)) {
+        return;
+    }
+
+    const btn = document.getElementById('log_delete_btn');
+    if (btn) { btn.disabled = true; btn.textContent = 'Deleting...'; }
+
+    try {
+        const result = await deleteLogFilesApi([...selectedFiles]);
+        if (result.success) {
+            showToast(result.message, 'success');
+            selectedFiles.clear();
+        } else {
+            showToast(result.message || 'Delete failed.', 'warning');
+        }
+        await refreshAll();
+    } catch (err) {
+        showToast(err.message || 'Delete failed.', 'error');
+    } finally {
+        if (btn) { btn.disabled = false; btn.textContent = 'Delete Selected'; }
+    }
+}
+
+// ─── Kernel Logs Section ─────────────────────────────────────
+
+function renderKernelLogsSection() {
+    const section = document.createElement('div');
+    section.className = 'card';
+    section.innerHTML = `
+        <div class="card__header">
+            <h2 class="card__title"><span class="card__title-icon">${icon('terminal-square', {size:16})}</span> Kernel Logs</h2>
+        </div>
+        <p class="form-hint">Bundle systemd journal exports and kernel log files for diagnostic download. Includes <code>kernel.log</code>, <code>full-journal.log</code>, <code>kernel-follow.log</code>, boot history, pstore crash dumps, and a manifest.</p>
+        <button id="kernel_bundle_btn" class="btn btn--primary">
+            Download Kernel Log Bundle
+        </button>
+    `;
+    section.querySelector('#kernel_bundle_btn')
+           .addEventListener('click', onDownloadKernelBundle);
+    return section;
+}
+
+async function onDownloadKernelBundle(event) {
+    const btn = event.currentTarget;
+    const original = btn.textContent.trim();
+    btn.disabled = true;
+    btn.textContent = 'Generating bundle…';
+    try {
+        const resp = await fetch('/setting/kernel-bundle');
+        if (!resp.ok) {
+            const msg = await resp.text().catch(() => `HTTP ${resp.status}`);
+            throw new Error(msg || `HTTP ${resp.status}`);
+        }
+        const blob = await resp.blob();
+        const cd = resp.headers.get('Content-Disposition') || '';
+        const m = cd.match(/filename="([^"]+)"/);
+        const filename = m ? m[1] : 'kernel-logs.tar.gz';
+        const url = URL.createObjectURL(blob);
+        const a = document.createElement('a');
+        a.href = url;
+        a.download = filename;
+        document.body.appendChild(a);
+        a.click();
+        document.body.removeChild(a);
+        URL.revokeObjectURL(url);
+        showToast('Kernel log bundle downloaded.', 'success');
+    } catch (err) {
+        showToast(`Kernel bundle failed: ${err.message}`, 'error');
+    } finally {
+        btn.disabled = false;
+        btn.textContent = original;
+    }
+}
+
+// ─── Data Collection ──────────────────────────────────────────
+
+function collectLogData() {
+    if (!state.device) state.device = {};
+
+    // v1.4.6.8 C2: partial-merge spread — Log 페이지 UI에 없는 키(compress_size_mb, compress_age_days)
+    // 보존. 이전 whole-replace 패턴은 누락 키가 state.js convertNestedToFlat의 default 50/7 fallback
+    // 으로 emit되어 매 save마다 log_config 두 키를 default로 wipe하던 결함을 차단.
+    const prev = state.device.log || {};
+    state.device.log = {
+        ...prev,
+        save: document.querySelector('input[name="log_save"]:checked')?.value || 'on',
+        max_size: parseInt(document.getElementById('log_max_size')?.value) || 100,
+        max_days: parseInt(document.getElementById('log_max_days')?.value) || 1,
+        auto_compress: document.querySelector('input[name="log_auto_compress"]:checked')?.value || 'off',
+        auto_cleanup: document.querySelector('input[name="log_auto_cleanup"]:checked')?.value || DEFAULTS.LOG_AUTO_CLEANUP,
+        cleanup_max_files: parseInt(document.getElementById('log_cleanup_max_files')?.value) || DEFAULTS.LOG_CLEANUP_MAX_FILES,
+        cleanup_max_size_mb: parseInt(document.getElementById('log_cleanup_max_size_mb')?.value) || DEFAULTS.LOG_CLEANUP_MAX_SIZE_MB,
+    };
+}
+
+// ─── New Page Interface ─────────────────────────────────────
+const logPage = {
+    render(container) {
+        // Delegate to legacy render (HTML + async loading is identical)
+        renderLogPage(container);
+    },
+
+    mount(container) {
+        // Reactive bindings for config fields
+        bindRadio(container, 'log_save',
+            () => state.device?.log?.save || 'on',
+            (val) => {
+                if (!state.device) state.device = {};
+                if (!state.device.log) state.device.log = {};
+                state.device.log.save = val;
+                state.isDirty = true;
+            }
+        );
+        bindInput(container, '#log_max_size',
+            () => state.device?.log?.max_size ?? 100,
+            (val) => {
+                if (!state.device) state.device = {};
+                if (!state.device.log) state.device.log = {};
+                state.device.log.max_size = parseInt(val) || 100;
+                state.isDirty = true;
+            }
+        );
+        bindInput(container, '#log_max_days',
+            () => state.device?.log?.max_days ?? 1,
+            (val) => {
+                if (!state.device) state.device = {};
+                if (!state.device.log) state.device.log = {};
+                state.device.log.max_days = parseInt(val) || 1;
+                state.isDirty = true;
+            }
+        );
+        bindRadio(container, 'log_auto_compress',
+            () => state.device?.log?.auto_compress || 'off',
+            (val) => {
+                if (!state.device) state.device = {};
+                if (!state.device.log) state.device.log = {};
+                state.device.log.auto_compress = val;
+                state.isDirty = true;
+            }
+        );
+        bindRadio(container, 'log_auto_cleanup',
+            () => state.device?.log?.auto_cleanup || DEFAULTS.LOG_AUTO_CLEANUP,
+            (val) => {
+                if (!state.device) state.device = {};
+                if (!state.device.log) state.device.log = {};
+                state.device.log.auto_cleanup = val;
+                state.isDirty = true;
+            }
+        );
+        bindInput(container, '#log_cleanup_max_files',
+            () => state.device?.log?.cleanup_max_files ?? DEFAULTS.LOG_CLEANUP_MAX_FILES,
+            (val) => {
+                if (!state.device) state.device = {};
+                if (!state.device.log) state.device.log = {};
+                state.device.log.cleanup_max_files = parseInt(val) || DEFAULTS.LOG_CLEANUP_MAX_FILES;
+                state.isDirty = true;
+            }
+        );
+        bindInput(container, '#log_cleanup_max_size_mb',
+            () => state.device?.log?.cleanup_max_size_mb ?? DEFAULTS.LOG_CLEANUP_MAX_SIZE_MB,
+            (val) => {
+                if (!state.device) state.device = {};
+                if (!state.device.log) state.device.log = {};
+                state.device.log.cleanup_max_size_mb = parseInt(val) || DEFAULTS.LOG_CLEANUP_MAX_SIZE_MB;
+                state.isDirty = true;
+            }
+        );
+
+        // Legacy collector (R4)
+        window.__pageCollectors.log = collectLogData;
+    },
+
+    destroy() {
+        // v1.11.9 (review LOW concurrency): reset module-level state on leave so in-flight
+        // loads from a prior visit can't race a fresh mount, and a revisit starts clean
+        // (loading/empty) rather than showing the previous visit's file list/usage.
+        logFiles = [];
+        logTotalSize = 0;
+        logLoading = false;
+        logError = null;
+        selectedFiles = new Set();
+        logStats = null;
+        statsLoading = false;
+    },
+
+    validate() {
+        const errors = [];
+        const log = state.device?.log || {};
+        const maxSize = log.max_size;
+        if (maxSize !== undefined && maxSize !== null && (isNaN(maxSize) || maxSize < 1)) {
+            errors.push({ field: 'log_max_size', page: 'log', message: 'Max Size — Must be a positive number' });
+        }
+        const maxDays = log.max_days;
+        if (maxDays !== undefined && maxDays !== null && (isNaN(maxDays) || maxDays < 1)) {
+            errors.push({ field: 'log_max_days', page: 'log', message: 'Max Duration — Must be a positive number' });
+        }
+        const cleanupFiles = log.cleanup_max_files;
+        if (cleanupFiles !== undefined && cleanupFiles !== null && (isNaN(cleanupFiles) || cleanupFiles < 5)) {
+            errors.push({ field: 'log_cleanup_max_files', page: 'log', message: 'Cleanup Max Files — Must be at least 5' });
+        }
+        const cleanupSize = log.cleanup_max_size_mb;
+        if (cleanupSize !== undefined && cleanupSize !== null && (isNaN(cleanupSize) || cleanupSize < 50)) {
+            errors.push({ field: 'log_cleanup_max_size_mb', page: 'log', message: 'Cleanup Max Size (MB) — Must be at least 50' });
+        }
+        return errors;
+    },
+};
+
+export default logPage;
diff --git a/src/static/js/pages/modbus.js b/src/static/js/pages/modbus.js
new file mode 100644
index 0000000..04374c7
--- /dev/null
+++ b/src/static/js/pages/modbus.js
@@ -0,0 +1,253 @@
+/**
+ * modbus.js — Modbus Configuration Page
+ *
+ * v1.5.0 Phase 3: Server Endpoint card + Byte Order card 추가
+ * (modbus_server_ip + modbus_server_port + four_byte_order)
+ * + 기존 Modbus Register Mapping table 유지.
+ *
+ * v1.5.3.2 Hotfix: two_byte_order 누락 회귀 fix — Java TwoByte enum
+ * (LITTLE("little") / BIG("big")) 복구. Byte Order card에 two_byte_order
+ * + four_byte_order 두 dropdown 모두 추가.
+ *
+ * Columns: Field, Addr, IDT, ODT, DV, Shift, Expr, Mask
+ *
+ * Data source: state.protocol.MODBUS (array), state.device.server.*,
+ *              state.protocol.two_byte_order, state.protocol.four_byte_order
+ */
+
+import { state, bindIpGroup, bindInput } from '../state.js';
+import { populateCrudTable } from '../components/crud-table.js';
+import { IDT_OPTIONS, ODT_OPTIONS } from '../constants.js';
+import { renderIpOctets, setupIpOctets, collectIpValue } from '../components/ip-input.js';
+import { setupPortInputs } from '../components/port-input.js';
+import { escapeHtml } from '../utils.js';
+import { icon } from '../icons.js';
+
+const MODBUS_COLUMNS = [
+    { key: 'field', label: 'Field', placeholder: 'TEMP', maxLength: 4 },
+    { key: 'addr', label: 'Addr', placeholder: '100' },
+    { key: 'idt', label: 'IDT', type: 'select', options: IDT_OPTIONS },
+    { key: 'odt', label: 'ODT', type: 'select', options: ODT_OPTIONS },
+    { key: 'dv', label: 'DV', placeholder: '-9', defaultValue: '-9', width: '60px' },
+    { key: 'shift', label: 'Shift', placeholder: '0', defaultValue: '0', width: '60px' },
+    { key: 'expr', label: 'Expr', placeholder: 'x*0.1' },
+    { key: 'mask', label: 'Mask', placeholder: '0xffff' },
+];
+
+let _modbusTable = null;
+
+export function renderModbusPage(container) {
+    const p = state.protocol || {};
+    const d = state.device || {};
+    const server = d.server || {};
+    const rows = p.MODBUS || [];
+    const fbo = p.four_byte_order || 'big';
+    const tbo = p.two_byte_order || 'big';
+
+    container.innerHTML = `
+        <div class="page-header">
+            <h1 class="page-header__title">${icon('share-2', { size: 28 })} Modbus</h1>
+            <p class="page-header__desc">Modbus server endpoint, byte order, and register mapping.</p>
+        </div>
+
+        <div class="card">
+            <div class="card__header">
+                <h2 class="card__title">${icon('server', { size: 18 })} Server Endpoint</h2>
+            </div>
+            <div class="form-row">
+                <div class="form-group">
+                    <label class="form-label">Server IP</label>
+                    ${renderIpOctets('modbus_server_ip', server.modbus_server_ip || '')}
+                </div>
+                <div class="form-group">
+                    <label class="form-label">Server Port</label>
+                    <input class="form-input form-input--mono" id="modbus_server_port" value="${escapeHtml(server.modbus_server_port || '')}" placeholder="502">
+                </div>
+            </div>
+        </div>
+
+        <div class="card">
+            <div class="card__header">
+                <h2 class="card__title">${icon('sliders-horizontal', { size: 18 })} Byte Order</h2>
+            </div>
+            <p class="card__desc">Endianness for register value interpretation (2-byte / 4-byte).</p>
+            <div class="form-row">
+                <div class="form-group">
+                    <label class="form-label" for="two_byte_order">Two Byte Order</label>
+                    <select class="form-select" id="two_byte_order">
+                        <option value="big"    ${tbo === 'big'    ? 'selected' : ''}>Big Endian</option>
+                        <option value="little" ${tbo === 'little' ? 'selected' : ''}>Little Endian</option>
+                    </select>
+                </div>
+                <div class="form-group">
+                    <label class="form-label" for="four_byte_order">Four Byte Order</label>
+                    <select class="form-select" id="four_byte_order">
+                        <option value="big"         ${fbo === 'big'         ? 'selected' : ''}>Big Endian</option>
+                        <option value="big swap"    ${fbo === 'big swap'    ? 'selected' : ''}>Big Endian (Swap)</option>
+                        <option value="little"      ${fbo === 'little'      ? 'selected' : ''}>Little Endian</option>
+                        <option value="little swap" ${fbo === 'little swap' ? 'selected' : ''}>Little Endian (Swap)</option>
+                    </select>
+                </div>
+            </div>
+        </div>
+
+        ${p.protocol !== 'MODBUS' ? `
+            <div class="card card--info">
+                <p>${icon('alert-triangle', { size: 16 })} Select <strong>MODBUS</strong> as the protocol on the General Settings page.</p>
+            </div>
+        ` : ''}
+
+        <div class="card">
+            <div class="card__header">
+                <h2 class="card__title">${icon('list', { size: 18 })} Modbus Register Mapping</h2>
+                <button class="btn btn--outline btn--sm" id="modbus-add-btn">＋ Add Row</button>
+            </div>
+            <div class="data-table-wrapper">
+                <table class="data-table" id="modbus-table">
+                    <thead>
+                        <tr>
+                            <th style="width:90px;">Field</th>
+                            <th style="width:70px;">Addr</th>
+                            <th style="width:120px;">IDT</th>
+                            <th style="width:120px;">ODT</th>
+                            <th style="width:60px;">DV</th>
+                            <th style="width:60px;">Shift</th>
+                            <th style="width:100px;">Expr</th>
+                            <th style="width:80px;">Mask</th>
+                            <th class="col-action"></th>
+                        </tr>
+                    </thead>
+                    <tbody id="modbus-tbody"></tbody>
+                </table>
+            </div>
+        </div>
+
+        <!-- Field Description (collapsible) -->
+        <div class="card card--collapsible">
+            <div class="card__header card__header--clickable" id="modbus-legend-toggle">
+                <h2 class="card__title"><span class="card__title-icon">${icon('book-open', {size:16})}</span> Field Description</h2>
+                <span class="card__collapse-icon">▼</span>
+            </div>
+            <div class="card__body" id="modbus-legend-body" style="display:none;">
+                <div class="legend-grid">
+                    <div><strong>Field</strong> — Data field name</div>
+                    <div><strong>Addr</strong> — Modbus Register address</div>
+                    <div><strong>IDT</strong> — Input Data Type (integer / float64 / boolean / unsignedInteger / short / unsignedShort)</div>
+                    <div><strong>ODT</strong> — Output Data Type</div>
+                    <div><strong>DV</strong> — Default Value (used on connection failure)</div>
+                    <div><strong>Shift</strong> — Bit shift value</div>
+                    <div><strong>Expr</strong> — Conversion expression (e.g. x*0.1)</div>
+                    <div><strong>Mask</strong> — Bitmask (e.g. 0xffff)</div>
+                </div>
+            </div>
+        </div>
+    `;
+
+    // Populate rows using shared CRUD component
+    const tbody = document.getElementById('modbus-tbody');
+    _modbusTable = populateCrudTable(tbody, { columns: MODBUS_COLUMNS, data: rows });
+
+    // Add row button
+    document.getElementById('modbus-add-btn').addEventListener('click', () => {
+        _modbusTable.addEmptyRow();
+    });
+
+    // Legend toggle
+    document.getElementById('modbus-legend-toggle').addEventListener('click', () => {
+        const body = document.getElementById('modbus-legend-body');
+        const iconEl = document.querySelector('#modbus-legend-toggle .card__collapse-icon');
+        const isHidden = body.style.display === 'none';
+        body.style.display = isHidden ? 'block' : 'none';
+        if (iconEl) iconEl.textContent = isHidden ? '▲' : '▼';
+    });
+
+    // Register data collector
+    window.__pageCollectors.modbus = collectModbusData;
+}
+
+function collectModbusData() {
+    if (!state.protocol) state.protocol = {};
+    if (!state.device) state.device = {};
+    if (!state.device.server) state.device.server = {};
+
+    if (_modbusTable) {
+        state.protocol.MODBUS = _modbusTable.collectData();
+    }
+
+    // Byte order
+    const tboEl = document.getElementById('two_byte_order');
+    if (tboEl) state.protocol.two_byte_order = tboEl.value;
+    const fboEl = document.getElementById('four_byte_order');
+    if (fboEl) state.protocol.four_byte_order = fboEl.value;
+
+    // Server endpoint
+    state.device.server.modbus_server_ip = collectIpValue('modbus_server_ip');
+    const portEl = document.getElementById('modbus_server_port');
+    if (portEl) state.device.server.modbus_server_port = portEl.value.trim();
+}
+
+// ─── New Page Interface ─────────────────────────────────────────────────────
+const modbusPage = {
+    render(container) { renderModbusPage(container); },
+
+    mount(container) {
+        // Setup IP octet event listeners
+        setupIpOctets(container);
+        setupPortInputs(container);
+
+        const server = state.device?.server || {};
+        const p = state.protocol || {};
+
+        // Reactive binding: IP → state
+        bindIpGroup(container, 'modbus_server_ip',
+            () => server.modbus_server_ip || '',
+            (val) => {
+                if (!state.device) state.device = {};
+                if (!state.device.server) state.device.server = {};
+                state.device.server.modbus_server_ip = val;
+                state.isDirty = true;
+            }
+        );
+
+        // Reactive binding: Port → state
+        bindInput(container, '#modbus_server_port',
+            () => server.modbus_server_port || '',
+            (val) => {
+                if (!state.device) state.device = {};
+                if (!state.device.server) state.device.server = {};
+                state.device.server.modbus_server_port = val.trim();
+                state.isDirty = true;
+            }
+        );
+
+        // Reactive binding: Two byte order → state
+        bindInput(container, '#two_byte_order',
+            () => p.two_byte_order || 'big',
+            (val) => {
+                if (!state.protocol) state.protocol = {};
+                state.protocol.two_byte_order = val;
+                state.isDirty = true;
+            }
+        );
+
+        // Reactive binding: Four byte order → state
+        bindInput(container, '#four_byte_order',
+            () => p.four_byte_order || 'big',
+            (val) => {
+                if (!state.protocol) state.protocol = {};
+                state.protocol.four_byte_order = val;
+                state.isDirty = true;
+            }
+        );
+
+        window.__pageCollectors.modbus = collectModbusData;
+    },
+
+    destroy() {
+        _modbusTable = null;
+    },
+
+    validate() { return []; },
+};
+
+export default modbusPage;
diff --git a/src/static/js/pages/net-apply.js b/src/static/js/pages/net-apply.js
new file mode 100644
index 0000000..788cfca
--- /dev/null
+++ b/src/static/js/pages/net-apply.js
@@ -0,0 +1,329 @@
+// src/static/js/pages/net-apply.js — v1.6.0 Network Apply & Status UI
+// API endpoints: /api/network/state  /api/network/apply  /api/network/apply/status
+//                /api/network/apply/confirm  /api/network/rollback  /api/network/journal
+import { showToast } from '../toast.js';
+import { escapeHtml } from '../utils.js';
+import { icon } from '../icons.js';
+import { confirmModal } from '../confirm-modal.js';
+// v1.8.1 (review C-3): coordinate with the User-mode Simple Apply poller so the same apply
+//   is never polled by both modules at once (double toast / double CONFIRM_WAIT banner).
+import { _resetApplyFlow as stopUserApplyFlow, resumeIfConfirming as resumeUserApplyFlow } from '../apply-flow.js';
+
+let pollTimer = null, statusTimer = null, currentApplyId = null;
+// I-2: epoch guard — each pollStatus() call increments pollEpoch; stale resolutions drop themselves
+let pollEpoch = 0;
+// I-3: progress re-render throttle key
+let lastProgressKey = null;
+
+async function api(path, opts) {
+    const res = await fetch(path, opts);
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) throw new Error(body.error || `${path}: ${res.status}`);
+    return body;
+}
+
+function badge(cls, text) { return `<span class="net-badge net-badge--${cls}">${escapeHtml(text)}</span>`; }
+
+function renderState(s) {
+    const el = document.getElementById('net-state');
+    if (!el) return;
+    const drift = s.drift || {};
+    const ifaces = Object.entries(s.interfaces || {}).map(([n, v]) =>
+        `<div class="dash-row"><span class="dash-row__lbl">${escapeHtml(n)}</span>
+         <span class="dash-row__val">${escapeHtml(v.state || '')} ${escapeHtml((v.addrs || []).join(', '))}</span></div>`).join('');
+    const wd = s.watchdog || {};
+    el.innerHTML = `
+        ${drift.error ? `<div class="info-banner">${icon('alert-triangle', {size:14})}
+            Drift status unknown — could not read the saved network config. Re-check after the device settles.</div>`
+        : (drift.dirty ? `<div class="info-banner info-banner--warning">${icon('alert-triangle', {size:14})}
+            Saved settings are not applied yet — ${drift.fields.length} field(s) pending. Pending changes are applied by dpworldapp on the next reboot.
+            <span class="text-mono">${escapeHtml(drift.fields.join(', '))}</span></div>` : '')}
+        ${s.country_pending ? `<div class="info-banner info-banner--warning">${icon('refresh-cw', {size:14})}
+            Country change pending — <strong>Reboot required</strong>. Reboot soon to take effect.</div>` : ''}
+        <div class="dash-card"><h3 class="dash-card__title">${icon('globe', {size:16})} Live Interfaces</h3>${ifaces || '<div class="dash-row">—</div>'}</div>
+        <div class="dash-card"><h3 class="dash-card__title">${icon('activity', {size:16})} Watchdog</h3>
+            <div class="dash-row"><span class="dash-row__lbl">Status</span>
+                <span class="dash-row__val">${wd.critical ? badge('fail', 'CRITICAL') : (wd.enabled ? badge('ok', 'enabled') : badge('na', 'off'))}</span></div>
+            <div class="dash-row"><span class="dash-row__lbl">Last check</span>
+                <span class="dash-row__val text-mono">${escapeHtml(JSON.stringify(wd.last_results || {}))}</span></div></div>
+        ${lastApplyCard(s.last_apply || {})}`;
+    // eth1 (web access path) changes must stay Confirm-able even after reconnecting
+    // from the new IP — bound via delegation in mount() so it survives re-renders.
+}
+
+function lastApplyCard(la) {
+    const confirmRow = la.state === 'CONFIRM_WAIT'
+        ? `<div class="info-banner info-banner--warning">Waiting to confirm eth1 change — ${escapeHtml(String(la.confirm_remaining_s ?? '?'))}s remaining.
+           If you changed the IP, reconnect at <span class="text-mono">http://&lt;new IP&gt;:9090</span> and then
+           <button class="btn btn--primary btn--sm" data-net-confirm="${escapeHtml(la.apply_id || '')}">Confirm</button> here (auto-revert if not confirmed).</div>` : '';
+    return `<div class="dash-card"><h3 class="dash-card__title">${icon('check-circle-2', {size:16})} Last Apply</h3>
+        <div class="dash-row"><span class="dash-row__lbl">${escapeHtml(la.apply_id || '—')}</span>
+            <span class="dash-row__val">${escapeHtml(la.state || 'IDLE')}</span></div>${confirmRow}</div>`;
+}
+
+// #2: 운영자 watchdog kill-switch 카드 — net_config 의 watchdog 키 + critical 재무장.
+function renderWatchdogControl(cfg) {
+    const el = document.getElementById('net-watchdog-control');
+    if (!el) return;
+    const enabled = cfg.watchdog_enabled === 'on';
+    const autoRecover = cfg.watchdog_auto_recover === 'on';
+    el.innerHTML = `
+        <div class="dash-card"><h3 class="dash-card__title">${icon('settings', {size:16})} Watchdog Control</h3>
+            <label class="radio-label"><input type="checkbox" id="net-wd-enabled" data-no-dirty ${enabled ? 'checked' : ''}>
+                Enable continuous monitoring and self-recovery (off stops the watchdog)</label>
+            <label class="radio-label"><input type="checkbox" id="net-wd-auto" data-no-dirty ${autoRecover ? 'checked' : ''}>
+                Run automatic recovery (off logs a warning only on a fault)</label>
+            <div class="dash-actions">
+                <button class="btn btn--outline btn--sm" id="net-wd-reset" data-no-dirty>Re-arm recovery (critical reset)</button>
+            </div></div>`;
+    const enabledEl = document.getElementById('net-wd-enabled');
+    const autoEl = document.getElementById('net-wd-auto');
+    if (enabledEl) enabledEl.onchange = () => postWatchdogConfig({ watchdog_enabled: enabledEl.checked ? 'on' : 'off' });
+    if (autoEl) autoEl.onchange = () => postWatchdogConfig({ watchdog_auto_recover: autoEl.checked ? 'on' : 'off' });
+    const resetEl = document.getElementById('net-wd-reset');
+    if (resetEl) resetEl.onclick = () => postWatchdogConfig({ reset_watchdog_critical: true }, 'Recovery re-armed.');
+}
+
+async function postWatchdogConfig(body, okMsg) {
+    try {
+        const r = await api('api/network/config', { method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(body) });
+        showToast(okMsg || 'Watchdog settings saved.', 'success');
+        if (r.net_config) renderWatchdogControl(r.net_config);
+        refreshState();
+    } catch (e) { showToast('Watchdog settings failed — ' + e.message, 'error'); refreshWatchdogControl(); }
+}
+
+async function refreshWatchdogControl() {
+    try {
+        const r = await api('api/network/config');
+        // 서버는 효과적 기본값을 merge 해 net_config 를 반환 — 부재 시 안전 기본값
+        renderWatchdogControl(r.net_config || {});
+    } catch (e) { /* config 조회 실패는 조용히 — 카드 미표시 */ }
+}
+
+async function refreshState() {
+    try { renderState(await api('api/network/state')); } catch (e) { /* state 폴링 실패는 조용히 */ }
+    await refreshWatchdogControl();
+    try {
+        const j = await api('api/network/journal?limit=50');
+        const el = document.getElementById('net-journal');
+        if (el) el.textContent = (j.events || []).map(ev =>
+            `${ev.ts || ''} [${ev.category}/${ev.phase}] ${ev.action} → ${ev.result}`).join('\n');
+    } catch (e) { /* ignore */ }
+}
+
+async function doDryRun() {
+    try {
+        const r = await api('api/network/apply', { method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ dry_run: true, fields: {} }) });   // fields:{} → 현 DB 기준 drift 적용
+        const diff = r.diff || [];
+        const errors = r.errors || [];
+        const rows = diff.map(d =>
+            `<tr><td class="text-mono">${escapeHtml(d.field)}</td><td>${escapeHtml(d.old)}</td><td>${escapeHtml(d.new)}</td></tr>`).join('');
+        const warns = (r.warnings || []).map(w => badge('warn', w)).join(' ');
+        const diffBodyEl = document.getElementById('net-diff-body');
+        if (!diffBodyEl) { showToast('UI error: net-diff-body missing', 'error'); return; }
+        diffBodyEl.innerHTML = diff.length
+            ? `<table class="data-table"><thead><tr><th>Field</th><th>Applied</th><th>DB (new)</th></tr></thead><tbody>${rows}</tbody></table><p>${warns}</p>`
+            : '<p>No changes — the DB matches the applied configuration.</p>';
+        const modalEl = document.getElementById('net-diff-modal');
+        if (!modalEl) { showToast('UI error: net-diff-modal missing', 'error'); return; }
+        modalEl.classList.remove('hidden');
+        // eth1 changes require explicit checkbox consent before the apply button enables
+        const hasEth1 = (r.warnings || []).includes('eth1_confirm');
+        const hasCountry = (r.warnings || []).includes('country_reboot_deferred');
+        document.getElementById('net-eth1-consent-row')?.classList.toggle('hidden', !hasEth1);
+        document.getElementById('net-country-now-row')?.classList.toggle('hidden', !hasCountry);
+        // RESET checkboxes on every modal open — consent must not persist across dry-runs
+        const ethConsent = document.getElementById('net-eth1-consent');
+        const countryNowEl = document.getElementById('net-country-now');
+        const forceEl = document.getElementById('net-force');
+        if (ethConsent) ethConsent.checked = false;
+        if (countryNowEl) countryNowEl.checked = false;
+        if (forceEl) forceEl.checked = false;
+        const gate = () => {
+            const consentOk = !hasEth1 || (ethConsent ? ethConsent.checked : true);
+            const applyGoEl = document.getElementById('net-apply-go');
+            if (applyGoEl) applyGoEl.disabled = !diff.length || errors.length > 0 || !consentOk;
+        };
+        if (ethConsent) ethConsent.onchange = gate;
+        gate();
+        if (errors.length) showToast('Validation error: ' + errors[0], 'error');
+    } catch (e) { showToast('Dry-run failed — ' + e.message, 'error'); }
+}
+
+async function doApply() {
+    const force = document.getElementById('net-force')?.checked || false;
+    const countryNow = document.getElementById('net-country-now')?.checked || false;
+    try {
+        const r = await api('api/network/apply', { method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ dry_run: false, force, country_now: countryNow, fields: {} }) });
+        currentApplyId = r.apply_id;   // async STARTED — progress is tracked by status polling
+        pollEpoch++;                   // invalidate any in-flight stale poll from before this apply
+        document.getElementById('net-diff-modal')?.classList.add('hidden');
+        pollStatus();
+    } catch (e) { showToast('Apply failed to start — ' + e.message, 'error'); }
+}
+
+// I-2: setInterval replaced with chained setTimeout + epoch guard
+function pollStatus() {
+    if (statusTimer) { clearTimeout(statusTimer); statusTimer = null; }
+    const epoch = ++pollEpoch;
+    lastProgressKey = null; // force first render
+
+    async function tick() {
+        try {
+            const s = await api(`api/network/apply/status?id=${encodeURIComponent(currentApplyId || '')}`);
+            // Stale resolution — a newer pollStatus() was started; drop this result
+            if (epoch !== pollEpoch) return;
+            const el = document.getElementById('net-progress');
+            if (el) {
+                const key = `${s.state}|${s.apply_id}|${(s.steps || []).length}`;
+                if (key !== lastProgressKey) {
+                    lastProgressKey = key;
+                    const steps = (s.steps || []).map(st =>
+                        `<div class="dash-row">${st.result === 'ok' ? '✓' : st.result === 'warn' ? '△' : '✕'}
+                         <span class="dash-row__lbl">${escapeHtml(st.phase)}</span>
+                         <span class="dash-row__val">${escapeHtml(st.detail || '')}</span></div>`).join('');
+                    const confirmRow = s.state === 'CONFIRM_WAIT'
+                        ? `<div class="info-banner info-banner--warning">eth1 change — auto-revert if not confirmed within <span data-net-count>${escapeHtml(String(s.confirm_remaining_s ?? '?'))}</span>s.
+                           If you changed the IP, this tab's connection will drop — reconnect at <span class="text-mono">http://&lt;new IP&gt;:9090</span> and
+                           Confirm here.
+                           <button class="btn btn--primary btn--sm" data-net-confirm="${escapeHtml(currentApplyId || '')}">Confirm</button></div>` : '';
+                    el.innerHTML = `<div class="dash-card"><h3 class="dash-card__title">Progress — ${escapeHtml(s.state)}</h3>${steps}${confirmRow}</div>`;
+                } else if (s.state === 'CONFIRM_WAIT') {
+                    // Throttled path: only update countdown text, do NOT rebuild innerHTML
+                    const countEl = el.querySelector('[data-net-count]');
+                    if (countEl) countEl.textContent = String(s.confirm_remaining_s ?? '?');
+                }
+            }
+            const TERMINAL = ['COMMITTED', 'ROLLED_BACK', 'FAILED_CRITICAL', 'FAILED_VALIDATION', 'NOOP'];
+            if (TERMINAL.includes(s.state)) {
+                statusTimer = null;
+                pollEpoch++;          // prevent any further tick() from this generation
+                showToast(`Apply ${s.state}`, s.state === 'COMMITTED' ? 'success' : 'warning');
+                refreshState();
+                return;               // do not reschedule
+            }
+        } catch (e) { /* 폴링 일시 실패 무시 (eth1 IP 변경 중 단절 가능) */ }
+        // Still running — reschedule only if epoch still matches
+        if (epoch === pollEpoch) {
+            statusTimer = setTimeout(tick, 1000);
+        }
+    }
+    statusTimer = setTimeout(tick, 1000);
+}
+
+async function doConfirm(applyId) {
+    try {
+        await api('api/network/apply/confirm', { method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ apply_id: applyId || currentApplyId }) });
+        showToast('Confirmed — COMMITTED', 'success');
+        refreshState();
+    } catch (e) { showToast('Confirm failed — ' + e.message, 'error'); }
+}
+
+async function doRollback() {
+    // v1.7.1 Task 4: shared accessible confirm modal replaces native confirm().
+    const ok = await confirmModal({
+        title: 'Revert network settings?',
+        message: 'Restore the last-known-good network configuration. The current settings will be discarded.',
+        confirmLabel: 'Revert',
+        danger: true,
+    });
+    if (!ok) return;
+    try { await api('api/network/rollback', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: '{}' });
+          showToast('Network settings reverted.', 'success'); refreshState();
+    } catch (e) { showToast('Revert failed — ' + e.message, 'error'); }
+}
+
+// I-3: delegated click handler for Confirm buttons (survives re-renders)
+function onDelegatedClick(event) {
+    const btn = event.target.closest('[data-net-confirm]');
+    if (btn) doConfirm(btn.getAttribute('data-net-confirm'));
+}
+
+// #page-container 는 SPA 가 페이지 전환 시 innerHTML 만 갈아끼우고 엘리먼트는 재사용한다 —
+// 위임 리스너를 destroy 에서 제거하지 않으면 방문마다 누적되어 Confirm 이 N중 발화한다.
+let boundContainer = null;
+
+const netApplyPage = {
+    render(container) {
+        container.innerHTML = `
+            <div class="page-header"><h1 class="page-header__title">${icon('plug-zap', {size:28})} Network Apply &amp; Status</h1>
+                <p class="page-header__desc">Apply saved network settings to the OS and monitor the result. Enter settings on the Wi-Fi / Ethernet / Server Setting pages.</p></div>
+            <div class="dash-actions">
+                <button class="btn btn--outline btn--sm" id="net-dryrun">${icon('radar', {size:14})} Preview changes</button>
+                <button class="btn btn--outline btn--sm" id="net-rollback">${icon('refresh-cw', {size:14})} Revert to last-known-good</button>
+            </div>
+            <div id="net-state"></div>
+            <div id="net-watchdog-control"></div>
+            <div id="net-progress"></div>
+            <div class="dash-card"><h3 class="dash-card__title">${icon('file-text', {size:16})} Journal (last 50)</h3>
+                <pre class="fw-log" id="net-journal" style="display:block;max-height:300px;"></pre></div>
+            <div class="nav-guard__backdrop hidden" id="net-diff-modal"><div class="nav-guard__modal" style="max-width:640px;">
+                <h2 class="nav-guard__title">Apply preview</h2>
+                <div id="net-diff-body"></div>
+                <label class="radio-label hidden" id="net-eth1-consent-row"><input type="checkbox" id="net-eth1-consent" data-no-dirty>
+                    I understand: changing eth1 (web access path) will auto-revert unless I reconnect at the new address and Confirm within 90 seconds.</label>
+                <label class="radio-label hidden" id="net-country-now-row"><input type="checkbox" id="net-country-now" data-no-dirty>
+                    Apply country change now (advanced — Wi-Fi drops for 10-20s; keep a console/eth1 path. If unchecked, it applies on the next reboot).</label>
+                <label class="radio-label"><input type="checkbox" id="net-force" data-no-dirty> Apply without validation (advanced — for pre-provisioning; recorded in the journal).</label>
+                <div class="nav-guard__actions">
+                    <button class="btn btn--primary" id="net-apply-go">Start apply</button>
+                    <button class="btn btn--ghost" id="net-diff-close">Close</button>
+                </div></div></div>`;
+    },
+    mount(container) {
+        // v1.8.1 (review C-3): this Advanced page is the active apply control surface while
+        //   mounted — take over from the User-mode apply-flow poller (stop its poll + clear its
+        //   persistent banner) so only ONE poller drives the in-flight apply. Handed back on destroy().
+        stopUserApplyFlow();
+        container.querySelector('#net-dryrun')?.addEventListener('click', doDryRun);
+        container.querySelector('#net-rollback')?.addEventListener('click', doRollback);
+        container.querySelector('#net-apply-go')?.addEventListener('click', doApply);
+        container.querySelector('#net-diff-close')?.addEventListener('click', () =>
+            document.getElementById('net-diff-modal')?.classList.add('hidden'));
+
+        // I-3: single delegated listener for all Confirm buttons — survives re-renders
+        if (boundContainer) boundContainer.removeEventListener('click', onDelegatedClick);
+        boundContainer = container;
+        container.addEventListener('click', onDelegatedClick);
+
+        refreshState().then(async () => {
+            // Resume polling if an apply is already in flight (e.g. page reload during apply)
+            try {
+                const s = await api(`api/network/apply/status?id=${encodeURIComponent(currentApplyId || '')}`);
+                const IN_FLIGHT = ['VALIDATING', 'SNAPSHOT', 'WRITING', 'APPLYING', 'VERIFYING', 'CONFIRM_WAIT'];
+                if (IN_FLIGHT.includes(s.state)) {
+                    currentApplyId = s.apply_id;
+                    pollStatus();
+                }
+            } catch (e) { /* no in-flight apply */ }
+        });
+        pollTimer = setInterval(refreshState, 10000);
+    },
+    destroy() {
+        if (pollTimer) { clearInterval(pollTimer); pollTimer = null; }
+        if (statusTimer) { clearTimeout(statusTimer); statusTimer = null; }
+        pollEpoch++;           // orphan any in-flight tick()s
+        currentApplyId = null;
+        lastProgressKey = null;
+        if (boundContainer) {
+            boundContainer.removeEventListener('click', onDelegatedClick);
+            boundContainer = null;
+        }
+        // v1.8.1 (review C-1/C-3): hand the apply back to the persistent User-mode banner.
+        //   If still in-flight (e.g. operator leaves this page or drops to User mode during
+        //   CONFIRM_WAIT), apply-flow re-paints the plain eth1 reconnect banner in
+        //   #apply-flow-host so the confirm is never lost. No-op if the apply already terminated.
+        resumeUserApplyFlow();
+    },
+    validate() { return []; },
+};
+export default netApplyPage;
diff --git a/src/static/js/pages/network.js b/src/static/js/pages/network.js
new file mode 100644
index 0000000..f744b14
--- /dev/null
+++ b/src/static/js/pages/network.js
@@ -0,0 +1,207 @@
+/**
+ * network.js — Network Configuration Page
+ * 
+ * Server endpoint settings (IP + Port for all server types).
+ * Uses shared IP octet component.
+ */
+
+import { state, bindIpGroup, bindInput } from '../state.js';
+import { escapeHtml } from '../utils.js';
+import { isValidIP, isValidPort } from '../validator.js';
+import { renderIpOctets, setupIpOctets, collectIpValue } from '../components/ip-input.js';
+import { setupPortInputs } from '../components/port-input.js';
+
+export function renderNetworkPage(container) {
+    const device = state.device || {};
+    const server = device.server || {};
+
+    const servers = [
+        { label: 'TIOT Server', ipKey: 'protocol_server_ip', portKey: 'protocol_server_port' },
+        { label: 'Update Server', ipKey: 'update_server_ip', portKey: 'update_server_port' },
+        { label: 'DGPS Server', ipKey: 'rtcm_server_ip', portKey: 'rtcm_server_port' },
+        { label: 'OPC-UA Server', ipKey: 'opc_ua_server_ip', portKey: 'opc_ua_server_port' },
+        { label: 'Modbus Server', ipKey: 'modbus_server_ip', portKey: 'modbus_server_port' },
+        { label: 'LTE Server', ipKey: 'lte_server_ip', portKey: 'lte_server_port' },
+    ];
+
+    container.innerHTML = `
+        <div class="page-header">
+            <h1 class="page-header__title">🌐 Network Settings</h1>
+            <p class="page-header__desc">Configure IP addresses and ports for each server.</p>
+        </div>
+
+        <div class="card" style="width: fit-content; margin-left: auto; margin-right: auto;">
+            <div class="card__header">
+                <h2 class="card__title"><span class="card__title-icon">🖥️</span> Server Endpoints</h2>
+            </div>
+            <div class="data-table-wrapper">
+                <table class="data-table" style="width: auto;">
+                    <thead>
+                        <tr>
+                            <th style="width: 160px;">Server Type</th>
+                            <th>IP Address</th>
+                            <th style="width: 100px;">Port</th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        ${servers.map(s => `
+                            <tr>
+                                <td style="font-weight: 500; color: var(--text-primary);">${s.label}</td>
+                                <td>${renderIpOctets(s.ipKey, server[s.ipKey] || '')}</td>
+                                <td><input class="form-input form-input--mono" id="${s.portKey}" value="${escapeHtml(server[s.portKey])}" placeholder="0"></td>
+                            </tr>
+                        `).join('')}
+                    </tbody>
+                </table>
+            </div>
+        </div>
+    `;
+
+    // Setup IP octet event listeners
+    setupIpOctets(container);
+
+    setupPortInputs(container);
+
+    // Register data collector
+    window.__pageCollectors.network = collectNetworkData;
+}
+
+function collectNetworkData() {
+    if (!state.device) state.device = {};
+
+    const ipKeys = [
+        'protocol_server_ip', 'update_server_ip', 'rtcm_server_ip',
+        'opc_ua_server_ip', 'modbus_server_ip', 'lte_server_ip',
+    ];
+    const portKeys = [
+        'protocol_server_port', 'update_server_port', 'rtcm_server_port',
+        'opc_ua_server_port', 'modbus_server_port', 'lte_server_port',
+    ];
+
+    const server = {};
+
+    ipKeys.forEach(ipKey => {
+        server[ipKey] = collectIpValue(ipKey);
+    });
+
+    portKeys.forEach(key => {
+        const el = document.getElementById(key);
+        if (el) {
+            server[key] = el.value.trim();
+        }
+    });
+
+    state.device.server = server;
+}
+
+// ─── Server definitions (shared) ────────────────────────────
+const SERVERS = [
+    { label: 'TIOT Server', ipKey: 'protocol_server_ip', portKey: 'protocol_server_port' },
+    { label: 'Update Server', ipKey: 'update_server_ip', portKey: 'update_server_port' },
+    { label: 'DGPS Server', ipKey: 'rtcm_server_ip', portKey: 'rtcm_server_port' },
+    { label: 'OPC-UA Server', ipKey: 'opc_ua_server_ip', portKey: 'opc_ua_server_port' },
+    { label: 'Modbus Server', ipKey: 'modbus_server_ip', portKey: 'modbus_server_port' },
+    { label: 'LTE Server', ipKey: 'lte_server_ip', portKey: 'lte_server_port' },
+];
+
+// ─── New Page Interface ─────────────────────────────────────
+const networkPage = {
+    render(container) {
+        const device = state.device || {};
+        const server = device.server || {};
+
+        container.innerHTML = `
+            <div class="page-header">
+                <h1 class="page-header__title">🌐 Network Settings</h1>
+                <p class="page-header__desc">Configure IP addresses and ports for each server.</p>
+            </div>
+
+            <div class="card" style="width: fit-content; margin-left: auto; margin-right: auto;">
+                <div class="card__header">
+                    <h2 class="card__title"><span class="card__title-icon">🖥️</span> Server Endpoints</h2>
+                </div>
+                <div class="data-table-wrapper">
+                    <table class="data-table" style="width: auto;">
+                        <thead>
+                            <tr>
+                                <th style="width: 160px;">Server Type</th>
+                                <th>IP Address</th>
+                                <th style="width: 100px;">Port</th>
+                            </tr>
+                        </thead>
+                        <tbody>
+                            ${SERVERS.map(s => `
+                                <tr>
+                                    <td style="font-weight: 500; color: var(--text-primary);">${s.label}</td>
+                                    <td>${renderIpOctets(s.ipKey, server[s.ipKey] || '')}</td>
+                                    <td><input class="form-input form-input--mono" id="${s.portKey}" value="${escapeHtml(server[s.portKey])}" placeholder="0"></td>
+                                </tr>
+                            `).join('')}
+                        </tbody>
+                    </table>
+                </div>
+            </div>
+        `;
+    },
+
+    mount(container) {
+        const server = state.device?.server || {};
+
+        // Setup IP octet event listeners (auto-tab, paste, numeric enforcement)
+        setupIpOctets(container);
+        setupPortInputs(container);
+
+        // Reactive bindings: IP groups → state
+        SERVERS.forEach(s => {
+            bindIpGroup(container, s.ipKey,
+                () => server[s.ipKey] || '',
+                (val) => {
+                    if (!state.device) state.device = {};
+                    if (!state.device.server) state.device.server = {};
+                    state.device.server[s.ipKey] = val;
+                    state.isDirty = true;
+                }
+            );
+        });
+
+        // Reactive bindings: Port inputs → state
+        SERVERS.forEach(s => {
+            bindInput(container, `#${s.portKey}`,
+                () => server[s.portKey] || '',
+                (val) => {
+                    if (!state.device) state.device = {};
+                    if (!state.device.server) state.device.server = {};
+                    state.device.server[s.portKey] = val.trim();
+                    state.isDirty = true;
+                }
+            );
+        });
+
+        // Register legacy collector (R4: __pageCollectors 유지)
+        window.__pageCollectors.network = collectNetworkData;
+    },
+
+    destroy() {
+        // No cleanup needed — DOM is replaced by showPage()
+    },
+
+    validate() {
+        const errors = [];
+        const server = state.device?.server || {};
+
+        SERVERS.forEach(s => {
+            const ip = server[s.ipKey];
+            if (ip && ip !== '...' && !isValidIP(ip)) {
+                errors.push({ field: s.ipKey, page: 'network', message: `${s.label} — Invalid IP format` });
+            }
+            const port = server[s.portKey];
+            if (port && !isValidPort(port)) {
+                errors.push({ field: s.portKey, page: 'network', message: `${s.label} Port — Must be 1–65535` });
+            }
+        });
+
+        return errors;
+    },
+};
+
+export default networkPage;
diff --git a/src/static/js/pages/opcua.js b/src/static/js/pages/opcua.js
new file mode 100644
index 0000000..f65fa8b
--- /dev/null
+++ b/src/static/js/pages/opcua.js
@@ -0,0 +1,164 @@
+/**
+ * opcua.js — OPC UA Configuration Page
+ *
+ * v1.5.0 Phase 3: Server Endpoint card 추가 (opc_ua_server_ip + opc_ua_server_port)
+ * + 기존 OPC-UA Node Mapping table 유지.
+ *
+ * Columns: Field, NS (Namespace), Addr (Node ID), ODT, DV, Shift, Expr, Mask
+ * Note: No IDT column (differs from MODBUS)
+ *
+ * Data source: state.protocol.OPC_UA (array), state.device.server.*
+ */
+
+import { state, bindIpGroup, bindInput } from '../state.js';
+import { populateCrudTable } from '../components/crud-table.js';
+import { ODT_OPTIONS } from '../constants.js';
+import { renderIpOctets, setupIpOctets, collectIpValue } from '../components/ip-input.js';
+import { setupPortInputs } from '../components/port-input.js';
+import { escapeHtml } from '../utils.js';
+import { icon } from '../icons.js';
+
+const OPCUA_COLUMNS = [
+    { key: 'field', label: 'Field', placeholder: 'TMP1', maxLength: 4 },
+    { key: 'ns', label: 'NS', placeholder: '3', width: '60px' },
+    { key: 'addr', label: 'Addr', placeholder: '1001' },
+    { key: 'odt', label: 'ODT', type: 'select', options: ODT_OPTIONS },
+    { key: 'dv', label: 'DV', placeholder: '-9', defaultValue: '-9', width: '60px' },
+    { key: 'shift', label: 'Shift', placeholder: '0', defaultValue: '0', width: '60px' },
+    { key: 'expr', label: 'Expr', placeholder: 'x*10' },
+    { key: 'mask', label: 'Mask', placeholder: '0xffff' },
+];
+
+let _opcuaTable = null;
+
+export function renderOpcuaPage(container) {
+    const p = state.protocol || {};
+    const d = state.device || {};
+    const server = d.server || {};
+    const rows = p.OPC_UA || [];
+
+    container.innerHTML = `
+        <div class="page-header">
+            <h1 class="page-header__title">${icon('link', { size: 28 })} OPC UA</h1>
+            <p class="page-header__desc">OPC UA server endpoint and node mapping.</p>
+        </div>
+
+        <div class="card">
+            <div class="card__header">
+                <h2 class="card__title">${icon('server', { size: 18 })} Server Endpoint</h2>
+            </div>
+            <div class="form-row">
+                <div class="form-group">
+                    <label class="form-label">Server IP</label>
+                    ${renderIpOctets('opc_ua_server_ip', server.opc_ua_server_ip || '')}
+                </div>
+                <div class="form-group">
+                    <label class="form-label">Server Port</label>
+                    <input class="form-input form-input--mono" id="opc_ua_server_port" value="${escapeHtml(server.opc_ua_server_port || '')}" placeholder="4840">
+                </div>
+            </div>
+        </div>
+
+        ${p.protocol !== 'OPC_UA' ? `
+            <div class="card card--info">
+                <p>${icon('alert-triangle', { size: 16 })} Select <strong>OPC_UA</strong> as the protocol on the General Settings page.</p>
+            </div>
+        ` : ''}
+
+        <div class="card">
+            <div class="card__header">
+                <h2 class="card__title">${icon('list', { size: 18 })} OPC-UA Node Mapping</h2>
+                <button class="btn btn--outline btn--sm" id="opcua-add-btn">＋ Add Row</button>
+            </div>
+            <div class="data-table-wrapper">
+                <table class="data-table" id="opcua-table">
+                    <thead>
+                        <tr>
+                            <th style="width:90px;">Field</th>
+                            <th style="width:60px;">NS</th>
+                            <th style="width:80px;">Addr</th>
+                            <th style="width:120px;">ODT</th>
+                            <th style="width:60px;">DV</th>
+                            <th style="width:60px;">Shift</th>
+                            <th style="width:120px;">Expr</th>
+                            <th style="width:80px;">Mask</th>
+                            <th class="col-action"></th>
+                        </tr>
+                    </thead>
+                    <tbody id="opcua-tbody"></tbody>
+                </table>
+            </div>
+        </div>
+    `;
+
+    // Populate rows using shared CRUD component
+    const tbody = document.getElementById('opcua-tbody');
+    _opcuaTable = populateCrudTable(tbody, { columns: OPCUA_COLUMNS, data: rows });
+
+    // Add row
+    document.getElementById('opcua-add-btn').addEventListener('click', () => {
+        _opcuaTable.addEmptyRow();
+    });
+
+    // Register data collector
+    window.__pageCollectors.opcua = collectOpcuaData;
+}
+
+function collectOpcuaData() {
+    if (!state.protocol) state.protocol = {};
+    if (!state.device) state.device = {};
+    if (!state.device.server) state.device.server = {};
+
+    if (_opcuaTable) {
+        state.protocol.OPC_UA = _opcuaTable.collectData();
+    }
+
+    state.device.server.opc_ua_server_ip = collectIpValue('opc_ua_server_ip');
+    const portEl = document.getElementById('opc_ua_server_port');
+    if (portEl) state.device.server.opc_ua_server_port = portEl.value.trim();
+}
+
+// ─── New Page Interface ─────────────────────────────────────────────────────
+const opcuaPage = {
+    render(container) { renderOpcuaPage(container); },
+
+    mount(container) {
+        // Setup IP octet event listeners
+        setupIpOctets(container);
+        setupPortInputs(container);
+
+        const server = state.device?.server || {};
+
+        // Reactive binding: IP → state
+        bindIpGroup(container, 'opc_ua_server_ip',
+            () => server.opc_ua_server_ip || '',
+            (val) => {
+                if (!state.device) state.device = {};
+                if (!state.device.server) state.device.server = {};
+                state.device.server.opc_ua_server_ip = val;
+                state.isDirty = true;
+            }
+        );
+
+        // Reactive binding: Port → state
+        bindInput(container, '#opc_ua_server_port',
+            () => server.opc_ua_server_port || '',
+            (val) => {
+                if (!state.device) state.device = {};
+                if (!state.device.server) state.device.server = {};
+                state.device.server.opc_ua_server_port = val.trim();
+                state.isDirty = true;
+            }
+        );
+
+        window.__pageCollectors.opcua = collectOpcuaData;
+    },
+
+    destroy() {
+        _opcuaTable = null;
+    },
+
+    validate() { return []; },
+};
+
+export default opcuaPage;
diff --git a/src/static/js/pages/register.js b/src/static/js/pages/register.js
new file mode 100644
index 0000000..9501e30
--- /dev/null
+++ b/src/static/js/pages/register.js
@@ -0,0 +1,480 @@
+/**
+ * register.js — Register / Protocol Settings Page
+ * 
+ * Equipment info, protocol selection (OPC_UA/MODBUS/NONE),
+ * CAN/DR/Heading toggles, Analog/Digital port config, byte order.
+ * 
+ * Changes:
+ * - "Input Level" → "Analog Input Level"
+ * - AI0~AI3, DI0~DI3: dropdown → checkbox toggle (data: "1"/"0")
+ * - Byte Order moved into Protocol Selection card (Modbus-only)
+ * 
+ * Data source: state.protocol
+ */
+
+import { state, bindInput, bindRadio, bindCheckbox } from '../state.js';
+import { updateTabVisibility } from '../app.js';
+import { escapeHtml } from '../utils.js';
+
+const EQUIPMENT_MEID = {
+    ITV: '1000', STS: '2000', RTG: '3000', RMG: '4000',
+    RS: '5000', ECH: '6000', MHC: '9000',
+    // v1.4.6.2 F4: FL/CR 제거 (v1.4.6.1 B-2 equipment dropdown 정합)
+};
+
+// v2: four_byte_order label helper — space forms canonical (reader: case-insensitive)
+function _fourByteLabel(v) {
+    if (!v) return '— Select —';
+    switch (v) {
+        case 'big': return 'Big Endian';
+        case 'big swap': return 'Big Endian (Swap)';
+        case 'little': return 'Little Endian';
+        case 'little swap': return 'Little Endian (Swap)';
+        default: return v;
+    }
+}
+
+export function renderRegisterPage(container) {
+    const p = state.protocol || {};
+    const isModbus = p.protocol === 'MODBUS';
+
+    container.innerHTML = `
+        <div class="page-header">
+            <h1 class="page-header__title">📋 Protocol Settings</h1>
+            <p class="page-header__desc">Configure equipment info, protocol, and I/O ports.</p>
+        </div>
+
+        <!-- Card: Equipment Info -->
+        <div class="card">
+            <div class="card__header">
+                <h2 class="card__title"><span class="card__title-icon">🏗️</span> Equipment Info</h2>
+            </div>
+            <div class="form-row">
+                <div class="form-group">
+                    <label class="form-label">Equipment Type</label>
+                    <select class="form-select" id="reg-equipment_type">
+                        ${['RTLS', 'TIOT'].map(v =>
+        `<option value="${v}" ${p.dev_type === v ? 'selected' : ''}>${v}</option>`
+    ).join('')}
+                    </select>
+                </div>
+                <div class="form-group">
+                    <label class="form-label">Equipment</label>
+                    <select class="form-select" id="reg-equipment">
+                        ${// v1.4.6.1 B-2: Java Equipment enum 7 값과 정합 (FL/CR 제거)
+                        ['ITV', 'RS', 'ECH', 'RTG', 'RMG', 'MHC', 'STS'].map(v =>
+        `<option value="${v}" ${p.equipment === v ? 'selected' : ''}>${v}</option>`
+    ).join('')}
+                    </select>
+                </div>
+            </div>
+            <div class="form-row">
+                <div class="form-group">
+                    <label class="form-label">Equipment ID</label>
+                    <input class="form-input form-input--mono" id="reg-equipment_id" value="${escapeHtml(p.equipment_id || '01')}" placeholder="01">
+                </div>
+                <div class="form-group">
+                    <label class="form-label">MEID</label>
+                    <input class="form-input form-input--mono" id="reg-MEID" value="${escapeHtml(p.MEID || EQUIPMENT_MEID[p.equipment] || '1000')}" placeholder="1000">
+                </div>
+            </div>
+            <div class="form-row">
+                <div class="form-group">
+                    <label class="form-label">Version</label>
+                    <input class="form-input" id="reg-version" value="${escapeHtml(p.version || 'v1.0')}" placeholder="v1.0">
+                </div>
+                <div class="form-group"></div>
+            </div>
+        </div>
+
+        <!-- Card: Protocol Selection + Byte Order -->
+        <div class="card">
+            <div class="card__header">
+                <h2 class="card__title"><span class="card__title-icon">📡</span> Protocol Selection</h2>
+            </div>
+            <div class="form-group">
+                <label class="form-label">Protocol</label>
+                <div class="radio-group">
+                    ${['OPC_UA', 'MODBUS', 'NONE'].map(v => `
+                        <label class="radio-label">
+                            <input type="radio" name="reg-protocol" value="${v}" ${p.protocol === v ? 'checked' : ''}>
+                            ${v}
+                        </label>
+                    `).join('')}
+                </div>
+            </div>
+
+            <div class="form-row">
+                ${renderToggle('CAN Input', 'reg-can_input', p.can_input)}
+                ${renderToggle('DR', 'reg-dr', p.dr_on)}
+            </div>
+            <div class="form-row">
+                ${renderToggle('Heading', 'reg-heading', p.heading_on)}
+                ${renderToggle('Heading IMU', 'reg-heading_imu', p.heading_imu_on)}
+            </div>
+            <div class="form-row">
+                ${renderToggle('Fix Mode', 'reg-fix_mode', p.fix_mode_on)}
+                <div class="form-group">
+                    <label class="form-label">Speed Data</label>
+                    <select class="form-select" id="reg-speed_data">
+                        ${['', 'CAN', 'GPS'].map(v =>
+        `<option value="${v}" ${p.speed_data === v ? 'selected' : ''}>${v || '— Select —'}</option>`
+    ).join('')}
+                    </select>
+                </div>
+            </div>
+
+            <!-- Byte Order — visible only when Modbus selected -->
+            <div class="form-row" id="byte-order-section" style="${isModbus ? '' : 'display:none;'}">
+                <div class="form-group">
+                    <label class="form-label">Byte Order (2-byte)</label>
+                    <select class="form-select" id="reg-two_byte_order">
+                        ${['', 'big', 'little'].map(v =>
+        `<option value="${v}" ${p.two_byte_order === v ? 'selected' : ''}>${v ? (v === 'big' ? 'Big Endian' : 'Little Endian') : '— Select —'}</option>`
+    ).join('')}
+                    </select>
+                </div>
+                <div class="form-group">
+                    <label class="form-label">Byte Order (4-byte)</label>
+                    <select class="form-select" id="reg-four_byte_order">
+                        ${['', 'big', 'big swap', 'little', 'little swap'].map(v =>
+        `<option value="${v}" ${p.four_byte_order === v ? 'selected' : ''}>${_fourByteLabel(v)}</option>`
+    ).join('')}
+                    </select>
+                </div>
+            </div>
+        </div>
+
+        <!-- Card: Analog / Digital Ports -->
+        <div class="card">
+            <div class="card__header">
+                <h2 class="card__title"><span class="card__title-icon">🎛️</span> Analog / Digital Ports</h2>
+            </div>
+            <div class="form-group" style="max-width: 200px;">
+                <label class="form-label">Analog Input Level</label>
+                <select class="form-select" id="reg-input_level">
+                    ${['', '2', '4', '6'].map(v =>
+        `<option value="${v}" ${p.analog_input_level === v ? 'selected' : ''}>${v || '— Select —'}</option>`
+    ).join('')}
+                </select>
+            </div>
+            <div class="data-table-wrapper">
+                <table class="data-table">
+                    <thead>
+                        <tr>
+                            <th style="width:100px;"></th>
+                            <th style="text-align:center;">AI0</th><th style="text-align:center;">AI1</th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        <tr>
+                            <td style="font-weight:500;">Enable</td>
+                            ${[0, 1].map(i => `<td style="text-align:center;"><input type="checkbox" class="checkbox-toggle" id="reg-ai${i}" ${p['ai' + i] === '1' || p['ai' + i] === 'on' ? 'checked' : ''}></td>`).join('')}
+                        </tr>
+                    </tbody>
+                </table>
+            </div>
+            <div class="data-table-wrapper" style="margin-top:12px;">
+                <table class="data-table">
+                    <thead>
+                        <tr>
+                            <th style="width:100px;"></th>
+                            <th style="text-align:center;">DI0</th><th style="text-align:center;">DI1</th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        <tr>
+                            <td style="font-weight:500;">Enable</td>
+                            ${[0, 1].map(i => `<td style="text-align:center;"><input type="checkbox" class="checkbox-toggle" id="reg-di${i}" ${p['di' + i] === '1' || p['di' + i] === 'on' ? 'checked' : ''}></td>`).join('')}
+                        </tr>
+                    </tbody>
+                </table>
+            </div>
+        </div>
+
+        <!-- Card: Odometer (v1.4.6 C) — odo_on + speed/direction source fields -->
+        <div class="card">
+            <div class="card__header">
+                <h2 class="card__title"><span class="card__title-icon">🛞</span> Odometer</h2>
+            </div>
+            <div class="form-row">
+                ${renderToggle('Odometer', 'reg-odo_on', p.odo_on)}
+            </div>
+
+            <div id="odo-section" style="${p.odo_on === 'on' ? '' : 'display:none;'}">
+                <h3 class="form-section-title" style="margin-top:1rem;">Odometer Speed</h3>
+                <div class="form-row">
+                    <div class="form-group">
+                        <label class="form-label">Source</label>
+                        <select class="form-select" id="reg-odo_speed_source">
+                            ${['can', 'hw'].map(v => `<option value="${v}" ${p.odo_speed?.source === v ? 'selected' : ''}>${v.toUpperCase()}</option>`).join('')}
+                        </select>
+                    </div>
+                    <div class="form-group">
+                        <label class="form-label">CAN ID (hex)</label>
+                        <input type="text" class="form-input" id="reg-odo_speed_id" value="${escapeHtml(p.odo_speed?.id || '')}" placeholder="0x56E">
+                    </div>
+                </div>
+                <div class="form-row">
+                    <div class="form-group">
+                        <label class="form-label">Shift</label>
+                        <input type="number" class="form-input" id="reg-odo_speed_shift" value="${Number(p.odo_speed?.shift) || 0}" min="0" max="63">
+                    </div>
+                    <div class="form-group">
+                        <label class="form-label">Mask (hex)</label>
+                        <input type="text" class="form-input" id="reg-odo_speed_mask" value="${escapeHtml(p.odo_speed?.mask || '')}" placeholder="0x0f">
+                    </div>
+                </div>
+                <div class="form-row">
+                    <div class="form-group" style="flex:1;">
+                        <label class="form-label">Expression</label>
+                        <input type="text" class="form-input" id="reg-odo_speed_expr" value="${escapeHtml(p.odo_speed?.expr || '')}" placeholder="x*1000" maxlength="256">
+                    </div>
+                </div>
+
+                <h3 class="form-section-title" style="margin-top:1rem;">Odometer Direction</h3>
+                <div class="form-row">
+                    <div class="form-group">
+                        <label class="form-label">Source</label>
+                        <select class="form-select" id="reg-odo_direction_source">
+                            ${['can', 'hw'].map(v => `<option value="${v}" ${p.odo_direction?.source === v ? 'selected' : ''}>${v.toUpperCase()}</option>`).join('')}
+                        </select>
+                    </div>
+                    <div class="form-group">
+                        <label class="form-label">CAN ID (hex)</label>
+                        <input type="text" class="form-input" id="reg-odo_direction_id" value="${escapeHtml(p.odo_direction?.id || '')}" placeholder="0x169">
+                    </div>
+                </div>
+                <div class="form-row">
+                    <div class="form-group">
+                        <label class="form-label">Shift</label>
+                        <input type="number" class="form-input" id="reg-odo_direction_shift" value="${Number(p.odo_direction?.shift) || 0}" min="0" max="63">
+                    </div>
+                    <div class="form-group">
+                        <label class="form-label">Mask (hex)</label>
+                        <input type="text" class="form-input" id="reg-odo_direction_mask" value="${escapeHtml(p.odo_direction?.mask || '')}" placeholder="0x0f">
+                    </div>
+                </div>
+                <div class="form-row">
+                    <div class="form-group" style="flex:1;">
+                        <label class="form-label">Expression</label>
+                        <input type="text" class="form-input" id="reg-odo_direction_expr" value="${escapeHtml(p.odo_direction?.expr || '')}" placeholder="x-7" maxlength="256">
+                    </div>
+                </div>
+            </div>
+        </div>
+    `;
+
+    // Equipment change → auto-fill MEID
+    document.getElementById('reg-equipment').addEventListener('change', (e) => {
+        const meid = EQUIPMENT_MEID[e.target.value];
+        if (meid) {
+            document.getElementById('reg-MEID').value = meid;
+        }
+    });
+
+    // Protocol change → update sidebar tab visibility + Byte Order section
+    document.querySelectorAll('input[name="reg-protocol"]').forEach(radio => {
+        radio.addEventListener('change', (e) => {
+            state.protocol.protocol = e.target.value;
+            updateTabVisibility();
+            // Toggle Byte Order visibility
+            const byteOrderSection = document.getElementById('byte-order-section');
+            if (byteOrderSection) {
+                byteOrderSection.style.display = e.target.value === 'MODBUS' ? '' : 'none';
+            }
+        });
+    });
+
+    // CAN input change → update sidebar tab visibility
+    document.querySelectorAll('input[name="reg-can_input"]').forEach(radio => {
+        radio.addEventListener('change', (e) => {
+            state.protocol.can_input = e.target.value;
+            updateTabVisibility();
+        });
+    });
+
+    // Initialize tab visibility
+    updateTabVisibility();
+
+    // Register data collector
+    window.__pageCollectors.register = collectRegisterData;
+}
+
+function renderToggle(label, name, currentValue) {
+    return `
+        <div class="form-group">
+            <label class="form-label">${label}</label>
+            <div class="radio-group">
+                <label class="radio-label">
+                    <input type="radio" name="${name}" value="on" ${currentValue === 'on' ? 'checked' : ''}>
+                    On
+                </label>
+                <label class="radio-label">
+                    <input type="radio" name="${name}" value="off" ${currentValue !== 'on' ? 'checked' : ''}>
+                    Off
+                </label>
+            </div>
+        </div>
+    `;
+}
+
+function collectRegisterData() {
+    if (!state.protocol) state.protocol = {};
+    const p = state.protocol;
+
+    // Equipment info
+    p.dev_type = document.getElementById('reg-equipment_type')?.value || '';
+    p.equipment = document.getElementById('reg-equipment')?.value || '';
+    p.equipment_id = document.getElementById('reg-equipment_id')?.value || '';
+    p.MEID = document.getElementById('reg-MEID')?.value || '';
+    p.version = document.getElementById('reg-version')?.value || '';
+
+    // Protocol
+    p.protocol = document.querySelector('input[name="reg-protocol"]:checked')?.value || 'NONE';
+
+    // Toggles
+    p.can_input = document.querySelector('input[name="reg-can_input"]:checked')?.value || 'off';
+    p.dr_on = document.querySelector('input[name="reg-dr"]:checked')?.value || 'off';
+    p.heading_on = document.querySelector('input[name="reg-heading"]:checked')?.value || 'off';
+    p.heading_imu_on = document.querySelector('input[name="reg-heading_imu"]:checked')?.value || 'off';
+    p.fix_mode_on = document.querySelector('input[name="reg-fix_mode"]:checked')?.value || 'off';
+    p.speed_data = document.getElementById('reg-speed_data')?.value || '';
+
+    // A/D Ports — checkbox → "1" (checked) / "0" (unchecked)
+    // v1.4.6 A: live .55 config + dha baseline ai0/ai1/di0/di1만 (ai2/ai3/di2/di3 phantom 제거)
+    p.analog_input_level = document.getElementById('reg-input_level')?.value || '';
+    for (let i = 0; i < 2; i++) {
+        const aiEl = document.getElementById('reg-ai' + i);
+        const diEl = document.getElementById('reg-di' + i);
+        p['ai' + i] = aiEl?.checked ? '1' : '0';
+        p['di' + i] = diEl?.checked ? '1' : '0';
+    }
+
+    // Byte order
+    p.two_byte_order = document.getElementById('reg-two_byte_order')?.value || '';
+    p.four_byte_order = document.getElementById('reg-four_byte_order')?.value || '';
+
+    // v1.4.6 C: Odometer (odo_on toggle + odo_speed/odo_direction nested)
+    p.odo_on = document.querySelector('input[name="reg-odo_on"]:checked')?.value || 'off';
+    if (p.odo_on === 'on') {
+        p.odo_speed = {
+            source: document.getElementById('reg-odo_speed_source')?.value || 'can',
+            id: document.getElementById('reg-odo_speed_id')?.value || '',
+            shift: parseInt(document.getElementById('reg-odo_speed_shift')?.value, 10) || 0,
+            mask: document.getElementById('reg-odo_speed_mask')?.value || '',
+            expr: document.getElementById('reg-odo_speed_expr')?.value || '',
+        };
+        p.odo_direction = {
+            source: document.getElementById('reg-odo_direction_source')?.value || 'can',
+            id: document.getElementById('reg-odo_direction_id')?.value || '',
+            shift: parseInt(document.getElementById('reg-odo_direction_shift')?.value, 10) || 0,
+            mask: document.getElementById('reg-odo_direction_mask')?.value || '',
+            expr: document.getElementById('reg-odo_direction_expr')?.value || '',
+        };
+    } else {
+        // v1.4.6.1 B-4: odo_on=off 시 stale nested 차단
+        delete p.odo_speed;
+        delete p.odo_direction;
+    }
+}
+
+// ─── Select/Input field bindings ────────────────────────────
+const REG_INPUTS = [
+    { id: 'reg-equipment_type', key: 'dev_type' },
+    { id: 'reg-equipment', key: 'equipment' },
+    { id: 'reg-equipment_id', key: 'equipment_id' },
+    { id: 'reg-MEID', key: 'MEID' },
+    { id: 'reg-version', key: 'version' },
+    { id: 'reg-speed_data', key: 'speed_data' },
+    { id: 'reg-input_level', key: 'analog_input_level' },
+    { id: 'reg-two_byte_order', key: 'two_byte_order' },
+    { id: 'reg-four_byte_order', key: 'four_byte_order' },
+];
+const REG_RADIOS = [
+    { name: 'reg-protocol', key: 'protocol' },
+    { name: 'reg-can_input', key: 'can_input' },
+    { name: 'reg-dr', key: 'dr_on' },
+    { name: 'reg-heading', key: 'heading_on' },
+    { name: 'reg-heading_imu', key: 'heading_imu_on' },
+    { name: 'reg-fix_mode', key: 'fix_mode_on' },
+];
+
+// ─── New Page Interface ─────────────────────────────────────
+const registerPage = {
+    render(container) {
+        renderRegisterPage(container);
+    },
+
+    mount(container) {
+        const p = state.protocol || {};
+
+        // Select/input fields → state
+        REG_INPUTS.forEach(({ id, key }) => {
+            bindInput(container, `#${id}`,
+                () => p[key] || '',
+                (val) => {
+                    if (!state.protocol) state.protocol = {};
+                    state.protocol[key] = val;
+                    state.isDirty = true;
+                }
+            );
+        });
+
+        // Radio groups → state
+        REG_RADIOS.forEach(({ name, key }) => {
+            bindRadio(container, name,
+                () => p[key] || (key === 'protocol' ? 'NONE' : 'off'),
+                (val) => {
+                    if (!state.protocol) state.protocol = {};
+                    state.protocol[key] = val;
+                    state.isDirty = true;
+                }
+            );
+        });
+
+        // AI/DI checkboxes → state (v1.4.6 A: 2 ports only — ai0/ai1, di0/di1)
+        for (let i = 0; i < 2; i++) {
+            bindCheckbox(container, `#reg-ai${i}`,
+                () => p['ai' + i] || '0',
+                (val) => {
+                    if (!state.protocol) state.protocol = {};
+                    state.protocol['ai' + i] = val;
+                    state.isDirty = true;
+                }
+            );
+            bindCheckbox(container, `#reg-di${i}`,
+                () => p['di' + i] || '0',
+                (val) => {
+                    if (!state.protocol) state.protocol = {};
+                    state.protocol['di' + i] = val;
+                    state.isDirty = true;
+                }
+            );
+        }
+
+        // v1.4.6 C: odo_on toggle → show/hide #odo-section
+        // v1.4.6.9 H6: sibling 패턴 일관 — state.isDirty=true 설정으로 beforeunload 경고 보장
+        document.querySelectorAll('input[name="reg-odo_on"]').forEach(radio => {
+            radio.addEventListener('change', e => {
+                const section = document.getElementById('odo-section');
+                if (section) section.style.display = e.target.value === 'on' ? '' : 'none';
+                if (!state.protocol) state.protocol = {};
+                state.protocol.odo_on = e.target.value;
+                state.isDirty = true;
+            });
+        });
+
+        // Legacy collector (R4)
+        window.__pageCollectors.register = collectRegisterData;
+    },
+
+    destroy() {},
+
+    validate() {
+        // No mandatory validation for register page currently
+        return [];
+    },
+};
+
+export default registerPage;
diff --git a/src/static/js/pages/sensor-io.js b/src/static/js/pages/sensor-io.js
new file mode 100644
index 0000000..1eb574a
--- /dev/null
+++ b/src/static/js/pages/sensor-io.js
@@ -0,0 +1,199 @@
+/**
+ * sensor-io.js — Sensor I/O Configuration (RS485 + AIO + DIO)
+ *
+ * v1.5.0 Phase 3 T2: io.js의 RS485 card + register.js의 Analog/Digital ports 통합.
+ * v1.5.3.1: analog_input_level enum 회귀 fix (Java enum 2/4/6 복구) + UI 카드 개선.
+ */
+
+import { state, bindInput, bindCheckbox } from '../state.js';
+import { escapeHtml } from '../utils.js';
+import { icon } from '../icons.js';
+
+const sensorIoPage = {
+    render(container) {
+        const device = state.device || {};
+        const rs485 = device.rs485 || {};
+        const protocol = state.protocol || {};
+        const ail = protocol.analog_input_level || '';
+
+        container.innerHTML = `
+            <div class="page-header">
+                <h1 class="page-header__title">${icon('cable', { size: 28 })} Sensor I/O</h1>
+                <p class="page-header__desc">RS485 serial bus + Analog/Digital input channels.</p>
+            </div>
+
+            <div class="card">
+                <div class="card__header">
+                    <h2 class="card__title">${icon('terminal-square', { size: 18 })} RS485</h2>
+                </div>
+                <div class="form-row">
+                    <div class="form-group">
+                        <label class="form-label">Mode</label>
+                        <select class="form-select" id="rs485_mode">
+                            <option value="half" ${rs485.mode === 'half' ? 'selected' : ''}>Half Duplex</option>
+                            <option value="full" ${rs485.mode === 'full' ? 'selected' : ''}>Full Duplex</option>
+                        </select>
+                    </div>
+                    <div class="form-group">
+                        <label class="form-label">Baud Rate</label>
+                        <select class="form-select" id="rs485_speed">
+                            ${[9600, 115200].map(v => `<option value="${v}" ${String(rs485.speed) === String(v) ? 'selected' : ''}>${v}</option>`).join('')}
+                        </select>
+                    </div>
+                </div>
+                <div class="form-row">
+                    <div class="form-group">
+                        <label class="form-label">Data Bits</label>
+                        <select class="form-select" id="rs485_databits">
+                            ${['5','6','7','8'].map(v => `<option value="${v}" ${(rs485.databits||'8')===v?'selected':''}>${v}</option>`).join('')}
+                        </select>
+                    </div>
+                    <div class="form-group">
+                        <label class="form-label">Parity</label>
+                        <select class="form-select" id="rs485_parity">
+                            <option value="no" ${rs485.parity !== 'even' && rs485.parity !== 'odd' ? 'selected' : ''}>None</option>
+                            <option value="even" ${rs485.parity === 'even' ? 'selected' : ''}>Even</option>
+                            <option value="odd" ${rs485.parity === 'odd' ? 'selected' : ''}>Odd</option>
+                        </select>
+                    </div>
+                    <div class="form-group">
+                        <label class="form-label">Stop Bits</label>
+                        <select class="form-select" id="rs485_stopbits">
+                            ${['0','1','2'].map(v => `<option value="${v}" ${(rs485.stopbits||'1')===v?'selected':''}>${v}</option>`).join('')}
+                        </select>
+                    </div>
+                </div>
+            </div>
+
+            <div class="card">
+                <div class="card__header">
+                    <h2 class="card__title">${icon('sliders-horizontal', { size: 18 })} Analog Inputs</h2>
+                </div>
+                <p class="card__desc">Configure analog input range and enable individual channels.</p>
+                <div class="form-row">
+                    <div class="form-group" style="max-width:240px;">
+                        <label class="form-label" for="analog_input_level">Input Level</label>
+                        <select class="form-select" id="analog_input_level">
+                            ${['', '2', '4', '6'].map(v => `<option value="${escapeHtml(v)}" ${v === '' ? 'disabled' : ''} ${ail === v ? 'selected' : ''}>${v === '' ? '— Select Level —' : 'Level ' + escapeHtml(v)}</option>`).join('')}
+                        </select>
+                        <p class="form-hint">Range values per operator manual.</p>
+                    </div>
+                </div>
+                <div class="form-row form-row--ports">
+                    ${[0, 1].map(i => `
+                        <div class="port-row">
+                            <label class="port-row__label" for="AI${i}">
+                                ${icon('activity', { size: 16 })}
+                                <span class="port-row__name">AI${i}</span>
+                                <span class="port-row__hint">Analog Input ${i}</span>
+                            </label>
+                            <input type="checkbox" class="checkbox-toggle" id="AI${i}" ${(protocol['ai' + i] === '1' || protocol['ai' + i] === 1) ? 'checked' : ''}>
+                        </div>
+                    `).join('')}
+                </div>
+            </div>
+
+            <div class="card">
+                <div class="card__header">
+                    <h2 class="card__title">${icon('plug-zap', { size: 18 })} Digital Inputs</h2>
+                </div>
+                <p class="card__desc">Enable digital input channels (high/low state).</p>
+                <div class="form-row form-row--ports">
+                    ${[0, 1].map(i => `
+                        <div class="port-row">
+                            <label class="port-row__label" for="DI${i}">
+                                ${icon('plug-zap', { size: 16 })}
+                                <span class="port-row__name">DI${i}</span>
+                                <span class="port-row__hint">Digital Input ${i}</span>
+                            </label>
+                            <input type="checkbox" class="checkbox-toggle" id="DI${i}" ${(protocol['di' + i] === '1' || protocol['di' + i] === 1) ? 'checked' : ''}>
+                        </div>
+                    `).join('')}
+                </div>
+            </div>
+        `;
+    },
+
+    mount(container) {
+        // RS485 bindings
+        ['mode','speed','databits','parity','stopbits'].forEach(key => {
+            bindInput(container, `#rs485_${key}`,
+                () => state.device?.rs485?.[key] || '',
+                (val) => {
+                    if (!state.device) state.device = {};
+                    if (!state.device.rs485) state.device.rs485 = {};
+                    state.device.rs485[key] = val;
+                    state.isDirty = true;
+                }
+            );
+        });
+
+        // Analog Input Level
+        bindInput(container, '#analog_input_level',
+            () => state.protocol?.analog_input_level || '',
+            (val) => {
+                if (!state.protocol) state.protocol = {};
+                state.protocol.analog_input_level = val;
+                state.isDirty = true;
+            }
+        );
+
+        // AI / DI checkboxes (stored as ai0/ai1/di0/di1 in state.protocol)
+        [0, 1].forEach(i => {
+            ['AI', 'DI'].forEach(prefix => {
+                const id = `${prefix}${i}`;
+                const stateKey = prefix.toLowerCase() + i;
+                bindCheckbox(container, `#${id}`,
+                    // GETTER: return the raw stored string so bindCheckbox's '1'/'on'
+                    // comparison renders the box checked on load (boolean broke this).
+                    () => state.protocol?.[stateKey] ?? '0',
+                    (val) => {
+                        if (!state.protocol) state.protocol = {};
+                        // SETTER: val is already '1'/'0' from bindCheckbox. Re-wrapping with
+                        // `val ? '1' : '0'` always yielded '1' (the string '0' is truthy),
+                        // so channels could never be saved off.
+                        state.protocol[stateKey] = val;
+                        state.isDirty = true;
+                    }
+                );
+            });
+        });
+
+        window.__pageCollectors['sensor-io'] = collectSensorIoData;
+    },
+
+    destroy() {},
+
+    validate() {
+        return [];
+    },
+};
+
+function collectSensorIoData() {
+    if (!state.device) state.device = {};
+    if (!state.protocol) state.protocol = {};
+
+    state.device.rs485 = {
+        mode: document.getElementById('rs485_mode')?.value || '',
+        speed: document.getElementById('rs485_speed')?.value || '',
+        databits: document.getElementById('rs485_databits')?.value || '8',
+        parity: document.getElementById('rs485_parity')?.value || '',
+        stopbits: document.getElementById('rs485_stopbits')?.value || '1',
+    };
+
+    // v1.5.4.2 M1 fix: omit analog_input_level when empty (sibling of state.js H10 log.compress_size_mb pattern)
+    const ail = document.getElementById('analog_input_level')?.value || '';
+    if (ail !== '') {
+        state.protocol.analog_input_level = ail;
+    } else {
+        delete state.protocol.analog_input_level;
+    }
+    [0, 1].forEach(i => {
+        const ai = document.getElementById(`AI${i}`);
+        const di = document.getElementById(`DI${i}`);
+        if (ai) state.protocol['ai' + i] = ai.checked ? '1' : '0';
+        if (di) state.protocol['di' + i] = di.checked ? '1' : '0';
+    });
+}
+
+export default sensorIoPage;
diff --git a/src/static/js/pages/server-setting.js b/src/static/js/pages/server-setting.js
new file mode 100644
index 0000000..e120d18
--- /dev/null
+++ b/src/static/js/pages/server-setting.js
@@ -0,0 +1,174 @@
+/**
+ * server-setting.js — Server Endpoint Configuration Page
+ *
+ * v1.5.0 Phase 2 T3: renamed from network.js.
+ * Server endpoint settings (IP + Port for all server types).
+ * Uses shared IP octet component.
+ * Phase 3 will move OPC-UA + Modbus rows to their respective protocol pages.
+ */
+
+import { state, bindIpGroup, bindInput } from '../state.js';
+import { escapeHtml } from '../utils.js';
+import { isValidIP, isValidPort } from '../validator.js';
+import { renderIpOctets, setupIpOctets, collectIpValue } from '../components/ip-input.js';
+import { setupPortInputs } from '../components/port-input.js';
+import { icon } from '../icons.js';
+
+// ─── Server definitions (shared) ────────────────────────────
+// v1.5.0 Phase 3: OPC-UA + Modbus 2 row 제거 — 각 protocol 페이지(opcua.js / modbus.js)로 이동
+const SERVERS = [
+    { label: 'TIOT Server',   ipKey: 'protocol_server_ip', portKey: 'protocol_server_port' },
+    { label: 'Update Server', ipKey: 'update_server_ip',   portKey: 'update_server_port' },
+    { label: 'DGPS Server',   ipKey: 'rtcm_server_ip',     portKey: 'rtcm_server_port' },
+    // v1.7.1 Task 3: visible label corrected (no cellular modem). DB keys lte_server_* stay.
+    { label: 'Uplink Server', ipKey: 'lte_server_ip',      portKey: 'lte_server_port' },
+];
+
+function isBlankIp(ip) {
+    if (!ip) return true;
+    const text = String(ip).trim();
+    return text === '' || text === '...' || text.split('.').every(part => part === '');
+}
+
+function isBlankPort(port) {
+    return port === null || port === undefined || String(port).trim() === '';
+}
+
+// ─── Page Interface ─────────────────────────────────────────
+const serverSettingPage = {
+    render(container) {
+        const device = state.device || {};
+        const server = device.server || {};
+
+        container.innerHTML = `
+            <div class="page-header">
+                <h1 class="page-header__title">${icon('server', { size: 28 })} Server Setting</h1>
+                <p class="page-header__desc">Configure external server endpoints (TIOT, Update, DGPS, Uplink). OPC UA and Modbus endpoints are configured on their respective protocol pages.</p>
+            </div>
+
+            <div class="card" style="width: fit-content; margin-left: auto; margin-right: auto;">
+                <div class="card__header">
+                    <h2 class="card__title"><span class="card__title-icon">${icon('server', {size:16})}</span> Server Endpoints</h2>
+                </div>
+                <div class="data-table-wrapper">
+                    <table class="data-table" style="width: auto;">
+                        <thead>
+                            <tr>
+                                <th style="width: 160px;">Server Type</th>
+                                <th>IP Address</th>
+                                <th style="width: 100px;">Port</th>
+                            </tr>
+                        </thead>
+                        <tbody>
+                            ${SERVERS.map(s => `
+                                <tr>
+                                    <td style="font-weight: 500; color: var(--text-primary);">${s.label}</td>
+                                    <td>${renderIpOctets(s.ipKey, server[s.ipKey] || '')}</td>
+                                    <td><input class="form-input form-input--mono" id="${s.portKey}" value="${escapeHtml(server[s.portKey])}" placeholder="0"></td>
+                                </tr>
+                            `).join('')}
+                        </tbody>
+                    </table>
+                </div>
+            </div>
+        `;
+    },
+
+    mount(container) {
+        const server = state.device?.server || {};
+
+        // Setup IP octet event listeners (auto-tab, paste, numeric enforcement)
+        setupIpOctets(container);
+        setupPortInputs(container);
+
+        // Reactive bindings: IP groups → state
+        SERVERS.forEach(s => {
+            bindIpGroup(container, s.ipKey,
+                () => server[s.ipKey] || '',
+                (val) => {
+                    if (!state.device) state.device = {};
+                    if (!state.device.server) state.device.server = {};
+                    state.device.server[s.ipKey] = val;
+                    state.isDirty = true;
+                }
+            );
+        });
+
+        // Reactive bindings: Port inputs → state
+        SERVERS.forEach(s => {
+            bindInput(container, `#${s.portKey}`,
+                () => server[s.portKey] != null ? String(server[s.portKey]) : '',
+                (val) => {
+                    if (!state.device) state.device = {};
+                    if (!state.device.server) state.device.server = {};
+                    state.device.server[s.portKey] = val.trim();
+                    state.isDirty = true;
+                }
+            );
+        });
+
+        // Register data collector under new canonical id
+        window.__pageCollectors['server-setting'] = collectServerSettingData;
+    },
+
+    destroy() {
+        // No cleanup needed — DOM is replaced by showPage()
+    },
+
+    validate() {
+        const errors = [];
+        const server = state.device?.server || {};
+
+        SERVERS.forEach(s => {
+            const ip = server[s.ipKey];
+            if (isBlankIp(ip)) {
+                errors.push({ field: s.ipKey, page: 'server-setting', message: `${s.label} IP - Required` });
+            } else if (!isValidIP(ip)) {
+                errors.push({ field: s.ipKey, page: 'server-setting', message: `${s.label} - Invalid IP format` });
+            }
+            const port = server[s.portKey];
+            if (isBlankPort(port)) {
+                errors.push({ field: s.portKey, page: 'server-setting', message: `${s.label} Port - Required` });
+            } else if (!isValidPort(port)) {
+                errors.push({ field: s.portKey, page: 'server-setting', message: `${s.label} Port - Must be 1-65535` });
+            }
+        });
+
+        return errors;
+    },
+};
+
+function collectServerSettingData() {
+    if (!state.device) state.device = {};
+
+    // Preserve OPC-UA + Modbus keys written by opcua.js / modbus.js
+    const existingServer = state.device.server || {};
+    const server = {
+        opc_ua_server_ip:   existingServer.opc_ua_server_ip   || '',
+        opc_ua_server_port: existingServer.opc_ua_server_port || '',
+        modbus_server_ip:   existingServer.modbus_server_ip   || '',
+        modbus_server_port: existingServer.modbus_server_port || '',
+    };
+
+    const ipKeys = [
+        'protocol_server_ip', 'update_server_ip', 'rtcm_server_ip', 'lte_server_ip',
+    ];
+    const portKeys = [
+        'protocol_server_port', 'update_server_port', 'rtcm_server_port', 'lte_server_port',
+    ];
+
+    ipKeys.forEach(ipKey => {
+        server[ipKey] = collectIpValue(ipKey);
+    });
+
+    portKeys.forEach(key => {
+        const el = document.getElementById(key);
+        if (el) {
+            server[key] = el.value.trim();
+        }
+    });
+
+    state.device.server = server;
+}
+
+export default serverSettingPage;
diff --git a/src/static/js/pages/ssid.js b/src/static/js/pages/ssid.js
new file mode 100644
index 0000000..8affe07
--- /dev/null
+++ b/src/static/js/pages/ssid.js
@@ -0,0 +1,458 @@
+/**
+ * ssid.js — SSID Configuration Page
+ * 
+ * Manages WiFi SSID list and WiFi connection settings (static/DHCP).
+ * IP fields use shared octet-split component.
+ */
+
+import { state, bindIpGroup, bindRadio } from '../state.js';
+import { escapeHtml } from '../utils.js';
+import { isValidIP, isValidCountryCode, normalizeCountryCode } from '../validator.js';
+import { renderIpOctets, setupIpOctets, collectIpValue } from '../components/ip-input.js';
+import { DEFAULTS } from '../constants.js';
+import { COUNTRY_CODES, CONTINENT_GROUPS, FREQUENT_COUNTRY_CODES } from '../country-codes.js';
+
+const MAX_SSID_COUNT = 10;
+
+/**
+ * Build the grouped <optgroup>/<option> markup for the Country Code <select>:
+ * a pinned "Frequently used" group above five continent groups (205 codes).
+ * `selected` is the current stored code; if it is not a recognized code (an
+ * empty value, or a stale "EU" from the old free-text field), the dropdown
+ * falls back to the AE default. The `selected` attribute is applied to the
+ * first occurrence only, so exactly one option is selected.
+ */
+function renderCountryOptions(selected) {
+    const want = (selected || DEFAULTS.WIFI_COUNTRY_CODE).toUpperCase();
+    const sel = COUNTRY_CODES[want] ? want : DEFAULTS.WIFI_COUNTRY_CODE;
+    let selPlaced = false;
+
+    const option = (code) => {
+        const isSel = !selPlaced && code === sel;
+        if (isSel) selPlaced = true;
+        return `<option value="${code}"${isSel ? ' selected' : ''}>` +
+               `${escapeHtml(code + ' — ' + COUNTRY_CODES[code])}</option>`;
+    };
+    const group = (label, codes) =>
+        `<optgroup label="${escapeHtml(label)}">` +
+        codes.map(option).join('') +
+        `</optgroup>`;
+
+    let html = group('Frequently used', FREQUENT_COUNTRY_CODES);
+    html += CONTINENT_GROUPS.map(g => group(g.region, g.codes)).join('');
+    return html;
+}
+
+export function renderSsidPage(container) {
+    const device = state.device || {};
+    const wifi = device.wifi || {};
+    const ssidList = device.ssid_list || [];
+
+    container.innerHTML = `
+        <div class="page-header">
+            <h1 class="page-header__title">📶 WiFi SSID Management</h1>
+            <p class="page-header__desc">Manage WiFi network list and connection settings.</p>
+        </div>
+
+        <!-- SSID List -->
+        <div class="card">
+            <div class="card__header">
+                <h2 class="card__title"><span class="card__title-icon">📡</span> SSID List</h2>
+                <button class="btn btn--outline btn--sm" id="ssid-add-btn">＋ Add</button>
+            </div>
+            <div class="data-table-wrapper">
+                <table class="data-table" id="ssid-table">
+                    <thead>
+                        <tr>
+                            <th>SSID Name</th>
+                            <th>Password</th>
+                            <th>Security</th>
+                            <th class="col-action"></th>
+                        </tr>
+                    </thead>
+                    <tbody id="ssid-tbody"></tbody>
+                </table>
+            </div>
+            <p class="form-hint mt-sm">Up to 10 SSIDs can be registered.</p>
+        </div>
+
+        <!-- WiFi Connection Settings -->
+        <div class="card">
+            <div class="card__header">
+                <h2 class="card__title"><span class="card__title-icon">🔧</span> WiFi Connection Settings</h2>
+            </div>
+
+            <div class="form-group">
+                <label class="form-label">Connection Type</label>
+                <div class="radio-group">
+                    <label class="radio-label">
+                        <input type="radio" name="wifi_type" value="static" ${wifi.type !== 'dhcp' ? 'checked' : ''}>
+                        Static
+                    </label>
+                    <label class="radio-label">
+                        <input type="radio" name="wifi_type" value="dhcp" ${wifi.type === 'dhcp' ? 'checked' : ''}>
+                        DHCP
+                    </label>
+                </div>
+            </div>
+
+            <div id="wifi-static-fields">
+                <div class="form-row">
+                    <div class="form-group">
+                        <label class="form-label">IP Address</label>
+                        ${renderIpOctets('wifi_ip', wifi.ip)}
+                    </div>
+                    <div class="form-group">
+                        <label class="form-label">Subnet Mask</label>
+                        ${renderIpOctets('wifi_netmask', wifi.netmask)}
+                    </div>
+                </div>
+                <div class="form-row">
+                    <div class="form-group">
+                        <label class="form-label">Gateway</label>
+                        ${renderIpOctets('wifi_gateway', wifi.gateway)}
+                    </div>
+                    <div class="form-group">
+                        <label class="form-label">DNS 1</label>
+                        ${renderIpOctets('wifi_dns1', wifi.dns1)}
+                    </div>
+                </div>
+                <div class="form-row">
+                    <div class="form-group">
+                        <label class="form-label">DNS 2</label>
+                        ${renderIpOctets('wifi_dns2', wifi.dns2)}
+                    </div>
+                    <div class="form-group"></div>
+                </div>
+            </div>
+        </div>
+    `;
+
+    // Setup IP octet event listeners
+    setupIpOctets(container);
+
+    // Populate SSID rows
+    const tbody = document.getElementById('ssid-tbody');
+    ssidList.forEach((s, i) => addSsidRow(tbody, s, i));
+
+    // Add SSID button (max 10 rows)
+    const addBtn = document.getElementById('ssid-add-btn');
+    addBtn.addEventListener('click', () => {
+        if (tbody.querySelectorAll('tr').length >= MAX_SSID_COUNT) return;
+        addSsidRow(tbody, { ssid: '', password: '', security: 'wpa/wpa2' }, ssidList.length);
+        updateSsidAddButton();
+    });
+    updateSsidAddButton();
+
+    // Static/DHCP toggle
+    document.querySelectorAll('input[name="wifi_type"]').forEach(radio => {
+        radio.addEventListener('change', () => toggleStaticFields());
+    });
+    toggleStaticFields();
+
+    // Register data collector
+    window.__pageCollectors.ssid = collectSsidData;
+}
+
+function addSsidRow(tbody, data, index) {
+    const tr = document.createElement('tr');
+    tr.innerHTML = `
+        <td><input class="form-input" data-field="ssid" value="${escapeHtml(data.ssid)}" placeholder="SSID Name"></td>
+        <td>
+            <div class="input-password">
+                <input class="form-input" type="password" data-field="password" value="${escapeHtml(data.password)}" placeholder="Password">
+                <button class="input-password__toggle" type="button" title="Show password">👁</button>
+            </div>
+        </td>
+        <td>
+            <select class="form-select" data-field="security">
+                <option value="wpa/wpa2" ${data.security === 'wpa/wpa2' || data.security === 'WPA' ? 'selected' : ''}>WPA/WPA2</option>
+                <option value="WEP" ${data.security === 'WEP' ? 'selected' : ''}>WEP</option>
+                <option value="Open" ${data.security === 'Open' ? 'selected' : ''}>Open</option>
+            </select>
+        </td>
+        <td class="col-action">
+            <button class="btn btn--ghost btn--icon ssid-delete" title="Delete">🗑</button>
+        </td>
+    `;
+
+    // Toggle password visibility
+    tr.querySelector('.input-password__toggle').addEventListener('click', (e) => {
+        const input = tr.querySelector('input[data-field="password"]');
+        input.type = input.type === 'password' ? 'text' : 'password';
+        e.target.textContent = input.type === 'password' ? '👁' : '🔒';
+    });
+
+    // Delete row
+    tr.querySelector('.ssid-delete').addEventListener('click', () => {
+        tr.remove();
+        updateSsidAddButton();
+    });
+
+    tbody.appendChild(tr);
+}
+
+function updateSsidAddButton() {
+    const btn = document.getElementById('ssid-add-btn');
+    const count = document.querySelectorAll('#ssid-tbody tr').length;
+    if (btn) btn.disabled = count >= MAX_SSID_COUNT;
+}
+
+function toggleStaticFields() {
+    const isDhcp = document.querySelector('input[name="wifi_type"]:checked')?.value === 'dhcp';
+    const fields = document.getElementById('wifi-static-fields');
+    if (!fields) return;
+    fields.querySelectorAll('.form-input').forEach(input => {
+        input.disabled = isDhcp;
+    });
+    fields.style.opacity = isDhcp ? '0.5' : '1';
+}
+
+function collectSsidData() {
+    if (!state.device) state.device = {};
+
+    // WiFi settings — collect from octet groups.
+    // country_code MUST be re-collected here: this object replaces state.device.wifi
+    // wholesale, so omitting it would silently drop the legacy Java value on save.
+    const wifiType = document.querySelector('input[name="wifi_type"]:checked')?.value || 'static';
+    const ccEl = document.getElementById('wifi_country_code');
+    const countryCode = normalizeCountryCode(
+        ccEl ? ccEl.value : (state.device.wifi && state.device.wifi.country_code)
+    ) || DEFAULTS.WIFI_COUNTRY_CODE;
+    state.device.wifi = {
+        type: wifiType,
+        ip: collectIpValue('wifi_ip'),
+        netmask: collectIpValue('wifi_netmask'),
+        gateway: collectIpValue('wifi_gateway'),
+        dns1: collectIpValue('wifi_dns1'),
+        dns2: collectIpValue('wifi_dns2'),
+        country_code: countryCode,
+    };
+
+    // SSID list
+    const rows = document.querySelectorAll('#ssid-tbody tr');
+    state.device.ssid_list = Array.from(rows).map(tr => ({
+        ssid: tr.querySelector('[data-field="ssid"]')?.value || '',
+        password: tr.querySelector('[data-field="password"]')?.value || '',
+        security: tr.querySelector('[data-field="security"]')?.value || 'wpa/wpa2',
+    }));
+}
+
+// ─── WiFi IP fields ─────────────────────────────────────────
+const WIFI_IP_FIELDS = ['wifi_ip', 'wifi_netmask', 'wifi_gateway', 'wifi_dns1', 'wifi_dns2'];
+const WIFI_IP_LABELS = {
+    wifi_ip: 'WiFi IP', wifi_netmask: 'WiFi Subnet Mask', wifi_gateway: 'WiFi Gateway',
+    wifi_dns1: 'WiFi DNS 1', wifi_dns2: 'WiFi DNS 2',
+};
+const WIFI_STATE_KEYS = { wifi_ip: 'ip', wifi_netmask: 'netmask', wifi_gateway: 'gateway', wifi_dns1: 'dns1', wifi_dns2: 'dns2' };
+
+// ─── New Page Interface ─────────────────────────────────────
+const ssidPage = {
+    render(container) {
+        const device = state.device || {};
+        const wifi = device.wifi || {};
+        const ssidList = device.ssid_list || [];
+
+        container.innerHTML = `
+            <div class="page-header">
+                <h1 class="page-header__title">📶 WiFi SSID Management</h1>
+                <p class="page-header__desc">Manage WiFi network list and connection settings.</p>
+            </div>
+
+            <div class="card">
+                <div class="card__header">
+                    <h2 class="card__title"><span class="card__title-icon">📡</span> SSID List</h2>
+                    <button class="btn btn--outline btn--sm" id="ssid-add-btn">＋ Add</button>
+                </div>
+                <div class="data-table-wrapper">
+                    <table class="data-table" id="ssid-table">
+                        <thead>
+                            <tr>
+                                <th>SSID Name</th>
+                                <th>Password</th>
+                                <th>Security</th>
+                                <th class="col-action"></th>
+                            </tr>
+                        </thead>
+                        <tbody id="ssid-tbody"></tbody>
+                    </table>
+                </div>
+                <p class="form-hint mt-sm">Up to 10 SSIDs can be registered.</p>
+            </div>
+
+            <div class="card">
+                <div class="card__header">
+                    <h2 class="card__title"><span class="card__title-icon">🔧</span> WiFi Connection Settings</h2>
+                </div>
+                <div class="form-group">
+                    <label class="form-label">Connection Type</label>
+                    <div class="radio-group">
+                        <label class="radio-label">
+                            <input type="radio" name="wifi_type" value="static" ${wifi.type !== 'dhcp' ? 'checked' : ''}>
+                            Static
+                        </label>
+                        <label class="radio-label">
+                            <input type="radio" name="wifi_type" value="dhcp" ${wifi.type === 'dhcp' ? 'checked' : ''}>
+                            DHCP
+                        </label>
+                    </div>
+                </div>
+                <div id="wifi-static-fields">
+                    <div class="form-row">
+                        <div class="form-group">
+                            <label class="form-label">IP Address</label>
+                            ${renderIpOctets('wifi_ip', wifi.ip)}
+                        </div>
+                        <div class="form-group">
+                            <label class="form-label">Subnet Mask</label>
+                            ${renderIpOctets('wifi_netmask', wifi.netmask)}
+                        </div>
+                    </div>
+                    <div class="form-row">
+                        <div class="form-group">
+                            <label class="form-label">Gateway</label>
+                            ${renderIpOctets('wifi_gateway', wifi.gateway)}
+                        </div>
+                        <div class="form-group">
+                            <label class="form-label">DNS 1</label>
+                            ${renderIpOctets('wifi_dns1', wifi.dns1)}
+                        </div>
+                    </div>
+                    <div class="form-row">
+                        <div class="form-group">
+                            <label class="form-label">DNS 2</label>
+                            ${renderIpOctets('wifi_dns2', wifi.dns2)}
+                        </div>
+                        <div class="form-group"></div>
+                    </div>
+                </div>
+            </div>
+
+            <div class="card">
+                <div class="card__header">
+                    <h2 class="card__title"><span class="card__title-icon">🌍</span> Region</h2>
+                </div>
+                <div class="form-group">
+                    <label class="form-label" for="wifi_country_code">Country Code</label>
+                    <select class="form-input" id="wifi_country_code" style="max-width: 300px;">
+                        ${renderCountryOptions(wifi.country_code || DEFAULTS.WIFI_COUNTRY_CODE)}
+                    </select>
+                    <p class="form-hint">WiFi regulatory region. Defaults to AE (United Arab Emirates); dpworldapp applies it to the WiFi module.</p>
+                </div>
+            </div>
+        `;
+    },
+
+    mount(container) {
+        setupIpOctets(container);
+
+        // Reactive bindings: WiFi type radio
+        bindRadio(container, 'wifi_type',
+            () => (state.device?.wifi?.type || 'static'),
+            (val) => {
+                if (!state.device) state.device = {};
+                if (!state.device.wifi) state.device.wifi = {};
+                state.device.wifi.type = val;
+                state.isDirty = true;
+            }
+        );
+
+        // Reactive bindings: WiFi IP groups
+        WIFI_IP_FIELDS.forEach(ipKey => {
+            const stateKey = WIFI_STATE_KEYS[ipKey];
+            bindIpGroup(container, ipKey,
+                () => state.device?.wifi?.[stateKey] || '',
+                (val) => {
+                    if (!state.device) state.device = {};
+                    if (!state.device.wifi) state.device.wifi = {};
+                    state.device.wifi[stateKey] = val;
+                    state.isDirty = true;
+                }
+            );
+        });
+
+        // Reactive binding: WiFi country code (<select>)
+        const ccEl = container.querySelector('#wifi_country_code');
+        if (ccEl) {
+            ccEl.addEventListener('change', () => {
+                if (!state.device) state.device = {};
+                if (!state.device.wifi) state.device.wifi = {};
+                state.device.wifi.country_code = ccEl.value;
+                state.isDirty = true;
+            });
+        }
+
+        // SSID list: populate + event delegation
+        const tbody = container.querySelector('#ssid-tbody');
+        const ssidList = state.device?.ssid_list || [];
+        ssidList.forEach((s, i) => addSsidRow(tbody, s, i));
+
+        // SSID list: reactive sync on input/change/delete
+        tbody.addEventListener('input', () => { this._syncSsidList(tbody); });
+        tbody.addEventListener('change', () => { this._syncSsidList(tbody); });
+        // Sync after row deletion (DOM mutation via click on delete button)
+        tbody.addEventListener('click', (e) => {
+            if (e.target.closest('.ssid-delete')) {
+                // Delay to let the row be removed first
+                setTimeout(() => { this._syncSsidList(tbody); updateSsidAddButton(); }, 0);
+            }
+        });
+
+        // Add button
+        const addBtn = container.querySelector('#ssid-add-btn');
+        addBtn.addEventListener('click', () => {
+            if (tbody.querySelectorAll('tr').length >= MAX_SSID_COUNT) return;
+            addSsidRow(tbody, { ssid: '', password: '', security: 'wpa/wpa2' }, tbody.querySelectorAll('tr').length);
+            this._syncSsidList(tbody);
+            updateSsidAddButton();
+        });
+        updateSsidAddButton();
+
+        // Static/DHCP toggle
+        container.querySelectorAll('input[name="wifi_type"]').forEach(radio => {
+            radio.addEventListener('change', () => toggleStaticFields());
+        });
+        toggleStaticFields();
+
+        // Legacy collector (R4)
+        window.__pageCollectors.ssid = collectSsidData;
+    },
+
+    _syncSsidList(tbody) {
+        if (!state.device) state.device = {};
+        const rows = tbody.querySelectorAll('tr');
+        state.device.ssid_list = Array.from(rows).map(tr => ({
+            ssid: tr.querySelector('[data-field="ssid"]')?.value || '',
+            password: tr.querySelector('[data-field="password"]')?.value || '',
+            security: tr.querySelector('[data-field="security"]')?.value || 'wpa/wpa2',
+        }));
+        state.isDirty = true;
+    },
+
+    destroy() {},
+
+    validate() {
+        const errors = [];
+        const wifi = state.device?.wifi || {};
+        // Only validate IP fields when static mode
+        if (wifi.type !== 'dhcp') {
+            WIFI_IP_FIELDS.forEach(ipKey => {
+                const stateKey = WIFI_STATE_KEYS[ipKey];
+                const val = wifi[stateKey];
+                if (val && val !== '...' && !isValidIP(val)) {
+                    errors.push({ field: ipKey, page: 'ssid', message: `${WIFI_IP_LABELS[ipKey]} — Invalid IP format` });
+                }
+            });
+        }
+        // Region — WiFi country code: required, exactly 2 uppercase letters
+        if (!isValidCountryCode(normalizeCountryCode(wifi.country_code))) {
+            errors.push({
+                field: 'wifi_country_code', page: 'ssid',
+                message: 'Country Code — must be a 2-letter ISO 3166-1 alpha-2 code (e.g. KR, US, DE, JP, AE)',
+            });
+        }
+        return errors;
+    },
+};
+
+export default ssidPage;
diff --git a/src/static/js/pages/wifi-ap.js b/src/static/js/pages/wifi-ap.js
new file mode 100644
index 0000000..c047f7e
--- /dev/null
+++ b/src/static/js/pages/wifi-ap.js
@@ -0,0 +1,214 @@
+// src/static/js/pages/wifi-ap.js — Wi-Fi Access Point leaf (spec §9.1).
+// Dedicated ap_config key · STA uplink untouched · self-contained Save/Apply (/api/network/ap/*).
+import { isAdvanced } from '../view-mode.js';
+import { showFieldError, clearAllFieldErrors, setPageError } from '../validator.js';
+import { icon } from '../icons.js';
+import { showToast } from '../toast.js';
+import { escapeHtml } from '../utils.js';
+import { clearDirty } from '../page-dirty.js';
+
+const _DEFAULTS = { ap_enabled: false, ap_ssid: '', ap_passphrase: '', ap_band: 'auto', ap_channel: 0, ap_hidden: false };
+let _cfg = { ..._DEFAULTS };   // last loaded/saved config
+let _status = {};              // live status (ap_enabled, ap0_up, hostapd_running, clients, country_pending)
+let _countryPending = false;
+let _statusTimer = null;
+// v1.11.9 (review LOW concurrency): _save is async and bound to three buttons
+// (ap-save / ap-apply / ap-save-apply) — guard against a double-apply re-entry.
+let _saving = false;
+
+function _byteLen(s) { return new TextEncoder().encode(s || '').length; }
+function _badge(cls, text) { return `<span class="net-badge net-badge--${cls}">${escapeHtml(text)}</span>`; }
+
+async function _api(path, opts) {
+    const res = await fetch(path, opts);
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) throw new Error(body.error || `${path}: ${res.status}`);
+    return body;
+}
+
+function _collect() {
+    const g = id => document.getElementById(id);
+    const out = {
+        ap_enabled: g('ap_enabled')?.checked || false,
+        ap_ssid: g('ap_ssid')?.value || '',
+    };
+    // v1.11.9 (review HIGH security UX): the backend STRIPS ap_passphrase from GET status,
+    // so the field renders blank. Only send ap_passphrase when the user actually typed a new
+    // one — a BLANK field OMITS the key so the server-side RMW merge keeps the stored PSK.
+    // (Sending ap_passphrase:"" would wipe the existing password.)
+    const psk = g('ap_passphrase')?.value || '';
+    if (psk) out.ap_passphrase = psk;
+    // Advanced-only fields are collected only when rendered. In User mode (no DOM) they are
+    // omitted so the server-side config merge preserves the stored ap_band/ap_hidden.
+    const band = g('ap_band'); if (band) out.ap_band = band.value;
+    const hidden = g('ap_hidden'); if (hidden) out.ap_hidden = hidden.checked;
+    return out;
+}
+
+function _validate() {
+    clearAllFieldErrors();
+    const d = _collect(); const errs = [];
+    if (d.ap_enabled) {
+        if (!d.ap_ssid || _byteLen(d.ap_ssid) > 32) {
+            showFieldError(document.getElementById('ap_ssid'), 'Network name must be 1-32 bytes.'); errs.push('ssid');
+        }
+        // v1.11.9 (review HIGH security UX): a BLANK PSK field means "keep the existing
+        // stored password" (_collect omits ap_passphrase entirely). Only validate the
+        // 8-63 byte bound when the user actually typed a NEW passphrase.
+        if ('ap_passphrase' in d) {
+            const p = _byteLen(d.ap_passphrase);
+            if (p < 8 || p > 63) {
+                showFieldError(document.getElementById('ap_passphrase'), 'Password must be 8-63 bytes.'); errs.push('psk');
+            }
+        }
+    }
+    setPageError('wifi-ap', errs.length > 0);
+    return errs.length === 0;
+}
+
+// Live status panel (matches net-apply dash-card / net-badge design language).
+function _statusHtml() {
+    const adv = isAdvanced();
+    if (_status.ap_enabled === undefined) {
+        return `<div class="dash-card"><div class="dash-row"><span class="dash-row__lbl">Status</span>
+            <span class="dash-row__val">${_badge('na', 'loading…')}</span></div></div>`;
+    }
+    const running = _status.ap_enabled && _status.ap0_up && _status.hostapd_running;
+    const apBadge = running ? _badge('ok', 'Running') : _badge('na', 'Off');
+    const rows = [
+        `<div class="dash-row"><span class="dash-row__lbl">Access point</span><span class="dash-row__val">${apBadge}</span></div>`,
+        `<div class="dash-row"><span class="dash-row__lbl">${icon('smartphone', { size: 14 })} Connected clients</span>
+            <span class="dash-row__val">${escapeHtml(String(_status.clients ?? 0))}</span></div>`,
+    ];
+    if (adv) {
+        const hostapd = _status.hostapd_running ? _badge('ok', 'active') : _badge('na', 'inactive');
+        rows.push(`<div class="dash-row"><span class="dash-row__lbl">hostapd</span><span class="dash-row__val">${hostapd}</span></div>`);
+    }
+    if (_status.country_pending) {
+        rows.push(`<div class="dash-row"><span class="dash-row__lbl">Regulatory domain</span>
+            <span class="dash-row__val">${_badge('warn', 'Reboot required')}</span></div>`);
+    }
+    const refresh = adv
+        ? `<button class="btn btn--ghost btn--sm" id="ap-refresh" type="button">${icon('refresh-cw', { size: 14 })} Refresh</button>` : '';
+    return `<div class="dash-card"><h3 class="dash-card__title">${icon('activity', { size: 16 })} Status ${refresh}</h3>${rows.join('')}</div>`;
+}
+
+function _render(container) {
+    const a = _cfg, adv = isAdvanced();
+    container.innerHTML = `
+      <div class="page-header"><h1 class="page-header__title">${icon('radio-tower', { size: 28 })} Wi-Fi Access Point</h1>
+        <p class="page-header__desc">Broadcast this device as a Wi-Fi access point for local provisioning. Your <strong>STA uplink stays connected</strong> — clients can only reach the configurator.</p></div>
+      <div class="card">
+        ${_countryPending ? `<div class="info-banner info-banner--warning">${icon('alert-triangle', { size: 14 })}
+            A country-code change is pending. Reboot the device before enabling the access point.</div>` : ''}
+        <label class="radio-label"><input type="checkbox" id="ap_enabled" ${a.ap_enabled ? 'checked' : ''} ${_countryPending ? 'disabled' : ''}> Enable access point</label>
+        <div class="form-group"><label class="form-label" for="ap_ssid">Network name (SSID)</label>
+          <input class="form-input" id="ap_ssid" maxlength="32" value="${escapeHtml(a.ap_ssid)}" placeholder="e.g. Site-AP"></div>
+        <div class="form-group"><label class="form-label" for="ap_passphrase">Password ${icon('lock', { size: 12 })} (WPA2, 8-63 characters)</label>
+          <div class="input-password"><input class="form-input" type="password" id="ap_passphrase" value="" placeholder="leave blank to keep current password" autocomplete="new-password">
+          <button class="input-password__toggle" type="button" aria-label="Show password">${icon('eye', { size: 14 })}</button></div></div>
+        ${adv ? `
+        <div class="form-row">
+          <div class="form-group"><label class="form-label" for="ap_band">Band</label>
+            <select class="form-select" id="ap_band">
+              <option value="auto" ${a.ap_band === 'auto' ? 'selected' : ''}>Auto (follow STA channel, recommended)</option>
+              <option value="2g" ${a.ap_band === '2g' ? 'selected' : ''}>2.4 GHz (experimental)</option>
+              <option value="5g" ${a.ap_band === '5g' ? 'selected' : ''}>5 GHz (experimental)</option></select></div>
+          <div class="form-group"><label class="radio-label"><input type="checkbox" id="ap_hidden" ${a.ap_hidden ? 'checked' : ''}> Hide SSID (do not broadcast)</label></div>
+        </div>` : ''}
+        <div class="dash-actions">
+          ${adv
+            ? `<button class="btn btn--outline" id="ap-save" type="button">${icon('save', { size: 14 })} Save</button>
+               <button class="btn btn--primary" id="ap-apply" type="button">${icon('check-circle-2', { size: 14 })} Save &amp; Apply</button>`
+            : `<button class="btn btn--primary" id="ap-save-apply" type="button">${icon('check-circle-2', { size: 14 })} Save &amp; Apply</button>`}
+        </div>
+      </div>
+      <div id="ap-status" aria-live="polite">${_statusHtml()}</div>`;
+}
+
+function _bind(container) {
+    const t = container.querySelector('.input-password__toggle');
+    if (t) t.addEventListener('click', () => {
+        const i = container.querySelector('#ap_passphrase');
+        if (!i) return;
+        const show = i.type === 'password';
+        i.type = show ? 'text' : 'password';
+        t.innerHTML = icon(show ? 'eye-off' : 'eye', { size: 14 });
+        t.setAttribute('aria-label', show ? 'Hide password' : 'Show password');
+    });
+    container.querySelector('#ap-save')?.addEventListener('click', () => _save({ apply: false }));
+    container.querySelector('#ap-apply')?.addEventListener('click', () => _save({ apply: true }));
+    container.querySelector('#ap-save-apply')?.addEventListener('click', () => _save({ apply: true }));
+    container.querySelector('#ap-refresh')?.addEventListener('click', () => _refreshStatus());
+}
+
+async function _saveConfig({ toast = true } = {}) {
+    if (!document.getElementById('ap_enabled')) {
+        throw new Error('Wi-Fi AP page is not mounted.');
+    }
+    if (!_validate()) {
+        throw new Error('Check your input.');
+    }
+    const d = _collect();
+    await _api('api/network/ap/config', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(d) });
+    _cfg = { ..._cfg, ...d };
+    clearDirty('wifi-ap');
+    if (toast) showToast('Access point settings saved.', 'success');
+}
+
+async function _save({ apply }) {
+    if (_saving) return;   // in-flight guard: concurrent save/apply gestures → only one runs
+    _saving = true;
+    try {
+        await _saveConfig({ toast: !apply });
+        if (apply) {
+            const r = await _api('api/network/ap/apply', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ dry_run: false }) });
+            if (r.state !== 'COMMITTED') showToast('Apply failed: ' + ((r.errors && r.errors[0]) || 'validation failed'), 'error');
+            else showToast('Access point settings applied.', 'success');
+        }
+        await _refreshStatus();
+    } catch (e) { showToast('Failed — ' + e.message, 'error'); }
+    finally { _saving = false; }
+}
+
+async function _refreshStatus() {
+    try {
+        const s = await _api('api/network/ap/status');
+        _status = s || {};
+        _countryPending = !!s.country_pending;
+        if (s.config) _cfg = { ..._DEFAULTS, ...s.config };
+        const el = document.getElementById('ap-status');
+        if (el) {
+            el.innerHTML = _statusHtml();
+            // only the status region was replaced — re-bind just its Refresh button (form handlers persist)
+            el.querySelector('#ap-refresh')?.addEventListener('click', () => _refreshStatus());
+        }
+    } catch (e) { /* fail-soft: status poll failures stay silent */ }
+}
+
+const wifiApPage = {
+    render(container) { _render(container); },
+    mount(container) {
+        _bind(container);
+        // First entry: load saved config + live status, then re-render the form to reflect it.
+        _refreshStatus().then(() => { _render(container); _bind(container); });
+        if (isAdvanced()) _statusTimer = setInterval(_refreshStatus, 10000);
+    },
+    destroy() {
+        if (_statusTimer) { clearInterval(_statusTimer); _statusTimer = null; }
+        // v1.11.9 (review LOW correctness/honesty): reset live status so a revisit after an
+        // API failure shows loading/empty, not a stale "Running" panel. _cfg is intentionally
+        // NOT reset (resetting to defaults would flash a blank form before _refreshStatus).
+        _status = {};
+        _countryPending = false;
+        _saving = false;
+    },
+    validate() {
+        if (!document.getElementById('ap_enabled')) return [];
+        return _validate() ? [] : [{ page: 'wifi-ap', message: 'Invalid Wi-Fi AP settings' }];
+    },
+    async saveSelfContained() {
+        await _saveConfig({ toast: false });
+    },
+};
+export default wifiApPage;
diff --git a/src/static/js/pages/wifi.js b/src/static/js/pages/wifi.js
new file mode 100644
index 0000000..aabbb58
--- /dev/null
+++ b/src/static/js/pages/wifi.js
@@ -0,0 +1,495 @@
+/**
+ * wifi.js — Wi-Fi Configuration Page (v1.5.0 P2: renamed from ssid.js)
+ *
+ * Manages WiFi SSID list and WiFi connection settings (static/DHCP).
+ * IP fields use shared octet-split component.
+ */
+
+import { state, bindIpGroup, bindRadio } from '../state.js';
+import { escapeHtml } from '../utils.js';
+import { isValidIP, isValidCountryCode, normalizeCountryCode } from '../validator.js';
+import { renderIpOctets, setupIpOctets, collectIpValue } from '../components/ip-input.js';
+import { DEFAULTS } from '../constants.js';
+import { COUNTRY_CODES, CONTINENT_GROUPS, FREQUENT_COUNTRY_CODES } from '../country-codes.js';
+import { icon } from '../icons.js';
+
+const MAX_SSID_COUNT = 10;
+
+/**
+ * Build the grouped <optgroup>/<option> markup for the Country Code <select>:
+ * a pinned "Frequently used" group above five continent groups (205 codes).
+ * `selected` is the current stored code; if it is not a recognized code (an
+ * empty value, or a stale "EU" from the old free-text field), the dropdown
+ * falls back to the AE default. The `selected` attribute is applied to the
+ * first occurrence only, so exactly one option is selected.
+ */
+function renderCountryOptions(selected) {
+    const want = (selected || DEFAULTS.WIFI_COUNTRY_CODE).toUpperCase();
+    const sel = COUNTRY_CODES[want] ? want : DEFAULTS.WIFI_COUNTRY_CODE;
+    let selPlaced = false;
+
+    const option = (code) => {
+        const isSel = !selPlaced && code === sel;
+        if (isSel) selPlaced = true;
+        return `<option value="${code}"${isSel ? ' selected' : ''}>` +
+               `${escapeHtml(code + ' — ' + COUNTRY_CODES[code])}</option>`;
+    };
+    const group = (label, codes) =>
+        `<optgroup label="${escapeHtml(label)}">` +
+        codes.map(option).join('') +
+        `</optgroup>`;
+
+    let html = group('Frequently used', FREQUENT_COUNTRY_CODES);
+    html += CONTINENT_GROUPS.map(g => group(g.region, g.codes)).join('');
+    return html;
+}
+
+export function renderSsidPage(container) {
+    const device = state.device || {};
+    const wifi = device.wifi || {};
+    const ssidList = device.ssid_list || [];
+
+    container.innerHTML = `
+        <div class="page-header">
+            <h1 class="page-header__title">${icon('wifi', {size:28})} WiFi SSID Management</h1>
+            <p class="page-header__desc">Manage WiFi network list and connection settings.</p>
+        </div>
+
+        <!-- SSID List -->
+        <div class="card">
+            <div class="card__header">
+                <h2 class="card__title"><span class="card__title-icon">${icon('radio-tower', {size:16})}</span> SSID List</h2>
+                <button class="btn btn--outline btn--sm" id="ssid-add-btn">＋ Add</button>
+            </div>
+            <div class="data-table-wrapper">
+                <table class="data-table" id="ssid-table">
+                    <thead>
+                        <tr>
+                            <th>SSID Name</th>
+                            <th>Password</th>
+                            <th>Security</th>
+                            <th class="col-action"></th>
+                        </tr>
+                    </thead>
+                    <tbody id="ssid-tbody"></tbody>
+                </table>
+            </div>
+            <p class="form-hint mt-sm">Up to 10 SSIDs can be registered.</p>
+        </div>
+
+        <!-- WiFi Connection Settings -->
+        <div class="card">
+            <div class="card__header">
+                <h2 class="card__title"><span class="card__title-icon">${icon('wrench', {size:16})}</span> WiFi Connection Settings</h2>
+            </div>
+
+            <div class="form-group">
+                <label class="form-label">Connection Type</label>
+                <div class="radio-group">
+                    <label class="radio-label">
+                        <input type="radio" name="wifi_type" value="static" ${wifi.type !== 'dhcp' ? 'checked' : ''}>
+                        Static
+                    </label>
+                    <label class="radio-label">
+                        <input type="radio" name="wifi_type" value="dhcp" ${wifi.type === 'dhcp' ? 'checked' : ''}>
+                        DHCP
+                    </label>
+                </div>
+            </div>
+
+            <div id="wifi-static-fields">
+                <div class="form-row">
+                    <div class="form-group">
+                        <label class="form-label">IP Address</label>
+                        ${renderIpOctets('wifi_ip', wifi.ip)}
+                    </div>
+                    <div class="form-group">
+                        <label class="form-label">Subnet Mask</label>
+                        ${renderIpOctets('wifi_netmask', wifi.netmask)}
+                    </div>
+                </div>
+                <div class="form-row">
+                    <div class="form-group">
+                        <label class="form-label">Gateway</label>
+                        ${renderIpOctets('wifi_gateway', wifi.gateway)}
+                    </div>
+                    <div class="form-group">
+                        <label class="form-label">DNS 1</label>
+                        ${renderIpOctets('wifi_dns1', wifi.dns1)}
+                    </div>
+                </div>
+                <div class="form-row">
+                    <div class="form-group">
+                        <label class="form-label">DNS 2</label>
+                        ${renderIpOctets('wifi_dns2', wifi.dns2)}
+                    </div>
+                    <div class="form-group"></div>
+                </div>
+            </div>
+        </div>
+    `;
+
+    // Setup IP octet event listeners
+    setupIpOctets(container);
+
+    // Populate SSID rows
+    const tbody = document.getElementById('ssid-tbody');
+    ssidList.forEach((s, i) => addSsidRow(tbody, s, i));
+
+    // Add SSID button (max 10 rows)
+    const addBtn = document.getElementById('ssid-add-btn');
+    addBtn.addEventListener('click', () => {
+        if (tbody.querySelectorAll('tr').length >= MAX_SSID_COUNT) return;
+        addSsidRow(tbody, { ssid: '', password: '', security: 'wpa/wpa2' }, ssidList.length);
+        updateSsidAddButton();
+    });
+    updateSsidAddButton();
+
+    // Static/DHCP toggle
+    document.querySelectorAll('input[name="wifi_type"]').forEach(radio => {
+        radio.addEventListener('change', () => toggleStaticFields());
+    });
+    toggleStaticFields();
+
+    // Register data collector
+    window.__pageCollectors.ssid = collectSsidData;
+}
+
+function addSsidRow(tbody, data, index) {
+    // v1.6.0 §5.2 tolerant read: legacy 'Open'/any non-wpa/wpa2 → none selected
+    const secNone = data.security === 'none' || data.security === 'Open' || data.security === 'open';
+    const isWep = data.security === 'WEP';
+    const wepHint = isWep ? `<span class="form-hint">WEP is not supported. Saving converts this profile to WPA/WPA2.</span>` : '';
+    const tr = document.createElement('tr');
+    tr.innerHTML = `
+        <td><input class="form-input" data-field="ssid" maxlength="19" value="${escapeHtml(data.ssid)}" placeholder="SSID Name"></td>
+        <td>
+            <div class="input-password">
+                <input class="form-input" type="password" data-field="password" maxlength="19" value="${escapeHtml(data.password || '')}" placeholder="Password">
+                <button class="input-password__toggle" type="button" title="Show password">${icon('eye', {size:14})}</button>
+            </div>
+        </td>
+        <td>
+            <select class="form-select" data-field="security">
+                <option value="wpa/wpa2" ${!secNone ? 'selected' : ''}>WPA/WPA2</option>
+                <option value="none" ${secNone ? 'selected' : ''}>Open (none)</option>
+            </select>
+            ${wepHint}
+        </td>
+        <td class="col-action">
+            <button class="btn btn--ghost btn--icon ssid-delete" title="Delete">${icon('trash-2', {size:14})}</button>
+        </td>
+    `;
+
+    // Toggle password visibility
+    tr.querySelector('.input-password__toggle').addEventListener('click', (e) => {
+        const input = tr.querySelector('input[data-field="password"]');
+        input.type = input.type === 'password' ? 'text' : 'password';
+        e.target.innerHTML = input.type === 'password' ? icon('eye', {size:14}) : icon('eye-off', {size:14});
+    });
+
+    // Delete row
+    tr.querySelector('.ssid-delete').addEventListener('click', () => {
+        tr.remove();
+        updateSsidAddButton();
+    });
+
+    tbody.appendChild(tr);
+}
+
+function updateSsidAddButton() {
+    const btn = document.getElementById('ssid-add-btn');
+    const count = document.querySelectorAll('#ssid-tbody tr').length;
+    if (btn) btn.disabled = count >= MAX_SSID_COUNT;
+}
+
+function toggleStaticFields() {
+    const isDhcp = document.querySelector('input[name="wifi_type"]:checked')?.value === 'dhcp';
+    const fields = document.getElementById('wifi-static-fields');
+    if (!fields) return;
+    fields.querySelectorAll('.form-input').forEach(input => {
+        input.disabled = isDhcp;
+    });
+    fields.style.opacity = isDhcp ? '0.5' : '1';
+}
+
+function collectSsidData() {
+    if (!state.device) state.device = {};
+
+    // WiFi settings — collect from octet groups.
+    // country_code MUST be re-collected here: this object replaces state.device.wifi
+    // wholesale, so omitting it would silently drop the legacy Java value on save.
+    const wifiType = document.querySelector('input[name="wifi_type"]:checked')?.value || 'static';
+    const ccEl = document.getElementById('wifi_country_code');
+    const countryCode = normalizeCountryCode(
+        ccEl ? ccEl.value : (state.device.wifi && state.device.wifi.country_code)
+    ) || DEFAULTS.WIFI_COUNTRY_CODE;
+    state.device.wifi = {
+        type: wifiType,
+        ip: collectIpValue('wifi_ip'),
+        netmask: collectIpValue('wifi_netmask'),
+        gateway: collectIpValue('wifi_gateway'),
+        dns1: collectIpValue('wifi_dns1'),
+        dns2: collectIpValue('wifi_dns2'),
+        country_code: countryCode,
+    };
+
+    // SSID list
+    const rows = document.querySelectorAll('#ssid-tbody tr');
+    state.device.ssid_list = Array.from(rows).map(tr => ({
+        ssid: tr.querySelector('[data-field="ssid"]')?.value || '',
+        password: tr.querySelector('[data-field="password"]')?.value || '',
+        security: tr.querySelector('[data-field="security"]')?.value || 'wpa/wpa2',
+    }));
+}
+
+// ─── WiFi IP fields ─────────────────────────────────────────
+const WIFI_IP_FIELDS = ['wifi_ip', 'wifi_netmask', 'wifi_gateway', 'wifi_dns1', 'wifi_dns2'];
+const WIFI_IP_LABELS = {
+    wifi_ip: 'WiFi IP', wifi_netmask: 'WiFi Subnet Mask', wifi_gateway: 'WiFi Gateway',
+    wifi_dns1: 'WiFi DNS 1', wifi_dns2: 'WiFi DNS 2',
+};
+const WIFI_STATE_KEYS = { wifi_ip: 'ip', wifi_netmask: 'netmask', wifi_gateway: 'gateway', wifi_dns1: 'dns1', wifi_dns2: 'dns2' };
+
+// ─── New Page Interface ─────────────────────────────────────
+const wifiPage = {
+    render(container) {
+        const device = state.device || {};
+        const wifi = device.wifi || {};
+        const ssidList = device.ssid_list || [];
+
+        container.innerHTML = `
+            <div class="page-header">
+                <h1 class="page-header__title">${icon('wifi', {size:28})} WiFi SSID Management</h1>
+                <p class="page-header__desc">Manage WiFi network list and connection settings.</p>
+            </div>
+
+            <div class="card">
+                <div class="card__header">
+                    <h2 class="card__title"><span class="card__title-icon">${icon('radio-tower', {size:16})}</span> SSID List</h2>
+                    <button class="btn btn--outline btn--sm" id="ssid-add-btn">＋ Add</button>
+                </div>
+                <div class="data-table-wrapper">
+                    <table class="data-table" id="ssid-table">
+                        <thead>
+                            <tr>
+                                <th>SSID Name</th>
+                                <th>Password</th>
+                                <th>Security</th>
+                                <th class="col-action"></th>
+                            </tr>
+                        </thead>
+                        <tbody id="ssid-tbody"></tbody>
+                    </table>
+                </div>
+                <p class="form-hint mt-sm">Up to 10 SSIDs can be registered.</p>
+            </div>
+
+            <div class="card">
+                <div class="card__header">
+                    <h2 class="card__title"><span class="card__title-icon">${icon('wrench', {size:16})}</span> WiFi Connection Settings</h2>
+                </div>
+                <div class="form-group">
+                    <label class="form-label">Connection Type</label>
+                    <div class="radio-group">
+                        <label class="radio-label">
+                            <input type="radio" name="wifi_type" value="static" ${wifi.type !== 'dhcp' ? 'checked' : ''}>
+                            Static
+                        </label>
+                        <label class="radio-label">
+                            <input type="radio" name="wifi_type" value="dhcp" ${wifi.type === 'dhcp' ? 'checked' : ''}>
+                            DHCP
+                        </label>
+                    </div>
+                </div>
+                <div id="wifi-static-fields">
+                    <div class="form-row">
+                        <div class="form-group">
+                            <label class="form-label">IP Address</label>
+                            ${renderIpOctets('wifi_ip', wifi.ip)}
+                        </div>
+                        <div class="form-group">
+                            <label class="form-label">Subnet Mask</label>
+                            ${renderIpOctets('wifi_netmask', wifi.netmask)}
+                        </div>
+                    </div>
+                    <div class="form-row">
+                        <div class="form-group">
+                            <label class="form-label">Gateway</label>
+                            ${renderIpOctets('wifi_gateway', wifi.gateway)}
+                        </div>
+                        <div class="form-group">
+                            <label class="form-label">DNS 1</label>
+                            ${renderIpOctets('wifi_dns1', wifi.dns1)}
+                        </div>
+                    </div>
+                    <div class="form-row">
+                        <div class="form-group">
+                            <label class="form-label">DNS 2</label>
+                            ${renderIpOctets('wifi_dns2', wifi.dns2)}
+                        </div>
+                        <div class="form-group"></div>
+                    </div>
+                </div>
+            </div>
+
+            <div class="card">
+                <div class="card__header">
+                    <h2 class="card__title"><span class="card__title-icon">${icon('globe', {size:16})}</span> Region</h2>
+                </div>
+                <div class="form-group">
+                    <label class="form-label" for="wifi_country_code">Country Code</label>
+                    <select class="form-input" id="wifi_country_code" style="max-width: 300px;">
+                        ${renderCountryOptions(wifi.country_code || DEFAULTS.WIFI_COUNTRY_CODE)}
+                    </select>
+                    <p class="form-hint">WiFi regulatory region. Defaults to AE (United Arab Emirates); dpworldapp applies it to the WiFi module.</p>
+                </div>
+            </div>
+        `;
+    },
+
+    mount(container) {
+        setupIpOctets(container);
+
+        // Reactive bindings: WiFi type radio
+        bindRadio(container, 'wifi_type',
+            () => (state.device?.wifi?.type || 'static'),
+            (val) => {
+                if (!state.device) state.device = {};
+                if (!state.device.wifi) state.device.wifi = {};
+                state.device.wifi.type = val;
+                state.isDirty = true;
+            }
+        );
+
+        // Reactive bindings: WiFi IP groups
+        WIFI_IP_FIELDS.forEach(ipKey => {
+            const stateKey = WIFI_STATE_KEYS[ipKey];
+            bindIpGroup(container, ipKey,
+                () => state.device?.wifi?.[stateKey] || '',
+                (val) => {
+                    if (!state.device) state.device = {};
+                    if (!state.device.wifi) state.device.wifi = {};
+                    state.device.wifi[stateKey] = val;
+                    state.isDirty = true;
+                }
+            );
+        });
+
+        // Reactive binding: WiFi country code (<select>)
+        const ccEl = container.querySelector('#wifi_country_code');
+        if (ccEl) {
+            ccEl.addEventListener('change', () => {
+                if (!state.device) state.device = {};
+                if (!state.device.wifi) state.device.wifi = {};
+                state.device.wifi.country_code = ccEl.value;
+                state.isDirty = true;
+            });
+        }
+
+        // SSID list: populate + event delegation
+        const tbody = container.querySelector('#ssid-tbody');
+        const ssidList = state.device?.ssid_list || [];
+        ssidList.forEach((s, i) => addSsidRow(tbody, s, i));
+
+        // SSID list: reactive sync on input/change/delete
+        tbody.addEventListener('input', () => { this._syncSsidList(tbody); });
+        tbody.addEventListener('change', () => { this._syncSsidList(tbody); });
+        // Sync after row deletion (DOM mutation via click on delete button)
+        tbody.addEventListener('click', (e) => {
+            if (e.target.closest('.ssid-delete')) {
+                // Delay to let the row be removed first
+                setTimeout(() => { this._syncSsidList(tbody); updateSsidAddButton(); }, 0);
+            }
+        });
+
+        // Add button
+        const addBtn = container.querySelector('#ssid-add-btn');
+        addBtn.addEventListener('click', () => {
+            if (tbody.querySelectorAll('tr').length >= MAX_SSID_COUNT) return;
+            addSsidRow(tbody, { ssid: '', password: '', security: 'wpa/wpa2' }, tbody.querySelectorAll('tr').length);
+            this._syncSsidList(tbody);
+            updateSsidAddButton();
+        });
+        updateSsidAddButton();
+
+        // Static/DHCP toggle
+        container.querySelectorAll('input[name="wifi_type"]').forEach(radio => {
+            radio.addEventListener('change', () => toggleStaticFields());
+        });
+        toggleStaticFields();
+
+        // Legacy collector — keyed as 'wifi' (P2 canonical id) + 'ssid' (alias compat)
+        window.__pageCollectors.wifi = collectSsidData;
+        window.__pageCollectors.ssid = collectSsidData;
+    },
+
+    _syncSsidList(tbody) {
+        if (!state.device) state.device = {};
+        const rows = tbody.querySelectorAll('tr');
+        state.device.ssid_list = Array.from(rows).map(tr => ({
+            ssid: tr.querySelector('[data-field="ssid"]')?.value || '',
+            password: tr.querySelector('[data-field="password"]')?.value || '',
+            security: tr.querySelector('[data-field="security"]')?.value || 'wpa/wpa2',
+        }));
+        state.isDirty = true;
+    },
+
+    destroy() {},
+
+    validate() {
+        const errors = [];
+        const wifi = state.device?.wifi || {};
+        // Only validate IP fields when static mode
+        if (wifi.type !== 'dhcp') {
+            WIFI_IP_FIELDS.forEach(ipKey => {
+                const stateKey = WIFI_STATE_KEYS[ipKey];
+                const val = wifi[stateKey];
+                if (val && val !== '...' && !isValidIP(val)) {
+                    errors.push({ field: ipKey, page: 'wifi', message: `${WIFI_IP_LABELS[ipKey]} — Invalid IP format` });
+                }
+            });
+        }
+        // Region — WiFi country code: required, exactly 2 uppercase letters
+        if (!isValidCountryCode(normalizeCountryCode(wifi.country_code))) {
+            errors.push({
+                field: 'wifi_country_code', page: 'wifi',
+                message: 'Country Code — must be a 2-letter ISO 3166-1 alpha-2 code (e.g. KR, US, DE, JP, AE)',
+            });
+        }
+        // v1.6.0 §5.2: dpworldapp 한계 미러 — SSID ≤19바이트·"\ 금지, psk 8-19바이트(wpa/wpa2)·none 은 빈 값
+        // #12: validator.py 는 UTF-8 바이트 길이 기준(len(s.encode("utf-8"))) — TextEncoder 로 동일 의미론 적용
+        const _byteLen = (s) => new TextEncoder().encode(s).length;
+        const ssidList = state.device?.ssid_list || [];
+        // M-7: gap rule — find first empty-SSID row; any filled row after it will
+        // be silently dropped by the apply engine (netmodel.py effective_profiles
+        // truncates at first empty SSID, mirroring validator.py:48-52 gap 금지).
+        const firstEmpty = ssidList.findIndex(p => !p.ssid);
+        if (firstEmpty !== -1) {
+            for (let j = firstEmpty + 1; j < ssidList.length; j++) {
+                if (ssidList[j].ssid) {
+                    errors.push({
+                        field: 'ssid-table', page: 'wifi',
+                        message: `SSID #${j + 1}: a profile after an empty row will not be applied — move it up`,
+                    });
+                }
+            }
+        }
+        ssidList.forEach((p, i) => {
+            if (!p.ssid) return;
+            // Normalize security: legacy 'Open'/'open' rows import as open network
+            const sec = (p.security === 'Open' || p.security === 'open') ? 'none' : (p.security || 'wpa/wpa2');
+            const pw = p.password || '';
+            if (_byteLen(p.ssid) > 19) errors.push({ field: 'ssid-table', page: 'wifi', message: `SSID #${i + 1} — maximum 19 bytes; firmware may truncate longer names` });
+            if (/["\\]/.test(p.ssid)) errors.push({ field: 'ssid-table', page: 'wifi', message: `SSID #${i + 1} — double quote and backslash are not allowed` });
+            if (sec === 'none') {
+                if (pw) errors.push({ field: 'ssid-table', page: 'wifi', message: `SSID #${i + 1} — open networks must not have a password` });
+            } else if (_byteLen(pw) < 8 || _byteLen(pw) > 19) {
+                errors.push({ field: 'ssid-table', page: 'wifi', message: `SSID #${i + 1} — password must be 8-19 bytes` });
+            }
+        });
+        return errors;
+    },
+};
+
+export default wifiPage;
diff --git a/src/static/js/pending.js b/src/static/js/pending.js
new file mode 100644
index 0000000..1c2aade
--- /dev/null
+++ b/src/static/js/pending.js
@@ -0,0 +1,391 @@
+/**
+ * pending.js — v1.7.0 Pending Changes (보류 변경) 모듈
+ *
+ * Spec §3: 전역 "미저장 N · 미적용 M" 배지 + Pending Changes 패널(필드 diff + per-page/전체 revert·save).
+ *
+ * 책임:
+ *  - 배지 렌더·갱신 (#pending-badge): 미저장=getDirtyPages().length, 미적용=경량 drift 캐시.
+ *  - 미적용(drift) 캐시·저빈도 폴링 (GET api/network/drift, subprocess 0).
+ *  - per-page / 전체 되돌리기 (revertPage).
+ *  - Pending Changes 패널 (openPanel/closePanel — Task 5).
+ *
+ * 순환 import 회피: page-dirty.js 는 pending 을 import 하지 않고, 여기서 onDirtyChange 로 구독.
+ */
+
+import { getDirtyPages, clearDirty, onDirtyChange } from './page-dirty.js';
+import { state, discardPageChanges, computeChanges } from './state.js';
+import { PAGE_DISPLAY_NAMES } from './constants.js';
+import { escapeHtml } from './utils.js';
+import { showToast } from './toast.js';
+// v1.8.0 Task 5: User 모드는 "미적용(unapplied)" 개념을 노출하지 않는다 (Save=적용이라 통상 0).
+// view-mode 는 leaf 모듈 — 순환 import 없음.
+import { isAdvanced } from './view-mode.js';
+
+// ── 미적용(drift) 캐시 ───────────────────────────────────────────
+let _unapplied = 0;          // 미적용 필드 수 (경량 drift endpoint 기준)
+let _unappliedFields = [];   // 미적용 필드명 목록 (패널용)
+let _pollTimer = null;
+let _rerender = null;        // 현재 페이지 재렌더 콜백 (initPending 주입)
+let _navigate = null;        // 페이지 이동 콜백 (딥링크용, initPending 주입)
+let _saveAll = null;         // 전체 저장 콜백 (initPending 주입)
+
+const UNAPPLIED_POLL_MS = 60000;   // 저빈도 안전망 (drift 는 Save/Apply 로만 변함)
+
+/** Test-only: 미적용 캐시 초기화. */
+export function _resetUnapplied() {
+    _unapplied = 0;
+    _unappliedFields = [];
+}
+
+/** v1.7.1 Task 5: 현재 미적용(drift) 필드 수 — Save 후 Apply-needed CTA 판단용. */
+export function getUnapplied() {
+    return _unapplied;
+}
+
+async function _api(path, opts) {
+    const res = await fetch(path, opts);
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) throw new Error(body.error || `${path}: ${res.status}`);
+    return body;
+}
+
+/**
+ * 경량 drift endpoint 에서 미적용 카운트 갱신 후 배지 재그림.
+ * 실패는 조용히 무시 (배지가 네트워크 오류로 깨지면 안 됨).
+ */
+export async function refreshUnapplied() {
+    try {
+        const r = await _api('api/network/drift');
+        // #21: an unreadable network_config.json yields {dirty:null, error:...}.
+        // Treat that as UNKNOWN — do NOT zero the count (zeroing would be a false
+        // 'no unapplied changes'); keep the previous cached value instead.
+        if (!r || !r.error) {
+            _unappliedFields = Array.isArray(r.fields) ? r.fields : [];
+            _unapplied = _unappliedFields.length;
+        }
+    } catch (e) {
+        // silent — 전 페이지 배지가 endpoint 오류에 영향받지 않도록
+    }
+    renderBadge();
+}
+
+/**
+ * v1.7.1 Task 5: Save 성공 후 미적용(drift)>0 이면 "Apply needed" CTA 를 띄운다.
+ *  - 자체 toast (route 버튼 포함) 로 Apply & Status 동선 제공.
+ *  - 전역 pending 배지를 강조(flash)해 미적용 변경의 존재를 다시 환기.
+ * @param {Object} [opts]
+ * @param {Function} [opts.navigate] — 페이지 이동 콜백 (미주입 시 initPending 의 _navigate)
+ */
+export function applyNeededCta(opts = {}) {
+    const navigate = opts.navigate || _navigate;
+    const container = document.getElementById('toast-container');
+    if (container) {
+        const el = document.createElement('div');
+        el.className = 'toast toast--warning';
+        el.setAttribute('role', 'alert');
+
+        const msg = document.createElement('span');
+        msg.className = 'toast__message';
+        msg.textContent = 'Saved. Apply needed to take effect.';
+
+        const cta = document.createElement('button');
+        cta.className = 'toast__action';
+        cta.type = 'button';
+        cta.setAttribute('data-goto-apply', '');
+        cta.textContent = 'Apply & Status';
+        cta.addEventListener('click', () => {
+            el.remove();
+            if (typeof navigate === 'function') navigate('net-apply');
+        });
+
+        const close = document.createElement('button');
+        close.className = 'toast__close';
+        close.type = 'button';
+        close.setAttribute('aria-label', 'Close');
+        close.textContent = '✕';
+        close.addEventListener('click', () => el.remove());
+
+        el.appendChild(msg);
+        el.appendChild(cta);
+        el.appendChild(close);
+        container.appendChild(el);
+        // Auto-dismiss after a long-ish window (operator may act on it).
+        setTimeout(() => { if (el.parentNode) el.remove(); }, 8000);
+    } else {
+        // No toast container — fall back to the standard toast.
+        showToast('Saved. Apply needed to take effect — open Apply & Status.', 'warning');
+    }
+
+    // Emphasize the global pending badge so the unapplied count is re-surfaced.
+    document.querySelectorAll('[data-pending-badge]').forEach(badge => {
+        badge.classList.add('pending-badge--flash');
+        // Drop the emphasis after the animation window so it can re-trigger later.
+        setTimeout(() => badge.classList.remove('pending-badge--flash'), 4000);
+    });
+}
+
+/** 배지 렌더 — 미저장(getDirtyPages().length)·미적용(_unapplied) 두 카운트. 0·0 이면 hidden.
+ *  data-pending-badge 속성을 가진 모든 노드(sidebar + mobile)를 동시 갱신. */
+export function renderBadge() {
+    const nodes = document.querySelectorAll('[data-pending-badge]');
+    if (nodes.length === 0) return;
+    const unsaved = getDirtyPages().length;
+    // v1.8.0 Task 5: User 모드는 미적용(unapplied)을 노출하지 않는다 — 배지는 미저장만.
+    const advanced = isAdvanced();
+    const unapplied = advanced ? _unapplied : 0;
+    if (unsaved === 0 && unapplied === 0) {
+        nodes.forEach(el => {
+            el.classList.add('hidden');
+            el.innerHTML = '';
+            el.setAttribute('aria-label', 'No pending changes');
+        });
+        return;
+    }
+    const parts = [];
+    parts.push(`<span class="pending-badge__count pending-badge__count--unsaved">`
+        + `<span class="pending-badge__dot"></span>Unsaved ${unsaved}</span>`);
+    if (advanced) {
+        parts.push(`<span class="pending-badge__count pending-badge__count--unapplied">`
+            + `<span class="pending-badge__dot"></span>Unapplied ${unapplied}</span>`);
+    }
+    const html = parts.join('<span class="pending-badge__sep">·</span>');
+    const label = advanced
+        ? `Unsaved ${unsaved}, Unapplied ${unapplied}`
+        : `Unsaved ${unsaved}`;
+    nodes.forEach(el => {
+        el.classList.remove('hidden');
+        el.innerHTML = html;
+        el.setAttribute('aria-label', label);
+    });
+}
+
+/**
+ * 한 페이지의 변경 되돌리기.
+ *  1) discardPageChanges(pageId)  — state 복원
+ *  2) clearDirty(pageId)          — dirty flag 해제 (배지/dot 갱신)
+ *  3) pageId === currentPage 면 rerender() — 화면 반영
+ * @param {string} pageId
+ * @param {Function} [rerender] — 미주입 시 initPending 의 _rerender 사용
+ */
+export function revertPage(pageId, rerender) {
+    discardPageChanges(pageId);
+    clearDirty(pageId);   // onDirtyChange → renderBadge 가 자동 실행되나, 명시적으로도 보장
+    renderBadge();
+    const rr = rerender || _rerender;
+    if (typeof rr === 'function' && pageId === state.currentPage) rr();
+}
+
+/** 저빈도 미적용 폴링 시작 (이중 시작 방지). */
+export function startUnappliedPoll() {
+    stopUnappliedPoll();
+    _pollTimer = setInterval(() => { refreshUnapplied(); }, UNAPPLIED_POLL_MS);
+}
+
+/** 미적용 폴링 중지 (테스트·정리용). */
+export function stopUnappliedPoll() {
+    if (_pollTimer) { clearInterval(_pollTimer); _pollTimer = null; }
+}
+
+/**
+ * pending 모듈 초기화 — app.js 에서 1회 호출.
+ * @param {Object} opts
+ * @param {Function} opts.rerender — 현재 페이지 재렌더 콜백 (revertPage 용)
+ * @param {Function} [opts.navigate] — 페이지 이동 콜백 (딥링크용)
+ * @param {Function} [opts.saveAll]  — 전체 저장 콜백 (패널 [전체 저장] 용)
+ */
+export function initPending(opts = {}) {
+    _rerender = opts.rerender || null;
+    _navigate = opts.navigate || null;
+    _saveAll = opts.saveAll || null;
+
+    onDirtyChange(renderBadge);          // dirty 변할 때 배지 자동 갱신
+    renderBadge();                       // 초기 1회
+    refreshUnapplied();                  // 초기 미적용 fetch
+    startUnappliedPoll();                // 60s 안전망
+
+    // 모든 배지 노드(sidebar + mobile)에 클릭 리스너 — per-node 데이터셋 플래그로 누적 방지
+    document.querySelectorAll('[data-pending-badge]').forEach(el => {
+        if (!el.dataset.pendingBound) {
+            el.addEventListener('click', () => openPanel());
+            el.dataset.pendingBound = 'true';
+        }
+    });
+}
+
+// ─── Pending Changes 패널 (Task 5) ──────────────────────────────
+//
+// 단일 delegated 리스너(panel 자신) + closePanel 시 완전 제거 → 재방문 누적 없음 (net-apply I-3 교훈).
+// computeChanges() 의 old/new 는 사용자 입력값 → 모든 보간값 escapeHtml. 민감값은 computeChanges
+// 단계에서 이미 '***' 로 마스킹되어 DOM 에 평문이 도달하지 않는다.
+
+let _panel = null;
+let _escHandler = null;
+
+function _groupByPage(changes) {
+    const groups = new Map();   // pageId → [change,...]
+    changes.forEach(c => {
+        if (!groups.has(c.page)) groups.set(c.page, []);
+        groups.get(c.page).push(c);
+    });
+    return groups;
+}
+
+function _diffRows(changes) {
+    return changes.map(c => `
+        <tr>
+            <td class="pending-diff__field">${escapeHtml(c.field)}</td>
+            <td class="pending-diff__old">${escapeHtml(c.old)}</td>
+            <td class="pending-diff__arrow">→</td>
+            <td class="pending-diff__new">${escapeHtml(c.new)}</td>
+        </tr>`).join('');
+}
+
+function _pageBlock(pageId, changes) {
+    const name = PAGE_DISPLAY_NAMES[pageId] || pageId;
+    return `
+        <div class="pending-block" data-page-block="${escapeHtml(pageId)}">
+            <div class="pending-block__head">
+                <h3 class="pending-block__title">${escapeHtml(name)}</h3>
+                <button type="button" class="btn btn--outline btn--sm" data-revert-page="${escapeHtml(pageId)}">Revert this page</button>
+            </div>
+            <table class="pending-diff">
+                <thead><tr><th>Field</th><th>Old</th><th></th><th>New</th></tr></thead>
+                <tbody>${_diffRows(changes) || '<tr><td colspan="4">(no changes)</td></tr>'}</tbody>
+            </table>
+        </div>`;
+}
+
+function _unsavedSection() {
+    const dirty = getDirtyPages();
+    if (dirty.length === 0) {
+        return `<div class="pending-section">
+            <p class="pending-empty">No unsaved changes</p></div>`;
+    }
+    const changes = computeChanges();
+    const groups = _groupByPage(changes);
+    // dirty 페이지 순서대로 렌더 (computeChanges 가 비어도 블록은 표시 — dirty flag 우선)
+    const blocks = dirty.map(pid => _pageBlock(pid, groups.get(pid) || [])).join('');
+    return `
+        <div class="pending-section">
+            <h2 class="pending-section__title">Unsaved · ${dirty.length}</h2>
+            ${blocks}
+            <div class="pending-section__actions">
+                <button type="button" class="btn btn--primary" data-pending-save-all>Save All</button>
+                <button type="button" class="btn btn--outline" data-pending-revert-all>Revert All</button>
+            </div>
+        </div>`;
+}
+
+function _unappliedSection() {
+    // v1.8.0 Task 5: User 모드는 미적용 섹션/Apply 딥링크 비노출 (Save=적용).
+    if (!isAdvanced()) return '';
+    if (_unapplied <= 0) return '';
+    const fields = _unappliedFields.map(f =>
+        `<li class="pending-unapplied__item">${escapeHtml(f)}</li>`).join('');
+    return `
+        <div class="pending-section pending-section--unapplied">
+            <h2 class="pending-section__title">Unapplied · ${_unapplied}</h2>
+            <p class="pending-unapplied__desc">Network changes saved to the DB but not yet applied to the OS.</p>
+            <ul class="pending-unapplied__list">${fields}</ul>
+            <div class="pending-section__actions">
+                <button type="button" class="btn btn--primary" data-pending-goto-apply>Go to Apply &amp; Status</button>
+            </div>
+        </div>`;
+}
+
+/** Pending Changes 패널 열기 (이미 열려 있으면 재렌더). */
+export function openPanel() {
+    closePanel();   // 항상 깨끗한 상태에서 시작 (리스너 누적 0)
+
+    const wrap = document.createElement('div');
+    wrap.className = 'pending-panel__backdrop';
+    wrap.setAttribute('role', 'dialog');
+    wrap.setAttribute('aria-modal', 'true');
+    wrap.setAttribute('aria-labelledby', 'pending-panel-title');
+    wrap.innerHTML = `
+        <div class="pending-panel__modal nav-guard__modal">
+            <div class="pending-panel__header">
+                <h2 id="pending-panel-title" class="pending-panel__title">Pending Changes</h2>
+                <button type="button" class="pending-panel__close" data-pending-close aria-label="Close">&times;</button>
+            </div>
+            <div class="pending-panel__body">
+                ${_unsavedSection()}
+                ${_unappliedSection()}
+            </div>
+        </div>`;
+
+    // 단일 delegated 클릭 리스너 (panel 한정) — closePanel 에서 wrap 제거로 함께 사라짐.
+    wrap.addEventListener('click', (e) => {
+        const t = e.target.closest ? e.target.closest('[data-revert-page],'
+            + '[data-pending-save-all],[data-pending-revert-all],'
+            + '[data-pending-goto-apply],[data-pending-close]') : null;
+        if (!t) {
+            // backdrop 클릭(모달 바깥) → 닫기
+            if (e.target === wrap) closePanel();
+            return;
+        }
+        if (t.hasAttribute('data-pending-close')) {
+            closePanel();
+        } else if (t.hasAttribute('data-revert-page')) {
+            revertPage(t.getAttribute('data-revert-page'));
+            _refreshOrClose();
+        } else if (t.hasAttribute('data-pending-revert-all')) {
+            getDirtyPages().slice().forEach(pid => revertPage(pid));
+            _refreshOrClose();
+        } else if (t.hasAttribute('data-pending-save-all')) {
+            closePanel();
+            if (typeof _saveAll === 'function') _saveAll();
+        } else if (t.hasAttribute('data-pending-goto-apply')) {
+            closePanel();
+            if (typeof _navigate === 'function') _navigate('net-apply');
+        }
+    });
+
+    _escHandler = (e) => { if (e.key === 'Escape') { e.preventDefault(); closePanel(); } };
+    document.addEventListener('keydown', _escHandler, true);
+
+    // WCAG 2.4.3 / H12: Tab/Shift+Tab focus trap — 모달 내부에서 순환 (이 패널이 Save All 확인 모달을 대체).
+    wrap.addEventListener('keydown', (e) => {
+        if (e.key !== 'Tab') return;
+        const focusable = wrap.querySelectorAll(
+            'button, [href], input, select, textarea, [tabindex]:not([tabindex="-1"])');
+        if (focusable.length === 0) return;
+        const first = focusable[0];
+        const last = focusable[focusable.length - 1];
+        if (e.shiftKey && document.activeElement === first) {
+            e.preventDefault(); last.focus();
+        } else if (!e.shiftKey && document.activeElement === last) {
+            e.preventDefault(); first.focus();
+        }
+    });
+
+    document.body.appendChild(wrap);
+    _panel = wrap;
+
+    const closeBtn = wrap.querySelector('[data-pending-close]');
+    if (closeBtn) closeBtn.focus();
+}
+
+/** revert 후 남은 dirty/unapplied 가 있으면 재렌더, 없으면 닫기.
+ *  v1.8.0 Task 5: User 모드는 미적용을 보지 않으므로 미저장만으로 판단(미적용 잔존해도 닫힘). */
+function _refreshOrClose() {
+    renderBadge();
+    const unappliedRemaining = isAdvanced() ? _unapplied : 0;
+    if (getDirtyPages().length === 0 && unappliedRemaining <= 0) {
+        closePanel();
+    } else {
+        openPanel();   // openPanel 이 먼저 closePanel 호출 → 리스너 누적 없음
+    }
+}
+
+/** Pending Changes 패널 닫기 (리스너 완전 제거). */
+export function closePanel() {
+    if (_escHandler) {
+        document.removeEventListener('keydown', _escHandler, true);
+        _escHandler = null;
+    }
+    if (_panel) {
+        _panel.remove();
+        _panel = null;
+    }
+}
diff --git a/src/static/js/state.js b/src/static/js/state.js
new file mode 100644
index 0000000..eb5665f
--- /dev/null
+++ b/src/static/js/state.js
@@ -0,0 +1,830 @@
+/**
+ * state.js — Application State Management
+ *
+ * Central shared state for device and protocol configuration.
+ * All page modules read from and write to this state.
+ */
+
+import { DEFAULTS } from './constants.js';
+
+const DEBUG = typeof location !== 'undefined' &&
+    (location.hostname === 'localhost' || location.hostname === '127.0.0.1');
+
+// Current loaded configs
+export const state = {
+    device: null,
+    protocol: null,
+    currentPage: 'ssid',
+    isDirty: false,
+    /**
+     * v1.5.0 P1: per-page dirty matrix.
+     * Phase 1: 9 기존 page id + firmware placeholder.
+     * Phase 2-3에서 sensor-io / wifi / ethernet 등 신규 leaf 추가 시 entry 추가.
+     */
+    pageDirty: {
+        home:     false,
+        wifi:     false,  // v1.5.0 P2 NEW
+        'wifi-ap': false,  // AP: self-contained config page
+        ssid:     false,  // legacy alias
+        ethernet: false,  // v1.5.0 P2 NEW (Task 2)
+        io:       false,  // legacy + RS485/CAN 잔존
+        'server-setting': false,  // v1.5.0 P2 NEW (Task 3)
+        network:  false,  // legacy alias
+        general:  false,  // v1.5.0 P3 NEW
+        'sensor-io': false,  // v1.5.0 P3 NEW
+        'can-bus': false,  // v1.5.0 P3 NEW
+        register: false,  // legacy alias (PAGES)
+        can:      false,  // legacy alias (PAGES)
+        opcua:    false,
+        modbus:   false,
+        log:      false,
+        firmware: false,
+        'net-apply': false,  // v1.6.0
+    },
+};
+
+/**
+ * Detect if data is in flat format (from original Java app.jar).
+ * Flat format uses keys like wifi_ip, protocol_server_ip, WIFI_SSID etc.
+ */
+function isFlatDeviceFormat(data) {
+    if (!data || typeof data !== 'object') return false;
+    // Check for characteristic flat keys that don't exist in nested format
+    return ('wifi_ip' in data || 'eth_ip' in data || 'protocol_server_ip' in data ||
+        'WIFI_SSID' in data || 'wifi_static' in data || 'can_bus_type' in data ||
+        'can_baudrate' in data || 'lte_server_ip' in data);
+}
+
+/**
+ * Convert flat device config (Java app.jar format) to nested format (Web UI format).
+ *
+ * Flat keys:  wifi_ip, protocol_server_ip, can_baudrate, WIFI_SSID, ...
+ * Nested:     { wifi: { ip }, server: { protocol_server_ip }, can: { speed }, ssid_list, ... }
+ */
+function convertFlatToNested(flat) {
+    const device = createDefaultDevice();
+
+    // ── WiFi ──
+    const wifiStatic = flat.wifi_static;
+    device.wifi = {
+        type: (wifiStatic === 'on') ? 'static' : 'dhcp',
+        ip: flat.wifi_ip || '',
+        netmask: flat.wifi_netmask || '',
+        gateway: flat.wifi_gateway || '',
+        dns1: flat.wifi_dns1 || '',
+        dns2: flat.wifi_dns2 || '',
+        country_code: (flat.wifi_country_code || DEFAULTS.WIFI_COUNTRY_CODE).toString().replace(/[^a-zA-Z]/g, '').slice(0, 2).toUpperCase() || DEFAULTS.WIFI_COUNTRY_CODE,
+    };
+
+    // ── SSID List ── (WIFI_SSID → ssid_list with key rename)
+    if (Array.isArray(flat.WIFI_SSID)) {
+        device.ssid_list = flat.WIFI_SSID.map(entry => ({
+            ssid: entry.wifi_ssid || entry.ssid || '',
+            password: entry.wifi_passwd || entry.password || '',
+            security: entry.wifi_security || entry.security || 'wpa/wpa2',
+        }));
+    }
+
+    // ── Ethernet ──
+    device.eth = {
+        ip: flat.eth_ip || '',
+        netmask: flat.eth_netmask || '',
+        gateway: flat.eth_gateway || '',
+    };
+
+    // ── Server Endpoints (kept as flat sub-keys under server) ──
+    device.server = {};
+    const serverKeys = [
+        'protocol_server_ip', 'protocol_server_port',
+        'update_server_ip', 'update_server_port',
+        'rtcm_server_ip', 'rtcm_server_port',
+        'opc_ua_server_ip', 'opc_ua_server_port',
+        'modbus_server_ip', 'modbus_server_port',
+        'lte_server_ip', 'lte_server_port',
+    ];
+    serverKeys.forEach(k => {
+        if (flat[k] !== undefined) device.server[k] = flat[k];
+    });
+
+    // ── CAN Bus ──
+    device.can = {
+        type: flat.can_bus_type || 'extended',
+        speed: flat.can_baudrate != null ? String(flat.can_baudrate) : 'NONE',
+    };
+
+    // ── RS485 ──
+    device.rs485 = {
+        mode: flat.rs485_mode || 'half',
+        speed: flat.rs485_baudrate != null ? String(flat.rs485_baudrate) : '9600',
+        // v1.4.5 F1: DB Integer → UI String 비교/표시 (form select)
+        databits: flat.rs485_databits != null ? String(flat.rs485_databits) : '8',
+        parity: flat.rs485_parity || 'none',
+        stopbits: flat.rs485_stopbits != null ? String(flat.rs485_stopbits) : '1',
+    };
+
+    // ── LTE ──
+    device.lte = {
+        ip: flat.lte_ip || '',
+        netmask: flat.lte_netmask || '',
+        gateway: flat.lte_gateway || '',
+        port: flat.lte_port || '',
+    };
+
+    // ── Log ──
+    device.log = {
+        save: flat.log_save || 'on',
+        max_size: flat.log_max_size != null ? Number(flat.log_max_size) : 100,
+        max_days: flat.log_max_duration != null ? Number(flat.log_max_duration) : 1,
+        auto_compress: flat.log_auto_compress || 'off',
+        // v1.4.6.9 L1: DEFAULTS 단일 소스 — sibling fields와 일관
+        compress_size_mb: flat.log_compress_size_mb != null ? Number(flat.log_compress_size_mb) : DEFAULTS.LOG_COMPRESS_SIZE_MB,
+        compress_age_days: flat.log_compress_age_days != null ? Number(flat.log_compress_age_days) : DEFAULTS.LOG_COMPRESS_AGE_DAYS,
+        auto_cleanup: flat.log_auto_cleanup || DEFAULTS.LOG_AUTO_CLEANUP,
+        cleanup_max_files: flat.log_cleanup_max_files != null ? Number(flat.log_cleanup_max_files) : DEFAULTS.LOG_CLEANUP_MAX_FILES,
+        cleanup_max_size_mb: flat.log_cleanup_max_size_mb != null ? Number(flat.log_cleanup_max_size_mb) : DEFAULTS.LOG_CLEANUP_MAX_SIZE_MB,
+    };
+
+    return device;
+}
+
+/**
+ * Update device config in state.
+ * Auto-detects flat format from original Java app and converts to nested.
+ * @param {Object} data 
+ */
+/**
+ * v1.5.5.6+ — Discard baseline snapshot.
+ *  setDevice/setProtocol 호출 시점의 state 를 deep clone 으로 보관.
+ *  discardChanges() 는 전체 복원, discardPageChanges(pageId) 는 page-owned slice 만 복원.
+ *  Save 성공 후 commitChangesAsBaseline() 이 이 snapshot 을 최신 저장값으로 갱신.
+ */
+let _originalDevice = null;
+let _originalProtocol = null;
+
+function _deepClone(v) {
+    return v == null ? v : JSON.parse(JSON.stringify(v));
+}
+
+export function setDevice(data) {
+    if (DEBUG) console.log('[State] setDevice called with:', data ? Object.keys(data).slice(0, 10) : null);
+    if (data && isFlatDeviceFormat(data)) {
+        if (DEBUG) console.log('[State] Detected flat device config format, converting to nested...');
+        state.device = convertFlatToNested(data);
+        // v1.4.6.9 M6: WIFI_SSID에 wifi_passwd가 포함 — 평문 password가 console로 누출되던 결함.
+        // top-level 키 목록만 로깅 (구조 진단 충분, 비밀 정보 차단).
+        if (DEBUG) console.log('[State] After conversion — keys:', Object.keys(state.device || {}));
+    } else if (data && (data.wifi || data.ssid_list || data.eth)) {
+        if (DEBUG) console.log('[State] Detected nested device config format (already converted)');
+        state.device = data;
+    } else {
+        if (DEBUG) console.log('[State] No data or unrecognized format, using defaults');
+        state.device = data || createDefaultDevice();
+    }
+    // Snapshot — 이후 변경 / Discard 복원의 baseline
+    _originalDevice = _deepClone(state.device);
+}
+
+/**
+ * Map of old protocol key names → new key names.
+ * Used for backward compatibility when loading legacy configs.
+ */
+const PROTOCOL_KEY_MAP = {
+    equipment_type: 'dev_type',
+    input_level: 'analog_input_level',
+    dr: 'dr_on',
+    heading: 'heading_on',
+    heading_imu: 'heading_imu_on',
+    fix_mode: 'fix_mode_on',
+    byte_order_2: 'two_byte_order',
+    byte_order_4: 'four_byte_order',
+};
+
+/**
+ * Map of protocol VALUE aliases → the canonical value the deployed dpworldapp
+ * binary on .56 accepts. The legacy UI / imports may carry 'OPC-UA' (hyphen) or
+ * 'OPCUA' (no separator); the device config-reader contract only accepts
+ * 'OPC_UA' / 'MODBUS' / 'CAN_BUS' / 'NONE', so an un-normalized value silently
+ * resets to 'NONE' on save. Keyed by an upper-cased, separator-collapsed form so
+ * 'opc-ua', 'OPC UA', 'OPC_UA' all map identically.
+ */
+const PROTOCOL_VALUE_ALIAS = {
+    'OPC-UA': 'OPC_UA',
+    'OPCUA': 'OPC_UA',
+    'OPC_UA': 'OPC_UA',
+    'MODBUS': 'MODBUS',
+    'CAN_BUS': 'CAN_BUS',
+    'CANBUS': 'CAN_BUS',
+    'NONE': 'NONE',
+};
+
+/**
+ * Convert old protocol key names to new ones (in-place).
+ * If the data already uses new keys, they are preserved.
+ */
+function normalizeProtocolKeys(data) {
+    if (!data || typeof data !== 'object') return data;
+    for (const [oldKey, newKey] of Object.entries(PROTOCOL_KEY_MAP)) {
+        if (oldKey in data && !(newKey in data)) {
+            data[newKey] = data[oldKey];
+            delete data[oldKey];
+        } else if (oldKey in data && newKey in data) {
+            // new key takes precedence; just remove old key
+            delete data[oldKey];
+        }
+    }
+    return data;
+}
+
+/**
+ * Update protocol config in state.
+ * Auto-detects old key names and converts to new format.
+ * @param {Object} data 
+ */
+export function setProtocol(data) {
+    if (DEBUG) console.log('[State] setProtocol called with:', data ? Object.keys(data).slice(0, 10) : null);
+    if (data) {
+        normalizeProtocolKeys(data);
+        // Normalize the protocol VALUE too — 'OPC-UA'/'OPCUA' → 'OPC_UA' (the canonical
+        // value the deployed dpworldapp binary accepts), otherwise an un-canonical value
+        // silently resets to 'NONE' on save.
+        if (data.protocol) {
+            const lookup = String(data.protocol).toUpperCase().replace(/[-\s]+/g, '_');
+            data.protocol = PROTOCOL_VALUE_ALIAS[lookup] ?? data.protocol;
+        }
+    }
+    state.protocol = data || createDefaultProtocol();
+    _originalProtocol = _deepClone(state.protocol);
+}
+
+/**
+ * Full restore helper kept for callers that intentionally want to drop every
+ * unsaved page. Navigation Discard uses discardPageChanges(pageId) instead.
+ */
+export function discardChanges() {
+    if (_originalDevice != null) {
+        state.device = _deepClone(_originalDevice);
+    }
+    if (_originalProtocol != null) {
+        state.protocol = _deepClone(_originalProtocol);
+    }
+    state.isDirty = false;
+}
+
+const _PAGE_ALIASES = {
+    ssid: 'wifi',
+    network: 'server-setting',
+    register: 'general',
+    can: 'can-bus',
+};
+
+const _DEVICE_TOP_LEVEL_KEYS_BY_PAGE = {
+    wifi: ['wifi', 'ssid_list'],
+    ethernet: ['eth', 'lte'],
+    io: ['can', 'rs485'],
+    'sensor-io': ['rs485'],
+    'can-bus': ['can'],
+    log: ['log'],
+};
+
+const _SERVER_KEYS_BY_PAGE = {
+    'server-setting': [
+        'protocol_server_ip', 'protocol_server_port',
+        'update_server_ip', 'update_server_port',
+        'rtcm_server_ip', 'rtcm_server_port',
+        'lte_server_ip', 'lte_server_port',
+    ],
+    opcua: ['opc_ua_server_ip', 'opc_ua_server_port'],
+    modbus: ['modbus_server_ip', 'modbus_server_port'],
+};
+
+const _PROTOCOL_TOP_LEVEL_KEYS_BY_PAGE = {
+    general: [
+        'dev_type', 'equipment', 'equipment_id', 'MEID', 'version',
+        'protocol', 'can_input', 'dr_on', 'heading_on', 'heading_imu_on',
+        'fix_mode_on', 'speed_data', 'odo_on', 'odo_speed', 'odo_direction',
+    ],
+    'sensor-io': ['analog_input_level', 'ai0', 'ai1', 'di0', 'di1'],
+    'can-bus': ['CAN'],
+    opcua: ['OPC_UA'],
+    modbus: ['MODBUS', 'two_byte_order', 'four_byte_order'],
+};
+
+function _canonicalPageId(pageId) {
+    return _PAGE_ALIASES[pageId] || pageId;
+}
+
+function _hasOwn(obj, key) {
+    return !!obj && Object.prototype.hasOwnProperty.call(obj, key);
+}
+
+function _ensureObject(root, key) {
+    if (!root[key] || typeof root[key] !== 'object' || Array.isArray(root[key])) {
+        root[key] = {};
+    }
+    return root[key];
+}
+
+function _restoreTopLevelKeys(targetRoot, sourceRoot, keys) {
+    if (!targetRoot || !keys) return false;
+    keys.forEach(key => {
+        if (_hasOwn(sourceRoot, key)) targetRoot[key] = _deepClone(sourceRoot[key]);
+        else delete targetRoot[key];
+    });
+    return keys.length > 0;
+}
+
+function _restoreNestedKeys(targetRoot, sourceRoot, parentKey, keys) {
+    if (!targetRoot || !keys) return false;
+    const targetParent = _ensureObject(targetRoot, parentKey);
+    const sourceParent = sourceRoot && sourceRoot[parentKey];
+    keys.forEach(key => {
+        if (_hasOwn(sourceParent, key)) targetParent[key] = _deepClone(sourceParent[key]);
+        else delete targetParent[key];
+    });
+    return keys.length > 0;
+}
+
+/**
+ * Restore only the state slice owned by one page.
+ *
+ * Navigation Discard is page-scoped: if Wi-Fi and Server Setting are both dirty,
+ * discarding Server Setting must not silently throw away Wi-Fi edits.
+ */
+export function discardPageChanges(pageId) {
+    const page = _canonicalPageId(pageId);
+    let restored = false;
+
+    if (state.device) {
+        restored = _restoreTopLevelKeys(
+            state.device,
+            _originalDevice || {},
+            _DEVICE_TOP_LEVEL_KEYS_BY_PAGE[page]
+        ) || restored;
+        restored = _restoreNestedKeys(
+            state.device,
+            _originalDevice || {},
+            'server',
+            _SERVER_KEYS_BY_PAGE[page]
+        ) || restored;
+    }
+
+    if (state.protocol) {
+        restored = _restoreTopLevelKeys(
+            state.protocol,
+            _originalProtocol || {},
+            _PROTOCOL_TOP_LEVEL_KEYS_BY_PAGE[page]
+        ) || restored;
+    }
+
+    return restored;
+}
+
+/**
+ * v1.5.5.6 — Save 성공 후 호출 — 현재 state 를 새 baseline 으로 채택.
+ * 이후 Discard 는 이 시점으로 복원. (호출 안 하면 옛 load 시점으로 되돌아가 정합성 깨짐.)
+ */
+export function commitChangesAsBaseline() {
+    _originalDevice = _deepClone(state.device);
+    _originalProtocol = _deepClone(state.protocol);
+}
+
+// ─── v1.7.0: Pending field-diff (computeChanges) ────────────────────────────
+//
+// Spec §3.3: baseline(_originalDevice/_originalProtocol) vs 현재(state.device/state.protocol)
+// 를 재귀 비교해 페이지 귀속 변경 목록 [{page, domain, field, old, new}] 을 반환.
+// 페이지 귀속은 기존 discardPageChanges 맵을 역인덱스해 단일 출처 재사용(drift 없음).
+
+const _SECRET_RE = /password|psk|passwd/i;
+const _MASK = '***';
+
+// Legacy page ids that exist only for discardPageChanges (forward map) but must
+// NOT win attribution in the reverse index — the live nav has no such pages.
+const _LEGACY_PAGES = new Set(['io']);
+
+/** Reverse-index the page→keys maps so a changed key resolves to its owning page. */
+function _buildReverseIndex() {
+    const deviceTop = {};   // top-level device key → page
+    const serverKey = {};   // server.* leaf key → page
+    const protoTop = {};    // top-level protocol key → page
+    for (const [page, keys] of Object.entries(_DEVICE_TOP_LEVEL_KEYS_BY_PAGE)) {
+        if (_LEGACY_PAGES.has(page)) continue;   // skip: sensor-io/can-bus must win
+        keys.forEach(k => { if (!(k in deviceTop)) deviceTop[k] = page; });
+    }
+    for (const [page, keys] of Object.entries(_SERVER_KEYS_BY_PAGE)) {
+        keys.forEach(k => { if (!(k in serverKey)) serverKey[k] = page; });
+    }
+    for (const [page, keys] of Object.entries(_PROTOCOL_TOP_LEVEL_KEYS_BY_PAGE)) {
+        keys.forEach(k => { if (!(k in protoTop)) protoTop[k] = page; });
+    }
+    return { deviceTop, serverKey, protoTop };
+}
+
+const _REVERSE = _buildReverseIndex();
+
+/** Page attribution for a device change given its top-level key (server.* uses leaf). */
+function _devicePage(topKey, serverLeaf) {
+    if (topKey === 'server' && serverLeaf) {
+        return _REVERSE.serverKey[serverLeaf] || 'server-setting';
+    }
+    return _REVERSE.deviceTop[topKey] || 'device';
+}
+
+function _protocolPage(topKey) {
+    return _REVERSE.protoTop[topKey] || 'general';
+}
+
+function _isPlainObject(v) {
+    return v != null && typeof v === 'object' && !Array.isArray(v);
+}
+
+/** Display value for a scalar (null/undefined → ''), masking applied by caller. */
+function _scalarStr(v) {
+    if (v == null) return '';
+    return String(v);
+}
+
+/**
+ * Summarize an array change. Length change → "N→M entries", else "(내용 변경)".
+ * Returns {old, new} display strings (never per-row deep diff — spec non-goal).
+ */
+function _arraySummary(oldArr, newArr) {
+    const o = Array.isArray(oldArr) ? oldArr : [];
+    const n = Array.isArray(newArr) ? newArr : [];
+    if (o.length !== n.length) {
+        return { old: `${o.length} entries`, new: `${n.length} entries` };
+    }
+    return { old: '(내용 변경)', new: '(내용 변경)' };
+}
+
+/**
+ * Walk one config tree (baseline vs current), emitting changes for scalar leaves and
+ * array fields. `attribute(pathKey, leafKey)` returns the owning page; `domain` tags rows.
+ * Only top-level keys recurse one level (server.* nested); deeper nesting compares by
+ * JSON equality at the leaf (covers log.* which is one level under device).
+ *
+ * field naming: top-level scalar → "key"; one-level nested → "parent.child"; array → "key".
+ */
+function _diffTree(baseline, current, domain, attributeTop, attributeNested) {
+    const out = [];
+    const base = _isPlainObject(baseline) ? baseline : {};
+    const cur = _isPlainObject(current) ? current : {};
+    const keys = new Set([...Object.keys(base), ...Object.keys(cur)]);
+
+    for (const key of keys) {
+        const bv = base[key];
+        const cv = cur[key];
+
+        if (Array.isArray(bv) || Array.isArray(cv)) {
+            if (JSON.stringify(bv) !== JSON.stringify(cv)) {
+                const page = attributeTop(key);
+                const sum = _arraySummary(bv, cv);
+                out.push({ page, domain, field: key, old: sum.old, new: sum.new });
+            }
+            continue;
+        }
+
+        if (_isPlainObject(bv) || _isPlainObject(cv)) {
+            // Recurse one level (e.g. device.server.*, device.wifi.*, device.log.*).
+            const sub = _isPlainObject(bv) ? bv : {};
+            const subCur = _isPlainObject(cv) ? cv : {};
+            const subKeys = new Set([...Object.keys(sub), ...Object.keys(subCur)]);
+            for (const sk of subKeys) {
+                const sbv = sub[sk];
+                const scv = subCur[sk];
+                if (Array.isArray(sbv) || Array.isArray(scv)) {
+                    if (JSON.stringify(sbv) !== JSON.stringify(scv)) {
+                        const page = attributeNested(key, sk);
+                        const sum = _arraySummary(sbv, scv);
+                        out.push({ page, domain, field: `${key}.${sk}`, old: sum.old, new: sum.new });
+                    }
+                    continue;
+                }
+                if (_isPlainObject(sbv) || _isPlainObject(scv)) {
+                    // Deeper than one level — compare by JSON equality, summarize.
+                    if (JSON.stringify(sbv) !== JSON.stringify(scv)) {
+                        const page = attributeNested(key, sk);
+                        out.push({ page, domain, field: `${key}.${sk}`, old: '(내용 변경)', new: '(내용 변경)' });
+                    }
+                    continue;
+                }
+                if (_scalarStr(sbv) !== _scalarStr(scv)) {
+                    const field = `${key}.${sk}`;
+                    const page = attributeNested(key, sk);
+                    const masked = _SECRET_RE.test(field);
+                    out.push({
+                        page, domain, field,
+                        old: masked ? _MASK : _scalarStr(sbv),
+                        new: masked ? _MASK : _scalarStr(scv),
+                    });
+                }
+            }
+            continue;
+        }
+
+        // scalar leaf
+        if (_scalarStr(bv) !== _scalarStr(cv)) {
+            const page = attributeTop(key);
+            const masked = _SECRET_RE.test(key);
+            out.push({
+                page, domain, field: key,
+                old: masked ? _MASK : _scalarStr(bv),
+                new: masked ? _MASK : _scalarStr(cv),
+            });
+        }
+    }
+    return out;
+}
+
+/**
+ * v1.7.0 — 전 도메인 필드별 변경 목록 (baseline vs 현재).
+ * @returns {Array<{page:string, domain:string, field:string, old:string, new:string}>}
+ */
+export function computeChanges() {
+    const changes = [];
+    changes.push(..._diffTree(
+        _originalDevice, state.device, 'device',
+        (topKey) => _devicePage(topKey, null),
+        (topKey, leafKey) => _devicePage(topKey, leafKey),
+    ));
+    changes.push(..._diffTree(
+        _originalProtocol, state.protocol, 'protocol',
+        (topKey) => _protocolPage(topKey),
+        (topKey) => _protocolPage(topKey),
+    ));
+    return changes;
+}
+
+/**
+ * Get top-level value from device config.
+ * @param {string} key - Top-level property key (e.g. 'wifi', 'eth', 'server')
+ * @returns {*}
+ */
+export function getDeviceValue(key) {
+    if (!state.device) return undefined;
+    return state.device[key];
+}
+
+/**
+ * Set nested value in device config.
+ */
+export function setDeviceValue(key, value) {
+    if (!state.device) state.device = createDefaultDevice();
+    state.device[key] = value;
+    state.isDirty = true;
+}
+
+/**
+ * Get protocol config value.
+ */
+export function getProtocolValue(key) {
+    if (!state.protocol) return undefined;
+    return state.protocol[key];
+}
+
+/**
+ * Set protocol config value.
+ */
+export function setProtocolValue(key, value) {
+    if (!state.protocol) state.protocol = createDefaultProtocol();
+    state.protocol[key] = value;
+    state.isDirty = true;
+}
+
+/**
+ * Convert nested device config (Web UI format) back to the flat format the
+ * device config-reader contract expects (the format the legacy app (app.jar) and
+ * the deployed dpworldapp binary both read).
+ * This is the reverse of convertFlatToNested().
+ * Ensures data saved to SQLite DB is compatible with dpworldapp.
+ *
+ * IMPORTANT: All keys must ALWAYS be included (even if empty string/null).
+ * The legacy app only skips null-valued keys on save, not empty strings.
+ * Missing keys cause dpworldapp to lose data.
+ */
+function convertNestedToFlat(device) {
+    const flat = {};
+
+    // ── WiFi ──
+    const wifi = device.wifi || {};
+    // v1.3.1: matched to convertFlatToNested which treats absent
+    // wifi_static as 'dhcp' — drop the wifi.type===undefined branch.
+    flat.wifi_static = (wifi.type === 'static') ? 'on' : 'off';
+    flat.wifi_ip = wifi.ip || '';
+    flat.wifi_netmask = wifi.netmask || '';
+    flat.wifi_gateway = wifi.gateway || '';
+    flat.wifi_dns1 = wifi.dns1 || '';
+    flat.wifi_dns2 = wifi.dns2 || '';
+    // Region — WiFi regulatory domain (ISO 3166-1 alpha-2). Always emitted so a
+    // Python-side save never drops the value the legacy Java app persisted.
+    flat.wifi_country_code = (wifi.country_code || DEFAULTS.WIFI_COUNTRY_CODE).toString().replace(/[^a-zA-Z]/g, '').slice(0, 2).toUpperCase() || DEFAULTS.WIFI_COUNTRY_CODE;
+
+    // ── Ethernet ──
+    const eth = device.eth || {};
+    flat.eth_ip = eth.ip || '';
+    flat.eth_netmask = eth.netmask || '';
+    flat.eth_gateway = eth.gateway || '';
+
+    // ── Server Endpoints ──
+    // v1.4.6.7 C-2: ports는 정수 schema 일치 (dha baseline 운영 ground truth
+    // 확정 2026-06-04). 이전 string fallback이 운영 DB에 string 잔존 → 정수 parse fail → wipe 위험.
+    const portToInt = (v) => {
+        if (v == null || v === '') return null;  // null → legacy app가 null 키 drop
+        const n = parseInt(v, 10);
+        return Number.isFinite(n) ? n : null;
+    };
+    const server = device.server || {};
+    flat.protocol_server_ip = server.protocol_server_ip || '';
+    flat.protocol_server_port = portToInt(server.protocol_server_port);
+    flat.update_server_ip = server.update_server_ip || '';
+    flat.update_server_port = portToInt(server.update_server_port);
+    flat.rtcm_server_ip = server.rtcm_server_ip || '';
+    flat.rtcm_server_port = portToInt(server.rtcm_server_port);
+    flat.opc_ua_server_ip = server.opc_ua_server_ip || '';
+    flat.opc_ua_server_port = portToInt(server.opc_ua_server_port);
+    flat.modbus_server_ip = server.modbus_server_ip || '';
+    flat.modbus_server_port = portToInt(server.modbus_server_port);
+    flat.lte_server_ip = server.lte_server_ip || '';
+    flat.lte_server_port = portToInt(server.lte_server_port);
+
+    // ── CAN Bus ──
+    const can = device.can || {};
+    flat.can_bus_type = can.type || 'extended';
+    // NONE = no baudrate field (Old Configurator omits field when NONE)
+    if (can.speed != null && can.speed !== 'NONE') {
+        flat.can_baudrate = Number(can.speed) || can.speed;
+    }
+
+    // ── RS485 ──
+    const rs485 = device.rs485 || {};
+    flat.rs485_mode = rs485.mode || 'half';
+    flat.rs485_baudrate = rs485.speed != null ? (Number(rs485.speed) || rs485.speed) : 9600;
+    // v1.4.5.1 I2: 0 보존 (UI 옵션 / dha 일치) — Number||fallback falsy override 방지
+    flat.rs485_databits = rs485.databits != null ? Number(rs485.databits) : 8;
+    flat.rs485_parity = rs485.parity || 'none';
+    flat.rs485_stopbits = rs485.stopbits != null ? Number(rs485.stopbits) : 1;
+
+    // ── LTE ──
+    const lte = device.lte || {};
+    flat.lte_ip = lte.ip || '';
+    flat.lte_netmask = lte.netmask || '';
+    flat.lte_gateway = lte.gateway || '';
+    flat.lte_port = lte.port || '';
+
+    // ── Log ──
+    const log = device.log || {};
+    flat.log_save = log.save || 'on';
+    flat.log_max_size = log.max_size != null ? Number(log.max_size) : 100;
+    flat.log_max_duration = log.max_days != null ? Number(log.max_days) : 1;
+    flat.log_auto_compress = log.auto_compress || 'off';
+    // v1.4.6.9 H10: missing 시 key omit → backend partial-merge가 기존 log_config 값 보존.
+    // state.device.log reset path (loadAllData 실패, createDefault, import partial)에서
+    // 50/7 fallback이 운영자 입력 값을 overwrite하던 wipe vector 차단.
+    if (log.compress_size_mb != null) flat.log_compress_size_mb = Number(log.compress_size_mb);
+    if (log.compress_age_days != null) flat.log_compress_age_days = Number(log.compress_age_days);
+    flat.log_auto_cleanup = log.auto_cleanup || DEFAULTS.LOG_AUTO_CLEANUP;
+    flat.log_cleanup_max_files = log.cleanup_max_files != null ? Number(log.cleanup_max_files) : DEFAULTS.LOG_CLEANUP_MAX_FILES;
+    flat.log_cleanup_max_size_mb = log.cleanup_max_size_mb != null ? Number(log.cleanup_max_size_mb) : DEFAULTS.LOG_CLEANUP_MAX_SIZE_MB;
+
+    // ── WIFI_SSID ── (always include, even if empty array)
+    const ssidList = device.ssid_list || [];
+    flat.WIFI_SSID = ssidList.map(entry => ({
+        wifi_ssid: entry.ssid || '',
+        wifi_passwd: entry.password || '',
+        wifi_security: entry.security || 'wpa/wpa2',
+    }));
+
+    return flat;
+}
+
+/**
+ * Build complete device config for saving (from state).
+ * Converts nested UI format to flat format matching Java app.jar / dpworldapp.
+ * Saved to SQLite board_config table as key="device_config".
+ */
+export function buildDevicePayload() {
+    if (!state.device) return convertNestedToFlat(createDefaultDevice());
+    return convertNestedToFlat(state.device);
+}
+
+/**
+ * Build complete protocol config for saving.
+ * Ensures shift values in CAN/MODBUS/OPC_UA arrays remain strings
+ * for compatibility with legacy Java Configurator (app.jar).
+ */
+export function buildProtocolPayload() {
+    const payload = state.protocol ? { ...state.protocol } : createDefaultProtocol();
+    // Ensure shift values are always strings (legacy compatibility)
+    ['CAN', 'MODBUS', 'OPC_UA'].forEach(key => {
+        if (Array.isArray(payload[key])) {
+            payload[key] = payload[key].map(row => ({
+                ...row,
+                shift: row.shift != null ? String(row.shift) : '0',
+            }));
+        }
+    });
+    return payload;
+}
+
+export function createDefaultDevice() {
+    return {
+        wifi: { country_code: DEFAULTS.WIFI_COUNTRY_CODE },
+        ssid_list: [],
+        eth: {},
+        server: {},
+        can: {},
+        rs485: {},
+        lte: {},
+        log: {
+            save: 'on',
+            max_size: 100,
+            max_days: 1,
+            auto_compress: DEFAULTS.LOG_AUTO_COMPRESS,
+            compress_size_mb: DEFAULTS.LOG_COMPRESS_SIZE_MB,
+            compress_age_days: DEFAULTS.LOG_COMPRESS_AGE_DAYS,
+            auto_cleanup: DEFAULTS.LOG_AUTO_CLEANUP,
+            cleanup_max_files: DEFAULTS.LOG_CLEANUP_MAX_FILES,
+            cleanup_max_size_mb: DEFAULTS.LOG_CLEANUP_MAX_SIZE_MB,
+        },
+    };
+}
+
+export function createDefaultProtocol() {
+    return {
+        dev_type: '',
+        equipment: '',
+        equipment_id: '',
+        MEID: '',
+        version: '',
+        protocol: 'NONE',
+        can_input: 'off',
+        dr_on: 'off',
+        heading_on: 'off',
+        heading_imu_on: 'off',
+        fix_mode_on: 'off',
+        speed_data: '',
+        analog_input_level: '',
+        // v1.4.6.1 B-1: ai0/ai1/di0/di1만 (live device config + working DB baseline)
+        ai0: '0', ai1: '0',
+        di0: '0', di1: '0',
+        two_byte_order: '',
+        four_byte_order: '',
+        // v1.4.6 C: Odometer (odo_on as a flat string key + nested speed/direction fields, per the device config-reader contract)
+        odo_on: 'off',
+        MODBUS: [],
+        OPC_UA: [],
+        CAN: [],
+    };
+}
+
+// ─── Reactive Binding Helpers ───────────────────────────────
+
+/**
+ * 단일 input/select → state 양방향 바인딩
+ */
+export function bindInput(container, selector, getter, setter) {
+    const el = container.querySelector(selector);
+    if (!el) return;
+    const val = getter();
+    if (val !== undefined && val !== null) el.value = String(val);
+    el.addEventListener('input', () => setter(el.value));
+    el.addEventListener('change', () => setter(el.value));
+}
+
+/**
+ * radio 그룹 → state 바인딩
+ */
+export function bindRadio(container, name, getter, setter) {
+    const radios = container.querySelectorAll(`input[name="${name}"]`);
+    const currentVal = getter();
+    radios.forEach(radio => {
+        if (radio.value === currentVal) radio.checked = true;
+        radio.addEventListener('change', () => {
+            if (radio.checked) setter(radio.value);
+        });
+    });
+}
+
+/**
+ * checkbox → state 바인딩 ("1"/"0" 또는 "on"/"off")
+ */
+export function bindCheckbox(container, selector, getter, setter) {
+    const el = container.querySelector(selector);
+    if (!el) return;
+    el.checked = getter() === '1' || getter() === 'on';
+    el.addEventListener('change', () => setter(el.checked ? '1' : '0'));
+}
+
+/**
+ * IP 옥텟 그룹 → state 바인딩
+ */
+export function bindIpGroup(container, ipKey, getter, setter) {
+    const octets = container.querySelectorAll(`.ip-octet[data-ip="${ipKey}"]`);
+    if (octets.length !== 4) return;
+    const ip = getter() || '';
+    const parts = ip.split('.');
+    octets.forEach((oct, i) => { oct.value = parts[i] || ''; });
+    const collect = () => {
+        setter(Array.from(octets).map(o => o.value).join('.'));
+    };
+    octets.forEach(oct => oct.addEventListener('input', collect));
+}
diff --git a/src/static/js/toast.js b/src/static/js/toast.js
new file mode 100644
index 0000000..764f6c2
--- /dev/null
+++ b/src/static/js/toast.js
@@ -0,0 +1,96 @@
+/**
+ * toast.js — Toast Notification System
+ * 
+ * Uses textContent instead of innerHTML to prevent XSS (C-2 fix).
+ */
+
+const ICONS = {
+    success: '✅',
+    error: '❌',
+    warning: '⚠️',
+    info: 'ℹ️',
+};
+
+const DURATIONS = {
+    success: 3000,
+    error: 5000,
+    warning: 5000,
+    info: 3000,
+};
+
+function getContainer() {
+    // Always re-query to avoid stale references after DOM re-renders
+    return document.getElementById('toast-container');
+}
+
+/**
+ * Show a toast notification.
+ * @param {string} message 
+ * @param {'success'|'error'|'warning'|'info'} type 
+ * @param {number} [duration] - ms before auto-dismiss (auto-set by type if omitted)
+ */
+export function showToast(message, type = 'info', duration) {
+    const c = getContainer();
+    if (!c) {
+        console.warn('Toast container not found');
+        return;
+    }
+
+    const dur = duration ?? DURATIONS[type] ?? 3000;
+
+    const el = document.createElement('div');
+    el.className = `toast toast--${type}`;
+    // v1.7.1 Task 4: errors/warnings must interrupt screen readers (assertive);
+    // the polite container handles success/info announcements.
+    if (type === 'error' || type === 'warning') {
+        el.setAttribute('role', 'alert');
+    }
+
+    // Build DOM safely with textContent (XSS prevention)
+    const iconSpan = document.createElement('span');
+    iconSpan.className = 'toast__icon';
+    iconSpan.textContent = ICONS[type] || ICONS.info;
+
+    const msgSpan = document.createElement('span');
+    msgSpan.className = 'toast__message';
+    msgSpan.textContent = message;
+
+    const closeBtn = document.createElement('button');
+    closeBtn.className = 'toast__close';
+    closeBtn.setAttribute('aria-label', 'Close');
+    closeBtn.textContent = '✕';
+    closeBtn.addEventListener('click', () => removeToast(el));
+
+    el.appendChild(iconSpan);
+    el.appendChild(msgSpan);
+    el.appendChild(closeBtn);
+
+    c.appendChild(el);
+
+    // M-9: mirror error/warning text to the assertive SR-only live region so
+    // screen readers interrupt immediately (the polite #toast-container alone
+    // does not upgrade child role="alert" elements to assertive).
+    if (type === 'error' || type === 'warning') {
+        const srRegion = document.getElementById('toast-sr-assertive');
+        if (srRegion) {
+            srRegion.textContent = message;
+        }
+    }
+
+    if (dur > 0) {
+        setTimeout(() => removeToast(el), dur);
+    }
+}
+
+function removeToast(el) {
+    if (!el || !el.parentNode) return; // Already removed
+    el.classList.add('removing');
+    // Use animationend with a fallback timeout to guarantee removal
+    const fallback = setTimeout(() => {
+        if (el.parentNode) el.remove();
+    }, 500);
+    el.addEventListener('animationend', () => {
+        clearTimeout(fallback);
+        if (el.parentNode) el.remove();
+    }, { once: true });
+}
diff --git a/src/static/js/utils.js b/src/static/js/utils.js
new file mode 100644
index 0000000..ee35558
--- /dev/null
+++ b/src/static/js/utils.js
@@ -0,0 +1,20 @@
+/**
+ * utils.js — Shared Utility Functions
+ * 
+ * XSS defense and common helpers.
+ */
+
+/**
+ * Escape HTML special characters to prevent XSS when using innerHTML.
+ * @param {*} str - Value to escape (null/undefined → empty string)
+ * @returns {string} HTML-safe string
+ */
+export function escapeHtml(str) {
+    if (str == null) return '';
+    return String(str)
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
diff --git a/src/static/js/validator.js b/src/static/js/validator.js
new file mode 100644
index 0000000..b946050
--- /dev/null
+++ b/src/static/js/validator.js
@@ -0,0 +1,156 @@
+/**
+ * validator.js — Client-side Validation Utilities
+ * 
+ * Provides IP address, port, and required-field validation
+ * for use in page modules.
+ */
+
+/**
+ * Validate IPv4 address format.
+ * @param {string} str
+ * @returns {boolean}
+ */
+export function isValidIP(str) {
+    if (!str || typeof str !== 'string') return false;
+    const parts = str.trim().split('.');
+    if (parts.length !== 4) return false;
+    return parts.every(p => {
+        const n = parseInt(p, 10);
+        return !isNaN(n) && n >= 0 && n <= 255 && String(n) === p;
+    });
+}
+
+/**
+ * Validate port number (1-65535).
+ * Port 0 is rejected to match backend IANA-valid range (1..65535).
+ * @param {*} val
+ * @returns {boolean}
+ */
+export function isValidPort(val) {
+    const n = parseInt(val, 10);
+    return !isNaN(n) && n >= 1 && n <= 65535;
+}
+
+/**
+ * Normalize a WiFi country code: strip non-alpha, uppercase, 2 chars max.
+ * Mirrors the legacy Java Configurator's on-input + save-time normalization.
+ * @param {*} val
+ * @returns {string} 0–2 char uppercase alpha string
+ */
+export function normalizeCountryCode(val) {
+    return String(val ?? '').replace(/[^a-zA-Z]/g, '').slice(0, 2).toUpperCase();
+}
+
+/**
+ * Validate a WiFi regulatory country code: exactly 2 uppercase letters
+ * (ISO 3166-1 alpha-2, e.g. KR, US, DE, JP, AE).
+ * @param {*} str
+ * @returns {boolean}
+ */
+export function isValidCountryCode(str) {
+    return typeof str === 'string' && /^[A-Z]{2}$/.test(str);
+}
+
+/**
+ * Check if a value is non-empty.
+ * @param {*} value
+ * @returns {boolean}
+ */
+export function isRequired(value) {
+    if (value === null || value === undefined) return false;
+    if (typeof value === 'string') return value.trim().length > 0;
+    return true;
+}
+
+/**
+ * Show inline validation error on an input element.
+ * Handles IP octet groups: attaches error after the .ip-input-group container.
+ * @param {HTMLElement} el 
+ * @param {string} message 
+ */
+export function showFieldError(el, message) {
+    // Determine the correct container for error placement
+    const group = el.closest('.ip-input-group');
+    const anchor = group || el;
+    const parent = anchor.parentElement;
+
+    anchor.classList.add('form-input--error');
+
+    let hint = parent.querySelector('.field-error');
+    if (!hint) {
+        hint = document.createElement('span');
+        hint.className = 'field-error';
+        // Insert after the anchor element
+        if (anchor.nextSibling) {
+            parent.insertBefore(hint, anchor.nextSibling);
+        } else {
+            parent.appendChild(hint);
+        }
+    }
+    hint.textContent = message;
+}
+
+/**
+ * Clear inline validation error.
+ * Handles IP octet groups.
+ * @param {HTMLElement} el 
+ */
+export function clearFieldError(el) {
+    const group = el.closest('.ip-input-group');
+    const anchor = group || el;
+    const parent = anchor.parentElement;
+
+    anchor.classList.remove('form-input--error');
+    const hint = parent.querySelector('.field-error');
+    if (hint) hint.remove();
+}
+
+/**
+ * Clear all field errors in the entire document.
+ * Useful at the start of validation to remove stale errors.
+ */
+export function clearAllFieldErrors() {
+    document.querySelectorAll('.form-input--error').forEach(el => {
+        el.classList.remove('form-input--error');
+    });
+    document.querySelectorAll('.field-error').forEach(el => {
+        el.remove();
+    });
+}
+
+/**
+ * 사이드바 nav-item에 에러 인디케이터(빨간 점) 토글
+ */
+export function setPageError(pageId, hasError) {
+    const nav = document.querySelector(`.nav-item[data-page="${pageId}"]`);
+    if (!nav) return;
+    nav.classList.toggle('nav-item--error', hasError);
+}
+
+/**
+ * 모든 사이드바 에러 인디케이터 제거
+ */
+export function clearAllPageErrors() {
+    document.querySelectorAll('.nav-item--error').forEach(el =>
+        el.classList.remove('nav-item--error')
+    );
+}
+
+/**
+ * 에러 객체의 field 값으로 DOM 요소를 찾아 포커스 + 에러 표시
+ */
+export function focusErrorField(error) {
+    let el = null;
+    // 1. IP 필드 → data-ip 속성으로 첫 번째 옥텟 찾기
+    el = document.querySelector(`.ip-octet[data-ip="${error.field}"][data-idx="0"]`);
+    // 2. 일반 input → id로 찾기
+    if (!el) el = document.getElementById(error.field);
+    // 3. data-field 속성으로 찾기 (CRUD 테이블)
+    if (!el) el = document.querySelector(`[data-field="${error.field}"]`);
+
+    if (el) {
+        showFieldError(el, error.message);
+        el.scrollIntoView({ behavior: 'smooth', block: 'center' });
+        el.focus();
+    }
+}
diff --git a/src/static/js/view-mode.js b/src/static/js/view-mode.js
new file mode 100644
index 0000000..b15b354
--- /dev/null
+++ b/src/static/js/view-mode.js
@@ -0,0 +1,59 @@
+/**
+ * view-mode.js — v1.8.0 Advanced/Debug 보기 토글 상태
+ *
+ * Spec §1.1: 전역 boolean `advancedView` (localStorage `wc.advancedView`, 기본 false).
+ *   - User(기본): apply 머신(상태머신 step·watchdog·drift·journal·force·Apply&Status·미적용 배지) 숨김.
+ *   - Advanced(ON): v1.6/v1.7 가 만든 전부 노출(디버깅용).
+ *
+ * ★ 보안 경계 아님 — 누구나 켤 수 있는 표시 스위치(인증 없음). SEC-2 로그인 도입 시 admin 역할로 승격.
+ *
+ * 순환 import 회피: 이 모듈은 **다른 앱 모듈을 import 하지 않는다**(말단 leaf).
+ *   page-dirty.js 의 onDirtyChange 패턴을 그대로 미러 — 다른 모듈이 onAdvancedChange 로 구독한다.
+ */
+
+const LS_KEY = 'wc.advancedView';
+
+let _advanced = false;          // in-memory truth (initFromStorage 로 hydrate)
+const _subs = [];               // onAdvancedChange 구독자 (dedup)
+
+/** localStorage 에서 값을 읽어 in-memory 플래그를 갱신. app.js init 에서 1회 호출. */
+export function initFromStorage() {
+    try {
+        _advanced = localStorage.getItem(LS_KEY) === 'true';
+    } catch (e) {
+        _advanced = false;   // localStorage 차단(사파리 프라이빗 등) → User 기본
+    }
+    return _advanced;
+}
+
+/** 현재 Advanced 보기 여부. */
+export function isAdvanced() {
+    return _advanced === true;
+}
+
+/**
+ * Advanced 보기 on/off 설정 + localStorage 영속 + 구독자 통지.
+ * @param {boolean} on
+ */
+export function setAdvanced(on) {
+    _advanced = on === true;
+    try {
+        localStorage.setItem(LS_KEY, String(_advanced));
+    } catch (e) { /* quota/차단 무시 — in-memory 상태는 유지 */ }
+    _notify();
+}
+
+/**
+ * Advanced 보기 변경 구독 등록 (dedup — 같은 콜백 중복 등록 무시, 반복 init 가드).
+ * 콜백은 setAdvanced 시 새 boolean 값을 인자로 호출된다.
+ * @param {(advanced: boolean) => void} cb
+ */
+export function onAdvancedChange(cb) {
+    if (typeof cb === 'function' && !_subs.includes(cb)) _subs.push(cb);
+}
+
+function _notify() {
+    _subs.forEach(cb => {
+        try { cb(_advanced); } catch (e) { /* 구독자 예외가 토글을 깨면 안 됨 */ }
+    });
+}
diff --git a/src/support_bundle.py b/src/support_bundle.py
new file mode 100644
index 0000000..f2d37bb
--- /dev/null
+++ b/src/support_bundle.py
@@ -0,0 +1,104 @@
+"""
+support_bundle.py — Assemble a diagnostics zip for the Home dashboard.
+
+Bundles status snapshot, configs (WiFi passwords masked), the newest dpworldapp
+log, and OS diagnostics text. Intended to be emailed to support.
+"""
+
+import copy
+import io
+import json
+import os
+import zipfile
+
+import system_status
+
+MAX_LOG_BYTES = 5 * 1024 * 1024  # cap the bundled log at 5 MB
+
+
+def mask_passwords(device_config):
+    """Return a deep copy of device_config with every wifi_passwd masked.
+
+    Coerces a non-dict device_config (e.g. a corrupted board_config row that
+    decoded to a string, int, or list) to an empty dict rather than propagating
+    an AttributeError from .get().
+    """
+    cfg = copy.deepcopy(device_config if isinstance(device_config, dict) else {})
+    for entry in cfg.get("WIFI_SSID", []) or []:
+        if isinstance(entry, dict) and "wifi_passwd" in entry:
+            entry["wifi_passwd"] = "***"
+    return cfg
+
+
+def _newest_log_path(log_dir):
+    if not os.path.isdir(log_dir):
+        return None
+    newest, newest_mtime = None, 0
+    try:
+        for name in os.listdir(log_dir):
+            if not name.endswith(".log"):
+                continue
+            p = os.path.join(log_dir, name)
+            if os.path.isfile(p):
+                m = os.stat(p).st_mtime
+                if m > newest_mtime:
+                    newest, newest_mtime = p, m
+    except OSError:
+        return None
+    return newest
+
+
+def build_support_bundle(db):
+    """Build the diagnostics zip. Returns the zip file content as bytes."""
+    buf = io.BytesIO()
+    with zipfile.ZipFile(buf, "w", zipfile.ZIP_DEFLATED) as z:
+        # status snapshot
+        try:
+            status = system_status.get_system_status(db)
+        except Exception as e:  # never let one failure abort the bundle
+            status = {"error": str(e)}
+        z.writestr("status.json", json.dumps(status, indent=2, ensure_ascii=False))
+
+        # configs (passwords masked)
+        device = mask_passwords(db.get_config("device_config") or {})
+        z.writestr("config-device.json",
+                   json.dumps(device, indent=2, ensure_ascii=False))
+        protocol = db.get_config("protocol_config") or {}
+        z.writestr("config-protocol.json",
+                   json.dumps(protocol, indent=2, ensure_ascii=False))
+
+        # newest dpworldapp log (capped)
+        log_path = _newest_log_path(system_status.LOG_DIR)
+        if log_path:
+            try:
+                with open(log_path, "rb") as f:
+                    z.writestr("dpworldapp-latest.log", f.read(MAX_LOG_BYTES))
+            except OSError:
+                pass
+
+        # OS diagnostics text
+        z.writestr("ip-addr.txt",
+                   system_status._run(["ip", "addr"]) +
+                   "\n--- routes ---\n" +
+                   system_status._run(["ip", "route"]))
+        z.writestr("systemctl-status.txt",
+                   system_status._run(["systemctl", "status",
+                                       system_status.DPWORLDAPP_UNIT]) +
+                   "\n--- web-configurator ---\n" +
+                   system_status._run(["systemctl", "status",
+                                       "web-configurator.service"]))
+        z.writestr("dmesg.txt", system_status._run(["dmesg"])[-200000:])
+
+        # v1.6.0 (§9): 네트워크 저널 tail — 부재 시 항목 생략 (기존 fail-soft 패턴)
+        try:
+            from network.journal import Journal
+            journal_path = os.path.join(os.environ.get("LOG_DIR", "/opt/log/dpworldapp"),
+                                        "network_journal.jsonl")
+            sections_net = Journal(journal_path).tail(200)
+            z.writestr("network_journal_tail.json",
+                       json.dumps(sections_net, indent=2, ensure_ascii=False))
+        except Exception:   # noqa: BLE001
+            z.writestr("network_journal_tail.json", "[]")
+
+    buf.seek(0)
+    return buf.read()
diff --git a/src/system_status.py b/src/system_status.py
new file mode 100644
index 0000000..8ba74f5
--- /dev/null
+++ b/src/system_status.py
@@ -0,0 +1,1166 @@
+"""
+system_status.py — Device status aggregation for the Home dashboard.
+
+Gathers dpworldapp liveness, communication reachability, network/IP state,
+and system health. dpworldapp is a closed binary, so communication status is
+INFERRED from log freshness + socket reachability — never claimed beyond what
+can be observed.
+"""
+
+import json
+import os
+import re
+import socket
+import sqlite3
+import subprocess
+import threading
+import time
+from datetime import datetime
+
+# ─── Tier constants ──────────────────────────────────────────────
+TIER_OK = "ok"
+TIER_WARN = "warn"
+TIER_ERROR = "error"
+TIER_NA = "na"
+
+# ─── Tunables ────────────────────────────────────────────────────
+DPWORLDAPP_UNIT = "dpworldapp.service"
+LOG_DIR = os.environ.get("LOG_DIR", "/opt/log/dpworldapp")
+PROBE_TIMEOUT = 2.0          # seconds per TCP connect
+EXPENSIVE_TTL = 30.0         # seconds to cache socket probes
+LOG_FRESH_SECONDS = 60       # log mtime younger than this → processing
+LOG_IDLE_SECONDS = 300       # log mtime younger than this → idle, else stale
+# ─── v1.2.0/v1.2.1: tail vs full-scan split ────────────────────
+# Tail (small) is used only for last_line. The FWVE/FWVER/GNSS
+# scanners use a line iterator (Python buffered I/O) and need no
+# chunk size or cap — memory is bounded by line length.
+DPWORLD_LOG_TAIL_BYTES = 4096
+
+# ─── v1.2.0: compiled regex patterns for log scanning ──────────
+_FWVE_RE = re.compile(r'"FWVE"\s*:\s*"([^"]+)"')
+_FWVER_RE = re.compile(r'\[FWVER\]\s+(\S+)')
+_GNSS_FW_RE = re.compile(r'\[GNSS FW VER\s*:\s*([^\]]+)\]')
+
+# ─── v1.3.0: dpworldapp startup phase markers (byte regexes) ────
+# Order matters — scanned in this list order, first match per line wins.
+_PHASE_PATTERNS = [
+    ("fram_init",      re.compile(rb"SPI open for FRAM success")),
+    ("config_load",    re.compile(rb"\[INIT\] device configuration from d/b success")),
+    ("task_spawn",     re.compile(rb"AI/DI Task Started")),
+    ("hw_probes",      re.compile(rb"\[GNSS FW VER\s*:")),
+    ("gnss_time_sync", re.compile(rb"\[GNSS\] accepted initial seed time")),
+    ("server_connect", re.compile(rb"HTTP Status Code:\s*\d{3}")),
+    ("steady_state",   re.compile(rb"\[MSG_PERI\]\s+\d+DATA")),
+]
+# Human-readable labels in the same order — used by the dashboard card.
+_PHASE_LABELS = [
+    ("fram_init",      "FRAM init"),
+    ("config_load",    "Config load"),
+    ("task_spawn",     "Tasks spawned"),
+    ("hw_probes",      "HW probes"),
+    ("gnss_time_sync", "GNSS time sync"),
+    ("server_connect", "Server connect"),
+    ("steady_state",   "Steady state"),
+]
+# Cap for the line-iter scan — bounds worst-case I/O for the one-time-per
+# startup scan. 50k lines ≈ 20 MB of typical dpworldapp log.
+DPWORLDAPP_PHASE_SCAN_MAX_LINES = 50_000
+# Hung detection: a phase exceeds this multiplier of its typical duration.
+DPWORLDAPP_HUNG_FACTOR = 2.0
+# Typical wall-clock durations per phase, used as the hung baseline.
+DPWORLDAPP_TYPICAL_DURATIONS_S = {
+    "fram_init": 1.0, "config_load": 1.0, "task_spawn": 1.0,
+    "hw_probes": 1.0, "gnss_time_sync": 60.0, "server_connect": 60.0,
+    "steady_state": 60.0,
+}
+# v1.3.2: Resume-boot detection — these init markers are ONLY
+# written on cold init. If ANY are present, this is cold init
+# (not a resume boot) and the resume-boot fallback must NOT fire.
+_RESUME_BOOT_COLD_INIT_MARKERS = frozenset({"config_load", "task_spawn", "hw_probes"})
+
+
+def _next_phase_after_last_found(phases_found):
+    """Return the index of the first _PHASE_LABELS entry whose
+    phase name has not been matched yet. Scans in declared order.
+    Returns len(_PHASE_LABELS) if all phases are found."""
+    for idx, (name, _label) in enumerate(_PHASE_LABELS):
+        if name not in phases_found:
+            return idx
+    return len(_PHASE_LABELS)
+
+
+# ─── v1.2.0: Hardware Modules (GNSS + WiFi firmware) ────────────
+AMSS_PATH = os.environ.get("AMSS_PATH", "/lib/firmware/amss.bin")
+WIFI_FW_TOKEN = b"QC_IMAGE_VERSION_STRING="
+WIFI_FW_MAX_LEN = 200  # safety cap on the version string length
+
+
+def classify_core_app_tier(running, log_age_seconds):
+    """running: bool. log_age_seconds: float or None (None = no log found)."""
+    if not running:
+        return TIER_ERROR
+    if log_age_seconds is None:
+        return TIER_WARN
+    if log_age_seconds < LOG_FRESH_SECONDS:
+        return TIER_OK
+    return TIER_WARN  # idle or stale — process alive, so never error
+
+
+def classify_disk_tier(percent):
+    """percent: 0-100 disk usage."""
+    if percent >= 80:
+        return TIER_ERROR
+    if percent >= 60:
+        return TIER_WARN
+    return TIER_OK
+
+
+def classify_endpoint_tier(reachable):
+    """reachable: bool from a TCP probe."""
+    return TIER_OK if reachable else TIER_ERROR
+
+
+def parse_ip_addr(text):
+    """Parse `ip -br addr show` output. Returns list of {name, up, ip, mac}.
+    Loopback is skipped. MAC 은 link state 와 무관하게 `/sys/class/net/<iface>/address` 에서 read.
+
+    v1.5.5.2: MAC 필드 추가 — Dashboard Network 카드에 표시. DOWN 인터페이스도 MAC 보유.
+    """
+    out = []
+    for line in text.splitlines():
+        parts = line.split()
+        if len(parts) < 2:
+            continue
+        name, state = parts[0].split("@")[0], parts[1]
+        if name == "lo":
+            continue
+        ipv4 = ""
+        for tok in parts[2:]:
+            if "." in tok and "/" in tok:
+                ipv4 = tok.split("/")[0]
+                break
+        # v1.5.5.2: MAC from sysfs (link state 무관, DOWN 시에도 read 됨)
+        mac = ""
+        try:
+            with open("/sys/class/net/%s/address" % name, "r") as f:
+                mac = f.read().strip()
+        except OSError:
+            pass
+        out.append({"name": name, "up": state == "UP", "ip": ipv4, "mac": mac})
+    return out
+
+
+def parse_iw_link(text):
+    """Parse `iw dev <if> link` output. Returns {connected, ssid, signal_dbm}."""
+    if not text or "Not connected" in text:
+        return {"connected": False, "ssid": "", "signal_dbm": None}
+    ssid = ""
+    signal = None
+    for line in text.splitlines():
+        s = line.strip()
+        if s.startswith("SSID:"):
+            ssid = s[len("SSID:"):].strip()
+        elif s.startswith("signal:"):
+            m = re.search(r"-?\d+", s)
+            if m:
+                signal = int(m.group())
+    return {"connected": True, "ssid": ssid, "signal_dbm": signal}
+
+
+def parse_systemctl_show(text):
+    """Parse `systemctl show -p ...` KEY=VALUE output into a dict."""
+    out = {}
+    for line in text.splitlines():
+        if "=" in line:
+            key, _, val = line.partition("=")
+            out[key.strip()] = val.strip()
+    return out
+
+
+def tcp_probe(host, port, timeout=PROBE_TIMEOUT):
+    """Return True if a TCP connection to host:port succeeds within timeout."""
+    if not host or port in (None, ""):
+        return False
+    try:
+        port_int = int(port)
+    except (TypeError, ValueError):
+        return False
+    try:
+        with socket.create_connection((host, port_int), timeout=timeout):
+            return True
+    except OSError:
+        return False
+
+
+def _run(cmd, timeout=4):
+    """Run a command, return stdout text. Returns '' on any failure."""
+    try:
+        result = subprocess.run(
+            cmd, capture_output=True, text=True, timeout=timeout,
+            encoding="utf-8", errors="replace",  # non-UTF-8 bytes must not raise
+        )
+        return result.stdout or ""
+    except (subprocess.SubprocessError, OSError):
+        return ""
+
+
+def get_disk(path):
+    """Disk usage for the filesystem hosting `path`, with a tier."""
+    import shutil
+    try:
+        usage = shutil.disk_usage(path)
+    except (OSError, AttributeError):
+        return {"total": 0, "used": 0, "free": 0, "percent": 0, "tier": TIER_NA}
+    percent = round(usage.used / usage.total * 100) if usage.total else 0
+    return {
+        "total": usage.total, "used": usage.used, "free": usage.free,
+        "percent": percent, "tier": classify_disk_tier(percent),
+    }
+
+
+def _find_newest_dpworld_log(log_dir):
+    """Return absolute path of the newest .log file in log_dir, or None.
+
+    Shared by get_log_freshness, _get_dpworld_version_cached, and the
+    GNSS scanner in get_hardware_modules.
+    """
+    if not os.path.isdir(log_dir):
+        return None
+    newest_path, newest_mtime = None, 0.0
+    try:
+        for name in os.listdir(log_dir):
+            if not name.endswith(".log"):
+                continue
+            p = os.path.join(log_dir, name)
+            if not os.path.isfile(p):
+                continue
+            m = os.stat(p).st_mtime
+            if m > newest_mtime:
+                newest_mtime, newest_path = m, p
+    except OSError:
+        return None
+    return newest_path
+
+
+def _scan_log_for_dpworld_version(log_path):
+    """Scan log_path line-by-line for FWVE or [FWVER]; return version str or None.
+
+    Line iteration is bounded in memory (one line at a time) and immune to
+    chunk-boundary misses — FWVE/FWVER are line-anchored patterns. Stops on
+    the first match of either pattern (FWVE preferred — it is the live
+    heartbeat; FWVER is the startup-line fallback).
+    """
+    if not log_path or not os.path.isfile(log_path):
+        return None
+    try:
+        with open(log_path, "rb") as f:
+            for raw in f:
+                text = raw.decode("utf-8", errors="replace")
+                m = _FWVE_RE.search(text)
+                if m:
+                    return m.group(1)
+                m = _FWVER_RE.search(text)
+                if m:
+                    return m.group(1)
+    except OSError:
+        return None
+    return None
+
+
+def _get_dpworld_version_cached(log_dir):
+    """Return dpworldapp version, scanning newest log on first miss.
+
+    The value is memoized, but keyed on dpworldapp's systemd start time
+    (ActiveEnterTimestamp): a `systemctl restart` without a full reboot
+    changes that timestamp, so the cache is invalidated and the version is
+    re-scanned — otherwise a stale version would be reported. Safe to call
+    from multiple threads.
+    """
+    global _dpworld_version_cache, _dpworld_version_ts
+    current_ts = _systemd_active_enter_ts()
+    with _dpworld_version_lock:
+        # A None timestamp (e.g. bad RTC / unit inactive) must never produce a
+        # cache hit — otherwise None == None would pin a stale version forever.
+        if (_dpworld_version_cache is not None and current_ts is not None
+                and current_ts == _dpworld_version_ts):
+            return _dpworld_version_cache
+    newest_path = _find_newest_dpworld_log(log_dir)
+    if newest_path is None:
+        return None
+    value = _scan_log_for_dpworld_version(newest_path)
+    if value is not None:
+        with _dpworld_version_lock:
+            _dpworld_version_cache = value
+            _dpworld_version_ts = current_ts
+    return value
+
+
+def _parse_systemd_active_enter(props):
+    """Parse the 'ActiveEnterTimestamp' value from `systemctl show` output.
+
+    systemd emits a localized weekday abbreviation followed by the date,
+    time, and timezone: e.g. 'Mon 2026-05-27 16:40:46 KST' (en_US) or
+    '월 2026-05-27 16:40:46 KST' (ko_KR). We extract the locale-independent
+    YYYY-MM-DD HH:MM:SS substring with a regex so the parse is robust on
+    any device locale. Returns a naive datetime (assumed local) or None on
+    n/a / missing / unparseable input.
+    """
+    raw = (props.get("ActiveEnterTimestamp") or "").strip()
+    if not raw or raw == "n/a":
+        return None
+    m = re.search(r"(\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2})", raw)
+    if not m:
+        return None
+    try:
+        return datetime.strptime(m.group(1), "%Y-%m-%d %H:%M:%S")
+    except ValueError:
+        return None
+
+
+def _scan_log_for_startup_phases(log_path):
+    """Line-iterate log_path looking for the 7 dpworldapp startup-phase
+    markers. Returns a dict mapping phase_name -> line_number (1-based) for
+    each match found. Stops on the first steady_state match, or after
+    DPWORLDAPP_PHASE_SCAN_MAX_LINES lines.
+
+    Bounded memory (one binary line at a time). Compatible with the
+    v1.2.1 line-iter idiom used by _scan_log_for_dpworld_version.
+    """
+    if not log_path or not os.path.isfile(log_path):
+        return {}
+    found = {}
+    try:
+        with open(log_path, "rb") as f:
+            for i, line in enumerate(f, start=1):
+                if i > DPWORLDAPP_PHASE_SCAN_MAX_LINES:
+                    break
+                for phase_name, pattern in _PHASE_PATTERNS:
+                    if phase_name in found:
+                        continue
+                    if pattern.search(line):
+                        found[phase_name] = i
+                        break
+                if "steady_state" in found:
+                    break
+    except OSError:
+        return found
+    return found
+
+
+def _find_log_for_startup(log_dir):
+    """Find the dpworldapp_*.log file containing the most recent startup.
+
+    Strategy: try the newest .log file first (mtime). If its first 200
+    lines contain the FRAM-init marker (phase 1), that's our file.
+    Otherwise walk rotated .log.0 / .log.1 / ... companions in mtime-
+    descending order. Returns the absolute path, or None when only
+    deeply-rotated .gz / .tar.gz archives remain.
+    """
+    if not os.path.isdir(log_dir):
+        return None
+    fram_pattern = _PHASE_PATTERNS[0][1]
+
+    def _peek_for_fram(path):
+        try:
+            with open(path, "rb") as f:
+                for i, line in enumerate(f, start=1):
+                    if i > 200:
+                        return False
+                    if fram_pattern.search(line):
+                        return True
+        except OSError:
+            return False
+        return False
+
+    # 1) newest live .log
+    newest = _find_newest_dpworld_log(log_dir)
+    if newest and _peek_for_fram(newest):
+        return newest
+
+    # 2) rotated .log.N companions (newest first), no .gz
+    try:
+        rotated = []
+        for name in os.listdir(log_dir):
+            if not re.match(r"dpworldapp_.*\.log\.\d+$", name):
+                continue
+            p = os.path.join(log_dir, name)
+            if not os.path.isfile(p):
+                continue
+            rotated.append((os.stat(p).st_mtime, p))
+        rotated.sort(reverse=True)
+        for _mtime, path in rotated:
+            if _peek_for_fram(path):
+                return path
+    except OSError:
+        pass
+    return None
+
+
+def _scan_log_for_gnss_fw(log_path):
+    """Scan log_path line-by-line for [GNSS FW VER : ...]; return version or None.
+
+    dpworldapp emits this line once at startup right after probing the
+    GNSS module. Line-based iteration handles arbitrary file size and is
+    immune to chunk-boundary misses.
+    """
+    if not log_path or not os.path.isfile(log_path):
+        return None
+    try:
+        with open(log_path, "rb") as f:
+            for raw in f:
+                text = raw.decode("utf-8", errors="replace")
+                m = _GNSS_FW_RE.search(text)
+                if m:
+                    return m.group(1).strip()
+    except OSError:
+        return None
+    return None
+
+
+def _read_wifi_fw_from_amss(path=None):
+    """Read the WLAN firmware version string from amss.bin (Qualcomm
+    QCA6490 firmware blob). Returns None when path missing, token absent,
+    or extraction fails.
+
+    Uses mmap so RSS stays low even on 50MB+ files — only the page
+    containing the token is paged into memory rather than the full blob.
+    Looks for the ASCII token b"QC_IMAGE_VERSION_STRING=" and returns the
+    bytes that follow up to the next NUL byte (capped at WIFI_FW_MAX_LEN).
+    """
+    import mmap  # local import to avoid module-level cost
+    p = path if path is not None else AMSS_PATH
+    if not os.path.isfile(p):
+        return None
+    try:
+        size = os.path.getsize(p)
+        if size == 0:
+            return None
+        with open(p, "rb") as f:
+            with mmap.mmap(f.fileno(), 0, access=mmap.ACCESS_READ) as mm:
+                idx = mm.find(WIFI_FW_TOKEN)
+                if idx < 0:
+                    return None
+                start = idx + len(WIFI_FW_TOKEN)
+                end = mm.find(b"\x00", start, start + WIFI_FW_MAX_LEN)
+                if end < 0:
+                    end = min(start + WIFI_FW_MAX_LEN, size)
+                raw = bytes(mm[start:end])
+    except (OSError, ValueError):
+        return None
+    try:
+        return raw.decode("utf-8").strip() or None
+    except UnicodeDecodeError:
+        return None
+
+
+def _shorten_wifi_fw(full):
+    """Return the first two dash-separated parts (e.g. 'WLAN.HSP.1.1-04389').
+
+    None passes through; strings without a dash are returned as-is.
+    """
+    if not full:
+        return None
+    parts = full.split("-", 2)
+    if len(parts) >= 2:
+        return "-".join(parts[:2])
+    return full
+
+
+def get_hardware_modules(log_dir, amss_path=None):
+    """Lazy-load and cache GNSS + WiFi firmware versions for the dashboard.
+
+    Each module is cached independently — a slow start of dpworldapp
+    means GNSS may not be findable on the first call but WiFi can be,
+    and vice versa. Once a module's value is found it sticks for the
+    life of the process.
+    """
+    global _hw_modules_cache
+    with _hw_modules_lock:
+        gnss_cached = _hw_modules_cache.get("gnss")
+        wifi_cached = _hw_modules_cache.get("wifi")
+
+    if gnss_cached is None:
+        newest = _find_newest_dpworld_log(log_dir)
+        if newest:
+            value = _scan_log_for_gnss_fw(newest)
+            if value:
+                gnss_cached = value
+                with _hw_modules_lock:
+                    _hw_modules_cache["gnss"] = value
+
+    if wifi_cached is None:
+        value = _read_wifi_fw_from_amss(amss_path)
+        if value:
+            wifi_cached = value
+            with _hw_modules_lock:
+                _hw_modules_cache["wifi"] = value
+
+    if gnss_cached:
+        gnss = {"tier": TIER_OK, "fw_version": gnss_cached}
+    else:
+        gnss = {"tier": TIER_NA, "fw_version": None}
+
+    if wifi_cached:
+        wifi = {
+            "tier": TIER_OK,
+            "fw_version_full": wifi_cached,
+            "fw_version_short": _shorten_wifi_fw(wifi_cached),
+        }
+    else:
+        wifi = {"tier": TIER_NA, "fw_version_full": None,
+                "fw_version_short": None}
+
+    return {"gnss": gnss, "wifi": wifi}
+
+
+def _systemd_active_enter_ts(unit=DPWORLDAPP_UNIT):
+    """Return the parsed wall-clock ActiveEnterTimestamp for `unit`, or None."""
+    raw = _run(["systemctl", "show", "-p", "ActiveEnterTimestamp", unit])
+    return _parse_systemd_active_enter(parse_systemctl_show(raw))
+
+
+def _normalize_protocol(value):
+    """Canonicalize a protocol value to the native/Java form.
+
+    dpworldapp writes `"OPC-UA"` (hyphen) but Java `Protocol.from()` canonicalizes
+    with `upper().replace('-','_').replace(' ','_')` → `OPC_UA`. We mirror that so
+    comparisons against `"OPC_UA"`/`"MODBUS"` succeed regardless of which writer
+    last touched board_config. None/empty → "NONE".
+    """
+    return (value or "NONE").strip().upper().replace("-", "_").replace(" ", "_")
+
+
+def _build_dpworldapp_config(protocol_config, device_config):
+    """Extract the 6 runtime-config display fields from the two DB rows.
+
+    Tolerates two storage shapes for odo_speed / odo_dir:
+      - nested dict: {"source": "can"} (the nested shape)
+      - flat scalar: "can" stored as odo_speed_source / odo_dir_source
+    """
+    # Guard against corrupted board_config rows that are non-dict
+    if not isinstance(protocol_config, dict):
+        protocol_config = {}
+    if not isinstance(device_config, dict):
+        device_config = {}
+
+    def _odo(name):
+        nested = protocol_config.get(name)
+        if isinstance(nested, dict):
+            return nested.get("source")
+        return protocol_config.get(name + "_source")
+
+    proto = protocol_config.get("protocol")
+    # v1.5.5.9 D-2: (1) normalize alias so dpworldapp's "OPC-UA" matches; (2) the
+    # *_server_port keys live in device_config, NOT protocol_config.
+    # Previously both bugs made protocol_endpoint always None on live devices.
+    proto_norm = _normalize_protocol(proto)
+    endpoint = None
+    if proto_norm == "OPC_UA":
+        port = device_config.get("opc_ua_server_port")
+        if port:
+            endpoint = f":{port}"
+    elif proto_norm == "MODBUS":
+        port = device_config.get("modbus_server_port")
+        if port:
+            endpoint = f":{port}"
+
+    return {
+        "equipment":         protocol_config.get("equipment"),
+        "equipment_id":      protocol_config.get("equipment_id"),
+        "protocol":          proto,
+        "protocol_endpoint": endpoint,
+        "can_input":         protocol_config.get("can_input"),
+        # config row split (verified against the working DB):
+        #   - device_config:   can_bus_type, can_baudrate, odo_direction
+        #   - protocol_config: odo_speed (source)
+        # Frontend output field names preserved for stability (can_type, can_speed, odo_dir).
+        "can_type":          device_config.get("can_bus_type"),
+        "can_speed":         device_config.get("can_baudrate"),
+        "speed_data":        protocol_config.get("speed_data"),
+        "odo_speed":         _odo("odo_speed"),
+        "odo_dir":           device_config.get("odo_direction"),
+    }
+
+
+def _result_for_phases(phases_found, proc_running, active_enter_ts,
+                      detail_available=True):
+    """Return (result_code, result_label, end_to_end_seconds) from the
+    detection inputs. result_code is one of:
+        'healthy' | 'starting' | 'hung' | 'failed' | 'unknown'."""
+    if not proc_running:
+        return ("failed", "Service not active", None)
+    if active_enter_ts is None:
+        return ("unknown", "—", None)
+
+    found_count = len(phases_found)
+    steady = "steady_state" in phases_found
+    elapsed_s = None
+    try:
+        elapsed_s = (datetime.now() - active_enter_ts).total_seconds()
+    except (TypeError, ValueError):
+        elapsed_s = None
+
+    # v1.3.1: When the startup log is rotated (we have no phase evidence)
+    # but the service is active AND has been alive longer than a typical
+    # full startup, trust systemd's 'active' state over absent log
+    # markers. Without this, log_rotated + long uptime trips 'hung'.
+    if (not phases_found
+            and not detail_available
+            and elapsed_s is not None
+            and elapsed_s > sum(DPWORLDAPP_TYPICAL_DURATIONS_S.values())):
+        label = f"Healthy ({int(elapsed_s)}s · phase detail unavailable)"
+        return ("healthy", label, elapsed_s)
+
+    # v1.3.2: Resume-boot healthy fallback.
+    # dpworldapp 5/22 has two boot paths. On resume from FRAM
+    # checkpoint, init markers (config_load, task_spawn, hw_probes)
+    # are NOT written to the log — only fram_init and gnss_time_sync
+    # mark a resume boot. Trust gnss_time_sync as the alive signal
+    # once uptime exceeds the cold-init end-to-end budget.
+    # The cold-init markers (config_load, task_spawn, hw_probes) must
+    # ALL be absent — otherwise this is a true cold-init hang, not a
+    # resume boot, and the standard hung-detection path should handle it.
+    if ("gnss_time_sync" in phases_found
+            and not (phases_found.keys() & _RESUME_BOOT_COLD_INIT_MARKERS)
+            and elapsed_s is not None
+            and elapsed_s > sum(DPWORLDAPP_TYPICAL_DURATIONS_S.values())):
+        label = f"Healthy ({int(elapsed_s)}s · resume boot)"
+        return ("healthy", label, elapsed_s)
+
+    if steady:
+        end_to_end = None
+        if elapsed_s is not None and elapsed_s > 0:
+            end_to_end = min(round(elapsed_s, 1),
+                             sum(DPWORLDAPP_TYPICAL_DURATIONS_S.values()) * 10)
+        label = f"Healthy ({int(end_to_end)}s)" if end_to_end else "Healthy"
+        return ("healthy", label, end_to_end)
+
+    # Not yet steady. Determine current phase.
+    next_idx = _next_phase_after_last_found(phases_found)
+    if next_idx >= len(_PHASE_LABELS):
+        next_idx = len(_PHASE_LABELS) - 1
+    next_phase_name, next_phase_label = _PHASE_LABELS[next_idx]
+    typical = DPWORLDAPP_TYPICAL_DURATIONS_S.get(next_phase_name, 60.0)
+
+    if elapsed_s is not None and elapsed_s > typical * DPWORLDAPP_HUNG_FACTOR:
+        return (
+            "hung",
+            f"{next_phase_label} ({int(elapsed_s)}s elapsed, no progress)",
+            None,
+        )
+    label_prefix = f"phase {next_idx + 1}/{len(_PHASE_LABELS)}"
+    return ("starting", f"Starting ({label_prefix}: {next_phase_label})", None)
+
+
+def get_dpworldapp_status(db, log_dir=LOG_DIR):
+    """Return the dpworldapp Status Tracker payload for /api/system-status.
+
+    Combines:
+      - systemctl process state (running / pid / ActiveEnterTimestamp)
+      - phase markers scanned from the relevant log file (cached + frozen
+        once steady_state is reached)
+      - runtime config from board_config (protocol_config + device_config)
+
+    Shape follows the dpworldapp runtime status contract.
+    """
+    global _dpworld_status_cache
+
+    proc = get_process_status(DPWORLDAPP_UNIT)
+    active_enter_ts = _systemd_active_enter_ts(DPWORLDAPP_UNIT)
+
+    # Decide cache action
+    with _dpworld_status_lock:
+        cached_ts = _dpworld_status_cache.get("active_enter_ts")
+        cached_phases = _dpworld_status_cache.get("phases")
+        cached_log = _dpworld_status_cache.get("log_path")
+        cached_frozen = _dpworld_status_cache.get("frozen")
+
+    if (active_enter_ts is not None
+            and active_enter_ts == cached_ts
+            and cached_frozen
+            and cached_phases is not None):
+        phases_found = cached_phases
+        log_path = cached_log
+        detail_unavailable = None
+    else:
+        log_path = _find_log_for_startup(log_dir) if active_enter_ts else None
+        if log_path:
+            phases_found = _scan_log_for_startup_phases(log_path)
+            detail_unavailable = None
+        else:
+            phases_found = {}
+            detail_unavailable = "log_rotated" if active_enter_ts else None
+        # Update cache
+        with _dpworld_status_lock:
+            _dpworld_status_cache["active_enter_ts"] = active_enter_ts
+            _dpworld_status_cache["phases"] = phases_found
+            _dpworld_status_cache["log_path"] = log_path
+            _dpworld_status_cache["frozen"] = "steady_state" in phases_found
+
+    # Result + label (computed first because the row tiers depend on it)
+    result, result_label, end_to_end_s = _result_for_phases(
+        phases_found, proc["running"], active_enter_ts,
+        detail_available=(detail_unavailable is None),
+    )
+
+    # The "in-progress" phase is the first unfound phase, but only when
+    # the overall result is starting/hung AND the log detail is available.
+    # For healthy/failed/unknown, or when detail_unavailable is set,
+    # we leave all unfound phases as TIER_NA.
+    in_progress_idx = None
+    if result in ("starting", "hung") and detail_unavailable is None:
+        idx = _next_phase_after_last_found(phases_found)
+        if idx < len(_PHASE_LABELS):
+            in_progress_idx = idx
+
+    # Build per-phase rows
+    rows = []
+    for idx, (name, label) in enumerate(_PHASE_LABELS):
+        if name in phases_found:
+            tier = TIER_OK
+        elif idx == in_progress_idx:
+            tier = TIER_WARN
+        else:
+            tier = TIER_NA
+        rows.append({"name": name, "label": label, "tier": tier,
+                     "duration_s": None})
+
+    # Config (from DB) — guard against non-dict (corrupted board_config row)
+    _pc = db.get_config("protocol_config")
+    protocol_config = _pc if isinstance(_pc, dict) else {}
+    _dc = db.get_config("device_config")
+    device_config = _dc if isinstance(_dc, dict) else {}
+    config = _build_dpworldapp_config(protocol_config, device_config)
+
+    started_at_iso = active_enter_ts.isoformat() if active_enter_ts else None
+    return {
+        "started_at": started_at_iso,
+        "uptime_seconds": proc.get("uptime_seconds"),
+        "pid": proc.get("pid"),
+        "result": result,
+        "result_label": result_label,
+        "end_to_end_seconds": end_to_end_s,
+        "phases": rows,
+        "config": config,
+        "detail_unavailable_reason": detail_unavailable,
+    }
+
+
+def get_log_freshness(log_dir):
+    """Newest log file's age, last line, and dpworldapp firmware version.
+
+    Tail read is small (DPWORLD_LOG_TAIL_BYTES) and used only for last_line.
+    The firmware version is fetched via _get_dpworld_version_cached(), which
+    chunk-scans the file from the start once, then memoizes the result —
+    avoiding the bug where a 16 KB tail missed the ~30-minute FWVE heartbeat
+    on high-traffic CAN logs.
+    """
+    empty = {"age_seconds": None, "last_line": "", "dpworld_version": None}
+    newest_path = _find_newest_dpworld_log(log_dir)
+    if newest_path is None:
+        return dict(empty)
+    try:
+        mtime = os.stat(newest_path).st_mtime
+    except OSError:
+        return dict(empty)
+    last_line = ""
+    try:
+        with open(newest_path, "rb") as f:
+            f.seek(0, os.SEEK_END)
+            size = f.tell()
+            f.seek(max(0, size - DPWORLD_LOG_TAIL_BYTES))
+            tail = f.read().decode("utf-8", errors="replace")
+        for line in tail.splitlines():
+            stripped = line.strip()
+            if stripped:
+                last_line = stripped
+    except OSError:
+        pass
+    return {
+        "age_seconds": max(0.0, time.time() - mtime),
+        "last_line": last_line,
+        "dpworld_version": _get_dpworld_version_cached(log_dir),
+    }
+
+
+def get_interfaces():
+    """List of UP/DOWN interfaces via `ip -br addr`. [] if `ip` unavailable."""
+    text = _run(["ip", "-br", "addr", "show"])
+    return parse_ip_addr(text) if text else []
+
+
+def get_wifi(iface):
+    """WiFi link info via `iw dev <iface> link`."""
+    text = _run(["iw", "dev", iface, "link"])
+    if not text:
+        return {"connected": False, "ssid": "", "signal_dbm": None}
+    return parse_iw_link(text)
+
+
+def get_default_gateway():
+    """Default-route gateway IP via `ip route`. '' if none/unavailable."""
+    text = _run(["ip", "route", "show", "default"])
+    for line in text.splitlines():
+        parts = line.split()
+        if "via" in parts:
+            return parts[parts.index("via") + 1]
+    return ""
+
+
+def _dpworldapp_pid_from_proc():
+    """Return the PID of a running /usr/bin/dpworldapp process by scanning /proc,
+    or None. Used as a fallback when the systemd unit does not report it active
+    (e.g. dpworldapp started outside its unit, or systemctl unavailable)."""
+    try:
+        entries = os.listdir("/proc")
+    except OSError:
+        return None
+    for name in entries:
+        if not name.isdigit():
+            continue
+        try:
+            with open("/proc/%s/comm" % name) as f:
+                if f.read().strip() == "dpworldapp":
+                    return int(name)
+        except (OSError, ValueError):
+            continue
+    return None
+
+
+def get_process_status(unit=DPWORLDAPP_UNIT):
+    """dpworldapp liveness via systemctl with /proc fallback.
+
+    Priority:
+    1. systemctl unit active + MainPID != 0 → running=True, unit_managed=True.
+    2. Else: scan /proc for a dpworldapp comm entry → running=True, unit_managed=False.
+    3. Neither → running=False, unit_managed=False.
+
+    This also handles the silent-systemctl-failure case (_run returns ""):
+    props will be empty → unit not active → /proc fallback decides liveness.
+    """
+    text = _run(["systemctl", "show", "-p", "MainPID", "-p", "ActiveState",
+                 "-p", "ActiveEnterTimestampMonotonic", unit])
+    props = parse_systemctl_show(text)
+    try:
+        pid = int(props.get("MainPID", "0")) or None
+    except ValueError:
+        pid = None
+    unit_active = (props.get("ActiveState") == "active") and (pid is not None)
+
+    uptime_seconds = None
+    try:
+        enter_us = int(props.get("ActiveEnterTimestampMonotonic", "0"))
+        if enter_us > 0:
+            with open("/proc/uptime", "r") as f:
+                boot_uptime = float(f.read().split()[0])
+            uptime_seconds = max(0.0, boot_uptime - enter_us / 1_000_000)
+    except (ValueError, OSError, IndexError):
+        uptime_seconds = None
+
+    if unit_active:
+        return {"running": True, "unit_managed": True,
+                "pid": pid, "uptime_seconds": uptime_seconds, "unit": unit}
+
+    proc_pid = _dpworldapp_pid_from_proc()
+    if proc_pid is not None:
+        return {"running": True, "unit_managed": False,
+                "pid": proc_pid, "uptime_seconds": uptime_seconds, "unit": unit,
+                "detail": "running, not under systemd supervision"}
+
+    return {"running": False, "unit_managed": False,
+            "pid": None, "uptime_seconds": uptime_seconds, "unit": unit}
+
+
+# ─── Probe cache (expensive signals, 30 s TTL) ───────────────────
+# server.py uses ThreadingMixIn — guard the shared cache with a lock.
+_probe_cache = {"data": None, "ts": 0.0}
+_probe_lock = threading.Lock()
+
+# ─── v1.2.0: dpworldapp version cache ──────────────────────────
+# A FWVE/FWVER found in the log is memoized, but keyed on dpworldapp's systemd
+# ActiveEnterTimestamp (v1.11.9): a `systemctl restart` (no full reboot) changes
+# that timestamp → cache invalidated → version re-scanned (no stale version).
+_dpworld_version_cache = None
+_dpworld_version_ts = None
+_dpworld_version_lock = threading.Lock()
+
+# ─── v1.2.0: hardware modules cache (GNSS + WiFi firmware) ─────
+_hw_modules_cache = {"gnss": None, "wifi": None}
+_hw_modules_lock = threading.Lock()
+
+# ─── v1.3.0: dpworldapp Status Tracker cache ────────────────────
+# Keyed on systemctl ActiveEnterTimestamp; frozen once steady_state
+# is reached. Re-scans only when timestamp changes (new restart).
+_dpworld_status_cache = {
+    "active_enter_ts": None, "phases": None,
+    "log_path": None, "frozen": False,
+}
+_dpworld_status_lock = threading.Lock()
+
+
+def get_events_summary(db_path):
+    """Row count + max id of event_history. Safe on any failure."""
+    try:
+        conn = sqlite3.connect(db_path, timeout=2)
+        try:
+            cur = conn.execute("SELECT COUNT(*), MAX(id) FROM event_history")
+            count, last_id = cur.fetchone()
+        finally:
+            conn.close()
+        return {"count": count or 0, "last_id": last_id}
+    except (sqlite3.Error, OSError):
+        return {"count": 0, "last_id": None}
+
+
+def _server_targets(device):
+    """(name, host, port) tuples for every configured server endpoint."""
+    return [
+        ("protocol_srv", device.get("protocol_server_ip"),
+         device.get("protocol_server_port")),
+        ("opc_ua", device.get("opc_ua_server_ip"),
+         device.get("opc_ua_server_port")),
+        ("modbus", device.get("modbus_server_ip"),
+         device.get("modbus_server_port")),
+    ]
+
+
+def _compute_connectivity(device):
+    """Run TCP probes for every server endpoint. {name: {reachable, endpoint}}."""
+    out = {}
+    for name, host, port in _server_targets(device):
+        if not host or port in (None, ""):
+            out[name] = {"reachable": False, "endpoint": None}
+        else:
+            out[name] = {"reachable": tcp_probe(host, port),
+                         "endpoint": f"{host}:{port}"}
+    return out
+
+
+def _endpoint_key(device):
+    """Stable string key derived from the current server-target tuple.
+
+    Used as a cache-busting discriminator: if the operator changes a server IP
+    or port, this key differs from the one stored alongside the cached data and
+    forces a fresh probe even within the TTL window.
+    """
+    return str(tuple(_server_targets(device)))
+
+
+def _get_connectivity_cached(device, now):
+    """Connectivity probes, cached EXPENSIVE_TTL seconds (thread-safe).
+
+    CAS pattern (v1.4.0 C4): the lock is held only for brief cache reads and
+    writes — never during the slow TCP probes themselves.  Concurrent callers
+    may each run their own probe (idempotent last-writer-wins write-back) but
+    they never queue behind each other waiting for a multi-second TCP timeout.
+
+    M-C: cache also stores the endpoint key; a changed server IP/port busts the
+    cache immediately even within the TTL window.
+    """
+    current_key = _endpoint_key(device)
+    # Phase 1: read cache snapshot under brief lock
+    with _probe_lock:
+        cached_data = _probe_cache.get("data")
+        cached_ts = _probe_cache.get("ts", 0.0)
+        cached_key = _probe_cache.get("endpoint_key")
+    # Phase 2: return cache if still fresh AND endpoints unchanged
+    if (cached_data is not None
+            and (now - cached_ts) < EXPENSIVE_TTL
+            and cached_key == current_key):
+        return cached_data
+    # Phase 3: probe OUTSIDE the lock (this is the slow part)
+    fresh = _compute_connectivity(device)
+    # Phase 4: write back under brief lock (last-writer-wins is fine — idempotent)
+    with _probe_lock:
+        _probe_cache["data"] = fresh
+        _probe_cache["ts"] = time.time()
+        _probe_cache["endpoint_key"] = current_key
+    return fresh
+
+
+def get_system_status(db):
+    """Aggregate every status section into the /api/system-status payload."""
+    now = time.time()
+    _dev = db.get_config("device_config")
+    device = _dev if isinstance(_dev, dict) else {}
+    _prot = db.get_config("protocol_config")
+    protocol = _prot if isinstance(_prot, dict) else {}
+
+    # ── Core app ──
+    proc = get_process_status()
+    log_info = get_log_freshness(LOG_DIR)
+    core_tier = classify_core_app_tier(proc["running"], log_info["age_seconds"])
+    core_app = {
+        "tier": core_tier,
+        "running": proc["running"],
+        "unit_managed": proc.get("unit_managed", True),
+        "pid": proc["pid"],
+        "uptime_seconds": proc["uptime_seconds"],
+        "unit": proc["unit"],
+        "version": log_info["dpworld_version"],
+        "last_log_line": log_info["last_line"],
+        "last_log_age_seconds": log_info["age_seconds"],
+        "detail": proc.get("detail"),  # set when running outside systemd unit
+    }
+
+    # ── Communication (inferred) ──
+    conn = _get_connectivity_cached(device, now)
+    # v1.5.5.9 D-2: normalize alias — DB stores "OPC-UA" (dpworldapp) so the prior
+    # bare .upper() left it as "OPC-UA" ≠ "OPC_UA", marking the active OPC-UA
+    # endpoint N/A instead of probing reachability.
+    proto_name = _normalize_protocol(protocol.get("protocol"))
+    can_on = (protocol.get("can_input") or "off") == "on"
+
+    if not can_on:
+        can = {"tier": TIER_NA, "label": "N/A"}
+    elif core_tier == TIER_OK:
+        can = {"tier": TIER_OK, "label": "Enabled"}
+    else:
+        can = {"tier": TIER_WARN, "label": "Enabled"}
+
+    def _endpoint_status(active, probe):
+        if not active:
+            return {"tier": TIER_NA, "label": "N/A", "endpoint": probe["endpoint"]}
+        reachable = probe["reachable"]
+        return {"tier": classify_endpoint_tier(reachable),
+                "label": "Reachable" if reachable else "Unreachable",
+                "endpoint": probe["endpoint"]}
+
+    communication = {
+        "protocol": proto_name,
+        "can": can,
+        "opc_ua": _endpoint_status(proto_name == "OPC_UA", conn["opc_ua"]),
+        "modbus": _endpoint_status(proto_name == "MODBUS", conn["modbus"]),
+        "protocol_srv": _endpoint_status(True, conn["protocol_srv"]),
+    }
+
+    # ── Network ──
+    # v1.5.5.2: 이전엔 UP 만 표시 — DOWN 인터페이스 (cable 미연결 eth, 가상 인터페이스 등)
+    # 가려졌음. 사용자 요구: eth* / wlan* 는 UP/DOWN 모두 표시 (운영자가 cable
+    # 연결 여부 + IP/MAC 인지 가능). pseudo 인터페이스 (p2p0/sit0/wifi-aware0 등)
+    # 는 노이즈이므로 prefix 화이트리스트로 필터.
+    _NET_VISIBLE_PREFIXES = ("eth", "wlan")
+    all_interfaces = get_interfaces()
+    interfaces = [i for i in all_interfaces
+                  if any(i["name"].startswith(p) for p in _NET_VISIBLE_PREFIXES)]
+    for iface in interfaces:
+        # UP → OK (green), DOWN → NA (gray, neutral — cable 미연결도 정상 상태)
+        iface["tier"] = TIER_OK if iface["up"] else TIER_NA
+    wifi_iface = next((i["name"] for i in interfaces
+                       if i["name"].startswith("wlan")), None)
+    wifi = {"tier": TIER_NA, "iface": None, "connected": False,
+            "ssid": "", "signal_dbm": None}
+    if wifi_iface:
+        link = get_wifi(wifi_iface)
+        wifi = {
+            "tier": TIER_OK if link["connected"] else TIER_WARN,
+            "iface": wifi_iface, "connected": link["connected"],
+            "ssid": link["ssid"], "signal_dbm": link["signal_dbm"],
+        }
+    gw_ip = get_default_gateway()
+    gw_reachable = tcp_probe(gw_ip, 80, timeout=1.0) if gw_ip else False
+    gateway = {
+        "tier": TIER_OK if gw_ip else TIER_WARN,
+        "ip": gw_ip, "reachable": gw_reachable,
+    }
+    dns_servers = [device.get("wifi_dns1"), device.get("wifi_dns2")]
+    dns_servers = [d for d in dns_servers if d]
+    network = {
+        "interfaces": interfaces, "wifi": wifi, "gateway": gateway,
+        "dns": {"tier": TIER_OK if dns_servers else TIER_WARN,
+                "servers": dns_servers},
+    }
+
+    # ── System ──
+    system = {
+        "disk_root": get_disk("/"),
+        "disk_opt": get_disk(LOG_DIR if os.path.isdir(LOG_DIR) else "/"),
+        "uptime_seconds": _device_uptime(),
+        "events": get_events_summary(getattr(db, "db_path", ":memory:")),
+    }
+
+    # v1.5.5: dpworldapp telemetry stream (TCP 8989) 에서 정적 정보 수집.
+    # 헤더 8 frame (firmware/MAC/IP) 만 짧게 query, 실시간 stream 은 받지 않음.
+    # v1.5.5.1: TTL 30s cache + timeout 1s default — dpworldapp 부담 1/3 (10s poll vs 30s cache).
+    # Import 는 모듈 import 사이클을 회피하기 위해 함수 안에서 lazy 로 (test 환경에서
+    # socket 자체를 mock 가능).
+    try:
+        from dpworldapp_telemetry import telemetry_summary
+        dpworldapp_runtime = telemetry_summary()  # default timeout=1s, cache=30s
+    except Exception:  # noqa: BLE001 — telemetry 실패가 system_status 자체를 실패시키면 안 됨
+        dpworldapp_runtime = {"available": False}
+
+    return {
+        # v1.4.6.5 L-B: time.strftime은 literal 문자 보장으로 빈 string 절대 불가 — or fallback 제거
+        "generated_at": time.strftime("%Y-%m-%dT%H:%M:%S%z"),
+        "core_app": core_app,
+        "communication": communication,
+        "network": network,
+        "system": system,
+        "hardware_modules": get_hardware_modules(LOG_DIR),
+        "dpworldapp_status": get_dpworldapp_status(db, LOG_DIR),
+        "dpworldapp_runtime": dpworldapp_runtime,
+        # v1.6.0: network apply/watchdog 요약 — server.py 가 setter 로 주입 (import 순환 회피)
+        "network_apply": _NETWORK_APPLY_PROVIDER() if _NETWORK_APPLY_PROVIDER else None,
+    }
+
+
+# v1.6.0: provider 주입 (import 순환 회피 — server.py 가 main() 직전에 주입)
+_NETWORK_APPLY_PROVIDER = None
+
+
+def set_network_apply_provider(fn):
+    global _NETWORK_APPLY_PROVIDER
+    _NETWORK_APPLY_PROVIDER = fn
+
+
+def _device_uptime():
+    """Device uptime in seconds from /proc/uptime. None if unavailable."""
+    try:
+        with open("/proc/uptime", "r") as f:
+            return float(f.read().split()[0])
+    except (OSError, ValueError, IndexError):
+        return None
+
+
+def test_connections(db):
+    """Probe every configured server endpoint. Returns list of result dicts."""
+    device = db.get_config("device_config") or {}
+    targets = [
+        ("protocol_server", device.get("protocol_server_ip"),
+         device.get("protocol_server_port")),
+        ("opc_ua_server", device.get("opc_ua_server_ip"),
+         device.get("opc_ua_server_port")),
+        ("modbus_server", device.get("modbus_server_ip"),
+         device.get("modbus_server_port")),
+        ("update_server", device.get("update_server_ip"),
+         device.get("update_server_port")),
+    ]
+    results = []
+    for name, host, port in targets:
+        if not host or port in (None, ""):
+            results.append({"name": name, "configured": False,
+                            "reachable": False, "endpoint": None})
+            continue
+        results.append({
+            "name": name, "configured": True,
+            "endpoint": f"{host}:{port}", "reachable": tcp_probe(host, port),
+        })
+    return results
+
+
+def restart_dpworldapp(unit=DPWORLDAPP_UNIT):
+    """`systemctl restart` the dpworldapp unit, then poll liveness up to 15 s."""
+    try:
+        subprocess.run(["systemctl", "restart", unit],
+                       capture_output=True, text=True, timeout=20, check=True)
+    except (subprocess.SubprocessError, OSError) as e:
+        return {"restarted": False, "running": False, "error": str(e)}
+    deadline = time.time() + 15
+    while time.time() < deadline:
+        st = get_process_status(unit)
+        if st["running"]:
+            return {"restarted": True, "running": True, "pid": st["pid"]}
+        time.sleep(1)
+    return {"restarted": True, "running": False,
+            "error": "unit did not become active within 15s"}