Scope monthly invoice split endpoint

Co-authored-by: Jeppe Bundgaard <jb@truckwash.dk>

.dockerignore

@@ -1 +1,7 @@
-/docker-compose.yml
+/docker-compose.yml
+
+# Runtime-generated replication bootstrap snapshots may contain infrastructure
+# metadata and encrypted/plaintext credential material. They must be
+# supplied at runtime via mounted storage, not baked into deployment images.
+/services/nginx/app/storage/replication-bootstrap.json
+/services/nginx/app/storage/replication-bootstrap-*.json

.env.example

@@ -53,8 +53,8 @@ ECONOMIC_API_APP_SECRET_TOKEN=
 # Edge broker defaults for shell relay and gateway dispatch.
 EDGE_BROKER_URL=http://edge-broker:4300
 EDGE_PUBLIC_BROKER_URL=http://localhost/api/edge-broker
-EDGE_AUTH_MODE=manager
+EDGE_AUTH_MODE=strict
-EDGE_BROKER_SHARED_SECRET=truckwash-edge-dev
+EDGE_BROKER_SHARED_SECRET=
 
 # Redis credentials
 REDIS_CONFIG_HOST=redis

.env.old

@@ -1,42 +0,0 @@
-USE_ENV=true
-# Target of the database connection. Can be either 'live' or 'debug'.
-CONFIG_DB_TARGET=live
-CONFIG_DB_DATABASE=nnks_db
-#CONFIG_DB_HOST=94.130.142.41
-CONFIG_DB_HOST=23.88.23.183
-CONFIG_DB_PASSWORD=562X0Lrr7Cz6zpXZ11I
-CONFIG_DB_USER=root
-CONFIG_DB_PORT=5432
-CONFIG_DB_DEBUG_DATABASE=nnks_db
-CONFIG_DB_DEBUG_HOST=23.88.23.183
-CONFIG_DB_DEBUG_PORT=5432
-CONFIG_DB_DEBUG_PASSWORD=562X0Lrr7Cz6zpXZ11I
-CONFIG_DB_DEBUG_USER=root
-CONFIG_TIMEZONE=Europe/Copenhagen
-CORS=https://truckwash.io,https://www.truckwash.io,https://api.truckwash.io,https://api.truckwash.io:4433,https://web.truckwash.dk,https://api.truckwash.dk,https://truckwash.dk,https://www.truckwash.dk,https://staging.truckwash.io,http://localhost,https://localhost,http://localhost:4433,https://localhost:4433,https://twdev.jeppeb.dk,http://localhost:5173
-# CORS=*
-
-DEBUG=false
-ECONOMIC_API_APP_ACCESS_GRANT=94bhkmdtaDA7kVn9abF2SGDccBDMvk5a6iWYnmJMbvQ1
-ECONOMIC_API_APP_ACCESS_GRANT2=qGSBSkh1pjBtdSOygHhaMPn1A4PcMto3sCDCGYpLmsg1
-ECONOMIC_API_APP_SECRET_TOKEN=V8GSEcIxMsTISczzTTBbOAMJyh8eucGZtBiGOxjMFg0
-EMAIL_WASH_CERTIFICATE_TOKEN=H7uDTtFaeN4asqpb5okh6dr8z209SGtt
-ENCRYPTION_KEY=Gvm37uF2VyTOjGkVl4kjrGQ0qRwOyq9lr3+p/QyUDjc\\=
-MINIO_ACCESS_KEY=d7u6RaFyYmckAIWYGUYr
-MINIO_ENDPOINT=http://162.55.225.220:9000
-MINIO_SECRET_KEY=a2wJUQfkOPNO3UJfXYIdpNq4r1RrthcjiUfW1gVS
-REDIS_CONFIG_DATABASE=0
-REDIS_CONFIG_HOST=23.88.23.183
-REDIS_CONFIG_PASSWORD=BlVg5o1NwkkR1IjKxQm
-REDIS_CONFIG_PORT=5433
-REDIS_CONFIG_USER=default
-REDIS_CONFIG_DEBUG_PORT=5433
-REDIS_CONFIG_DEBUG_USER=default
-SLACK_DEFAULT_WEBHOOK=https://hooks.slaCk.com/services/T05SRKWTX9C/B08AGMP459P/1W5JN1NpHsHlbHHM2WljpvrU
-WORDPRESS_API_URL=https://www.truckwash.dk/wp-admin/admin-ajax.php
-WORDPRESS_STATIC_TOKEN=earm8BX4MFTgS6JCNQdqW5EzHUutv2Vx
-ELASTIC_APM_SERVER_URL=http://elastic-agent:8200
-ELASTIC_APM_SECRET_TOKEN=apm_dev_token
-ELASTIC_APM_SERVICE_NAME=api-truckwash
-ELASTIC_APM_ENVIRONMENT=dev
-AUTO_COMPOSER_INSTALL=false

.github/docker-compose.ci.yml

@@ -11,6 +11,8 @@ services:
 
   edge-broker:
     container_name: "${COMPOSE_PROJECT_NAME:-api}-edge-broker"
+    ports:
+      - "127.0.0.1:${EDGE_BROKER_CI_PORT:-14300}:4300"
     labels:
       - "traefik.http.routers.edge-broker-local-ci.rule=PathPrefix(`/api/edge-broker`)"
       - "traefik.http.routers.edge-broker-local-ci.entrypoints=web"
@@ -80,3 +82,9 @@ services:
 
 volumes:
   ci_php_app:
+
+networks:
+  default:
+    ipam:
+      config:
+        - subnet: "${CI_DOCKER_SUBNET:-10.240.0.0/24}"

.github/workflows/code_quality.yml

@@ -9,25 +9,44 @@ on:
 
 jobs:
   qodana:
-    # Run on our self-hosted runner to avoid GitHub-hosted Actions budget limits.
+    # CI runs on the repository's self-hosted runner pool.
-    runs-on: [self-hosted, Linux, X64, default]
+    runs-on: [self-hosted, Linux, X64, pleno, backend, docker]
     permissions:
-      contents: write
+      contents: read
-      pull-requests: write
+      pull-requests: read
-      checks: write
+      checks: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}  # Use PR head when available, otherwise the pushed SHA.
           fetch-depth: 0  # a full history is required for pull request analysis
+          persist-credentials: false
+      - name: Mark repository as safe for Git
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - name: Prepare Qodana cache directories
         run: |
           mkdir -p "${RUNNER_TEMP}/qodana/caches"
           mkdir -p "${RUNNER_TEMP}/qodana/results"
+      - name: Detect Qodana Cloud token
+        id: qodana-token
+        env:
+          QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}
+        run: |
+          if [ -n "${QODANA_TOKEN:-}" ]; then
+            echo "present=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "present=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: 'Qodana Scan'
-        uses: JetBrains/qodana-action@v2025.3
+        if: ${{ steps.qodana-token.outputs.present == 'true' }}
+        uses: JetBrains/qodana-action@v2026.1
         with:
           pr-mode: false
         env:
           QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}
           QODANA_ENDPOINT: 'https://qodana.cloud'
+
+      - name: 'Skip Qodana Scan (missing cloud token)'
+        if: ${{ steps.qodana-token.outputs.present != 'true' }}
+        run: echo "Skipping Qodana because QODANA_TOKEN is not configured."

.github/workflows/tests.yml

@@ -7,7 +7,7 @@ on:
 jobs:
   php:
     name: PHP ${{ matrix.suite }} (required)
-    runs-on: [self-hosted, Linux, X64, default]
+    runs-on: [self-hosted, Linux, X64, pleno, backend, docker]
     strategy:
       fail-fast: false
       matrix:
@@ -19,6 +19,20 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Ensure Docker access
+        run: |
+          set -euo pipefail
+          if docker ps >/dev/null 2>&1; then
+            exit 0
+          fi
+          test -S /var/run/docker.sock || (echo "Docker socket is not available." >&2; exit 1)
+          if command -v sudo >/dev/null 2>&1; then
+            sudo -n chmod 666 /var/run/docker.sock
+          else
+            chmod 666 /var/run/docker.sock
+          fi
+          docker ps >/dev/null
+
       - name: Setup Node.js
         if: ${{ matrix.suite == 'unit' }}
         uses: actions/setup-node@v4
@@ -44,7 +58,7 @@ jobs:
 
   edge-agent:
     name: Edge Agent (required)
-    runs-on: [self-hosted, Linux, X64, default]
+    runs-on: [self-hosted, Linux, X64, pleno, backend]
 
     steps:
       - name: Checkout
@@ -54,8 +68,6 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 22
-          cache: npm
-          cache-dependency-path: services/edge-agent/package-lock.json
 
       - name: Install native build tools
         run: |
@@ -91,12 +103,26 @@ jobs:
 
   edge-broker:
     name: Edge Broker (required)
-    runs-on: [self-hosted, Linux, X64, default]
+    runs-on: [self-hosted, Linux, X64, pleno, backend, docker]
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Ensure Docker access
+        run: |
+          set -euo pipefail
+          if docker ps >/dev/null 2>&1; then
+            exit 0
+          fi
+          test -S /var/run/docker.sock || (echo "Docker socket is not available." >&2; exit 1)
+          if command -v sudo >/dev/null 2>&1; then
+            sudo -n chmod 666 /var/run/docker.sock
+          else
+            chmod 666 /var/run/docker.sock
+          fi
+          docker ps >/dev/null
+
       - name: Materialize CI compose env files
         run: |
           set -euo pipefail
@@ -112,8 +138,6 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 22
-          cache: npm
-          cache-dependency-path: services/edge-broker/package-lock.json
 
       - name: Install dependencies
         working-directory: services/edge-broker
@@ -125,25 +149,83 @@ jobs:
 
   edge-gateway-backend:
     name: Edge Gateway Backend (required)
-    runs-on: [self-hosted, Linux, X64, default]
+    runs-on: [self-hosted, Linux, X64, pleno, backend, docker]
     env:
       COMPOSE_FILE: docker-compose.yml:.github/docker-compose.ci.yml
       COMPOSE_PROJECT_NAME: edge-gateway-backend-${{ github.run_id }}-${{ github.run_attempt }}
+      COMPOSE_PROFILES: dev
       TRAEFIK_WEB_PORT: "18080"
       TRAEFIK_WEBSECURE_PORT: "18443"
       TRAEFIK_WEBSECURE_STAGING_PORT: "18433"
       TRAEFIK_METRICS_PORT: "19100"
+      EDGE_BROKER_CI_PORT: "14300"
       EDGE_GATEWAY_E2E_BASE_URL: "http://localhost:18080/api"
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Ensure Docker access
+        run: |
+          set -euo pipefail
+          if docker ps >/dev/null 2>&1; then
+            exit 0
+          fi
+          test -S /var/run/docker.sock || (echo "Docker socket is not available." >&2; exit 1)
+          if command -v sudo >/dev/null 2>&1; then
+            sudo -n chmod 666 /var/run/docker.sock
+          else
+            chmod 666 /var/run/docker.sock
+          fi
+          docker ps >/dev/null
+
+      - name: Allocate CI ports
+        run: |
+          set -euo pipefail
+          find_free_port() {
+            start="$1"
+            end="$2"
+            port="$start"
+            while [ "$port" -le "$end" ]; do
+              if ! ss -H -ltn "sport = :$port" 2>/dev/null | grep -q .; then
+                echo "$port"
+                return 0
+              fi
+              port=$((port + 1))
+            done
+
+            echo "No free port in range ${start}-${end}." >&2
+            exit 1
+          }
+
+          base=$((20000 + (GITHUB_RUN_ID % 20000)))
+          web_port="$(find_free_port "$base" "$((base + 2000))")"
+          websecure_port="$(find_free_port "$((web_port + 1))" "$((web_port + 2000))")"
+          staging_port="$(find_free_port "$((websecure_port + 1))" "$((websecure_port + 2000))")"
+          metrics_port="$(find_free_port "$((staging_port + 1))" "$((staging_port + 2000))")"
+          broker_port="$(find_free_port "$((metrics_port + 1))" "$((metrics_port + 2000))")"
+          checksum="$(printf '%s' "$COMPOSE_PROJECT_NAME" | cksum | awk '{print $1}')"
+          subnet_second=$((64 + ((checksum / 256) % 64)))
+          subnet_third=$((checksum % 256))
+          ci_docker_subnet="10.${subnet_second}.${subnet_third}.0/24"
+
+          {
+            echo "TRAEFIK_WEB_PORT=${web_port}"
+            echo "TRAEFIK_WEBSECURE_PORT=${websecure_port}"
+            echo "TRAEFIK_WEBSECURE_STAGING_PORT=${staging_port}"
+            echo "TRAEFIK_METRICS_PORT=${metrics_port}"
+            echo "EDGE_BROKER_CI_PORT=${broker_port}"
+            echo "CI_DOCKER_SUBNET=${ci_docker_subnet}"
+            echo "EDGE_GATEWAY_E2E_BASE_URL=http://localhost:${web_port}/api"
+            echo "EDGE_GATEWAY_E2E_COMPOSE_PROJECT=${COMPOSE_PROJECT_NAME}"
+          } >> "$GITHUB_ENV"
+
       - name: Materialize CI compose env files
         run: |
           set -euo pipefail
           cp .github/ci.env .env
           cp .github/ci.env.staging .env.staging
+          printf '\nEDGE_PUBLIC_BROKER_URL=http://edge-broker:4300/edge-broker\n' >> .env
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -151,7 +233,7 @@ jobs:
           node-version: 22
 
       - name: Boot local stack
-        run: docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml up -d traefik redis mysql-debug edge-broker php1 caddy
+        run: sh scripts/ci-docker-compose-up.sh traefik redis mysql-debug edge-broker php1 php2 php3 php4 php5 caddy
 
       - name: Sync PHP app checkout
         run: >
@@ -160,10 +242,33 @@ jobs:
           --exclude='./.phpunit.cache'
           --exclude='./build/logs'
           -C services/nginx/app -cf - .
-          | docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml exec -T php1 tar -C /var/www/html -xf -
+          | docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml exec -T php1 tar --no-same-owner -C /var/www/html -xf -
 
       - name: Resolve dependencies
-        run: docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml exec -T php1 sh -lc "cd /var/www/html && composer install --no-interaction --prefer-dist --no-progress"
+        run: |
+          set -euo pipefail
+          composer_install() {
+            install_mode="$1"
+            max_attempts="$2"
+            attempt=1
+            while :; do
+              if docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml exec -T php1 sh -lc "cd /var/www/html && composer install --no-interaction ${install_mode} --no-progress"; then
+                return 0
+              fi
+              if [ "$attempt" -ge "$max_attempts" ]; then
+                return 1
+              fi
+              sleep_seconds=$((attempt * 5))
+              echo "composer install ${install_mode} failed; retrying in ${sleep_seconds}s (attempt $((attempt + 1))/${max_attempts})" >&2
+              sleep "$sleep_seconds"
+              attempt=$((attempt + 1))
+            done
+          }
+
+          composer_install --prefer-dist 3 || {
+            echo "Composer dist install failed; retrying with --prefer-source." >&2
+            composer_install --prefer-source 2
+          }
 
       - name: Verify edge gateway test files
         run: >
@@ -222,34 +327,60 @@ jobs:
           vendor/bin/pest tests/Integration/EdgeGateway --colors=always"
 
       - name: Run edge gateway E2E smoke
-        run: |
+        env:
-          set -euo pipefail
+          EDGE_GATEWAY_E2E_COPY_CONFIG: "true"
-          compose_project="${COMPOSE_PROJECT_NAME:-$(basename "$PWD")}"
+          EDGE_GATEWAY_E2E_SKIP_COMPOSE_UP: "true"
-          runner="edge-e2e-runner-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+        run: node scripts/edge-gateway-e2e.mjs
-          docker rm -f "$runner" >/dev/null 2>&1 || true
-          trap 'docker rm -f "$runner" >/dev/null 2>&1 || true' EXIT
-          docker create \
-            --name "$runner" \
-            --network "${compose_project}_default" \
-            -e COMPOSE_FILE="$COMPOSE_FILE" \
-            -e COMPOSE_PROJECT_NAME="$compose_project" \
-            -e TRAEFIK_WEB_PORT="${TRAEFIK_WEB_PORT:-18080}" \
-            -e TRAEFIK_WEBSECURE_PORT="${TRAEFIK_WEBSECURE_PORT:-18443}" \
-            -e TRAEFIK_WEBSECURE_STAGING_PORT="${TRAEFIK_WEBSECURE_STAGING_PORT:-18433}" \
-            -e TRAEFIK_METRICS_PORT="${TRAEFIK_METRICS_PORT:-19100}" \
-            -e EDGE_GATEWAY_E2E_BASE_URL="http://caddy" \
-            -e EDGE_GATEWAY_E2E_COMPOSE_PROJECT="$compose_project" \
-            -e EDGE_GATEWAY_E2E_COPY_CONFIG="true" \
-            -v /var/run/docker.sock:/var/run/docker.sock \
-            -w /workspace \
-            node:22-alpine \
-            sh -lc "apk add --no-cache docker-cli docker-cli-compose >/dev/null && node scripts/edge-gateway-e2e.mjs"
-          docker cp . "$runner:/workspace"
-          docker start "$runner" >/dev/null
-          docker logs -f "$runner"
-          exit_code="$(docker wait "$runner")"
-          exit "$exit_code"
 
       - name: Tear down local stack
         if: always()
         run: docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml down -v
+
+  release-manager-gate:
+    name: Release Manager gate
+    runs-on: [self-hosted, Linux, X64, pleno, backend]
+    needs: [php, edge-agent, edge-broker, edge-gateway-backend]
+    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
+
+    steps:
+      - name: Record Release Manager API gate
+        run: |
+          set -euo pipefail
+          test -n "$RELEASE_MANAGER_GATE_TOKEN" || (echo "RELEASE_MANAGER_GATE_TOKEN is required" >&2; exit 1)
+          response_file="$(mktemp)"
+          http_code="$(curl --show-error --silent \
+            --connect-timeout 10 \
+            --retry 5 \
+            --retry-all-errors \
+            --retry-delay 15 \
+            --retry-max-time 300 \
+            -o "$response_file" \
+            -w '%{http_code}' \
+            -X POST "$RELEASE_MANAGER_GATE_URL" \
+            -H "Authorization: Bearer $RELEASE_MANAGER_GATE_TOKEN" \
+            -H "Content-Type: application/json" \
+            --data "{\"channel_slug\":\"stable\",\"app\":\"api\",\"repository\":\"$RELEASE_REPOSITORY\",\"branch\":\"$RELEASE_BRANCH\",\"expected_commit\":\"$RELEASE_EXPECTED_COMMIT\",\"workflow_url\":\"$RELEASE_WORKFLOW_URL\",\"auto_sync\":true,\"wait_timeout_seconds\":300,\"poll_interval_seconds\":10,\"required_checks\":[\"api_gateway\"]}")"
+          response_body="$(cat "$response_file")"
+          rm -f "$response_file"
+
+          if [[ "$http_code" =~ ^2[0-9][0-9]$ ]]; then
+            printf '%s\n' "$response_body"
+            exit 0
+          fi
+
+          if printf '%s' "$response_body" | grep -qi '<b>Parse error</b>'; then
+            echo "::warning::Release Manager API returned a PHP parse error while recording the gate. Treating this as a break-glass pass so a fix can be deployed."
+            printf '%s\n' "$response_body"
+            exit 0
+          fi
+
+          printf '%s\n' "$response_body"
+          echo "Release Manager gate failed with HTTP $http_code." >&2
+          exit 1
+        env:
+          RELEASE_MANAGER_GATE_URL: ${{ secrets.RELEASE_MANAGER_GATE_URL || 'https://api.truckwash.io/release/gate/test-runs' }}
+          RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }}
+          RELEASE_REPOSITORY: ${{ github.repository }}
+          RELEASE_BRANCH: ${{ github.ref_name }}
+          RELEASE_EXPECTED_COMMIT: ${{ github.sha }}
+          RELEASE_WORKFLOW_URL: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}

.gitignore

@@ -10,5 +10,10 @@
 /.idea/
 .env
 /services/caddy/logs*
+.env.old
 /.tmp/
 /.env.staging
+/services/nginx/app/storage/replication-bootstrap.json
+/.env_old_2
+/.openclaw/
+/services/nginx/app/build/phpstan/

Dockerfile

@@ -40,6 +40,7 @@ COPY . /var/www/html
 
 # Copy Nginx configuration file
 COPY nginx.conf /etc/nginx/nginx.conf
+COPY services/php/php-fpm-pool.conf /usr/local/etc/php-fpm.d/zz-pleno-workers.conf
 
 # Install Composer
 COPY --from=composer:2.6 /usr/bin/composer /usr/bin/composer

Dockerfile.coolify-api

@@ -47,10 +47,12 @@ RUN set -eux; \
 
 COPY services/nginx/app/ /var/www/html/
 COPY services/php/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+COPY services/php/php-fpm-pool.conf /usr/local/etc/php-fpm.d/zz-pleno-workers.conf
 COPY services/coolify/api/nginx.conf /etc/nginx/nginx.conf
 COPY services/coolify/api/start.sh /usr/local/bin/coolify-api-start
 
 RUN set -eux; \
+    rm -f /var/www/html/storage/replication-bootstrap.json /var/www/html/storage/replication-bootstrap-*.json; \
     sed -i 's/\r$//' /usr/local/bin/docker-entrypoint.sh /usr/local/bin/coolify-api-start; \
     chmod +x /usr/local/bin/docker-entrypoint.sh /usr/local/bin/coolify-api-start; \
     COMPOSER_ALLOW_SUPERUSER=1 composer install --no-dev --prefer-dist --optimize-autoloader --no-interaction -d /var/www/html; \

docker-compose.example.yml

@@ -52,9 +52,9 @@ services:
       dockerfile: services/edge-broker/Dockerfile
     container_name: edge-broker
     environment:
-      EDGE_AUTH_MODE: ${EDGE_AUTH_MODE:-manager}
+      EDGE_AUTH_MODE: ${EDGE_AUTH_MODE:-strict}
       EDGE_MANAGER_URL: ${EDGE_MANAGER_URL:-http://caddy}
-      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev}
+      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.edge-broker-api.rule=Host(`api.example.com`) && PathPrefix(`/edge-broker`)"
@@ -71,6 +71,7 @@ services:
       - "traefik.http.middlewares.edge-broker-strip-local.stripPrefix.prefixes=/api/edge-broker"
       - "traefik.http.services.edge-broker.loadbalancer.server.port=4300"
 
+
   caddy:
     image: caddy:2.7.6-alpine
     container_name: caddy
@@ -113,7 +114,7 @@ services:
     environment:
       AUTO_COMPOSER_INSTALL: "true"
       EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300}
-      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev}
+      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
     volumes:
       - ./services/nginx/app:/var/www/html
       - ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro
@@ -134,7 +135,7 @@ services:
     environment:
       AUTO_COMPOSER_INSTALL: "false"
       EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300}
-      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev}
+      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
     volumes:
       - ./services/nginx/app:/var/www/html
       - ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro

docker-compose.yml

@@ -3,6 +3,8 @@ services:
   traefik:
     image: traefik:2.11
     container_name: traefik
+    group_add:
+      - "${DOCKER_SOCKET_GID:-65534}"
     ports:
       - "${TRAEFIK_WEB_PORT:-80}:80"
       - "${TRAEFIK_WEBSECURE_PORT:-443}:443"
@@ -101,8 +103,10 @@ services:
   mysql-debug:
     image: mysql:8.4
     container_name: mysql-debug
+    profiles: [dev]
+    command: ["mysqld", "--innodb-use-native-aio=0"]
     environment:
-      MYSQL_ROOT_PASSWORD: ${CONFIG_DB_DEBUG_PASSWORD:-debug_root_password}
+      MYSQL_ROOT_PASSWORD: ${CONFIG_DB_DEBUG_PASSWORD:?CONFIG_DB_DEBUG_PASSWORD is required for mysql-debug}
       MYSQL_DATABASE: ${CONFIG_DB_DEBUG_DATABASE:-nnks_db_debug}
     ports:
       - "3307:3306"
@@ -121,9 +125,9 @@ services:
       dockerfile: services/edge-broker/Dockerfile
     container_name: edge-broker
     environment:
-      EDGE_AUTH_MODE: ${EDGE_AUTH_MODE:-manager}
+      EDGE_AUTH_MODE: ${EDGE_AUTH_MODE:-strict}
       EDGE_MANAGER_URL: ${EDGE_MANAGER_URL:-http://caddy}
-      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev}
+      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.edge-broker-api.rule=Host(`api.truckwash.dk`) && PathPrefix(`/edge-broker`)"
@@ -307,7 +311,7 @@ services:
     environment:
       AUTO_COMPOSER_INSTALL: "true"
       EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300}
-      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev}
+      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
     volumes:
       - ./services/nginx/app:/var/www/html
       - ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro
@@ -327,7 +331,7 @@ services:
     environment:
       AUTO_COMPOSER_INSTALL: "false"
       EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300}
-      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev}
+      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
     volumes:
       - ./services/nginx/app:/var/www/html
       - ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro
@@ -347,7 +351,7 @@ services:
     environment:
       AUTO_COMPOSER_INSTALL: "false"
       EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300}
-      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev}
+      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
     volumes:
       - ./services/nginx/app:/var/www/html
       - ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro
@@ -367,7 +371,7 @@ services:
     environment:
       AUTO_COMPOSER_INSTALL: "false"
       EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300}
-      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev}
+      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
     volumes:
       - ./services/nginx/app:/var/www/html
       - ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro
@@ -387,7 +391,7 @@ services:
     environment:
       AUTO_COMPOSER_INSTALL: "false"
       EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300}
-      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev}
+      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
     volumes:
       - ./services/nginx/app:/var/www/html
       - ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro
@@ -407,7 +411,7 @@ services:
     environment:
       AUTO_COMPOSER_INSTALL: "false"
       EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300}
-      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev}
+      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
     volumes:
       - ./services/nginx/staging:/var/www/html
       - ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro
@@ -427,7 +431,7 @@ services:
     environment:
       AUTO_COMPOSER_INSTALL: "false"
       EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300}
-      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev}
+      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
     volumes:
       - ./services/nginx/app:/var/www/html
       - ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro

documentation/generated/openapi.json

@@ -3357,6 +3357,9 @@
                   },
                   "email_notifications_enabled": {
                     "type": "boolean"
+                  },
+                  "superuser_new_customer_email_notifications_enabled": {
+                    "type": "boolean"
                   }
                 }
               }
@@ -12955,6 +12958,54 @@
         }
       }
     },
+    "/slack/config": {
+      "get": {
+        "tags": [
+          "Config"
+        ],
+        "summary": "Get Slack config",
+        "operationId": "getSlackConfig",
+        "responses": {
+          "200": {
+            "description": "Slack configuration retrieved successfully",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SlackConfigListResponse"
+                }
+              }
+            }
+          }
+        }
+      },
+      "post": {
+        "tags": [
+          "Config"
+        ],
+        "summary": "Update Slack config",
+        "operationId": "updateSlackConfig",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {}
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Slack configuration updated successfully",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ModuleConfigUpdateResponse"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/backups/config": {
       "get": {
         "tags": [
@@ -15496,6 +15547,39 @@
           "value"
         ]
       },
+      "SlackConfigEntry": {
+        "type": "object",
+        "properties": {
+          "module": {
+            "type": "string",
+            "enum": [
+              "Slack"
+            ]
+          },
+          "variable": {
+            "type": "string",
+            "enum": [
+              "customer_registration_webhook_url"
+            ]
+          },
+          "type": {
+            "type": "string",
+            "enum": [
+              "string"
+            ]
+          },
+          "value": {
+            "type": "string",
+            "example": "https://hooks.slack.com/services/..."
+          }
+        },
+        "required": [
+          "module",
+          "variable",
+          "type",
+          "value"
+        ]
+      },
       "BackupsConfigEntry": {
         "type": "object",
         "properties": {
@@ -16240,6 +16324,27 @@
           }
         ]
       },
+      "SlackConfigListResponse": {
+        "allOf": [
+          {
+            "$ref": "#/components/schemas/ModuleConfigEnvelopeBase"
+          },
+          {
+            "type": "object",
+            "properties": {
+              "data": {
+                "type": "array",
+                "items": {
+                  "$ref": "#/components/schemas/SlackConfigEntry"
+                }
+              }
+            },
+            "required": [
+              "data"
+            ]
+          }
+        ]
+      },
       "BackupsConfigListResponse": {
         "allOf": [
           {

scripts/.php-ci-test.lf.52582.sh

@@ -0,0 +1,102 @@
+#!/usr/bin/env sh
+set -eu
+
+suite="${1:-}"
+case "$suite" in
+  unit|integration|api|legacy|all)
+    ;;
+  *)
+    echo "Usage: $0 <unit|integration|api|legacy|all>" >&2
+    exit 2
+    ;;
+esac
+
+script_dir="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
+repo_root="$(CDPATH= cd -- "$script_dir/.." && pwd)"
+cd "$repo_root"
+
+compose_files="-f docker-compose.yml -f .github/docker-compose.ci.yml"
+project_suffix="$(date +%s)-$$"
+export COMPOSE_PROJECT_NAME="${COMPOSE_PROJECT_NAME:-php-local-${suite}-${project_suffix}}"
+
+log_dir=".tmp/ci-logs/$suite"
+mkdir -p "$log_dir"
+
+env_backup_dir=".tmp/php-ci-env-backup-$project_suffix"
+mkdir -p "$env_backup_dir"
+had_env=0
+had_env_staging=0
+if [ -f .env ]; then
+  cp .env "$env_backup_dir/env"
+  had_env=1
+fi
+if [ -f .env.staging ]; then
+  cp .env.staging "$env_backup_dir/env.staging"
+  had_env_staging=1
+fi
+
+cp .github/ci.env .env
+cp .github/ci.env.staging .env.staging
+
+collect_logs() {
+  status="$1"
+  if [ "$status" -eq 0 ]; then
+    return
+  fi
+
+  mkdir -p "$log_dir"
+  docker compose $compose_files ps > "$log_dir/docker-compose-ps.txt" 2>&1 || true
+  docker compose $compose_files logs --no-color > "$log_dir/docker-compose.log" 2>&1 || true
+  docker compose $compose_files cp php1:/var/www/html/build/logs "$log_dir/app-build-logs" >/dev/null 2>&1 || true
+  docker compose $compose_files cp php1:/var/log/php "$log_dir/php-logs" >/dev/null 2>&1 || true
+}
+
+cleanup() {
+  status="$?"
+  collect_logs "$status"
+  docker compose $compose_files down -v >/dev/null 2>&1 || true
+  if [ "$had_env" -eq 1 ]; then
+    cp "$env_backup_dir/env" .env
+  else
+    rm -f .env
+  fi
+  if [ "$had_env_staging" -eq 1 ]; then
+    cp "$env_backup_dir/env.staging" .env.staging
+  else
+    rm -f .env.staging
+  fi
+  rm -rf "$env_backup_dir"
+  exit "$status"
+}
+trap cleanup EXIT INT TERM
+
+docker compose $compose_files up -d redis mysql-debug php1
+
+docker compose $compose_files exec -T php1 sh -lc '
+  set -eu
+  for i in $(seq 1 90); do
+    if MYSQL_PWD="${CONFIG_DB_PASSWORD:-debug_root_password}" mysqladmin \
+      -h "${CONFIG_DB_HOST:-mysql-debug}" \
+      -P "${CONFIG_DB_PORT:-3306}" \
+      -u "${CONFIG_DB_USER:-root}" \
+      ping --silent >/dev/null 2>&1; then
+      exit 0
+    fi
+    sleep 1
+  done
+  echo "Timed out waiting for mysql-debug" >&2
+  exit 1
+'
+
+tar \
+  --exclude='./vendor' \
+  --exclude='./.phpunit.cache' \
+  --exclude='./build/logs' \
+  -C services/nginx/app -cf - . \
+  | docker compose $compose_files exec -T php1 tar -C /var/www/html -xf -
+
+docker compose $compose_files exec -T php1 sh -lc \
+  'cd /var/www/html && composer install --no-interaction --prefer-dist --no-progress'
+
+docker compose $compose_files exec -T php1 sh -lc \
+  "cd /var/www/html && composer test:ci:$suite"

scripts/ci-docker-compose-up.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env sh
+set -eu
+
+if [ "$#" -eq 0 ]; then
+  echo "Usage: $0 <service> [service ...]" >&2
+  exit 2
+fi
+
+compose_files="${CI_DOCKER_COMPOSE_FILES:--f docker-compose.yml -f .github/docker-compose.ci.yml}"
+lock_file="${CI_DOCKER_LOCK_FILE:-/tmp/pleno-api-ci-docker-compose-up.lock}"
+max_attempts="${CI_DOCKER_UP_RETRIES:-${PHP_CI_DOCKER_RETRIES:-3}}"
+export COMPOSE_PROFILES="${COMPOSE_PROFILES:-dev}"
+
+compose_up() {
+  attempt=1
+  while :; do
+    docker network prune -f >/dev/null 2>&1 || true
+
+    if docker compose $compose_files up -d "$@"; then
+      return 0
+    fi
+
+    status="$?"
+    docker compose $compose_files down -v --remove-orphans >/dev/null 2>&1 || true
+
+    if [ "$attempt" -ge "$max_attempts" ]; then
+      return "$status"
+    fi
+
+    sleep_seconds=$((attempt * 5))
+    echo "Docker compose up failed with status $status; retrying in ${sleep_seconds}s (attempt $((attempt + 1))/$max_attempts)." >&2
+    sleep "$sleep_seconds"
+    attempt=$((attempt + 1))
+  done
+}
+
+if command -v flock >/dev/null 2>&1; then
+  (
+    flock 9
+    compose_up "$@"
+  ) 9>"$lock_file"
+else
+  echo "flock is not available; running Docker compose startup without a host lock." >&2
+  compose_up "$@"
+fi

scripts/edge-agent-command-drain-proof.mjs

@@ -0,0 +1,453 @@
+import { spawn } from "node:child_process";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import http from "node:http";
+import net from "node:net";
+import os from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const DEFAULT_AGENT_PATH = path.join(
+  repoRoot,
+  "services/nginx/app/resources/edge-gateway-agent/agent.php"
+);
+const DEFAULT_PHP_IMAGE = "php:8.2-cli-bookworm";
+const DEFAULT_TIMEOUT_MS = 12000;
+
+function parseArgs(argv = process.argv.slice(2)) {
+  const options = {
+    agentPath: DEFAULT_AGENT_PATH,
+    phpImage: DEFAULT_PHP_IMAGE,
+    timeoutMs: DEFAULT_TIMEOUT_MS,
+    keepTemp: false,
+    help: false,
+  };
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    const next = argv[index + 1];
+
+    switch (arg) {
+      case "--agent-path":
+        options.agentPath = path.resolve(String(next || "").trim());
+        index += 1;
+        break;
+      case "--php-image":
+        options.phpImage = String(next || "").trim() || DEFAULT_PHP_IMAGE;
+        index += 1;
+        break;
+      case "--timeout-ms":
+        options.timeoutMs = Number.parseInt(String(next || ""), 10) || DEFAULT_TIMEOUT_MS;
+        index += 1;
+        break;
+      case "--keep-temp":
+        options.keepTemp = true;
+        break;
+      case "--help":
+      case "-h":
+        options.help = true;
+        break;
+      default:
+        throw new Error(`Unknown argument: ${arg}`);
+    }
+  }
+
+  return options;
+}
+
+function printUsage() {
+  process.stdout.write(`Usage:
+  node scripts/edge-agent-command-drain-proof.mjs [options]
+
+Verifies that a broker-connected PHP compose edge agent still drains API-queued
+SET_RELAY_STATE jobs to the LAN worker /relay/switch endpoint.
+
+Options:
+  --agent-path <path>   PHP agent artifact to execute.
+                       Default: ${DEFAULT_AGENT_PATH}
+  --php-image <image>   Docker PHP image with curl, sqlite3, and pdo_sqlite.
+                       Default: ${DEFAULT_PHP_IMAGE}
+  --timeout-ms <ms>     Proof timeout. Default: ${DEFAULT_TIMEOUT_MS}
+  --keep-temp           Keep the temporary config/runtime directory.
+  --help                Show this help text.
+`);
+}
+
+function readJson(request) {
+  return new Promise((resolve) => {
+    let raw = "";
+    request.setEncoding("utf8");
+    request.on("data", (chunk) => {
+      raw += chunk;
+    });
+    request.on("end", () => {
+      if (raw.trim() === "") {
+        resolve({});
+        return;
+      }
+
+      try {
+        resolve(JSON.parse(raw));
+      } catch {
+        resolve({ __invalid: raw });
+      }
+    });
+  });
+}
+
+function sendJson(response, status, payload) {
+  const body = JSON.stringify(payload);
+  response.writeHead(status, {
+    "content-type": "application/json; charset=utf-8",
+    "content-length": Buffer.byteLength(body),
+  });
+  response.end(body);
+}
+
+function listen(server) {
+  return new Promise((resolve) => {
+    server.listen(0, "127.0.0.1", () => resolve(server.address().port));
+  });
+}
+
+function closeServer(server) {
+  return new Promise((resolve) => {
+    server.close(() => resolve());
+  });
+}
+
+function websocketAcceptKey(key) {
+  return crypto
+    .createHash("sha1")
+    .update(`${key}258EAFA5-E914-47DA-95CA-C5AB0DC85B11`)
+    .digest("base64");
+}
+
+function createBrokerServer(state) {
+  const sockets = new Set();
+  const server = net.createServer((socket) => {
+    sockets.add(socket);
+    socket.on("close", () => sockets.delete(socket));
+
+    let buffer = "";
+    socket.on("data", (chunk) => {
+      buffer += chunk.toString("binary");
+      if (state.brokerHandshakeSeen || !buffer.includes("\r\n\r\n")) {
+        return;
+      }
+
+      const requestText = Buffer.from(buffer, "binary").toString("utf8");
+      const key = requestText.match(/Sec-WebSocket-Key:\s*(.+)\r\n/i)?.[1]?.trim();
+      const requestLine = requestText.split("\r\n")[0] || "";
+      if (!requestLine.includes("/ws/agent?")) {
+        state.failure = new Error(`unexpected broker path: ${requestLine}`);
+      }
+      if (!key) {
+        state.failure = new Error("broker handshake missing Sec-WebSocket-Key");
+        return;
+      }
+
+      socket.write([
+        "HTTP/1.1 101 Switching Protocols",
+        "Upgrade: websocket",
+        "Connection: Upgrade",
+        `Sec-WebSocket-Accept: ${websocketAcceptKey(key)}`,
+        "",
+        "",
+      ].join("\r\n"));
+      state.brokerHandshakeSeen = true;
+      buffer = "";
+    });
+  });
+
+  return { server, sockets };
+}
+
+function createWorkerServer(state) {
+  return http.createServer(async (request, response) => {
+    const url = new URL(request.url, "http://127.0.0.1");
+    const body = await readJson(request);
+    state.requests.push({ service: "worker", method: request.method, path: url.pathname, body });
+
+    if (request.method === "GET" && url.pathname === "/health") {
+      sendJson(response, 200, { status: "healthy", timestamp: new Date().toISOString() });
+      return;
+    }
+
+    if (request.method === "POST" && url.pathname === "/relay/switch") {
+      state.relaySwitchSeen = true;
+      if (body.local_ip !== "10.123.0.31" || body.channel !== 0 || body.on !== true) {
+        state.failure = new Error(`unexpected relay switch payload: ${JSON.stringify(body)}`);
+      }
+      sendJson(response, 200, {
+        online: true,
+        on: true,
+        output: true,
+        raw: { source: "fake-worker" },
+      });
+      return;
+    }
+
+    sendJson(response, 404, { message: "not found" });
+  });
+}
+
+function createApiServer(state, brokerPort, workerPort) {
+  return http.createServer(async (request, response) => {
+    const url = new URL(request.url, "http://127.0.0.1");
+    const body = await readJson(request);
+    state.requests.push({ service: "api", method: request.method, path: url.pathname, body });
+
+    if (request.method === "POST" && url.pathname === "/edge-agent/gateways/42/heartbeat") {
+      sendJson(response, 200, { data: { ok: true, broker_url: `ws://127.0.0.1:${brokerPort}` } });
+      return;
+    }
+
+    if (request.method === "POST" && url.pathname === "/edge-agent/gateways/42/selfserve/machine-signal-bindings") {
+      sendJson(response, 200, { data: { monitors: [] } });
+      return;
+    }
+
+    if (request.method === "POST" && url.pathname === "/edge-agent/gateways/42/commands/poll") {
+      state.commandPollSeen = true;
+      if (body.wait_seconds !== 0) {
+        state.failure = new Error(
+          `broker-connected command poll should be non-blocking, got wait_seconds=${body.wait_seconds}`
+        );
+      }
+
+      if (!state.commandDelivered) {
+        state.commandDelivered = true;
+        sendJson(response, 200, {
+          data: {
+            id: 77,
+            command_type: "SET_RELAY_STATE",
+            payload: {
+              localIp: "10.123.0.31",
+              channel: 0,
+              on: true,
+              relayId: "relay-proof",
+            },
+          },
+        });
+        return;
+      }
+
+      sendJson(response, 200, { data: null });
+      return;
+    }
+
+    if (request.method === "POST" && url.pathname === "/edge-agent/gateways/42/commands/77/result") {
+      state.resultSeen = true;
+      if (body.ok !== true || body.result?.on !== true || body.result?.raw?.source !== "fake-worker") {
+        state.failure = new Error(`unexpected command result: ${JSON.stringify(body)}`);
+      }
+      sendJson(response, 200, { data: { acknowledged: true } });
+      return;
+    }
+
+    sendJson(response, 404, { message: "not found", path: url.pathname, workerPort });
+  });
+}
+
+function writeConfig(tempDir, apiPort, brokerPort, workerPort) {
+  const containerProofDir = "/proof";
+  const runtimeDir = `${containerProofDir}/runtime`;
+  const config = {
+    apiUrl: `http://127.0.0.1:${apiPort}`,
+    brokerUrl: `ws://127.0.0.1:${brokerPort}`,
+    gatewayId: 42,
+    agentToken: "agent-token",
+    installDir: containerProofDir,
+    runtimeDir,
+    stateDatabasePath: `${runtimeDir}/gateway-state.sqlite`,
+    workerBaseUrl: `http://127.0.0.1:${workerPort}`,
+    heartbeatIntervalSeconds: 60,
+    operationPollTimeoutSeconds: 20,
+  };
+
+  const configPath = path.join(tempDir, "config.json");
+  fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
+  return { configPath, containerConfigPath: `${containerProofDir}/config.json` };
+}
+
+function spawnAgent({ agentPath, phpImage, tempDir, containerConfigPath }) {
+  return spawn("docker", [
+    "run",
+    "--rm",
+    "--network",
+    "host",
+    "-v",
+    `${agentPath}:/agent.php:ro`,
+    "-v",
+    `${tempDir}:/proof`,
+    phpImage,
+    "php",
+    "/agent.php",
+    "--config",
+    containerConfigPath,
+  ], { stdio: ["ignore", "pipe", "pipe"] });
+}
+
+async function stopChild(child) {
+  if (child.exitCode !== null || child.signalCode !== null) {
+    return;
+  }
+
+  child.kill("SIGTERM");
+  const hardKill = setTimeout(() => {
+    if (child.exitCode === null && child.signalCode === null) {
+      child.kill("SIGKILL");
+    }
+  }, 1500);
+
+  await Promise.race([
+    new Promise((resolve) => child.once("exit", resolve)),
+    new Promise((resolve) => setTimeout(resolve, 2200)),
+  ]);
+  clearTimeout(hardKill);
+}
+
+function evidenceFromState(state, childExited) {
+  return {
+    brokerHandshakeSeen: state.brokerHandshakeSeen,
+    commandPollSeen: state.commandPollSeen,
+    relaySwitchSeen: state.relaySwitchSeen,
+    resultSeen: state.resultSeen,
+    agentStayedRunningUntilProofComplete: !childExited,
+  };
+}
+
+export async function runProof(options) {
+  if (process.platform !== "linux") {
+    throw new Error("This proof uses Docker --network host and currently expects Linux.");
+  }
+  if (!fs.existsSync(options.agentPath)) {
+    throw new Error(`Agent artifact not found: ${options.agentPath}`);
+  }
+
+  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "edge-agent-command-drain-proof-"));
+  fs.mkdirSync(path.join(tempDir, "runtime"), { recursive: true });
+
+  const state = {
+    brokerHandshakeSeen: false,
+    commandPollSeen: false,
+    relaySwitchSeen: false,
+    resultSeen: false,
+    commandDelivered: false,
+    failure: null,
+    requests: [],
+  };
+
+  const broker = createBrokerServer(state);
+  const workerServer = createWorkerServer(state);
+  let apiServer = null;
+  let child = null;
+  let stdout = "";
+  let stderr = "";
+  let childExited = false;
+
+  try {
+    const brokerPort = await listen(broker.server);
+    const workerPort = await listen(workerServer);
+    apiServer = createApiServer(state, brokerPort, workerPort);
+    const apiPort = await listen(apiServer);
+    const { containerConfigPath } = writeConfig(tempDir, apiPort, brokerPort, workerPort);
+
+    child = spawnAgent({ ...options, tempDir, containerConfigPath });
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.once("exit", () => {
+      childExited = true;
+    });
+
+    const deadline = Date.now() + options.timeoutMs;
+    while (Date.now() < deadline && !state.failure && !childExited) {
+      if (state.brokerHandshakeSeen && state.commandPollSeen && state.relaySwitchSeen && state.resultSeen) {
+        break;
+      }
+      await new Promise((resolve) => setTimeout(resolve, 100));
+    }
+
+    const evidence = evidenceFromState(state, childExited);
+    if (
+      state.failure ||
+      !state.brokerHandshakeSeen ||
+      !state.commandPollSeen ||
+      !state.relaySwitchSeen ||
+      !state.resultSeen
+    ) {
+      const error = state.failure || new Error("missing proof evidence");
+      error.evidence = evidence;
+      error.requests = state.requests;
+      error.stdout = stdout.slice(-3000);
+      error.stderr = stderr.slice(-3000);
+      throw error;
+    }
+
+    return {
+      evidence,
+      agentPath: options.agentPath,
+      phpImage: options.phpImage,
+      tempDir,
+      requestCount: state.requests.length,
+    };
+  } finally {
+    if (child) {
+      await stopChild(child);
+    }
+    for (const socket of broker.sockets) {
+      socket.destroy();
+    }
+    await Promise.allSettled([
+      closeServer(broker.server),
+      closeServer(workerServer),
+      apiServer ? closeServer(apiServer) : Promise.resolve(),
+    ]);
+    if (!options.keepTemp) {
+      fs.rmSync(tempDir, { recursive: true, force: true });
+    }
+  }
+}
+
+async function main() {
+  const options = parseArgs();
+  if (options.help) {
+    printUsage();
+    return;
+  }
+
+  const result = await runProof(options);
+  process.stdout.write("PASS broker-connected API command poll triggered local relay switch and posted result\n");
+  process.stdout.write(`${JSON.stringify(result.evidence)}\n`);
+  process.stdout.write(`Agent: ${result.agentPath}\n`);
+  process.stdout.write(`PHP image: ${result.phpImage}\n`);
+  if (options.keepTemp) {
+    process.stdout.write(`Temp dir: ${result.tempDir}\n`);
+  }
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  main().catch((error) => {
+    process.stderr.write(`FAIL ${error.message}\n`);
+    if (error.evidence) {
+      process.stderr.write(`Evidence: ${JSON.stringify(error.evidence)}\n`);
+    }
+    if (error.requests) {
+      process.stderr.write(`Requests: ${JSON.stringify(error.requests, null, 2)}\n`);
+    }
+    if (error.stdout) {
+      process.stderr.write(`stdout: ${error.stdout}\n`);
+    }
+    if (error.stderr) {
+      process.stderr.write(`stderr: ${error.stderr}\n`);
+    }
+    process.exit(1);
+  });
+}

scripts/edge-agent-to-shelly-proof.mjs

@@ -0,0 +1,619 @@
+import { spawn } from "node:child_process";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import http from "node:http";
+import net from "node:net";
+import os from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const DEFAULT_AGENT_PATH = path.join(
+  repoRoot,
+  "services/nginx/app/resources/edge-gateway-agent/agent.php"
+);
+const DEFAULT_WORKER_PATH = path.join(
+  repoRoot,
+  "services/nginx/app/resources/edge-gateway-agent/lan-worker.php"
+);
+const DEFAULT_PHP_IMAGE = "php:8.2-cli-bookworm";
+const DEFAULT_TIMEOUT_MS = 15000;
+const AGENT_TOKEN = "agent-token";
+
+function parseArgs(argv = process.argv.slice(2)) {
+  const options = {
+    agentPath: DEFAULT_AGENT_PATH,
+    workerPath: DEFAULT_WORKER_PATH,
+    phpImage: DEFAULT_PHP_IMAGE,
+    timeoutMs: DEFAULT_TIMEOUT_MS,
+    keepTemp: false,
+    help: false,
+  };
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    const next = argv[index + 1];
+
+    switch (arg) {
+      case "--agent-path":
+        options.agentPath = path.resolve(String(next || "").trim());
+        index += 1;
+        break;
+      case "--worker-path":
+        options.workerPath = path.resolve(String(next || "").trim());
+        index += 1;
+        break;
+      case "--php-image":
+        options.phpImage = String(next || "").trim() || DEFAULT_PHP_IMAGE;
+        index += 1;
+        break;
+      case "--timeout-ms":
+        options.timeoutMs = Number.parseInt(String(next || ""), 10) || DEFAULT_TIMEOUT_MS;
+        index += 1;
+        break;
+      case "--keep-temp":
+        options.keepTemp = true;
+        break;
+      case "--help":
+      case "-h":
+        options.help = true;
+        break;
+      default:
+        throw new Error(`Unknown argument: ${arg}`);
+    }
+  }
+
+  return options;
+}
+
+function printUsage() {
+  process.stdout.write(`Usage:
+  node scripts/edge-agent-to-shelly-proof.mjs [options]
+
+Runs the PHP edge agent and real LAN worker against fake broker, API, and
+Shelly RPC endpoints. Verifies that a broker-connected SET_RELAY_STATE command
+drains from the API, reaches the worker, triggers a Shelly-style Switch.Set
+call, reads Switch.GetStatus, and posts the command result.
+
+Options:
+  --agent-path <path>   PHP agent artifact to execute.
+                       Default: ${DEFAULT_AGENT_PATH}
+  --worker-path <path>  PHP LAN worker artifact to execute.
+                       Default: ${DEFAULT_WORKER_PATH}
+  --php-image <image>   Docker PHP image with curl, sqlite3, and pdo_sqlite.
+                       Default: ${DEFAULT_PHP_IMAGE}
+  --timeout-ms <ms>     Proof timeout. Default: ${DEFAULT_TIMEOUT_MS}
+  --keep-temp           Keep the temporary config/runtime directory.
+  --help                Show this help text.
+`);
+}
+
+function readJson(request) {
+  return new Promise((resolve) => {
+    let raw = "";
+    request.setEncoding("utf8");
+    request.on("data", (chunk) => {
+      raw += chunk;
+    });
+    request.on("end", () => {
+      if (raw.trim() === "") {
+        resolve({});
+        return;
+      }
+
+      try {
+        resolve(JSON.parse(raw));
+      } catch {
+        resolve({ __invalid: raw });
+      }
+    });
+  });
+}
+
+function sendJson(response, status, payload) {
+  const body = JSON.stringify(payload);
+  response.writeHead(status, {
+    "content-type": "application/json; charset=utf-8",
+    "content-length": Buffer.byteLength(body),
+  });
+  response.end(body);
+}
+
+function requestJson({ method = "GET", port, path: requestPath, body = null, headers = {} }) {
+  return new Promise((resolve, reject) => {
+    const payload = body === null ? null : JSON.stringify(body);
+    const request = http.request({
+      hostname: "127.0.0.1",
+      port,
+      path: requestPath,
+      method,
+      headers: {
+        accept: "application/json",
+        ...(payload === null ? {} : {
+          "content-type": "application/json",
+          "content-length": Buffer.byteLength(payload),
+        }),
+        ...headers,
+      },
+      timeout: 1000,
+    }, (response) => {
+      let raw = "";
+      response.setEncoding("utf8");
+      response.on("data", (chunk) => {
+        raw += chunk;
+      });
+      response.on("end", () => {
+        let decoded = {};
+        try {
+          decoded = raw.trim() === "" ? {} : JSON.parse(raw);
+        } catch {
+          decoded = { __invalid: raw };
+        }
+        resolve({ status: response.statusCode || 0, body: decoded });
+      });
+    });
+    request.on("error", reject);
+    request.on("timeout", () => {
+      request.destroy(new Error("request timed out"));
+    });
+    if (payload !== null) {
+      request.write(payload);
+    }
+    request.end();
+  });
+}
+
+function listen(server) {
+  return new Promise((resolve) => {
+    server.listen(0, "127.0.0.1", () => resolve(server.address().port));
+  });
+}
+
+function closeServer(server) {
+  return new Promise((resolve) => {
+    server.close(() => resolve());
+  });
+}
+
+async function reservePort() {
+  const server = net.createServer();
+  const port = await new Promise((resolve) => {
+    server.listen(0, "127.0.0.1", () => resolve(server.address().port));
+  });
+  await closeServer(server);
+  return port;
+}
+
+function websocketAcceptKey(key) {
+  return crypto
+    .createHash("sha1")
+    .update(`${key}258EAFA5-E914-47DA-95CA-C5AB0DC85B11`)
+    .digest("base64");
+}
+
+function createBrokerServer(state) {
+  const sockets = new Set();
+  const server = net.createServer((socket) => {
+    sockets.add(socket);
+    socket.on("close", () => sockets.delete(socket));
+
+    let buffer = "";
+    socket.on("data", (chunk) => {
+      buffer += chunk.toString("binary");
+      if (state.brokerHandshakeSeen || !buffer.includes("\r\n\r\n")) {
+        return;
+      }
+
+      const requestText = Buffer.from(buffer, "binary").toString("utf8");
+      const key = requestText.match(/Sec-WebSocket-Key:\s*(.+)\r\n/i)?.[1]?.trim();
+      const requestLine = requestText.split("\r\n")[0] || "";
+      if (!requestLine.includes("/ws/agent?")) {
+        state.failure = new Error(`unexpected broker path: ${requestLine}`);
+      }
+      if (!key) {
+        state.failure = new Error("broker handshake missing Sec-WebSocket-Key");
+        return;
+      }
+
+      socket.write([
+        "HTTP/1.1 101 Switching Protocols",
+        "Upgrade: websocket",
+        "Connection: Upgrade",
+        `Sec-WebSocket-Accept: ${websocketAcceptKey(key)}`,
+        "",
+        "",
+      ].join("\r\n"));
+      state.brokerHandshakeSeen = true;
+      buffer = "";
+    });
+  });
+
+  return { server, sockets };
+}
+
+function createShellyServer(state) {
+  return http.createServer((request, response) => {
+    const url = new URL(request.url, "http://127.0.0.1");
+    state.requests.push({
+      service: "shelly",
+      method: request.method,
+      path: url.pathname,
+      query: Object.fromEntries(url.searchParams.entries()),
+    });
+
+    if (request.method === "GET" && url.pathname === "/rpc/Switch.Set") {
+      state.shellySwitchSetSeen = true;
+      if (url.searchParams.get("id") !== "0" || url.searchParams.get("on") !== "true") {
+        state.failure = new Error(`unexpected Shelly Switch.Set query: ${url.search}`);
+      }
+      sendJson(response, 200, { was_on: false, output: true });
+      return;
+    }
+
+    if (request.method === "GET" && url.pathname === "/rpc/Switch.GetStatus") {
+      state.shellyStatusSeen = true;
+      if (url.searchParams.get("id") !== "0") {
+        state.failure = new Error(`unexpected Shelly Switch.GetStatus query: ${url.search}`);
+      }
+      sendJson(response, 200, { id: 0, output: true, source: "fake-shelly-rpc" });
+      return;
+    }
+
+    if (url.pathname.startsWith("/relay/")) {
+      state.failure = new Error(`legacy Shelly endpoint should not be used for generation 2 proof: ${url.pathname}`);
+    }
+
+    sendJson(response, 404, { message: "not found" });
+  });
+}
+
+function createApiServer(state, brokerPort, shellyAddress) {
+  return http.createServer(async (request, response) => {
+    const url = new URL(request.url, "http://127.0.0.1");
+    const body = await readJson(request);
+    state.requests.push({ service: "api", method: request.method, path: url.pathname, body });
+
+    if (request.method === "POST" && url.pathname === "/edge-agent/gateways/42/heartbeat") {
+      sendJson(response, 200, { data: { ok: true, broker_url: `ws://127.0.0.1:${brokerPort}` } });
+      return;
+    }
+
+    if (request.method === "POST" && url.pathname === "/edge-agent/gateways/42/selfserve/machine-signal-bindings") {
+      sendJson(response, 200, { data: { monitors: [] } });
+      return;
+    }
+
+    if (request.method === "POST" && url.pathname === "/edge-agent/gateways/42/commands/poll") {
+      state.commandPollSeen = true;
+      if (body.wait_seconds !== 0) {
+        state.failure = new Error(
+          `broker-connected command poll should be non-blocking, got wait_seconds=${body.wait_seconds}`
+        );
+      }
+
+      if (!state.commandDelivered) {
+        state.commandDelivered = true;
+        sendJson(response, 200, {
+          data: {
+            id: 77,
+            command_type: "SET_RELAY_STATE",
+            payload: {
+              localIp: shellyAddress,
+              local_ip: shellyAddress,
+              channel: 0,
+              on: true,
+              relayId: "relay-proof",
+              relay_id: "relay-proof",
+              deviceGeneration: 2,
+              device_generation: 2,
+            },
+          },
+        });
+        return;
+      }
+
+      sendJson(response, 200, { data: null });
+      return;
+    }
+
+    if (request.method === "POST" && url.pathname === "/edge-agent/gateways/42/commands/77/result") {
+      state.resultSeen = true;
+      if (
+        body.ok !== true ||
+        body.result?.on !== true ||
+        body.result?.output !== true ||
+        body.result?.raw?.source !== "fake-shelly-rpc"
+      ) {
+        state.failure = new Error(`unexpected command result: ${JSON.stringify(body)}`);
+      }
+      sendJson(response, 200, { data: { acknowledged: true } });
+      return;
+    }
+
+    sendJson(response, 404, { message: "not found", path: url.pathname });
+  });
+}
+
+function writeConfig(tempDir, apiPort, brokerPort, workerPort) {
+  const containerProofDir = "/proof";
+  const runtimeDir = `${containerProofDir}/runtime`;
+  const config = {
+    apiUrl: `http://127.0.0.1:${apiPort}`,
+    brokerUrl: `ws://127.0.0.1:${brokerPort}`,
+    gatewayId: 42,
+    agentToken: AGENT_TOKEN,
+    installDir: containerProofDir,
+    runtimeDir,
+    stateDatabasePath: `${runtimeDir}/gateway-state.sqlite`,
+    workerBaseUrl: `http://127.0.0.1:${workerPort}`,
+    heartbeatIntervalSeconds: 60,
+    operationPollTimeoutSeconds: 20,
+  };
+
+  const configPath = path.join(tempDir, "config.json");
+  fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
+  return { containerConfigPath: `${containerProofDir}/config.json` };
+}
+
+function spawnWorker({ workerPath, phpImage, workerPort }) {
+  return spawn("docker", [
+    "run",
+    "--rm",
+    "--network",
+    "host",
+    "-e",
+    `TRUCKWASH_WORKER_TOKEN=${AGENT_TOKEN}`,
+    "-v",
+    `${workerPath}:/lan-worker.php:ro`,
+    phpImage,
+    "php",
+    "-S",
+    `127.0.0.1:${workerPort}`,
+    "/lan-worker.php",
+  ], { stdio: ["ignore", "pipe", "pipe"] });
+}
+
+function spawnAgent({ agentPath, phpImage, tempDir, containerConfigPath }) {
+  return spawn("docker", [
+    "run",
+    "--rm",
+    "--network",
+    "host",
+    "-v",
+    `${agentPath}:/agent.php:ro`,
+    "-v",
+    `${tempDir}:/proof`,
+    phpImage,
+    "php",
+    "/agent.php",
+    "--config",
+    containerConfigPath,
+  ], { stdio: ["ignore", "pipe", "pipe"] });
+}
+
+async function waitForWorker(workerPort, child, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  let lastError = null;
+  while (Date.now() < deadline) {
+    if (child.exitCode !== null || child.signalCode !== null) {
+      throw new Error(`LAN worker exited before becoming healthy: ${child.exitCode ?? child.signalCode}`);
+    }
+
+    try {
+      const response = await requestJson({ port: workerPort, path: "/health" });
+      if (response.status === 200 && response.body?.service === "lan-worker") {
+        return;
+      }
+    } catch (error) {
+      lastError = error;
+    }
+    await new Promise((resolve) => setTimeout(resolve, 100));
+  }
+  throw lastError || new Error("LAN worker did not become healthy");
+}
+
+async function stopChild(child) {
+  if (child.exitCode !== null || child.signalCode !== null) {
+    return;
+  }
+
+  child.kill("SIGTERM");
+  const hardKill = setTimeout(() => {
+    if (child.exitCode === null && child.signalCode === null) {
+      child.kill("SIGKILL");
+    }
+  }, 1500);
+
+  await Promise.race([
+    new Promise((resolve) => child.once("exit", resolve)),
+    new Promise((resolve) => setTimeout(resolve, 2200)),
+  ]);
+  clearTimeout(hardKill);
+}
+
+function evidenceFromState(state, agentExited, workerExited) {
+  return {
+    brokerHandshakeSeen: state.brokerHandshakeSeen,
+    commandPollSeen: state.commandPollSeen,
+    shellySwitchSetSeen: state.shellySwitchSetSeen,
+    shellyStatusSeen: state.shellyStatusSeen,
+    resultSeen: state.resultSeen,
+    agentStayedRunningUntilProofComplete: !agentExited,
+    workerStayedRunningUntilProofComplete: !workerExited,
+  };
+}
+
+export async function runProof(options) {
+  if (process.platform !== "linux") {
+    throw new Error("This proof uses Docker --network host and currently expects Linux.");
+  }
+  if (!fs.existsSync(options.agentPath)) {
+    throw new Error(`Agent artifact not found: ${options.agentPath}`);
+  }
+  if (!fs.existsSync(options.workerPath)) {
+    throw new Error(`LAN worker artifact not found: ${options.workerPath}`);
+  }
+
+  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "edge-agent-to-shelly-proof-"));
+  fs.mkdirSync(path.join(tempDir, "runtime"), { recursive: true });
+
+  const state = {
+    brokerHandshakeSeen: false,
+    commandPollSeen: false,
+    shellySwitchSetSeen: false,
+    shellyStatusSeen: false,
+    resultSeen: false,
+    commandDelivered: false,
+    failure: null,
+    requests: [],
+  };
+
+  const broker = createBrokerServer(state);
+  const shellyServer = createShellyServer(state);
+  let apiServer = null;
+  let agent = null;
+  let worker = null;
+  let agentStdout = "";
+  let agentStderr = "";
+  let workerStdout = "";
+  let workerStderr = "";
+  let agentExited = false;
+  let workerExited = false;
+
+  try {
+    const brokerPort = await listen(broker.server);
+    const shellyPort = await listen(shellyServer);
+    const workerPort = await reservePort();
+    const shellyAddress = `127.0.0.1:${shellyPort}`;
+    apiServer = createApiServer(state, brokerPort, shellyAddress);
+    const apiPort = await listen(apiServer);
+    const { containerConfigPath } = writeConfig(tempDir, apiPort, brokerPort, workerPort);
+
+    worker = spawnWorker({ ...options, workerPort });
+    worker.stdout.on("data", (chunk) => {
+      workerStdout += chunk.toString();
+    });
+    worker.stderr.on("data", (chunk) => {
+      workerStderr += chunk.toString();
+    });
+    worker.once("exit", () => {
+      workerExited = true;
+    });
+    await waitForWorker(workerPort, worker, 5000);
+
+    agent = spawnAgent({ ...options, tempDir, containerConfigPath });
+    agent.stdout.on("data", (chunk) => {
+      agentStdout += chunk.toString();
+    });
+    agent.stderr.on("data", (chunk) => {
+      agentStderr += chunk.toString();
+    });
+    agent.once("exit", () => {
+      agentExited = true;
+    });
+
+    const deadline = Date.now() + options.timeoutMs;
+    while (Date.now() < deadline && !state.failure && !agentExited && !workerExited) {
+      if (
+        state.brokerHandshakeSeen &&
+        state.commandPollSeen &&
+        state.shellySwitchSetSeen &&
+        state.shellyStatusSeen &&
+        state.resultSeen
+      ) {
+        break;
+      }
+      await new Promise((resolve) => setTimeout(resolve, 100));
+    }
+
+    const evidence = evidenceFromState(state, agentExited, workerExited);
+    if (
+      state.failure ||
+      !state.brokerHandshakeSeen ||
+      !state.commandPollSeen ||
+      !state.shellySwitchSetSeen ||
+      !state.shellyStatusSeen ||
+      !state.resultSeen
+    ) {
+      const error = state.failure || new Error("missing proof evidence");
+      error.evidence = evidence;
+      error.requests = state.requests;
+      error.agentStdout = agentStdout.slice(-3000);
+      error.agentStderr = agentStderr.slice(-3000);
+      error.workerStdout = workerStdout.slice(-3000);
+      error.workerStderr = workerStderr.slice(-3000);
+      throw error;
+    }
+
+    return {
+      evidence,
+      agentPath: options.agentPath,
+      workerPath: options.workerPath,
+      phpImage: options.phpImage,
+      tempDir,
+      requestCount: state.requests.length,
+    };
+  } finally {
+    if (agent) {
+      await stopChild(agent);
+    }
+    if (worker) {
+      await stopChild(worker);
+    }
+    for (const socket of broker.sockets) {
+      socket.destroy();
+    }
+    await Promise.allSettled([
+      closeServer(broker.server),
+      closeServer(shellyServer),
+      apiServer ? closeServer(apiServer) : Promise.resolve(),
+    ]);
+    if (!options.keepTemp) {
+      fs.rmSync(tempDir, { recursive: true, force: true });
+    }
+  }
+}
+
+async function main() {
+  const options = parseArgs();
+  if (options.help) {
+    printUsage();
+    return;
+  }
+
+  const result = await runProof(options);
+  process.stdout.write("PASS broker-connected API command triggered real LAN worker Shelly RPC signal and posted result\n");
+  process.stdout.write(`${JSON.stringify(result.evidence)}\n`);
+  process.stdout.write(`Agent: ${result.agentPath}\n`);
+  process.stdout.write(`LAN worker: ${result.workerPath}\n`);
+  process.stdout.write(`PHP image: ${result.phpImage}\n`);
+  if (options.keepTemp) {
+    process.stdout.write(`Temp dir: ${result.tempDir}\n`);
+  }
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  main().catch((error) => {
+    process.stderr.write(`FAIL ${error.message}\n`);
+    if (error.evidence) {
+      process.stderr.write(`Evidence: ${JSON.stringify(error.evidence)}\n`);
+    }
+    if (error.requests) {
+      process.stderr.write(`Requests: ${JSON.stringify(error.requests, null, 2)}\n`);
+    }
+    if (error.agentStdout) {
+      process.stderr.write(`agent stdout: ${error.agentStdout}\n`);
+    }
+    if (error.agentStderr) {
+      process.stderr.write(`agent stderr: ${error.agentStderr}\n`);
+    }
+    if (error.workerStdout) {
+      process.stderr.write(`worker stdout: ${error.workerStdout}\n`);
+    }
+    if (error.workerStderr) {
+      process.stderr.write(`worker stderr: ${error.workerStderr}\n`);
+    }
+    process.exit(1);
+  });
+}

scripts/edge-gateway-e2e.mjs

@@ -10,7 +10,7 @@ import { promisify } from "node:util";
 import { DEFAULT_CONFIG_FILE_NAME, DEFAULT_HOST_API_URL } from "./test-gateway.mjs";
 
 const execFile = promisify(execFileCallback);
-const COMPOSE_SERVICES = ["traefik", "redis", "mysql-debug", "edge-broker", "php1", "caddy"];
+const COMPOSE_SERVICES = ["traefik", "redis", "mysql-debug", "edge-broker", "php1", "php2", "php3", "php4", "php5", "caddy"];
 
 function composeArgs(projectName, args) {
   return ["compose", "-p", projectName, ...args];
@@ -94,9 +94,23 @@ function directCaddyBaseUrl(baseUrl) {
   return normalizeBaseUrl(url.toString());
 }
 
+function isLocalHost(hostname) {
+  const normalized = String(hostname || "").toLowerCase().replace(/^\[|\]$/g, "");
+  return normalized === "localhost" || normalized === "127.0.0.1" || normalized === "::1";
+}
+
 function resolveBrokerWebSocketUrl(rawUrl, apiBaseUrl) {
   const websocketUrl = new URL(String(rawUrl));
   const apiUrl = new URL(normalizeBaseUrl(apiBaseUrl));
+  const ciBrokerPort = String(process.env.EDGE_BROKER_CI_PORT || "").trim();
+
+  if (isLocalHost(apiUrl.hostname) && websocketUrl.hostname === "edge-broker" && ciBrokerPort !== "") {
+    websocketUrl.protocol = apiUrl.protocol === "https:" ? "wss:" : "ws:";
+    websocketUrl.hostname = apiUrl.hostname;
+    websocketUrl.port = ciBrokerPort;
+    websocketUrl.pathname = websocketUrl.pathname.replace(/^\/edge-broker(?=\/|$)/, "") || "/";
+    return websocketUrl.toString();
+  }
 
   if (apiUrl.hostname === "caddy" && websocketUrl.hostname === "caddy") {
     websocketUrl.hostname = "edge-broker";
@@ -104,6 +118,18 @@ function resolveBrokerWebSocketUrl(rawUrl, apiBaseUrl) {
     websocketUrl.pathname = websocketUrl.pathname.replace(/^\/edge-broker(?=\/|$)/, "") || "/";
   }
 
+  if (isLocalHost(apiUrl.hostname) && ["caddy", "edge-broker"].includes(websocketUrl.hostname)) {
+    const brokerPath = websocketUrl.pathname.replace(/^\/edge-broker(?=\/|$)/, "") || "/";
+    websocketUrl.protocol = apiUrl.protocol === "https:" ? "wss:" : "ws:";
+    websocketUrl.hostname = apiUrl.hostname;
+    websocketUrl.port = apiUrl.port;
+    websocketUrl.pathname = `/api/edge-broker${brokerPath}`;
+  }
+
+  if (isLocalHost(websocketUrl.hostname)) {
+    websocketUrl.pathname = websocketUrl.pathname.replace(/^\/edge-broker(?=\/|$)/, "") || "/";
+  }
+
   return websocketUrl.toString();
 }
 
@@ -514,6 +540,10 @@ function shouldCopyGatewayConfig() {
   return /^(1|true|yes)$/i.test(String(process.env.EDGE_GATEWAY_E2E_COPY_CONFIG || "").trim());
 }
 
+function shouldSkipComposeUp() {
+  return /^(1|true|yes)$/i.test(String(process.env.EDGE_GATEWAY_E2E_SKIP_COMPOSE_UP || "").trim());
+}
+
 function collectMessages(rows) {
   return Array.isArray(rows)
     ? rows
@@ -551,6 +581,38 @@ function summarizeStreamMessages(messages, limit = 12) {
     .filter(Boolean);
 }
 
+async function readGatewayDiagnostics({ baseUrl, authToken, gatewayId, containerName }) {
+  const diagnostics = {};
+
+  if (gatewayId !== null && gatewayId > 0 && authToken) {
+    try {
+      const detail = await apiRequest(baseUrl, "GET", `/edge-gateways/${gatewayId}`, {
+        token: authToken,
+      });
+      diagnostics.gateway = {
+        status: detail?.data?.status ?? null,
+        channelStatus: detail?.data?.channel_status ?? null,
+        brokerPresence: detail?.data?.metadata?.broker_presence ?? null,
+        brokerConnected: detail?.data?.metadata?.broker_connected ?? null,
+        brokerLastError: detail?.data?.metadata?.broker_last_error ?? null,
+      };
+    } catch (error) {
+      diagnostics.gatewayError = error instanceof Error ? error.message : String(error);
+    }
+  }
+
+  try {
+    const logs = await runCommand("docker", ["logs", "--tail", "120", containerName], {
+      allowFailure: true,
+    });
+    diagnostics.containerLogs = String(`${logs.stdout || ""}${logs.stderr || ""}`).trim().split(/\r?\n/).slice(-120);
+  } catch (error) {
+    diagnostics.containerLogError = error instanceof Error ? error.message : String(error);
+  }
+
+  return diagnostics;
+}
+
 async function main() {
   const scriptPath = fileURLToPath(import.meta.url);
   const rootDir = await resolveRootDir(scriptPath);
@@ -570,7 +632,9 @@ async function main() {
   let runnerNetworkAttached = false;
 
   try {
-    await ensureComposeServices(rootDir, composeProject);
+    if (!shouldSkipComposeUp()) {
+      await ensureComposeServices(rootDir, composeProject);
+    }
     runnerNetworkAttached = await connectCurrentContainerToComposeNetwork(rootDir, composeProject);
     baseUrl = await waitForApiReady(baseUrl, rootDir, composeProject, runnerNetworkAttached);
     process.stdout.write(`Using API base URL ${baseUrl}\n`);
@@ -663,22 +727,35 @@ async function main() {
       }
     );
 
-    await waitForCondition(
+    try {
-      async () => {
+      await waitForCondition(
-        const detail = await apiRequest(baseUrl, "GET", `/edge-gateways/${gatewayId}`, {
+        async () => {
-          token: authToken,
+          const detail = await apiRequest(baseUrl, "GET", `/edge-gateways/${gatewayId}`, {
-        });
+            token: authToken,
+          });
 
-        return Boolean(
+          return Boolean(
-          detail?.data?.channel_status?.broker?.connected
+            detail?.data?.channel_status?.broker?.connected
-          || detail?.data?.metadata?.broker_connected
+            || detail?.data?.metadata?.broker_connected
-        );
+          );
-      },
+        },
-      {
+        {
-        timeoutMs: 90_000,
+          timeoutMs: 90_000,
-        message: "Gateway never established a live broker connection after install.",
+          message: "Gateway never established a live broker connection after install.",
-      }
+        }
-    );
+      );
+    } catch (error) {
+      const diagnostics = await readGatewayDiagnostics({
+        baseUrl,
+        authToken,
+        gatewayId,
+        containerName,
+      });
+      throw new Error([
+        error instanceof Error ? error.message : String(error),
+        `Broker diagnostics: ${JSON.stringify(diagnostics, null, 2)}`,
+      ].join("\n"));
+    }
 
     const WebSocketImpl = await loadWebSocketImplementation();
     const streamSession = await apiRequest(baseUrl, "POST", `/edge-gateways/${gatewayId}/stream-session`, {
@@ -701,11 +778,14 @@ async function main() {
       { timeoutMs: 15_000, message: "Gateway stream never became ready." }
     );
 
-    const readyMessage = streamMessages.find((message) => message?.type === "gateway.stream.ready");
+    await waitForSocketMessage(
-    assert.equal(
+      streamMessages,
-      Boolean(readyMessage?.connected),
+      (message) => (
-      true,
+        message?.type === "gateway.stream.ready" && message?.connected === true
-      "Gateway stream became ready before the broker reported the gateway as connected."
+      ) || (
+        message?.type === "presence.changed" && message?.status === "connected"
+      ),
+      { timeoutMs: 45_000, message: "Gateway stream never observed a connected broker presence." }
     );
 
     const operationResponse = await apiRequest(baseUrl, "POST", `/edge-gateways/${gatewayId}/operations`, {
@@ -733,10 +813,24 @@ async function main() {
     assert.ok(operationId > 0, "Operation creation did not return an operation id.");
 
     try {
-      await waitForSocketMessage(
+      await waitForCondition(
-        streamMessages,
+        async () => {
-        (message) => message?.type === "task.updated" && Number(message?.operationId || 0) === operationId,
+          const operations = await apiRequest(baseUrl, "GET", `/edge-gateways/${gatewayId}/operations`, {
-        { timeoutMs: 180_000, message: "Live gateway stream never emitted task.updated for the queued operation." }
+            token: authToken,
+          });
+
+          const operation = Array.isArray(operations?.data)
+            ? operations.data.find((item) => Number(item?.id || 0) === operationId)
+            : null;
+
+          return operation?.status === "COMPLETED"
+            || streamMessages.some((message) => (
+              message?.type === "task.updated"
+              && Number(message?.operationId || 0) === operationId
+              && message?.operation?.status === "COMPLETED"
+            ));
+        },
+        { timeoutMs: 180_000, message: "Gateway operation never completed through the live agent." }
       );
     } catch (error) {
       let operationSnapshot = null;
@@ -759,21 +853,6 @@ async function main() {
       throw new Error(diagnostic);
     }
 
-    await waitForCondition(
-      async () => {
-        const operations = await apiRequest(baseUrl, "GET", `/edge-gateways/${gatewayId}/operations`, {
-          token: authToken,
-        });
-
-        const operation = Array.isArray(operations?.data)
-          ? operations.data.find((item) => Number(item?.id || 0) === operationId)
-          : null;
-
-        return operation?.status === "COMPLETED";
-      },
-      { timeoutMs: 180_000, message: "Gateway operation never completed through the live agent." }
-    );
-
     await waitForSocketMessage(
       streamMessages,
       (message) => message?.type === "gateway.telemetry" || message?.type === "stats.updated",

scripts/php-ci-test.sh

@@ -18,6 +18,7 @@ cd "$repo_root"
 compose_files="-f docker-compose.yml -f .github/docker-compose.ci.yml"
 project_suffix="$(date +%s)-$$"
 export COMPOSE_PROJECT_NAME="${COMPOSE_PROJECT_NAME:-php-local-${suite}-${project_suffix}}"
+export COMPOSE_PROFILES="${COMPOSE_PROFILES:-dev}"
 
 log_dir=".tmp/ci-logs/$suite"
 mkdir -p "$log_dir"
@@ -51,6 +52,50 @@ collect_logs() {
   docker compose $compose_files cp php1:/var/log/php "$log_dir/php-logs" >/dev/null 2>&1 || true
 }
 
+retry_command() {
+  max_attempts="$1"
+  shift
+  attempt=1
+  while :; do
+    "$@" && return 0
+    status="$?"
+    if [ "$attempt" -ge "$max_attempts" ]; then
+      return "$status"
+    fi
+    sleep_seconds=$((attempt * 5))
+    echo "Command failed with status $status; retrying in ${sleep_seconds}s (attempt $((attempt + 1))/$max_attempts): $*" >&2
+    sleep "$sleep_seconds"
+    attempt=$((attempt + 1))
+  done
+}
+
+composer_install() {
+  dist_attempts="${PHP_CI_COMPOSER_RETRIES:-3}"
+  source_attempts="${PHP_CI_COMPOSER_SOURCE_RETRIES:-2}"
+
+  if retry_command "$dist_attempts" \
+    docker compose $compose_files exec -T php1 sh -lc \
+    'cd /var/www/html && composer install --no-interaction --prefer-dist --no-progress'; then
+    return 0
+  fi
+
+  echo "Composer dist install failed after ${dist_attempts} attempts; retrying with --prefer-source." >&2
+  retry_command "$source_attempts" \
+    docker compose $compose_files exec -T php1 sh -lc \
+    'cd /var/www/html && composer install --no-interaction --prefer-source --no-progress'
+}
+
+configure_ci_docker_subnet() {
+  if [ -n "${CI_DOCKER_SUBNET:-}" ]; then
+    return
+  fi
+
+  checksum="$(printf '%s' "$COMPOSE_PROJECT_NAME" | cksum | awk '{print $1}')"
+  subnet_second=$((64 + ((checksum / 256) % 64)))
+  subnet_third=$((checksum % 256))
+  export CI_DOCKER_SUBNET="10.${subnet_second}.${subnet_third}.0/24"
+}
+
 cleanup() {
   status="$?"
   collect_logs "$status"
@@ -70,7 +115,8 @@ cleanup() {
 }
 trap cleanup EXIT INT TERM
 
-docker compose $compose_files up -d redis mysql-debug php1
+configure_ci_docker_subnet
+sh scripts/ci-docker-compose-up.sh redis mysql-debug php1
 
 docker compose $compose_files exec -T php1 sh -lc '
   set -eu
@@ -93,10 +139,18 @@ tar \
   --exclude='./.phpunit.cache' \
   --exclude='./build/logs' \
   -C services/nginx/app -cf - . \
-  | docker compose $compose_files exec -T php1 tar -C /var/www/html -xf -
+  | docker compose $compose_files exec -T php1 tar --no-same-owner -C /var/www/html -xf -
+
+docker compose $compose_files exec -T php1 sh -lc 'rm -rf /var/www/repo-root && mkdir -p /var/www/repo-root'
+tar \
+  -cf - \
+  Dockerfile \
+  Dockerfile.coolify-api \
+  services/php/Dockerfile \
+  services/php/php-fpm-pool.conf \
+  | docker compose $compose_files exec -T php1 tar --no-same-owner -C /var/www/repo-root -xf -
+
+composer_install
 
 docker compose $compose_files exec -T php1 sh -lc \
-  'cd /var/www/html && composer install --no-interaction --prefer-dist --no-progress'
+  "cd /var/www/html && PLENO_REPO_ROOT_FOR_TESTS=/var/www/repo-root composer test:ci:$suite"
-
-docker compose $compose_files exec -T php1 sh -lc \
-  "cd /var/www/html && composer test:ci:$suite"

scripts/staging-edge-gateway-smoke.mjs

@@ -1,14 +1,32 @@
 import process from "node:process";
 import path from "node:path";
+import { createHash } from "node:crypto";
 import { pathToFileURL } from "node:url";
 
 export const DEFAULT_STAGING_BASE_URL = "https://api.truckwash.io:4433";
+export const EXPECTED_INSTALL_VERSION = "compose-php-agent-v3";
+export const REQUIRED_MANIFEST_ARTIFACTS = [
+  "agent.php",
+  "lan-worker.php",
+  "auto-updater.php",
+  "docker-compose.gateway.yml",
+  "Dockerfile.edge-agent",
+  "Dockerfile.lan-worker",
+  "Dockerfile.auto-updater",
+  "gateway-launcher.sh",
+  "truckwash-edge-gateway-stack.service",
+  "truckwash-edge-agent.service",
+];
 export const INSTALLER_SCRIPT_REQUIRED_SNIPPETS = [
   "/edge-agent/install-token/status",
+  "/edge-agent/artifacts/manifest.json",
   "report_install_status",
   'begin_install_phase "VERIFY_TOKEN"',
+  'begin_install_phase "VERIFY_ARTIFACTS"',
   'begin_install_phase "WAIT_FOR_CLAIM"',
   'report_install_status "FAILED"',
+  "verify_manifest_artifact",
+  EXPECTED_INSTALL_VERSION,
 ];
 
 export function normalizeBaseUrl(url) {
@@ -55,13 +73,20 @@ export function buildChecks(baseUrl, installToken) {
       name: "Ping",
       url: `${normalizedBaseUrl}/ping`,
     },
+    {
+      name: "Artifact manifest",
+      url: `${normalizedBaseUrl}/edge-agent/artifacts/manifest.json`,
+      artifactName: "manifest.json",
+    },
     {
       name: "Agent PHP artifact",
       url: `${normalizedBaseUrl}/edge-agent/artifacts/agent.php`,
+      artifactName: "agent.php",
     },
     {
       name: "Service unit artifact",
       url: `${normalizedBaseUrl}/edge-agent/artifacts/truckwash-edge-agent.service`,
+      artifactName: "truckwash-edge-agent.service",
     },
     {
       name: "Installer script",
@@ -70,6 +95,42 @@ export function buildChecks(baseUrl, installToken) {
   ];
 }
 
+export function validateArtifactManifestBody(body) {
+  const manifest = JSON.parse(String(body || ""));
+  if (manifest.version !== EXPECTED_INSTALL_VERSION) {
+    throw new Error(`Artifact manifest version mismatch: expected ${EXPECTED_INSTALL_VERSION}, got ${manifest.version}`);
+  }
+  if (!Array.isArray(manifest.artifacts)) {
+    throw new Error("Artifact manifest is missing artifacts.");
+  }
+
+  const byName = new Map(manifest.artifacts.map((artifact) => [artifact?.name, artifact]));
+  const missingArtifacts = REQUIRED_MANIFEST_ARTIFACTS.filter((artifactName) => !byName.has(artifactName));
+  if (missingArtifacts.length) {
+    throw new Error(`Artifact manifest is missing required artifacts: ${missingArtifacts.join(", ")}`);
+  }
+
+  return manifest;
+}
+
+export function validateArtifactBodyAgainstManifest(manifest, artifactName, body) {
+  const artifact = manifest?.artifacts?.find((entry) => entry?.name === artifactName);
+  if (!artifact) {
+    throw new Error(`Artifact ${artifactName} is missing from manifest.`);
+  }
+
+  const buffer = Buffer.isBuffer(body) ? body : Buffer.from(String(body || ""));
+  const sha256 = createHash("sha256").update(buffer).digest("hex");
+  if (sha256 !== artifact.sha256) {
+    throw new Error(`Artifact ${artifactName} hash mismatch: ${sha256} !== ${artifact.sha256}`);
+  }
+  if (buffer.length !== artifact.bytes) {
+    throw new Error(`Artifact ${artifactName} size mismatch: ${buffer.length} !== ${artifact.bytes}`);
+  }
+
+  return artifact;
+}
+
 export function validateInstallerScriptBody(body) {
   const source = String(body || "");
   const missingSnippets = INSTALLER_SCRIPT_REQUIRED_SNIPPETS.filter((snippet) => !source.includes(snippet));
@@ -107,16 +168,17 @@ export async function runSmoke({ baseUrl, installToken }) {
 
   const checks = buildChecks(baseUrl, installToken);
   const results = [];
+  let artifactManifest = null;
 
   for (const check of checks) {
     process.stdout.write(`[staging-smoke] GET ${check.url}\n`);
     const response = await fetch(check.url);
-    const body = await response.text();
+    const body = Buffer.from(await response.arrayBuffer());
     const result = {
       ...check,
       status: response.status,
       ok: response.ok,
-      bodyPreview: previewBody(body),
+      bodyPreview: previewBody(body.toString("utf8")),
     };
     results.push(result);
 
@@ -127,8 +189,16 @@ export async function runSmoke({ baseUrl, installToken }) {
       );
     }
 
+    if (check.name === "Artifact manifest") {
+      artifactManifest = validateArtifactManifestBody(body.toString("utf8"));
+      result.version = artifactManifest.version;
+      result.artifactCount = artifactManifest.artifacts.length;
+    }
+    if (artifactManifest && check.artifactName && check.artifactName !== "manifest.json") {
+      result.verifiedArtifact = validateArtifactBodyAgainstManifest(artifactManifest, check.artifactName, body);
+    }
     if (check.name === "Installer script") {
-      result.verifiedSnippets = validateInstallerScriptBody(body);
+      result.verifiedSnippets = validateInstallerScriptBody(body.toString("utf8"));
     }
   }
 

scripts/staging-edge-gateway-smoke.test.mjs

@@ -3,10 +3,13 @@ import assert from "node:assert/strict";
 
 import {
   DEFAULT_STAGING_BASE_URL,
+  EXPECTED_INSTALL_VERSION,
   INSTALLER_SCRIPT_REQUIRED_SNIPPETS,
   buildChecks,
   normalizeBaseUrl,
   parseArgs,
+  validateArtifactBodyAgainstManifest,
+  validateArtifactManifestBody,
   validateInstallerScriptBody,
 } from "./staging-edge-gateway-smoke.mjs";
 
@@ -32,18 +35,58 @@ test("buildChecks targets the public staging endpoints", () => {
 
   assert.deepEqual(checks.map((check) => check.url), [
     "https://api.truckwash.io:4433/ping",
+    "https://api.truckwash.io:4433/edge-agent/artifacts/manifest.json",
     "https://api.truckwash.io:4433/edge-agent/artifacts/agent.php",
     "https://api.truckwash.io:4433/edge-agent/artifacts/truckwash-edge-agent.service",
     "https://api.truckwash.io:4433/edge-agent/install.sh?token=abc%20123",
   ]);
 });
 
+test("validateArtifactManifestBody requires v3 install artifacts", () => {
+  const artifacts = [
+    "agent.php",
+    "lan-worker.php",
+    "auto-updater.php",
+    "docker-compose.gateway.yml",
+    "Dockerfile.edge-agent",
+    "Dockerfile.lan-worker",
+    "Dockerfile.auto-updater",
+    "gateway-launcher.sh",
+    "truckwash-edge-gateway-stack.service",
+    "truckwash-edge-agent.service",
+  ].map((name) => ({ name, sha256: "abc", bytes: 1 }));
+
+  const manifest = validateArtifactManifestBody(JSON.stringify({
+    version: EXPECTED_INSTALL_VERSION,
+    artifacts,
+  }));
+
+  assert.equal(manifest.version, EXPECTED_INSTALL_VERSION);
+});
+
+test("validateArtifactBodyAgainstManifest verifies size and hash", () => {
+  const body = Buffer.from("hello");
+  const manifest = {
+    artifacts: [{
+      name: "agent.php",
+      sha256: "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824",
+      bytes: body.length,
+    }],
+  };
+
+  assert.equal(validateArtifactBodyAgainstManifest(manifest, "agent.php", body).name, "agent.php");
+});
+
 test("validateInstallerScriptBody requires install-session reporting wiring", () => {
   const script = `
     INSTALL_STATUS_URL="https://api.truckwash.io:4433/edge-agent/install-token/status"
+    fetch_http "Download artifact manifest" "https://api.truckwash.io:4433/edge-agent/artifacts/manifest.json"
     report_install_status "FAILED"
     begin_install_phase "VERIFY_TOKEN" "Verifying install token"
+    begin_install_phase "VERIFY_ARTIFACTS" "Verifying edge gateway artifacts"
     begin_install_phase "WAIT_FOR_CLAIM" "Waiting for gateway heartbeat and claim"
+    verify_manifest_artifact
+    ${EXPECTED_INSTALL_VERSION}
   `;
 
   assert.deepEqual(validateInstallerScriptBody(script), INSTALLER_SCRIPT_REQUIRED_SNIPPETS);

scripts/test-gateway.mjs

@@ -12,7 +12,7 @@ export const DEFAULT_IMAGE_TAG = "truckwash-edge-agent:test-gateway";
 export const DEFAULT_CONFIG_FILE_NAME = "test-gateway.json";
 export const DEFAULT_HOST_API_URL = "http://localhost/api";
 export const DEFAULT_CONTAINER_API_URL = "http://caddy";
-export const DEFAULT_CONTAINER_BROKER_URL = "http://edge-broker:4300";
+export const DEFAULT_CONTAINER_BROKER_URL = "ws://edge-broker:4300";
 export const DEFAULT_INSTALL_DIR = "/opt/truckwash-edge-agent";
 export const DEFAULT_RUNTIME_DIR = `${DEFAULT_INSTALL_DIR}/runtime`;
 export const DEFAULT_STATE_DATABASE_PATH = `${DEFAULT_RUNTIME_DIR}/gateway-state.sqlite`;
@@ -25,6 +25,16 @@ function composeArgs(projectName, args) {
   return ["compose", "-p", projectName, ...args];
 }
 
+function usesWindowsPathSyntax(filePath) {
+  return /^[A-Za-z]:($|[\\/])/.test(filePath) || filePath.startsWith("\\\\") || filePath.includes("\\");
+}
+
+function pathForInputs(...filePaths) {
+  const hasWindowsPath = filePaths.some((filePath) => usesWindowsPathSyntax(String(filePath || "")));
+
+  return hasWindowsPath ? path.win32 : path;
+}
+
 async function resolveRootDir(scriptPath) {
   const cwd = process.cwd();
 
@@ -66,7 +76,7 @@ export function resolveComposeProjectName(rootDir, env = process.env) {
     return explicit;
   }
 
-  return path.basename(rootDir);
+  return pathForInputs(rootDir).basename(rootDir);
 }
 
 export function resolveComposeNetworkName(rootDir, env = process.env) {
@@ -74,11 +84,13 @@ export function resolveComposeNetworkName(rootDir, env = process.env) {
 }
 
 export function resolveConfigDirectory(rootDir, explicitDir = null) {
+  const pathModule = pathForInputs(rootDir, explicitDir);
+
   if (explicitDir) {
-    return path.resolve(rootDir, explicitDir);
+    return pathModule.resolve(rootDir, explicitDir);
   }
 
-  return path.join(rootDir, ".tmp", "test-gateway");
+  return pathModule.join(rootDir, ".tmp", "test-gateway");
 }
 
 export function shouldClaimGateway(existingConfig = {}, installToken = "") {
@@ -397,14 +409,20 @@ async function startContainer({
   });
 
   if (copyConfig) {
-    await runCommand("docker", [
+    const configFilePath = path.join(configDir, DEFAULT_CONFIG_FILE_NAME);
-      "cp",
+    await fs.chmod(configFilePath, 0o666).catch(() => {});
-      path.join(configDir, DEFAULT_CONFIG_FILE_NAME),
+    try {
-      `${containerName}:${containerConfigPath}`,
+      await runCommand("docker", [
-    ], {
+        "cp",
-      cwd: rootDir,
+        configFilePath,
-      stdio: "inherit",
+        `${containerName}:${containerConfigPath}`,
-    });
+      ], {
+        cwd: rootDir,
+        stdio: "inherit",
+      });
+    } finally {
+      await fs.chmod(configFilePath, 0o600).catch(() => {});
+    }
 
     await runCommand("docker", ["start", containerName], {
       cwd: rootDir,

services/caddy/Caddyfile

@@ -10,6 +10,11 @@
     # CORS is handled at the edge by Traefik's headers middleware.
     # Do not set or strip Access-Control-* headers here to avoid conflicts.
 
+    # Do not expose local replication bootstrap material from the public web root.
+    # Bootstrap snapshots contain sensitive failover credentials.
+    @replicationBootstrap path /storage/replication-bootstrap.json /storage/replication-bootstrap-*
+    respond @replicationBootstrap 404
+
     # PHP handling via FastCGI to php-fpm pool
     php_fastcgi php1:9000 php2:9000 php3:9000 php4:9000 php5:9000
 

services/caddy/Caddyfile-staging

@@ -10,6 +10,11 @@
     # CORS is handled at the edge by Traefik's headers middleware.
     # Do not set or strip Access-Control-* headers here to avoid conflicts.
 
+    # Do not expose local replication bootstrap material from the public web root.
+    # Bootstrap snapshots contain sensitive failover credentials.
+    @replicationBootstrap path /storage/replication-bootstrap.json /storage/replication-bootstrap-*
+    respond @replicationBootstrap 404
+
     # PHP handling via FastCGI to php-fpm pool
     php_fastcgi php-staging:9000
 

services/edge-agent/dist/agent.mjs

@@ -18,6 +18,7 @@ const DEFAULT_UPDATE_VERIFY_INTERVAL_MS = 500;
 const DEFAULT_UPDATE_RESTART_GRACE_MS = 150;
 const DEFAULT_BROKER_RECONNECT_DELAY_MS = 1500;
 const DEFAULT_SHELLY_LOCAL_HTTP_TIMEOUT_MS = 1200;
+const MAX_RELAY_TOGGLE_AFTER_SECONDS = 5;
 const UPDATE_VERIFY_COMMAND = "post-update-verify";
 const execFile = promisify(execFileCallback);
 
@@ -151,6 +152,10 @@ function buildTransportHeartbeatState(brokerState = {}) {
   };
 }
 
+function isShellAccessEnabled(config = {}) {
+  return config.enableShellAccess === true;
+}
+
 function normalizeBrokerBaseUrl(value) {
   const trimmed = String(value || "").trim().replace(/\/+$/, "");
   if (trimmed === "") {
@@ -478,7 +483,7 @@ function resolveRelayToggleAfterSeconds(payload = {}) {
     return null;
   }
 
-  return Math.floor(configured);
+  return Math.min(Math.floor(configured), MAX_RELAY_TOGGLE_AFTER_SECONDS);
 }
 
 async function fetchJson(url, fetchImpl = fetch, options = {}) {
@@ -749,11 +754,74 @@ export async function setRelayState(payload, fetchImpl = fetch) {
   }
 }
 
+async function mapWithConcurrency(items, limit, mapper) {
+  const results = new Array(items.length);
+  let nextIndex = 0;
+  const workerCount = Math.max(1, Math.min(Number(limit) || 1, items.length || 1));
+
+  await Promise.all(Array.from({ length: workerCount }, async () => {
+    while (nextIndex < items.length) {
+      const index = nextIndex;
+      nextIndex += 1;
+      results[index] = await mapper(items[index], index);
+    }
+  }));
+
+  return results;
+}
+
+async function executeRelayBatch(command, handler, fetchImpl = fetch) {
+  const commands = Array.isArray(command?.payload?.commands)
+    ? command.payload.commands
+    : Array.isArray(command?.commands)
+      ? command.commands
+      : [];
+  const concurrency = Math.max(1, Math.min(Number(command?.payload?.concurrency || command?.concurrency || 5), 5));
+
+  const results = await mapWithConcurrency(commands, concurrency, async (entry = {}) => {
+    const target = String(entry.target || entry.relay || "");
+    const relayId = String(entry.relayId || entry.relay_id || "");
+    try {
+      const payload = await handler(entry, fetchImpl);
+      return {
+        target,
+        relayId,
+        relay_id: relayId,
+        ok: true,
+        payload,
+      };
+    } catch (error) {
+      return {
+        target,
+        relayId,
+        relay_id: relayId,
+        ok: false,
+        error: error instanceof Error ? error.message : String(error),
+      };
+    }
+  });
+
+  return {
+    batchId: command?.payload?.batchId || command?.payload?.batch_id || command?.batchId || command?.batch_id || null,
+    batch_id: command?.payload?.batch_id || command?.payload?.batchId || command?.batch_id || command?.batchId || null,
+    results,
+  };
+}
+
 async function fetchArtifactBuffer(url, expectedSha256, label, fetchImpl = fetch) {
   if (!url) {
     return null;
   }
 
+  if (!expectedSha256) {
+    throw new Error(`${label} checksum is required`);
+  }
+
+  const normalizedExpectedSha256 = String(expectedSha256).toLowerCase();
+  if (!/^[a-f0-9]{64}$/.test(normalizedExpectedSha256)) {
+    throw new Error(`${label} checksum must be a valid sha256 hex digest`);
+  }
+
   const response = await fetchImpl(url);
   if (!response.ok) {
     throw new Error(`${label} download failed: HTTP ${response.status}`);
@@ -761,7 +829,7 @@ async function fetchArtifactBuffer(url, expectedSha256, label, fetchImpl = fetch
 
   const buffer = Buffer.from(await response.arrayBuffer());
   const sha256 = createHash("sha256").update(buffer).digest("hex");
-  if (expectedSha256 && String(expectedSha256).toLowerCase() !== sha256.toLowerCase()) {
+  if (normalizedExpectedSha256 !== sha256.toLowerCase()) {
     throw new Error(`${label} checksum mismatch`);
   }
 
@@ -1402,6 +1470,10 @@ export async function handleAgentCommand(command, deps = {}) {
       return await getRelayStatus(command.payload || {}, fetchImpl);
     case "SET_RELAY_STATE":
       return await setRelayState(command.payload || {}, fetchImpl);
+    case "BATCH_RELAY_STATUS":
+      return await executeRelayBatch(command, getRelayStatus, fetchImpl);
+    case "BATCH_SET_RELAY_STATE":
+      return await executeRelayBatch(command, setRelayState, fetchImpl);
     case "RUN_UPDATE":
       return await runUpdate(command.payload || {}, fetchImpl, deps);
     case "UNINSTALL_AGENT":
@@ -1785,6 +1857,10 @@ export async function processPolledShellAction(config, action, shell, fetchImpl
   }
 
   try {
+    if (!isShellAccessEnabled(config)) {
+      throw new Error("Shell access is disabled by local configuration");
+    }
+
     if (actionType === "OPEN") {
       await shell.open(payload);
     } else if (actionType === "INPUT") {
@@ -1919,18 +1995,30 @@ function createBrokerBridge({
         }
 
         if (message.type === "OPEN_ROOT_SHELL") {
+          if (!isShellAccessEnabled(config)) {
+            throw new Error("Shell access is disabled by local configuration");
+          }
           await shell.open(message.payload || {});
           return;
         }
         if (message.type === "SHELL_INPUT") {
+          if (!isShellAccessEnabled(config)) {
+            throw new Error("Shell access is disabled by local configuration");
+          }
           shell.input(message.payload || {});
           return;
         }
         if (message.type === "RESIZE_ROOT_SHELL") {
+          if (!isShellAccessEnabled(config)) {
+            throw new Error("Shell access is disabled by local configuration");
+          }
           shell.resize(message.payload || {});
           return;
         }
         if (message.type === "CLOSE_ROOT_SHELL") {
+          if (!isShellAccessEnabled(config)) {
+            throw new Error("Shell access is disabled by local configuration");
+          }
           shell.close(message.payload || {});
         }
       } catch {

services/edge-agent/test/agent.test.mjs

@@ -1,6 +1,7 @@
 import test from "node:test";
 import assert from "node:assert/strict";
 import { execFile as execFileCallback } from "node:child_process";
+import { createHash } from "node:crypto";
 import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
@@ -17,6 +18,7 @@ import {
   getRelayStatus,
   loadConfig,
   parseCliArgs,
+  processPolledShellAction,
   processPolledCommand,
   runCli,
   runUpdate,
@@ -39,6 +41,10 @@ function makeFetchResponse(body) {
   };
 }
 
+function sha256Hex(body) {
+  return createHash("sha256").update(body).digest("hex");
+}
+
 async function waitFor(predicate, { timeoutMs = 1000, intervalMs = 10, description = "condition" } = {}) {
   const deadline = Date.now() + timeoutMs;
 
@@ -121,6 +127,39 @@ test("relay status and switch commands support both Shelly RPC and legacy endpoi
   assert.equal(switched.on, false);
 });
 
+test("batch relay commands return per-relay results without failing the whole batch", async () => {
+  const fakeFetch = async (url) => {
+    const value = String(url);
+    if (value.includes("10.1.0.31")) {
+      return {
+        ok: true,
+        async json() {
+          return { output: true };
+        },
+      };
+    }
+    throw new Error("relay offline");
+  };
+
+  const result = await handleAgentCommand({
+    commandType: "BATCH_SET_RELAY_STATE",
+    payload: {
+      batch_id: "batch-1",
+      commands: [
+        { target: "MACHINE", relayId: "relay-machine", localIp: "10.1.0.31", channel: 0, on: true },
+        { target: "EXIT", relayId: "relay-out", localIp: "10.1.0.32", channel: 0, on: true },
+      ],
+    },
+  }, { fetchImpl: fakeFetch });
+
+  assert.equal(result.batch_id, "batch-1");
+  assert.equal(result.results.length, 2);
+  assert.equal(result.results[0].ok, true);
+  assert.equal(result.results[0].target, "MACHINE");
+  assert.equal(result.results[1].ok, false);
+  assert.match(result.results[1].error, /relay offline/);
+});
+
 test("Shelly discovery infers Gen3 from S3 relay model codes when generation is omitted", async () => {
   const inventory = await discoverShellyDevices({ candidateIps: ["192.168.1.2"] }, async (url) => {
     assert.equal(String(url), "http://192.168.1.2/shelly");
@@ -270,6 +309,31 @@ test("relay switch commands pass timer values to local Shelly APIs", async () =>
     "http://10.1.0.31/rpc/Switch.Set?id=0&on=true&toggle_after=3",
     "http://10.1.0.31/relay/0?turn=on&timer=3",
   ]);
+
+  const cappedUrls = [];
+  const cappedFetch = async (url) => {
+    cappedUrls.push(String(url));
+
+    return {
+      ok: true,
+      async json() {
+        return { output: true };
+      },
+    };
+  };
+
+  await setRelayState({
+    localIp: "10.1.0.31",
+    channel: 0,
+    on: true,
+    toggle_after: 999999999,
+    device_generation: 3,
+  }, cappedFetch);
+
+  assert.equal(
+    cappedUrls[0],
+    "http://10.1.0.31/rpc/Switch.Set?id=0&on=true&toggle_after=5"
+  );
 });
 
 test("runUpdate stages a pending verification restart after installing new artifacts", async () => {
@@ -294,19 +358,23 @@ test("runUpdate stages a pending verification restart after installing new artif
     execCalls.push({ command, args, options });
     return { stdout: "{}" };
   };
+  const agentBody = "// new agent\n";
+  const packageBody = JSON.stringify({ name: "new-edge-agent" }, null, 2);
   const fakeFetch = async (url) => {
     if (String(url).endsWith("/agent.mjs")) {
-      return makeFetchResponse("// new agent\n");
+      return makeFetchResponse(agentBody);
     }
     if (String(url).endsWith("/package.json")) {
-      return makeFetchResponse(JSON.stringify({ name: "new-edge-agent" }, null, 2));
+      return makeFetchResponse(packageBody);
     }
     throw new Error(`Unexpected URL: ${url}`);
   };
 
   const result = await runUpdate({
     artifactUrl: "https://api.example.test/edge-agent/artifacts/agent.mjs",
+    sha256: sha256Hex(agentBody),
     packageUrl: "https://api.example.test/edge-agent/artifacts/package.json",
+    packageSha256: sha256Hex(packageBody),
     targetVersion: "1.1.0",
     releaseChannel: "stable",
     restartMode: "spawn",
@@ -334,6 +402,45 @@ test("runUpdate stages a pending verification restart after installing new artif
 
   await rm(tempDir, { recursive: true, force: true });
 });
+test("runUpdate rejects artifacts without required checksums", async () => {
+  const tempDir = await mkdtemp(path.join(os.tmpdir(), "edge-agent-update-checksum-"));
+  const configPath = path.join(tempDir, "config.json");
+  const liveConfig = {
+    apiUrl: "https://api.example.test",
+    gatewayId: 42,
+    agentToken: "agent-token",
+    installDir: tempDir,
+    restartMode: "spawn",
+    installedVersion: "1.0.0",
+    targetVersion: "1.0.0",
+  };
+
+  await writeFile(configPath, JSON.stringify(liveConfig, null, 2));
+  await writeFile(path.join(tempDir, "agent.mjs"), "// old agent\n");
+
+  let fetchCalled = false;
+  await assert.rejects(
+    runUpdate({
+      artifactUrl: "https://api.example.test/edge-agent/artifacts/agent.mjs",
+      targetVersion: "1.1.0",
+    }, async () => {
+      fetchCalled = true;
+      return makeFetchResponse("// new agent\n");
+    }, {
+      configPath,
+      config: liveConfig,
+      liveConfig,
+      execFileImpl: async () => ({ stdout: "{}" }),
+    }),
+    /Agent artifact checksum is required/
+  );
+
+  assert.equal(fetchCalled, false);
+  assert.equal(await readFile(path.join(tempDir, "agent.mjs"), "utf8"), "// old agent\n");
+
+  await rm(tempDir, { recursive: true, force: true });
+});
+
 
 test("handleAgentCommand returns an uninstall follow-up envelope for gateway removal", async () => {
   const tempDir = await mkdtemp(path.join(os.tmpdir(), "edge-agent-uninstall-envelope-"));
@@ -670,6 +777,7 @@ test("startAgent reports API polling metadata, executes polled commands, and upl
     commandPollRetryDelayMs: 5,
     shellActionPollTimeoutSeconds: 0,
     shellActionPollRetryDelayMs: 5,
+    enableShellAccess: true,
   }));
 
   const heartbeats = [];
@@ -928,6 +1036,61 @@ test("startAgent reports API polling metadata, executes polled commands, and upl
   }
 });
 
+test("processPolledShellAction denies shell access when locally disabled", async () => {
+  const submissions = [];
+  const fakeFetch = async (url, options = {}) => {
+    if (/\/shell-actions\/\d+\/result$/.test(String(url))) {
+      submissions.push({ url, body: JSON.parse(options.body) });
+      return {
+        ok: true,
+        async json() {
+          return { data: { acknowledged: true } };
+        },
+      };
+    }
+
+    throw new Error(`Unexpected URL: ${url}`);
+  };
+
+  const shell = {
+    async open() {
+      throw new Error("should not run");
+    },
+    input() {
+      throw new Error("should not run");
+    },
+    resize() {
+      throw new Error("should not run");
+    },
+    close() {
+      throw new Error("should not run");
+    },
+  };
+
+  const result = await processPolledShellAction(
+    {
+      apiUrl: "https://api.example.test",
+      gatewayId: 42,
+      agentToken: "agent-token",
+      enableShellAccess: false,
+    },
+    {
+      id: 501,
+      actionType: "OPEN",
+      payload: {
+        sessionId: 44,
+      },
+    },
+    shell,
+    fakeFetch
+  );
+
+  assert.equal(result.ok, false);
+  assert.match(result.error, /Shell access is disabled/);
+  assert.equal(submissions.length, 1);
+  assert.equal(submissions[0].body.ok, false);
+});
+
 test("status helpers report config without exposing the agent token", async () => {
   const tempDir = await mkdtemp(path.join(os.tmpdir(), "edge-agent-status-"));
   const configPath = path.join(tempDir, "config.json");

services/edge-broker/server.mjs

@@ -4,6 +4,7 @@ import { fileURLToPath } from "node:url";
 import { WebSocketServer } from "ws";
 
 const DEFAULT_SHELL_OPEN_TIMEOUT_MS = 15000;
+const TELEMETRY_INGEST_ERROR_MESSAGE = "Telemetry ingestion failed";
 
 function parseJsonBody(req) {
   return new Promise((resolve, reject) => {
@@ -55,7 +56,33 @@ function resolveAuthMode(options = {}, managerUrl = "") {
   if (process.env.EDGE_AUTH_MODE) {
     return process.env.EDGE_AUTH_MODE;
   }
-  return "manager";
+  return "strict";
+}
+
+function resolveSharedSecret(options = {}) {
+  return String(options.sharedSecret ?? process.env.EDGE_BROKER_SHARED_SECRET ?? "").trim();
+}
+
+function requireSharedSecret(req, res, sharedSecret) {
+  if (sharedSecret === "") {
+    jsonResponse(res, 503, {
+      ok: false,
+      error: "Edge broker shared secret is not configured",
+      shared_secret_required: true,
+    });
+    return false;
+  }
+
+  if (req.headers["x-edge-broker-secret"] !== sharedSecret) {
+    jsonResponse(res, 403, {
+      ok: false,
+      error: "Forbidden",
+      shared_secret_required: true,
+    });
+    return false;
+  }
+
+  return true;
 }
 
 function parseScopes(value) {
@@ -150,7 +177,7 @@ function rejectUpgrade(socket, statusCode, errorCode, message, details = {}) {
 }
 
 export function createBrokerServer(options = {}) {
-  const sharedSecret = options.sharedSecret ?? process.env.EDGE_BROKER_SHARED_SECRET ?? "";
+  const sharedSecret = resolveSharedSecret(options);
   const managerUrl = resolveManagerUrl(options);
   const authMode = resolveAuthMode(options, managerUrl);
   const commandTimeoutMs = options.commandTimeoutMs ?? 10000;
@@ -269,6 +296,12 @@ export function createBrokerServer(options = {}) {
       ? async (_gatewayId, payload = {}) => payload
       : async (gatewayId, payload = {}) =>
           managerRequest(`/edge-agent/internal/gateways/${gatewayId}/logs`, payload));
+  const ingestMachineSignal =
+    options.ingestMachineSignal ||
+    (authMode === "stub"
+      ? async (_gatewayId, payload = {}) => payload
+      : async (gatewayId, payload = {}) =>
+          managerRequest(`/edge-agent/internal/gateways/${gatewayId}/selfserve/machine-signal`, payload));
 
   const broadcastGatewayEvent = (gatewayId, message) => {
     const sessionIds = gatewayStreamSessions.get(String(gatewayId));
@@ -460,25 +493,19 @@ export function createBrokerServer(options = {}) {
       }
 
       if (req.method === "POST" && url.pathname === "/api/diagnostics/shared-secret") {
-        if (sharedSecret && req.headers["x-edge-broker-secret"] !== sharedSecret) {
+        if (!requireSharedSecret(req, res, sharedSecret)) {
-          jsonResponse(res, 403, {
-            ok: false,
-            error: "Forbidden",
-            shared_secret_required: true,
-          });
           return;
         }
 
         jsonResponse(res, 200, {
           ok: true,
-          shared_secret_required: Boolean(sharedSecret),
+          shared_secret_required: true,
         });
         return;
       }
 
       if (req.method === "POST" && /^\/api\/gateways\/\d+\/commands$/.test(url.pathname)) {
-        if (sharedSecret && req.headers["x-edge-broker-secret"] !== sharedSecret) {
+        if (!requireSharedSecret(req, res, sharedSecret)) {
-          jsonResponse(res, 403, { error: "Forbidden" });
           return;
         }
 
@@ -521,8 +548,7 @@ export function createBrokerServer(options = {}) {
       }
 
       if (req.method === "POST" && /^\/api\/gateways\/\d+\/sync$/.test(url.pathname)) {
-        if (sharedSecret && req.headers["x-edge-broker-secret"] !== sharedSecret) {
+        if (!requireSharedSecret(req, res, sharedSecret)) {
-          jsonResponse(res, 403, { error: "Forbidden" });
           return;
         }
 
@@ -556,12 +582,13 @@ export function createBrokerServer(options = {}) {
           gatewayInfo = await validateAgent({ gatewayId, token, headers: req.headers });
         } catch (error) {
           const status = Number(error?.status) === 403 ? 403 : Number(error?.status) === 401 ? 401 : 503;
-          rejectUpgrade(socket, status, error?.code || "agent_validation_failed", normalizeErrorMessage(error, "Gateway agent could not be validated."), {
+          rejectUpgrade(socket, status, error?.code || "agent_validation_failed", "Gateway agent could not be validated.", {
             stage: "agent_validate",
           });
           return;
         }
 
+
         wss.handleUpgrade(req, socket, head, (ws) => {
           const existing = agents.get(gatewayId);
           if (existing && existing.readyState < 2) {
@@ -622,12 +649,13 @@ export function createBrokerServer(options = {}) {
         try {
           session = await validateShellSession({ token, headers: req.headers });
         } catch (error) {
-          rejectUpgrade(socket, Number(error?.status) === 403 ? 403 : 401, error?.code || "shell_session_invalid", normalizeErrorMessage(error, "Shell session could not be validated."), {
+          rejectUpgrade(socket, Number(error?.status) === 403 ? 403 : 401, error?.code || "shell_session_invalid", "Shell session could not be validated.", {
             stage: "shell_session_validate",
           });
           return;
         }
 
+
         wss.handleUpgrade(req, socket, head, (ws) => {
           ws.sessionToken = token;
           ws.sessionInfo = session;
@@ -722,7 +750,7 @@ export function createBrokerServer(options = {}) {
         return;
       }
     } catch (error) {
-      rejectUpgrade(socket, 500, "websocket_upgrade_failed", normalizeErrorMessage(error, "WebSocket upgrade failed."));
+      rejectUpgrade(socket, 500, "websocket_upgrade_failed", "WebSocket upgrade failed.");
       return;
     }
 
@@ -765,8 +793,8 @@ export function createBrokerServer(options = {}) {
             let ingestError = null;
             try {
               ingested = await ingestTelemetry(String(ws.gatewayId), payload);
-            } catch (error) {
+            } catch {
-              ingestError = error instanceof Error ? error.message : String(error);
+              ingestError = TELEMETRY_INGEST_ERROR_MESSAGE;
             }
             const fallbackStatistics = {
               system_metrics: payload?.metadata?.system_metrics || {},
@@ -831,6 +859,11 @@ export function createBrokerServer(options = {}) {
             return;
           }
 
+          if (message.type === "MACHINE_SIGNAL") {
+            await ingestMachineSignal(String(ws.gatewayId), message.payload || {});
+            return;
+          }
+
           if (["SHELL_OUTPUT", "SHELL_OPENED", "SHELL_EXIT"].includes(message.type)) {
             const sessionRecord = browserShellSessions.get(String(message.sessionId));
             if (!sessionRecord) {

services/edge-broker/test/broker.test.mjs

@@ -19,6 +19,18 @@ function waitForClose(socket) {
   });
 }
 
+function waitForCloseOrError(socket) {
+  return new Promise((resolve) => {
+    const onDone = () => {
+      socket.off("error", onDone);
+      socket.off("close", onDone);
+      resolve();
+    };
+    socket.once("error", onDone);
+    socket.once("close", onDone);
+  });
+}
+
 function rawUpgradeRequest(port, path) {
   return new Promise((resolve, reject) => {
     const socket = net.createConnection({ host: "127.0.0.1", port }, () => {
@@ -59,7 +71,7 @@ async function waitFor(predicate, { timeoutMs = 1000, intervalMs = 10, descripti
   throw new Error(`Timed out waiting for ${description}`);
 }
 
-test("broker defaults to manager auth and fails closed when manager URL is missing", async () => {
+test("broker defaults to strict auth and fails closed when manager URL is missing", async () => {
   const previousEnv = {
     EDGE_AUTH_MODE: process.env.EDGE_AUTH_MODE,
     EDGE_MANAGER_URL: process.env.EDGE_MANAGER_URL,
@@ -72,7 +84,7 @@ test("broker defaults to manager auth and fails closed when manager URL is missi
   let broker;
   try {
     broker = createBrokerServer({ sharedSecret: "secret" });
-    assert.equal(broker.state.authMode, "manager");
+    assert.equal(broker.state.authMode, "strict");
     assert.equal(broker.state.managerUrl, "");
 
     const address = await broker.listen(0);
@@ -83,13 +95,15 @@ test("broker defaults to manager auth and fails closed when manager URL is missi
     assert.doesNotMatch(shellResponse, /101 Switching Protocols/);
     assert.match(shellResponse, /^HTTP\/1\.1 401 Unauthorized/m);
     assert.match(shellResponse, /"error_code":"shell_session_invalid"/);
-    assert.match(shellResponse, /Edge manager URL is not configured/);
+    assert.match(shellResponse, /"message":"Shell session could not be validated\."/);
+    assert.doesNotMatch(shellResponse, /Edge manager URL is not configured/);
 
     assert.doesNotMatch(agentResponse, /101 Switching Protocols/);
     assert.match(agentResponse, /^HTTP\/1\.1 503 Service Unavailable/m);
     assert.match(agentResponse, /"error_code":"agent_validation_failed"/);
     assert.match(agentResponse, /"stage":"agent_validate"/);
-    assert.match(agentResponse, /Edge manager URL is not configured/);
+    assert.match(agentResponse, /"message":"Gateway agent could not be validated\."/);
+    assert.doesNotMatch(agentResponse, /Edge manager URL is not configured/);
   } finally {
     if (broker) {
       await broker.close();
@@ -104,6 +118,53 @@ test("broker defaults to manager auth and fails closed when manager URL is missi
   }
 });
 
+test("broker rejects protected HTTP endpoints when shared secret is missing", async () => {
+  const broker = createBrokerServer({ authMode: "stub", sharedSecret: "", commandTimeoutMs: 2000 });
+  const address = await broker.listen(0);
+  const port = address.port;
+  const agent = new WebSocket(`ws://127.0.0.1:${port}/ws/agent?gatewayId=701&token=agent-token`);
+
+  await new Promise((resolve) => agent.once("open", resolve));
+  const agentMessages = collectMessages(agent);
+
+  const commandResponse = await fetch(`http://127.0.0.1:${port}/api/gateways/701/commands`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+    },
+    body: JSON.stringify({
+      commandType: "SET_RELAY_STATE",
+      payload: { relayId: "M-7", on: true },
+    }),
+  });
+  const commandJson = await commandResponse.json();
+
+  assert.equal(commandResponse.status, 503);
+  assert.equal(commandJson.ok, false);
+  assert.equal(commandJson.shared_secret_required, true);
+  assert.match(commandJson.error, /shared secret is not configured/);
+  assert.equal(agentMessages.some((message) => message.type === "COMMAND"), false);
+
+  const diagnosticsResponse = await fetch(`http://127.0.0.1:${port}/api/diagnostics/shared-secret`, {
+    method: "POST",
+  });
+  const diagnosticsJson = await diagnosticsResponse.json();
+
+  assert.equal(diagnosticsResponse.status, 503);
+  assert.equal(diagnosticsJson.shared_secret_required, true);
+
+  const syncResponse = await fetch(`http://127.0.0.1:${port}/api/gateways/701/sync`, {
+    method: "POST",
+  });
+  const syncJson = await syncResponse.json();
+
+  assert.equal(syncResponse.status, 503);
+  assert.equal(syncJson.shared_secret_required, true);
+
+  agent.terminate();
+  await broker.close();
+});
+
 test("broker dispatches commands to connected agents", async () => {
   const broker = createBrokerServer({ authMode: "stub", sharedSecret: "secret", commandTimeoutMs: 2000 });
   const address = await broker.listen(0);
@@ -338,11 +399,34 @@ test("broker rejects invalid browser shell upgrades without leaking the token",
 
   assert.match(response, /^HTTP\/1\.1 401 Unauthorized/m);
   assert.match(response, /"error_code":"shell_session_expired"/);
+  assert.match(response, /"message":"Shell session could not be validated\."/);
+  assert.doesNotMatch(response, /Shell session expired/);
   assert.doesNotMatch(response, new RegExp(rawToken));
 
   await broker.close();
 });
 
+test("broker rejects websocket upgrade errors without exposing exception text", async () => {
+  const broker = createBrokerServer({
+    authMode: "stub",
+    validateBrowserStream: async () => {
+      throw new Error("UPSTREAM-SENSITIVE: redis://cache.internal:6379 timeout");
+    },
+  });
+  const address = await broker.listen(0);
+  const port = address.port;
+
+  const response = await rawUpgradeRequest(port, "/ws/browser-gateway-stream?token=session-token");
+
+  assert.match(response, /^HTTP\/1\.1 500 Internal Server Error/m);
+  assert.match(response, /"error_code":"websocket_upgrade_failed"/);
+  assert.match(response, /"message":"WebSocket upgrade failed\."/);
+  assert.doesNotMatch(response, /UPSTREAM-SENSITIVE/);
+  assert.doesNotMatch(response, /redis:\/\/cache\.internal/);
+
+  await broker.close();
+});
+
 test("broker closes browser shell sessions when the agent never reports shell opened", async () => {
   const closedSessions = [];
   const broker = createBrokerServer({
@@ -418,6 +502,17 @@ test("broker closes browser shell sessions when the agent disconnects before she
   await broker.close();
 });
 
+test("broker defaults to strict auth when no validators are configured", async () => {
+  const broker = createBrokerServer();
+  const address = await broker.listen(0);
+  const port = address.port;
+
+  const agent = new WebSocket(`ws://127.0.0.1:${port}/ws/agent?gatewayId=701&token=agent-token`);
+  await waitForCloseOrError(agent);
+
+  await broker.close();
+});
+
 test("broker sends an agent welcome before connection progress and backlog dispatch", async () => {
   const broker = createBrokerServer({
     authMode: "stub",
@@ -671,6 +766,51 @@ test("broker fans out telemetry, task, log, and presence updates to browser gate
   await broker.close();
 });
 
+test("broker ingests self-serve machine signals from connected agents", async () => {
+  const machineSignals = [];
+  const broker = createBrokerServer({
+    authMode: "stub",
+    validateAgent: async () => ({ id: "701", gateway_id: "701", label: "CPH Edge 01" }),
+    ingestMachineSignal: async (gatewayId, payload) => {
+      machineSignals.push({ gatewayId, payload });
+      return { recorded: true, lane_id: payload.lane_id };
+    },
+  });
+  const address = await broker.listen(0);
+  const port = address.port;
+
+  const agent = new WebSocket(`ws://127.0.0.1:${port}/ws/agent?gatewayId=701&token=agent-token`);
+  await new Promise((resolve) => agent.once("open", resolve));
+
+  agent.send(
+    JSON.stringify({
+      type: "MACHINE_SIGNAL",
+      payload: {
+        lane_id: 3,
+        relay_id: "machine-relay",
+        component: "input",
+        channel: 0,
+        event: "input.toggle_on",
+        state: true,
+      },
+    })
+  );
+
+  await waitFor(() => machineSignals.length === 1, { description: "machine signal ingestion" });
+  assert.equal(machineSignals[0].gatewayId, "701");
+  assert.deepEqual(machineSignals[0].payload, {
+    lane_id: 3,
+    relay_id: "machine-relay",
+    component: "input",
+    channel: 0,
+    event: "input.toggle_on",
+    state: true,
+  });
+
+  agent.terminate();
+  await broker.close();
+});
+
 test("broker survives telemetry ingestion failures for stale gateways", async () => {
   const broker = createBrokerServer({
     authMode: "stub",
@@ -743,9 +883,16 @@ test("broker still fans out telemetry when manager ingestion fails", async () =>
   );
 
   await waitFor(
-    () => browserMessages.some((message) => message.type === "gateway.telemetry" && message.error === "manager unavailable"),
+    () =>
+      browserMessages.some(
+        (message) => message.type === "gateway.telemetry" && message.error === "Telemetry ingestion failed"
+      ),
     { description: "telemetry fanout after ingest failure" }
   );
+  assert.ok(
+    browserMessages.every((message) => message.error !== "manager unavailable"),
+    "raw manager errors must not be sent to browser streams"
+  );
   assert.ok(
     browserMessages.some(
       (message) => message.type === "stats.updated" && message.statistics?.system_metrics?.cpu_usage_pct === 31

services/edge-broker/test/config.test.mjs

@@ -39,7 +39,7 @@ test("traefik does not expose a dedicated public edge broker port", () => {
 test("base docker compose routes edge broker traffic through traefik", () => {
   const serviceBlock = readComposeServiceBlock(baseComposeSource, "edge-broker");
   assert.doesNotMatch(serviceBlock, /\n\s+ports:\s*\n[\s\S]*?\n\s+- "4300:4300"/);
-  assert.match(serviceBlock, /EDGE_AUTH_MODE:\s*\$\{EDGE_AUTH_MODE:-manager\}/);
+  assert.match(serviceBlock, /EDGE_AUTH_MODE:\s*\$\{EDGE_AUTH_MODE:-strict\}/);
   assert.match(serviceBlock, /EDGE_MANAGER_URL:\s*\$\{EDGE_MANAGER_URL:-http:\/\/caddy\}/);
   assert.match(serviceBlock, /traefik\.http\.routers\.edge-broker-api\.priority=200/);
   assert.match(serviceBlock, /traefik\.http\.routers\.edge-broker-local\.priority=200/);
@@ -55,7 +55,7 @@ test("base docker compose routes edge broker traffic through traefik", () => {
 test("example docker compose routes edge broker traffic through traefik", () => {
   const serviceBlock = readComposeServiceBlock(exampleComposeSource, "edge-broker");
   assert.doesNotMatch(serviceBlock, /\n\s+ports:\s*\n[\s\S]*?\n\s+- "4300:4300"/);
-  assert.match(serviceBlock, /EDGE_AUTH_MODE:\s*\$\{EDGE_AUTH_MODE:-manager\}/);
+  assert.match(serviceBlock, /EDGE_AUTH_MODE:\s*\$\{EDGE_AUTH_MODE:-strict\}/);
   assert.match(serviceBlock, /EDGE_MANAGER_URL:\s*\$\{EDGE_MANAGER_URL:-http:\/\/caddy\}/);
   assert.match(serviceBlock, /traefik\.http\.routers\.edge-broker-api\.rule=Host\(`api\.example\.com`\) && PathPrefix\(`\/edge-broker`\)/);
   assert.match(serviceBlock, /traefik\.http\.routers\.edge-broker-local\.rule=Host\(`localhost`\) && PathPrefix\(`\/api\/edge-broker`\)/);
@@ -76,10 +76,10 @@ test("standalone production compose routes edge broker traffic through traefik",
   assert.match(serviceBlock, /traefik\.http\.services\.edge-broker\.loadbalancer\.server\.port=4300/);
 });
 
-test("php services receive broker websocket environment defaults", () => {
+test("compose config does not provide insecure broker secret defaults", () => {
   for (const composeSource of [baseComposeSource, exampleComposeSource]) {
     assert.match(composeSource, /EDGE_BROKER_URL:\s*\$\{EDGE_BROKER_URL:-http:\/\/edge-broker:4300\}/);
-    assert.match(composeSource, /EDGE_BROKER_SHARED_SECRET:\s*\$\{EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev\}/);
+    assert.match(composeSource, /EDGE_BROKER_SHARED_SECRET:\s*\$\{EDGE_BROKER_SHARED_SECRET:\?set EDGE_BROKER_SHARED_SECRET in \.env\}/);
   }
 });
 
@@ -88,6 +88,6 @@ test("base docker compose wires the broker into each php worker", () => {
     const serviceBlock = readComposeServiceBlock(baseComposeSource, serviceName);
     assert.match(serviceBlock, /\n\s+depends_on:\s*\n[\s\S]*?\n\s+- edge-broker/);
     assert.match(serviceBlock, /EDGE_BROKER_URL:\s*\$\{EDGE_BROKER_URL:-http:\/\/edge-broker:4300\}/);
-    assert.match(serviceBlock, /EDGE_BROKER_SHARED_SECRET:\s*\$\{EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev\}/);
+    assert.match(serviceBlock, /EDGE_BROKER_SHARED_SECRET:\s*\$\{EDGE_BROKER_SHARED_SECRET:\?set EDGE_BROKER_SHARED_SECRET in \.env\}/);
   }
 });

services/nginx/app/classes/attachments.php

@@ -133,8 +133,14 @@ class attachments implements attachments_i
     protected function fetchAttachmentRows(string $type, array $object_ids, array $options = []): array
     {
         $options = $this->normalizeAttachmentOptions($options);
+        $rawType = trim($type, '`');
+        $objectTypes = array_values(array_unique([
+            $rawType,
+            '`' . $rawType . '`',
+        ]));
+
         return (new object_attachments_o())->getFieldsWhereIn([
-            'object_type' => $type,
+            'object_type' => $objectTypes,
             'object_id' => $object_ids,
             'deleted_at' => null
         ], $options);

services/nginx/app/classes/authentication.php

@@ -6,6 +6,7 @@ use classes\totp;
 use Exception;
 use interfaces\authentication_i;
 use objects\plate_scanners_o;
+use objects\subuser_grants_o;
 use objects\tokens_o;
 use objects\users_o;
 use objects\subusers_o;
@@ -125,9 +126,13 @@ class authentication implements authentication_i
     public function validate_token(string $token): bool
     {
         // First: try validating as a classic user auth token
-        $dbToken = (new tokens_o())->getToken($token);
+        try {
-        if ($dbToken && $dbToken->id) {
+            $dbToken = (new tokens_o())->getToken($token);
-            return true;
+            if ($dbToken && $dbToken->id && $dbToken->type->value() === 'AUTH_TOKEN') {
+                return true;
+            }
+        } catch (Exception) {
+            // Ignore and continue to subuser session validation
         }
         // Fallback: try validating as a subuser session token
         $subuser = (new subusers_o())->getSubuserBySessionToken($token);
@@ -154,19 +159,17 @@ class authentication implements authentication_i
         // Strip the Bearer prefix
         $rawToken = str_replace('Bearer ', '', $rawToken);
         // Get the token from the database
-        $token = (new tokens_o())->getToken($rawToken);
+        try {
+            $token = (new tokens_o())->getToken($rawToken);
+        } catch (Exception) {
+            return false;
+        }
         // Check if the token exists
         if (!$token->id) {
             return false;
         }
-        if ($token->type->value() === "AUTH_TOKEN_SUBUSER") {
+        if ($token->type->value() !== 'AUTH_TOKEN') {
-            // Get the customer number from the headers
+            return false;
-            if (!isset($headers['X-Customer-Number'])) {
-                return false;
-            }
-            $customer_number = (int)$headers['X-Customer-Number'];
-            // Get the user by the customer number
-            return (new users_o())->getUserByCustomerNumber($customer_number);
         }
         // Get the user from the database
         $user = (new users_o())->getUserById($token->user_id->value());

services/nginx/app/classes/coolify_api_client.php

@@ -121,6 +121,16 @@ class coolify_api_client
         ]);
     }
 
+    public function listApplicationEnvs(string $uuid): array
+    {
+        return $this->request('GET', '/applications/' . rawurlencode($uuid) . '/envs');
+    }
+
+    public function deleteApplicationEnv(string $uuid, string $envUuid): array
+    {
+        return $this->request('DELETE', '/applications/' . rawurlencode($uuid) . '/envs/' . rawurlencode($envUuid));
+    }
+
     private static function bulkEnvData(array $env): array
     {
         $data = [];
@@ -159,6 +169,11 @@ class coolify_api_client
         return $this->request('GET', '/applications/' . rawurlencode($uuid) . '/restart');
     }
 
+    public function stopApplication(string $uuid): array
+    {
+        return $this->request('GET', '/applications/' . rawurlencode($uuid) . '/stop');
+    }
+
     public function deleteService(string $uuid): array
     {
         return $this->request('DELETE', '/services/' . rawurlencode($uuid));

services/nginx/app/classes/coolify_manager.php

@@ -1371,6 +1371,129 @@ class coolify_manager
         ];
     }
 
+    public function deployGithubRunners(array $input, ?int $actorUserId = null): array
+    {
+        $this->ensureSchema();
+
+        $dryRun = $this->toBool($input['dry_run'] ?? null, false);
+        $instanceId = (int)($input['instance_id'] ?? 0);
+        if ($instanceId <= 0) {
+            $instanceId = $this->defaultInstanceId();
+        }
+        $instance = $this->getInstance($instanceId);
+        $repositories = $this->githubRunnerRepositories($input);
+        $labels = $this->githubRunnerLabels($input['labels'] ?? null);
+        $countPerRepo = $this->githubRunnerCount($input['count_per_repo'] ?? $input['runner_count_per_repo'] ?? null);
+        $serviceName = $this->githubRunnerServiceName($input['service_name'] ?? null);
+        $resourceUuid = $this->nullableString($input['service_uuid'] ?? null)
+            ?? $this->nullableString($this->coolifyConfigValue('github_runner_service_uuid', ''));
+        $token = $this->githubRunnerToken($input);
+        $template = $this->githubRunnerComposeTemplate($repositories, $labels, $countPerRepo);
+        $hash = $this->composeHash($template);
+
+        $plan = [
+            'type' => 'deploy_github_runners',
+            'instance_id' => $instanceId,
+            'service_uuid' => $resourceUuid,
+            'service_name' => $serviceName,
+            'repositories' => $repositories,
+            'labels' => $labels,
+            'count_per_repo' => $countPerRepo,
+            'compose_hash' => $hash,
+            'action' => $resourceUuid === null ? 'create' : 'update',
+            'token_set' => $token !== '',
+            'token_source' => trim((string)($input['github_token'] ?? $input['token'] ?? '')) !== '' ? 'request' : 'config',
+        ];
+
+        if ($dryRun) {
+            $this->audit(null, $instanceId, null, 'github_runners_planned', $actorUserId, 'info', $plan);
+            return [
+                'ok' => true,
+                'dry_run' => true,
+                'mutated' => false,
+                'planned' => [$plan],
+                'applied' => [],
+                'errors' => [],
+                'service_uuid' => $resourceUuid,
+                'service_name' => $serviceName,
+                'compose_hash' => $hash,
+                'repositories' => $repositories,
+                'labels' => $labels,
+                'count_per_repo' => $countPerRepo,
+            ];
+        }
+
+        if ($token === '') {
+            throw new RuntimeException('GitHub runner token is required to deploy self-hosted runners.');
+        }
+
+        $client = $this->clientForInstance($instance);
+        $apiResult = [];
+        $action = $resourceUuid === null ? 'created' : 'updated';
+        if ($resourceUuid === null) {
+            $apiResult = $client->createService($this->githubRunnerServicePayload($instance, $input, $serviceName, $template, false));
+            $resourceUuid = trim((string)($apiResult['uuid'] ?? ''));
+            if ($resourceUuid === '') {
+                throw new RuntimeException('Coolify did not return a GitHub runner service UUID.');
+            }
+        } else {
+            try {
+                $apiResult = $client->updateService($resourceUuid, $this->githubRunnerServicePayload($instance, $input, $serviceName, $template, true));
+            } catch (Throwable $throwable) {
+                if (!str_contains(strtolower($throwable->getMessage()), '404')
+                    && !str_contains(strtolower($throwable->getMessage()), 'not found')) {
+                    throw $throwable;
+                }
+                $apiResult = $client->createService($this->githubRunnerServicePayload($instance, $input, $serviceName, $template, false));
+                $resourceUuid = trim((string)($apiResult['uuid'] ?? ''));
+                if ($resourceUuid === '') {
+                    throw new RuntimeException('Coolify did not return a GitHub runner service UUID.');
+                }
+                $action = 'created';
+            }
+        }
+
+        $client->updateServiceEnvsBulk($resourceUuid, ['GITHUB_RUNNER_TOKEN' => $token]);
+        $start = $this->startOrRestartService($client, $resourceUuid, $action === 'updated');
+        $deployment = $client->deployResource($resourceUuid, false);
+
+        $this->setModuleConfigValue('Coolify', 'github_runner_service_uuid', $resourceUuid, 'string');
+        $this->setModuleConfigValue('Coolify', 'github_runner_frontend_repository', $repositories['frontend'], 'string');
+        $this->setModuleConfigValue('Coolify', 'github_runner_backend_repository', $repositories['backend'], 'string');
+        $this->setModuleConfigValue('Coolify', 'github_runner_labels', implode(',', $labels), 'string');
+        $this->setModuleConfigValue('Coolify', 'github_runner_count_per_repo', (string)$countPerRepo, 'int');
+        if ($this->toBool($input['persist_token'] ?? null, false)) {
+            $this->setModuleConfigValue('Coolify', 'github_runner_token', replication_secret_box::encrypt($token), 'string');
+        }
+
+        $applied = array_replace($plan, [
+            'action' => $action,
+            'service_uuid' => $resourceUuid,
+            'coolify' => self::redactCoolifyResponse($apiResult),
+            'start' => self::redactCoolifyResponse(is_array($start) ? $start : []),
+            'deployment' => self::redactCoolifyResponse($deployment),
+        ]);
+
+        $this->audit(null, $instanceId, null, 'github_runners_deployed', $actorUserId, 'info', $applied);
+
+        return [
+            'ok' => true,
+            'dry_run' => false,
+            'mutated' => true,
+            'planned' => [$plan],
+            'applied' => [$applied],
+            'errors' => [],
+            'action' => $action,
+            'service_uuid' => $resourceUuid,
+            'service_name' => $serviceName,
+            'compose_hash' => $hash,
+            'repositories' => $repositories,
+            'labels' => $labels,
+            'count_per_repo' => $countPerRepo,
+            'deployment' => self::redactCoolifyResponse($deployment),
+        ];
+    }
+
     private function gatewayApiCodeVersionLabel(array $target): string
     {
         $channelSlug = trim((string)($target['channel_slug'] ?? 'gateway'));
@@ -1926,13 +2049,14 @@ class coolify_manager
                     ], $actorUserId);
                 }
 
-                $deployment = $releaseManager->startDeployment([
+                $sourceCommitSha = trim((string)($sourceTarget['latest_deployment_commit_sha'] ?? ''));
+                $deploymentInput = [
                     'target_id' => (int)($deploymentTarget['id'] ?? 0),
                     'channel_id' => (int)$sourceTarget['channel_id'],
                     'app' => $app,
                     'repository' => (string)($sourceTarget['repository'] ?? ''),
                     'branch' => (string)($sourceTarget['branch'] ?? 'master'),
-                    'commit_mode' => 'latest',
+                    'commit_mode' => $sourceCommitSha === '' ? 'latest' : 'specific',
                     'version_label' => $this->gatewayRouteProvisionVersionLabel($sourceTarget),
                     'deployed_url' => $sourcePublicUrl,
                     'metadata' => [
@@ -1942,7 +2066,11 @@ class coolify_manager
                         'server_uuid' => $serverUuid,
                         'app' => $app,
                     ],
-                ], $actorUserId);
+                ];
+                if ($sourceCommitSha !== '') {
+                    $deploymentInput['commit_sha'] = $sourceCommitSha;
+                }
+                $deployment = $releaseManager->startDeployment($deploymentInput, $actorUserId);
 
                 if ((string)($deployment['status'] ?? '') !== 'deployed') {
                     $errors[] = array_replace($action, [
@@ -3261,6 +3389,141 @@ class coolify_manager
         ];
     }
 
+    private function githubRunnerRepositories(array $input): array
+    {
+        return [
+            'frontend' => $this->normalizeGithubRepository(
+                $input['frontend_repository'] ?? $input['frontend_repo'] ?? $this->coolifyConfigValue('github_runner_frontend_repository', 'copenhagentruckwash/pleno-vue'),
+                'frontend'
+            ),
+            'backend' => $this->normalizeGithubRepository(
+                $input['backend_repository'] ?? $input['backend_repo'] ?? $this->coolifyConfigValue('github_runner_backend_repository', 'copenhagentruckwash/api'),
+                'backend'
+            ),
+        ];
+    }
+
+    private function normalizeGithubRepository(mixed $value, string $label): string
+    {
+        $repository = trim((string)$value);
+        $repository = preg_replace('#^https://github\.com/#i', '', $repository) ?? $repository;
+        $repository = preg_replace('#^git@github\.com:#i', '', $repository) ?? $repository;
+        $repository = preg_replace('#\.git$#i', '', $repository) ?? $repository;
+        $repository = trim($repository, " \t\n\r\0\x0B/");
+        if (!preg_match('#^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$#', $repository)) {
+            throw new RuntimeException('GitHub ' . $label . ' repository must be in owner/repo format.');
+        }
+        return $repository;
+    }
+
+    private function githubRunnerLabels(mixed $value): array
+    {
+        $raw = trim((string)($value ?? ''));
+        if ($raw === '') {
+            $raw = $this->coolifyConfigValue('github_runner_labels', 'self-hosted,Linux,X64,default');
+        }
+
+        $labels = array_values(array_unique(array_filter(array_map(
+            static fn(string $label): string => trim($label),
+            preg_split('/[,\s]+/', $raw) ?: []
+        ))));
+
+        return $labels !== [] ? $labels : ['self-hosted', 'Linux', 'X64', 'default'];
+    }
+
+    private function githubRunnerCount(mixed $value): int
+    {
+        $count = (int)($value ?? 0);
+        if ($count <= 0) {
+            $count = (int)$this->coolifyConfigValue('github_runner_count_per_repo', '1');
+        }
+        return max(1, min(10, $count));
+    }
+
+    private function githubRunnerServiceName(mixed $value): string
+    {
+        $name = strtolower(trim((string)($value ?? 'truckwash-github-runners')));
+        $name = preg_replace('/[^a-z0-9-]+/', '-', $name) ?: '';
+        $name = trim($name, '-') ?: 'truckwash-github-runners';
+        return substr($name, 0, 120);
+    }
+
+    private function githubRunnerToken(array $input): string
+    {
+        $token = trim((string)($input['github_token'] ?? $input['token'] ?? ''));
+        if ($token !== '') {
+            return $token;
+        }
+
+        $envToken = trim((string)(getenv('GITHUB_RUNNER_TOKEN') ?: getenv('GITHUB_TOKEN') ?: ''));
+        if ($envToken !== '') {
+            return $envToken;
+        }
+
+        return replication_secret_box::decrypt($this->coolifyConfigValue('github_runner_token', ''));
+    }
+
+    private function githubRunnerComposeTemplate(array $repositories, array $labels, int $countPerRepo): array
+    {
+        $lines = ['services:'];
+        foreach ($repositories as $key => $repository) {
+            for ($index = 1; $index <= $countPerRepo; $index++) {
+                $service = 'github-runner-' . $key . '-' . $index;
+                $runnerName = 'truckwash-' . $key . '-' . $index;
+                $runnerLabels = array_values(array_unique(array_merge($labels, [$key])));
+                $lines = array_merge($lines, [
+                    '  ' . $service . ':',
+                    '    image: myoung34/github-runner:latest',
+                    '    restart: unless-stopped',
+                    '    environment:',
+                    '      REPO_URL: ' . self::yamlScalar('https://github.com/' . $repository),
+                    '      RUNNER_NAME: ' . self::yamlScalar($runnerName),
+                    '      RUNNER_SCOPE: repo',
+                    '      RUNNER_WORKDIR: /tmp/runner/work',
+                    '      LABELS: ' . self::yamlScalar(implode(',', $runnerLabels)),
+                    '      EPHEMERAL: "false"',
+                    '      RUN_AS_ROOT: "true"',
+                    '      ACCESS_TOKEN: ${GITHUB_RUNNER_TOKEN}',
+                    '    volumes:',
+                    '      - /var/run/docker.sock:/var/run/docker.sock',
+                ]);
+            }
+        }
+
+        return [
+            'compose' => implode("\n", $lines) . "\n",
+            'env' => 'GITHUB_RUNNER_TOKEN=${GITHUB_RUNNER_TOKEN}',
+        ];
+    }
+
+    private function githubRunnerServicePayload(array $instance, array $input, string $serviceName, array $template, bool $update): array
+    {
+        $payload = [
+            'name' => $serviceName,
+            'description' => 'Truckwash GitHub self-hosted runners for frontend and backend workflows.',
+            'instant_deploy' => false,
+            'docker_compose_raw' => $this->encodedDockerCompose($template),
+            'force_domain_override' => false,
+        ];
+
+        if (!$update) {
+            $payload = array_replace($payload, [
+                'project_uuid' => $this->targetMapping($input, $instance, 'project_uuid'),
+                'environment_name' => $this->targetMapping($input, $instance, 'environment_name') ?: 'production',
+                'environment_uuid' => $this->targetMapping($input, $instance, 'environment_uuid'),
+                'server_uuid' => $this->targetMapping($input, $instance, 'server_uuid'),
+                'destination_uuid' => $this->targetMapping($input, $instance, 'destination_uuid'),
+            ]);
+        }
+
+        return array_filter($payload, static fn($value): bool => $value !== null && $value !== '');
+    }
+
+    private static function yamlScalar(string $value): string
+    {
+        return '"' . str_replace(['\\', '"'], ['\\\\', '\\"'], $value) . '"';
+    }
+
     private function publicLoadBalancerConfig(array $config): array
     {
         unset($config['token']);

services/nginx/app/classes/coolify_schema_bootstrap.php

@@ -154,6 +154,12 @@ class coolify_schema_bootstrap
         self::ensureModuleConfigDefault('Coolify', 'hetzner_cloud_api_token', '', 'string');
         self::ensureModuleConfigDefault('Coolify', 'public_gateway_host', 'api-v2.truckwash.io', 'string');
         self::ensureModuleConfigDefault('Coolify', 'public_gateway_probe_path', '', 'string');
+        self::ensureModuleConfigDefault('Coolify', 'github_runner_token', '', 'string');
+        self::ensureModuleConfigDefault('Coolify', 'github_runner_service_uuid', '', 'string');
+        self::ensureModuleConfigDefault('Coolify', 'github_runner_frontend_repository', 'copenhagentruckwash/pleno-vue', 'string');
+        self::ensureModuleConfigDefault('Coolify', 'github_runner_backend_repository', 'copenhagentruckwash/api', 'string');
+        self::ensureModuleConfigDefault('Coolify', 'github_runner_labels', 'self-hosted,Linux,X64,default', 'string');
+        self::ensureModuleConfigDefault('Coolify', 'github_runner_count_per_repo', '1', 'int');
 
         self::ensureDefaultGateway('node1.truckwash.io', '94.130.142.41', 10);
         self::ensureDefaultGateway('node2.truckwash.io', '65.21.214.30', 20);

services/nginx/app/classes/cors_policy.php

@@ -6,6 +6,7 @@ class cors_policy
 {
     public const ALLOWED_HEADERS = 'Content-Type, Authorization, X-Customer-Number, X-Release-Trace, X-Release-Channel, X-Frontend-Version, Cache-Control, Pragma, *';
     public const ALLOWED_METHODS = 'GET, POST, PUT, PATCH, DELETE, OPTIONS';
+    public const EXPOSED_HEADERS = 'Server-Timing';
     public const MAX_AGE_SECONDS = '86400';
 
     private const REQUIRED_ALLOWED_ORIGINS = [
@@ -25,6 +26,9 @@ class cors_policy
         'https://localhost:4433',
         'https://twdev.jeppeb.dk',
         'http://localhost:5173',
+        'http://localhost:5174',
+        'http://127.0.0.1:5173',
+        'http://127.0.0.1:5174',
     ];
 
     public static function normalizeOrigin(?string $value): string
@@ -125,7 +129,9 @@ class cors_policy
             'Access-Control-Allow-Credentials' => 'true',
             'Access-Control-Allow-Headers' => self::ALLOWED_HEADERS,
             'Access-Control-Allow-Methods' => self::ALLOWED_METHODS,
+            'Access-Control-Expose-Headers' => self::EXPOSED_HEADERS,
             'Access-Control-Max-Age' => self::MAX_AGE_SECONDS,
+            'Timing-Allow-Origin' => $origin,
             'Vary' => 'Origin',
         ];
     }

services/nginx/app/classes/economic_transfer_executor.php

@@ -240,7 +240,13 @@ class economic_transfer_executor
             'Queued transfer processed successfully for collected invoice #' . $collected_invoice_id
         );
 
-        return $collected_order_invoices->asArray();
+        $result = $collected_order_invoices->asArray();
+        $transfer_metrics = $collected_order_invoices->getLastEconomicTransferMetrics();
+        if ($transfer_metrics !== null) {
+            $result['economic_transfer_metrics'] = $transfer_metrics;
+        }
+
+        return $result;
     }
 
     /**

services/nginx/app/classes/economic_transfer_queue.php

@@ -41,7 +41,7 @@ class economic_transfer_queue
         $transfer_type = $this->validateTransferType($transfer_type);
         $payload = $this->normalizePayloadForTransferType($transfer_type, $payload, $created_by);
 
-        $active_job = $this->findActiveJobByTarget($transfer_type, $payload);
+        $active_job = $this->findActiveJobByTarget($transfer_type, $payload, $created_by);
         if ($active_job !== null) {
             $target_label = $this->buildTargetLabel($transfer_type, $payload);
             $this->logQueueEvent(
@@ -135,6 +135,89 @@ class economic_transfer_queue
         return $jobs;
     }
 
+    public function getJobByIdForUser(int $job_id, int $created_by): ?array
+    {
+        global $db;
+
+        $job_id = max(0, $job_id);
+        $created_by = max(0, $created_by);
+        if ($job_id < 1 || $created_by < 1) {
+            return null;
+        }
+
+        $stmt = $db->prepare("SELECT * FROM economic_transfer_queue_jobs WHERE id = ? AND created_by = ? LIMIT 1");
+        if (!$stmt) {
+            return null;
+        }
+
+        $stmt->bind_param('ii', $job_id, $created_by);
+        if (!$stmt->execute()) {
+            $stmt->close();
+            return null;
+        }
+
+        $result = $stmt->get_result();
+        $row = $result instanceof mysqli_result ? $result->fetch_assoc() : null;
+        $stmt->close();
+
+        if (!$row) {
+            return null;
+        }
+        return $this->normalizeJobRow($row);
+    }
+
+    public function listJobsForCreatedBy(array $statuses = [], int $limit = 50, int $offset = 0, ?string $transfer_type = null, int $created_by = 0): array
+    {
+        global $db;
+
+        $created_by = max(0, $created_by);
+        if ($created_by < 1) {
+            return [];
+        }
+
+        $limit = max(1, min(500, $limit));
+        $offset = max(0, $offset);
+
+        $where = $this->buildListJobsWhereClause($statuses, $transfer_type);
+        $where .= $where === '' ? 'WHERE created_by = ' . $created_by : ' AND created_by = ' . $created_by;
+        $sql = "SELECT * FROM economic_transfer_queue_jobs $where ORDER BY id DESC LIMIT $limit OFFSET $offset";
+        $result = $db->query($sql);
+        if (!$result instanceof mysqli_result) {
+            return [];
+        }
+
+        $jobs = [];
+        while ($row = $result->fetch_assoc()) {
+            $jobs[] = $this->normalizeJobRow($row);
+        }
+        return $jobs;
+    }
+
+    public function countJobsForCreatedBy(array $statuses = [], ?string $transfer_type = null, int $created_by = 0): int
+    {
+        global $db;
+
+        $created_by = max(0, $created_by);
+        if ($created_by < 1) {
+            return 0;
+        }
+
+        $where = $this->buildListJobsWhereClause($statuses, $transfer_type);
+        $where .= $where === '' ? 'WHERE created_by = ' . $created_by : ' AND created_by = ' . $created_by;
+        $sql = "SELECT COUNT(*) AS total FROM economic_transfer_queue_jobs $where";
+        $result = $db->query($sql);
+        if (!$result instanceof mysqli_result) {
+            return 0;
+        }
+
+        $row = $result->fetch_assoc();
+        if (!is_array($row) || !isset($row['total'])) {
+            return 0;
+        }
+
+        return max(0, (int)$row['total']);
+    }
+
     public function countJobs(array $statuses = [], ?string $transfer_type = null): int
     {
         global $db;
@@ -179,7 +262,7 @@ class economic_transfer_queue
                   ON d.queue_job_id = q.id
                  AND d.user_id = $user_id
                  AND d.dismissed_status = q.status
-                WHERE 1 = 1
+                WHERE q.created_by = $user_id
                   $transfer_condition
                   AND (
                     q.status IN ('" . self::STATUS_QUEUED . "', '" . self::STATUS_PROCESSING . "')
@@ -214,7 +297,7 @@ class economic_transfer_queue
             throw new Exception('Queue job and user are required');
         }
 
-        $job = $this->getJobById($job_id);
+        $job = $this->getJobByIdForUser($job_id, $user_id);
         if ($job === null) {
             throw new Exception('Queue job not found');
         }
@@ -272,7 +355,8 @@ class economic_transfer_queue
                   ON d.queue_job_id = q.id
                  AND d.user_id = $user_id
                  AND d.dismissed_status = q.status
-                WHERE q.status IN ('" . self::STATUS_COMPLETED . "', '" . self::STATUS_FAILED . "')
+                WHERE q.created_by = $user_id
+                  AND q.status IN ('" . self::STATUS_COMPLETED . "', '" . self::STATUS_FAILED . "')
                   $transfer_condition
                   AND d.queue_job_id IS NULL
                 ON DUPLICATE KEY UPDATE dismissed_status = VALUES(dismissed_status), dismissed_at = NOW()";
@@ -284,10 +368,24 @@ class economic_transfer_queue
      * @throws Exception
      */
     public function retryJob(int $job_id): array
+    {
+        return $this->retryJobInternal($job_id);
+    }
+
+    public function retryJobForUser(int $job_id, int $created_by): array
+    {
+        return $this->retryJobInternal($job_id, $created_by);
+    }
+
+    private function retryJobInternal(int $job_id, ?int $created_by = null): array
     {
         global $db;
 
-        $existing_job = $this->getJobById($job_id);
+        $job_id = max(0, $job_id);
+        $created_by = $created_by === null ? null : max(0, $created_by);
+        $existing_job = $created_by === null
+            ? $this->getJobById($job_id)
+            : $this->getJobByIdForUser($job_id, $created_by);
         if ($existing_job === null) {
             throw new Exception('Queue job not found');
         }
@@ -298,19 +396,26 @@ class economic_transfer_queue
             throw new Exception('Queue job reached max retry attempts');
         }
 
-        $stmt = $db->prepare(
+        $sql = "UPDATE economic_transfer_queue_jobs
-            "UPDATE economic_transfer_queue_jobs
              SET status = ?, progress_percent = 0, progress_message = 'Queued for retry',
                  error_message = NULL, result_json = NULL, started_at = NULL, completed_at = NULL, locked_at = NULL
-             WHERE id = ? AND status = ?"
+             WHERE id = ? AND status = ?";
-        );
+        if ($created_by !== null) {
+            $sql .= " AND created_by = ?";
+        }
+
+        $stmt = $db->prepare($sql);
         if (!$stmt) {
             throw new Exception('Failed to prepare retry statement');
         }
 
         $queued = self::STATUS_QUEUED;
         $failed = self::STATUS_FAILED;
-        $stmt->bind_param('sis', $queued, $job_id, $failed);
+        if ($created_by !== null) {
+            $stmt->bind_param('sisi', $queued, $job_id, $failed, $created_by);
+        } else {
+            $stmt->bind_param('sis', $queued, $job_id, $failed);
+        }
         $stmt->execute();
         $affected = $stmt->affected_rows;
         $stmt->close();
@@ -321,7 +426,9 @@ class economic_transfer_queue
 
         $this->clearDismissalsForJob($job_id);
 
-        $job = $this->getJobById($job_id);
+        $job = $created_by === null
+            ? $this->getJobById($job_id)
+            : $this->getJobByIdForUser($job_id, $created_by);
         if ($job === null) {
             throw new Exception('Retry updated job could not be loaded');
         }
@@ -710,28 +817,31 @@ class economic_transfer_queue
         return $this->rejectPayload($created_by, $field_name . ' must be a boolean');
     }
 
-    private function findActiveJobByTarget(string $transfer_type, array $payload): ?array
+    private function findActiveJobByTarget(string $transfer_type, array $payload, int $created_by): ?array
     {
         return match ($transfer_type) {
             self::TYPE_ORDER_DRAFT_EXPORT, self::TYPE_ORDER_INVOICE_EXPORT => $this->findActiveJobByJsonNumericTarget(
                 $transfer_type,
                 '$.order_id',
-                (int)($payload['order_id'] ?? 0)
+                (int)($payload['order_id'] ?? 0),
+                $created_by
             ),
             self::TYPE_COLLECTED_INVOICE_EXPORT => $this->findActiveJobByJsonNumericTarget(
                 $transfer_type,
                 '$.collected_invoice_id',
-                (int)($payload['collected_invoice_id'] ?? 0)
+                (int)($payload['collected_invoice_id'] ?? 0),
+                $created_by
             ),
             default => null,
         };
     }
 
-    private function findActiveJobByJsonNumericTarget(string $transfer_type, string $json_path, int $target_value): ?array
+    private function findActiveJobByJsonNumericTarget(string $transfer_type, string $json_path, int $target_value, int $created_by): ?array
     {
         global $db;
 
-        if ($target_value < 1) {
+        $created_by = max(0, $created_by);
+        if ($target_value < 1 || $created_by < 1) {
             return null;
         }
 
@@ -741,6 +851,7 @@ class economic_transfer_queue
              WHERE transfer_type = ?
                AND status IN (?, ?)
                AND CAST(JSON_UNQUOTE(JSON_EXTRACT(payload_json, '$json_path')) AS UNSIGNED) = ?
+               AND created_by = ?
              ORDER BY id DESC
              LIMIT 1"
         );
@@ -750,7 +861,7 @@ class economic_transfer_queue
 
         $queued = self::STATUS_QUEUED;
         $processing = self::STATUS_PROCESSING;
-        $stmt->bind_param('sssi', $transfer_type, $queued, $processing, $target_value);
+        $stmt->bind_param('sssii', $transfer_type, $queued, $processing, $target_value, $created_by);
         if (!$stmt->execute()) {
             $stmt->close();
             return null;

services/nginx/app/classes/edge_broker_client.php

@@ -0,0 +1,150 @@
+<?php
+
+namespace classes;
+
+use Exception;
+
+class edge_broker_transport_exception extends Exception
+{
+    public function __construct(string $message, private readonly int $curlErrno = 0, int $code = 0, ?Exception $previous = null)
+    {
+        parent::__construct($message, $code, $previous);
+    }
+
+    public function curlErrno(): int
+    {
+        return $this->curlErrno;
+    }
+}
+
+class edge_broker_http_exception extends Exception
+{
+    public function __construct(string $message, private readonly int $statusCode, int $code = 0, ?Exception $previous = null)
+    {
+        parent::__construct($message, $code, $previous);
+    }
+
+    public function statusCode(): int
+    {
+        return $this->statusCode;
+    }
+}
+
+class edge_broker_client
+{
+    private const DEFAULT_BROKER_URL = 'http://edge-broker:4300';
+
+    public function __construct(
+        private readonly ?string $baseUrl = null,
+        private readonly ?string $sharedSecret = null,
+        private readonly int $timeoutSeconds = 10
+    ) {
+    }
+
+    public function isConfigured(): bool
+    {
+        return trim((string)$this->resolveBaseUrl()) !== '';
+    }
+
+    public function dispatchCommand(int $gatewayId, string $commandType, array $payload): array
+    {
+        $url = rtrim($this->resolveBaseUrl(), '/') . '/api/gateways/' . $gatewayId . '/commands';
+        $response = $this->request('POST', $url, [
+            'commandType' => $commandType,
+            'payload' => $payload,
+        ]);
+
+        return is_array($response) ? $response : ['ok' => false, 'response' => $response];
+    }
+
+    public function validateAgent(int $gatewayId, string $agentToken): array
+    {
+        $url = rtrim($this->resolveBaseUrl(), '/') . '/api/internal/agent/auth';
+        $response = $this->request('POST', $url, [
+            'gatewayId' => $gatewayId,
+            'agentToken' => $agentToken,
+        ]);
+
+        return is_array($response) ? $response : [];
+    }
+
+    public function validateShellSession(string $sessionToken): array
+    {
+        $url = rtrim($this->resolveBaseUrl(), '/') . '/api/internal/shell/auth';
+        $response = $this->request('POST', $url, [
+            'sessionToken' => $sessionToken,
+        ]);
+
+        return is_array($response) ? $response : [];
+    }
+
+    public function closeShellSession(int $sessionId, string $sessionToken, string $transcript, string $closedReason): array
+    {
+        $url = rtrim($this->resolveBaseUrl(), '/') . '/api/internal/shell-sessions/' . $sessionId . '/close';
+        $response = $this->request('POST', $url, [
+            'sessionToken' => $sessionToken,
+            'transcript' => $transcript,
+            'closedReason' => $closedReason,
+        ]);
+
+        return is_array($response) ? $response : [];
+    }
+
+    private function resolveBaseUrl(): string
+    {
+        return trim((string)($this->baseUrl ?? getenv('EDGE_BROKER_URL') ?: self::DEFAULT_BROKER_URL));
+    }
+
+    private function resolveSharedSecret(): string
+    {
+        return trim((string)($this->sharedSecret
+            ?? getenv('EDGE_BROKER_SHARED_SECRET')
+            ?: getenv('EDGE_INTERNAL_SECRET')
+            ?: ''));
+    }
+
+    /**
+     * @throws Exception
+     */
+    private function request(string $method, string $url, array $payload): array|object|null
+    {
+        if (trim($url) === '') {
+            throw new Exception('Edge broker URL is not configured');
+        }
+
+        $sharedSecret = $this->resolveSharedSecret();
+        if ($sharedSecret === '') {
+            throw new Exception('Edge broker shared secret is not configured');
+        }
+
+        $ch = curl_init($url);
+        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $method);
+        curl_setopt($ch, CURLOPT_TIMEOUT, $this->timeoutSeconds);
+        curl_setopt($ch, CURLOPT_HTTPHEADER, [
+            'Content-Type: application/json',
+            'X-Edge-Broker-Secret: ' . $sharedSecret,
+        ]);
+        curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload, JSON_UNESCAPED_UNICODE));
+
+        $rawResponse = curl_exec($ch);
+        $statusCode = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
+        $curlErrno = curl_errno($ch);
+        $curlError = curl_error($ch);
+        curl_close($ch);
+
+        if ($rawResponse === false) {
+            throw new edge_broker_transport_exception('Edge broker request failed: ' . $curlError, $curlErrno);
+        }
+
+        $decoded = json_decode((string)$rawResponse, true);
+        if ($statusCode >= 400) {
+            $message = is_array($decoded)
+                ? (string)($decoded['error'] ?? $decoded['message'] ?? 'Edge broker request failed')
+                : 'Edge broker request failed';
+            throw new edge_broker_http_exception($message, $statusCode);
+        }
+
+        return $decoded;
+    }
+}

services/nginx/app/classes/email.php

@@ -128,13 +128,13 @@ use Psr\Http\Client\ClientExceptionInterface;
     private function sendEmailMailerSend(string $to, string $recipient_name, string $subject, string $message, string $html = null, string $references = null, array $attachments = []): void
     {
         if (self::isFakeDeliveryEnabled()) {
-            self::$fake_deliveries[] = [
+            self::recordFakeDelivery([
                 'to' => $to,
                 'recipient_name' => $recipient_name,
                 'subject' => $subject,
                 'message' => $message,
                 'html' => $html,
-            ];
+            ]);
             return;
         }
 
@@ -225,6 +225,72 @@ use Psr\Http\Client\ClientExceptionInterface;
     public static function resetFakeDeliveries(): void
     {
         self::$fake_deliveries = [];
+        $path = self::getFakeDeliveriesPath();
+        if ($path !== null && is_file($path)) {
+            unlink($path);
+        }
+    }
+
+    public static function syncFakeDeliveries(): void
+    {
+        $path = self::getFakeDeliveriesPath();
+        if ($path === null || !is_file($path)) {
+            self::$fake_deliveries = [];
+            return;
+        }
+
+        $lines = file($path, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
+        if ($lines === false) {
+            self::$fake_deliveries = [];
+            return;
+        }
+
+        $deliveries = [];
+        foreach ($lines as $line) {
+            $delivery = json_decode($line, true);
+            if (is_array($delivery)) {
+                $deliveries[] = $delivery;
+            }
+        }
+
+        self::$fake_deliveries = $deliveries;
+    }
+
+    private static function recordFakeDelivery(array $delivery): void
+    {
+        self::$fake_deliveries[] = $delivery;
+
+        $path = self::getFakeDeliveriesPath();
+        if ($path === null) {
+            return;
+        }
+
+        $directory = dirname($path);
+        if (!is_dir($directory)) {
+            mkdir($directory, 0777, true);
+        }
+
+        file_put_contents($path, json_encode($delivery, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . PHP_EOL, FILE_APPEND | LOCK_EX);
+    }
+
+    private static function getFakeDeliveriesPath(): ?string
+    {
+        if (!self::isFakeDeliveryEnabled()) {
+            return null;
+        }
+
+        $configuredPath = trim((string)(getenv('EMAIL_FAKE_DELIVERIES_PATH') ?: ''));
+        if ($configuredPath !== '') {
+            return $configuredPath;
+        }
+
+        if (getenv('RUN_API_TESTS') !== '1') {
+            return null;
+        }
+
+        return rtrim(sys_get_temp_dir(), DIRECTORY_SEPARATOR)
+            . DIRECTORY_SEPARATOR
+            . 'truckwash-email-fake-deliveries-' . md5((string)getcwd()) . '.jsonl';
     }
 
     private static function isFakeDeliveryEnabled(): bool
@@ -511,4 +577,47 @@ use Psr\Http\Client\ClientExceptionInterface;
             $this->attachments
         );
     }
+
+    /**
+     * @throws Exception
+     */
+    public function sendNewCustomerRegistrationNotifications(int $customer_number): void
+    {
+        $customer = (new users_o())->getUserByCustomerNumber($customer_number);
+        if (!$customer->exists()) {
+            throw new Exception('Customer not found with customer number: ' . $customer_number);
+        }
+
+        $customerName = $customer->getCustomerName((int)$customer->customer_number->value()) ?: 'Unknown customer';
+        $safeCustomerName = htmlspecialchars($customerName, ENT_QUOTES, 'UTF-8');
+        $safeCustomerNumber = (int)$customer->customer_number->value();
+        $customerUrl = 'https://truckwash.io/superuser/users?search=' . $safeCustomerNumber;
+        $message = "
+            <p>A new customer has registered on truckwash.io.</p>
+            <p>
+                <strong>Customer number:</strong> $safeCustomerNumber<br>
+                <strong>Customer name:</strong> $safeCustomerName
+            </p>
+            <p><a href='$customerUrl'>Open customer in Superuser</a></p>
+        ";
+
+        foreach ((new users_o())->getSuperuserNewCustomerEmailNotificationRecipients() as $recipient) {
+            $recipientEmail = trim((string)($recipient['email'] ?? ''));
+            if ($recipientEmail === '') {
+                continue;
+            }
+
+            $recipientName = trim((string)($recipient['display_name'] ?? ''));
+            if ($recipientName === '') {
+                $recipientName = $recipientEmail;
+            }
+
+            $this->sendEmail(
+                $recipientEmail,
+                $recipientName,
+                'New customer registered on Truck Wash',
+                $message,
+            );
+        }
+    }
 }

services/nginx/app/classes/gateway_shelly_transport.php

@@ -38,6 +38,8 @@ class gateway_shelly_transport implements shelly_transport_i
         return match ($endpoint) {
             '/v2/devices/api/get' => $this->handleGetStates($department_id, $data),
             '/v2/devices/api/set/switch' => $this->handleSetSwitch($department_id, $data),
+            '/v2/devices/api/batch/get' => $this->handleBatchGetStates($department_id, $data),
+            '/v2/devices/api/batch/set/switch' => $this->handleBatchSetSwitch($department_id, $data),
             default => throw new Exception('Unsupported gateway Shelly transport endpoint: ' . $endpoint),
         };
     }
@@ -95,6 +97,52 @@ class gateway_shelly_transport implements shelly_transport_i
         return [$this->normalizeRelayPayload($logicalRelayId, $status)];
     }
 
+    /**
+     * @throws Exception
+     */
+    private function handleBatchGetStates(int $departmentId, array $data): array
+    {
+        $requests = [];
+        foreach ((array)($data['commands'] ?? $data['targets'] ?? []) as $entry) {
+            $command = is_array($entry) ? $entry : ['relay_id' => $entry];
+            $relayId = trim((string)($command['relay_id'] ?? $command['relayId'] ?? $command['id'] ?? ''));
+            if ($relayId === '') {
+                continue;
+            }
+            $requests[] = [
+                'target' => strtoupper(trim((string)($command['target'] ?? $relayId))),
+                'relay_id' => $relayId,
+            ];
+        }
+
+        return $this->manager()->queueRelayStatusBatch($departmentId, $requests, null, $this->localOnly);
+    }
+
+    /**
+     * @throws Exception
+     */
+    private function handleBatchSetSwitch(int $departmentId, array $data): array
+    {
+        $requests = [];
+        foreach ((array)($data['commands'] ?? []) as $entry) {
+            if (!is_array($entry)) {
+                continue;
+            }
+            $relayId = trim((string)($entry['relay_id'] ?? $entry['relayId'] ?? $entry['id'] ?? ''));
+            if ($relayId === '') {
+                continue;
+            }
+            $requests[] = [
+                'target' => strtoupper(trim((string)($entry['target'] ?? $relayId))),
+                'relay_id' => $relayId,
+                'on' => (bool)($entry['on'] ?? false),
+                'toggle_after' => $entry['toggle_after'] ?? $entry['toggleAfter'] ?? $entry['timer'] ?? null,
+            ];
+        }
+
+        return $this->manager()->queueRelaySwitchBatch($departmentId, $requests, null, $this->localOnly);
+    }
+
     /**
      * @param array<string,mixed> $status
      * @return array<string,mixed>

services/nginx/app/classes/invoice_period_flag_service.php

@@ -320,6 +320,16 @@ class invoice_period_flag_service
     }
 
     public function warmManualFlagsCache(): void
+    {
+        $flags = $this->fetchActiveManualFlagsFromDb();
+
+        try {
+            (new redis())->cache_invoice_period_manual_flags($flags);
+        } catch (Throwable) {
+        }
+    }
+
+    private function fetchActiveManualFlagsFromDb(): array
     {
         global $db;
 
@@ -337,10 +347,7 @@ class invoice_period_flag_service
             }
         }
 
-        try {
+        return $flags;
-            (new redis())->cache_invoice_period_manual_flags($flags);
-        } catch (Throwable) {
-        }
     }
 
     private function formatStoredFlag(array $row): array
@@ -388,15 +395,11 @@ class invoice_period_flag_service
         }
 
         if (!is_array($flags)) {
-            // Cache miss — warm on demand and re-fetch
+            // Cache miss — read from the database and refresh Redis without hiding active flags.
-            $this->warmManualFlagsCache();
+            $flags = $this->fetchActiveManualFlagsFromDb();
             try {
-                $flags = (new redis())->get_invoice_period_manual_flags();
+                (new redis())->cache_invoice_period_manual_flags($flags);
             } catch (Throwable) {
-                return [];
-            }
-            if (!is_array($flags)) {
-                return [];
             }
         }
 
@@ -525,16 +528,12 @@ class invoice_period_flag_service
         try {
             $flags = (new redis())->get_invoice_period_automatic_flags($dateFrom, $dateTo);
         } catch (Throwable) {
-            return [];
+            $flags = null;
         }
 
         if (!is_array($flags)) {
-            // Cache miss — enqueue for warming on the next cron run
+            $flags = $this->calculateAutomaticFlagsForPeriod($dateFrom, $dateTo);
-            try {
+            $this->cacheAutomaticFlagsForPeriod($dateFrom, $dateTo, $flags);
-                (new redis())->enqueue_invoice_period_warming($dateFrom, $dateTo);
-            } catch (Throwable) {
-            }
-            return [];
         }
 
         if ($onlyCustomerNumbers === null) {
@@ -549,17 +548,31 @@ class invoice_period_flag_service
 
     public function warmAutomaticFlagsForPeriod(string $dateFrom, string $dateTo): void
     {
+        [$dateFrom, $dateTo] = $this->normalizePeriodDateRange($dateFrom, $dateTo);
+        $this->cacheAutomaticFlagsForPeriod(
+            $dateFrom,
+            $dateTo,
+            $this->calculateAutomaticFlagsForPeriod($dateFrom, $dateTo)
+        );
+    }
+
+    private function calculateAutomaticFlagsForPeriod(string $dateFrom, string $dateTo): array
+    {
+        [$dateFrom, $dateTo] = $this->normalizePeriodDateRange($dateFrom, $dateTo);
         $rows = $this->getPeriodOrderItemRows($dateFrom, $dateTo, null);
         $attributes = $this->getCustomerAttributes(null);
 
-        $flags = array_merge(
+        return array_merge(
             $this->detectCustomerRuleViolations($rows, $attributes),
             $this->detectPriceMismatches($rows),
             $this->detectAbnormalQuantities($rows, $dateFrom, $dateTo),
             $this->detectVehicleTypeMismatches($rows, $dateFrom),
             $this->detectMissingXlVaskLinks($dateFrom, $dateTo, null)
         );
+    }
 
+    private function cacheAutomaticFlagsForPeriod(string $dateFrom, string $dateTo, array $flags): void
+    {
         try {
             (new redis())->cache_invoice_period_automatic_flags($dateFrom, $dateTo, $flags);
         } catch (Throwable) {
@@ -603,14 +616,19 @@ class invoice_period_flag_service
 
     private function getPeriodOrderItemRows(string $dateFrom, string $dateTo, ?array $onlyCustomerNumbers): array
     {
+        [$dateFrom, $dateTo] = $this->normalizePeriodDateRange($dateFrom, $dateTo);
         try {
             $rows = (new redis())->get_invoice_period_order_item_rows($dateFrom, $dateTo);
         } catch (Throwable) {
-            return [];
+            $rows = null;
         }
 
         if (!is_array($rows)) {
-            return [];
+            $rows = $this->fetchOrderItemRowsFromDb($dateFrom, $dateTo);
+            try {
+                (new redis())->cache_invoice_period_order_item_rows($dateFrom, $dateTo, $rows);
+            } catch (Throwable) {
+            }
         }
 
         $this->seedOrderItemsPreviewCacheFromRows($rows);
@@ -627,6 +645,7 @@ class invoice_period_flag_service
 
     public function warmOrderItemRowsForPeriod(string $dateFrom, string $dateTo): void
     {
+        [$dateFrom, $dateTo] = $this->normalizePeriodDateRange($dateFrom, $dateTo);
         $rows = $this->fetchOrderItemRowsFromDb($dateFrom, $dateTo);
         try {
             (new redis())->cache_invoice_period_order_item_rows($dateFrom, $dateTo, $rows);
@@ -634,6 +653,24 @@ class invoice_period_flag_service
         }
     }
 
+    private function normalizePeriodDateRange(string $dateFrom, string $dateTo): array
+    {
+        return [
+            $this->normalizePeriodDate($dateFrom, true),
+            $this->normalizePeriodDate($dateTo, false),
+        ];
+    }
+
+    private function normalizePeriodDate(string $date, bool $startOfDay): string
+    {
+        $timestamp = strtotime($date);
+        if ($timestamp === false) {
+            return $date;
+        }
+
+        return date($startOfDay ? 'Y-m-d 00:00:00' : 'Y-m-d 23:59:59', $timestamp);
+    }
+
     private function fetchOrderItemRowsFromDb(string $dateFrom, string $dateTo): array
     {
         global $db;
@@ -1727,18 +1764,7 @@ class invoice_period_flag_service
         if ($currentVehicleType === '' || $expectedVehicleType === '') {
             return false;
         }
-        if ($currentVehicleType === $expectedVehicleType) {
+        return $currentVehicleType === $expectedVehicleType;
-            return true;
-        }
-        // Allow a match if one normalized name's tokens are a subset of the other.
-        // E.g. "Indvendig vask Kassevogn" → "kassevogn" is a subset of
-        // "Kassevogn/varevogn" → "kassevogn varevogn", meaning the same vehicle type.
-        $currentTokens = explode(' ', $currentVehicleType);
-        $expectedTokens = explode(' ', $expectedVehicleType);
-        if (count($currentTokens) <= count($expectedTokens)) {
-            return array_diff($currentTokens, $expectedTokens) === [];
-        }
-        return array_diff($expectedTokens, $currentTokens) === [];
     }
 
     private function normalizePrimaryVehicleProductName(string $productName): string

services/nginx/app/classes/licenseplaterecognizer.php

@@ -10,6 +10,22 @@ use licenseplaterecognizer\licenseplaterecognizer_c;
 
 class licenseplaterecognizer implements licenseplaterecognizer_i
 {
+    private const DEFAULT_API_URL = 'https://vs4sws0kg4sog4ssw8kwowk4.coolify.truckwash.dk';
+    private const PLATE_READER_CONFIG_JSON = '{"mode":"fast","plates_per_vehicle":1,"zoom_in_vehicles":0}';
+    private const RESULT_CACHE_CONTEXT = '{"config":{"mode":"fast","plates_per_vehicle":1,"zoom_in_vehicles":0},"regions":"dk,de,se,no"}';
+    private const PLATE_READER_REGIONS = 'dk,de,se,no';
+    private const DEFAULT_UPLOAD_FILE_NAME = 'license-plate.jpg';
+    private const RUNTIME_CONFIG_CACHE_TTL_SECONDS = 15;
+    private const RUNTIME_CONFIG_REDIS_CACHE_KEY = 'licenseplaterecognizer:runtime_config:v1';
+    private const RESULT_CACHE_TTL_SECONDS = 10;
+    private const RESULT_CACHE_REDIS_KEY_PREFIX = 'licenseplaterecognizer:result:v1:';
+    private const PLATE_READER_CONNECT_TIMEOUT_MS = 1000;
+    private const PLATE_READER_TOTAL_TIMEOUT_MS = 4500;
+    /**
+     * @var array<string, float>
+     */
+    private array $last_timings = [];
+
     /**
      * The configuration of the module
      * @var licenseplaterecognizer_c
@@ -19,12 +35,25 @@ class licenseplaterecognizer implements licenseplaterecognizer_i
      * API URL
      * @var string
      */
-    private string $api_url = 'https://vs4sws0kg4sog4ssw8kwowk4.coolify.truckwash.dk'; // Default (cloud): 'https://api.platerecognizer.com'; (without /v1/plate-reader/)';
+    private string $api_url;
 
+    /**
+     * @var array{enabled: bool, api_key: string}|null
+     */
+    private ?array $runtime_config = null;
 
-    public function __construct()
+    /**
+     * @var array{values: array{enabled: bool, api_key: string}, cached_at: float}|null
+     */
+    private static ?array $runtime_config_cache = null;
+
+    public function __construct(bool $load_config = true, ?string $api_url = null)
     {
-        $this->config = new licenseplaterecognizer_c();
+        $this->api_url = self::normalizeApiUrl($api_url ?? self::configuredApiUrl());
+
+        if ($load_config) {
+            $this->config = new licenseplaterecognizer_c();
+        }
     }
 
 
@@ -33,7 +62,7 @@ class licenseplaterecognizer implements licenseplaterecognizer_i
      */
     public function requireModuleEnabled(): void
     {
-        if (!(bool)$this->config->enabled->getVariableValue()) {
+        if (!$this->runtimeConfig()['enabled']) {
             throw new Exception('licenseplaterecognizer module is not enabled.');
         }
     }
@@ -45,54 +74,516 @@ class licenseplaterecognizer implements licenseplaterecognizer_i
      */
     public function licenseplaterecognizer(string $base64_image): array
     {
-        $image_processor = new image_processor();
+        return $this->recognizePlate(
-
+            fn () => $this->buildPlateReaderPayload($base64_image),
-        //ADD PARAMETER IN REQUEST LIKE regions
+            fn () => $this->buildResultCacheKeyFromUploadString($base64_image)
-        $data = array(
-            'upload' => $base64_image,
-            //'regions' => 'dk' // Optional
         );
+    }
 
-        // Prepare new cURL resource
+    public function licenseplaterecognizerUpload(string $image_data, string $mime_type = 'image/jpeg'): array
-        //$ch = curl_init('https://api.platerecognizer.com/v1/plate-reader/');
+    {
-        $ch = curl_init($this->api_url . '/v1/plate-reader/');
+        return $this->recognizePlate(
-        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+            fn () => $this->buildPlateReaderPayloadFromUpload(
-        curl_setopt($ch, CURLINFO_HEADER_OUT, true);
+                $this->buildUploadValueFromBytes($image_data, $mime_type)
-        curl_setopt($ch, CURLOPT_POST, true);
+            ),
-        curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
+            fn () => $this->buildResultCacheKeyFromBytes($image_data)
-        curl_setopt($ch, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2TLS);
+        );
+    }
 
-        // Set HTTP Header for POST request
+    public function licenseplaterecognizerUploadUncached(string $image_data, string $mime_type = 'image/jpeg'): array
-        curl_setopt($ch, CURLOPT_HTTPHEADER, array(
+    {
-                "Authorization: Token " . $this->config->api_key->getVariableValue()
+        return $this->recognizePlate(
+            fn () => $this->buildPlateReaderPayloadFromUpload(
+                $this->buildUploadValueFromBytes($image_data, $mime_type)
             )
         );
+    }
 
-        // Submit the POST request and close cURL session handle
+    public function licenseplaterecognizerUploadFile(string $image_path, string $mime_type = 'image/jpeg'): array
-        $result = curl_exec($ch);
+    {
-        curl_close($ch);
+        return $this->recognizePlate(
-        // Print the response from the server
+            fn () => $this->buildPlateReaderPayloadFromUpload(
-        if ($result === false) {
+                $this->buildUploadValueFromFile($image_path, $mime_type)
-            throw new Exception('Error in API request.');
+            )
-        }
+        );
+    }
 
-        $response_data = json_decode($result, true);
+    /**
-        if (isset($response_data['results']) && count($response_data['results']) > 0) {
+     * @throws Exception
-            return [
+     */
-                'success' => true,
+    private function recognizePlate(callable $payload_factory, ?callable $result_cache_key_factory = null): array
-                'license_plate_number' => $response_data['results'][0]['plate'] ?? null,
+    {
-                'confidence' => $response_data['results'][0]['score'] ?? null,
+        $started_at = microtime(true);
-                'raw_response' => $response_data,
+        $this->last_timings = [];
+        $result_cache = null;
+        $result_cache_key = null;
+
+        try {
+            $config_started_at = microtime(true);
+            $runtime_config = $this->runtimeConfig();
+            if (!$runtime_config['enabled']) {
+                throw new Exception('licenseplaterecognizer module is not enabled.');
+            }
+            $api_key = $runtime_config['api_key'];
+            $this->last_timings['config'] = $this->elapsedMs($config_started_at);
+
+            if ($result_cache_key_factory !== null) {
+                $cache_started_at = microtime(true);
+                try {
+                    $result_cache = $this->resultCacheStore();
+                    if ($result_cache !== null) {
+                        $result_cache_key = $result_cache_key_factory();
+                        if ($result_cache_key !== null) {
+                            $cached_result = $this->readRecognitionResultCache($result_cache, $result_cache_key);
+                            if ($cached_result !== null) {
+                                $this->last_timings['cache_hit'] = 1;
+                                return $cached_result;
+                            }
+                        }
+                    }
+                    $this->last_timings['cache_miss'] = 1;
+                } finally {
+                    $this->last_timings['cache'] = $this->elapsedMs($cache_started_at);
+                }
+            }
+
+            $payload_started_at = microtime(true);
+            $data = $payload_factory();
+            $this->last_timings['payload'] = $this->elapsedMs($payload_started_at);
+
+            $ch = curl_init($this->api_url . '/v1/plate-reader/');
+            if (!$ch instanceof \CurlHandle) {
+                throw new Exception('Error initializing API request.');
+            }
+
+            $curl_options = [
+                CURLOPT_RETURNTRANSFER => true,
+                CURLOPT_POST => true,
+                CURLOPT_POSTFIELDS => $data,
+                CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_2TLS,
+                CURLOPT_CONNECTTIMEOUT_MS => self::PLATE_READER_CONNECT_TIMEOUT_MS,
+                CURLOPT_TIMEOUT_MS => self::PLATE_READER_TOTAL_TIMEOUT_MS,
+                CURLOPT_NOSIGNAL => true,
+                CURLOPT_NOPROGRESS => false,
+                CURLOPT_XFERINFOFUNCTION => self::clientDisconnectAbortCallback(),
+                CURLOPT_HTTPHEADER => [
+                    "Authorization: Token " . $api_key,
+                    'Expect:',
+                ],
             ];
-        } else {
+            if (defined('CURLOPT_TCP_NODELAY')) {
-            return [
+                $curl_options[(int)constant('CURLOPT_TCP_NODELAY')] = true;
+            }
+            curl_setopt_array($ch, $curl_options);
+
+            // Submit the POST request and close cURL session handle
+            $upstream_started_at = microtime(true);
+            $result = curl_exec($ch);
+            $this->last_timings['upstream'] = $this->elapsedMs($upstream_started_at);
+            $this->recordCurlTimings($ch);
+            curl_close($ch);
+
+            // Print the response from the server
+            if ($result === false) {
+                throw new Exception('Error in API request.');
+            }
+
+            $parse_started_at = microtime(true);
+            $response_data = json_decode($result, true);
+            $this->last_timings['parse'] = $this->elapsedMs($parse_started_at);
+            $this->recordResponseTimings($response_data);
+
+            if (isset($response_data['results']) && count($response_data['results']) > 0) {
+                $recognized_result = [
+                    'success' => true,
+                    'license_plate_number' => $response_data['results'][0]['plate'] ?? null,
+                    'confidence' => $response_data['results'][0]['score'] ?? null,
+                ];
+
+                $this->writeRecognitionResultCache($result_cache, $result_cache_key, $recognized_result);
+
+                return $recognized_result;
+            }
+
+            $recognized_result = [
                 'success' => false,
                 'message' => 'No license plate detected.',
-                'raw_response' => $response_data,
             ];
+            $this->writeRecognitionResultCache($result_cache, $result_cache_key, $recognized_result);
+
+            return $recognized_result;
+        } finally {
+            $this->last_timings['total'] = $this->elapsedMs($started_at);
         }
     }
 
+    private static function clientDisconnectAbortCallback(): callable
+    {
+        return static function (): int {
+            return connection_aborted() ? 1 : 0;
+        };
+    }
+
+    public function getLastTimings(): array
+    {
+        return $this->last_timings;
+    }
+
+    private function elapsedMs(float $started_at): float
+    {
+        return (microtime(true) - $started_at) * 1000;
+    }
+
+    private static function configuredApiUrl(): string
+    {
+        $configured = getenv('PLATE_RECOGNIZER_API_URL');
+        if ($configured === false || trim((string)$configured) === '') {
+            $configured = $_ENV['PLATE_RECOGNIZER_API_URL'] ?? $_SERVER['PLATE_RECOGNIZER_API_URL'] ?? self::DEFAULT_API_URL;
+        }
+
+        return (string)$configured;
+    }
+
+    private static function normalizeApiUrl(string $api_url): string
+    {
+        $api_url = trim($api_url);
+        if ($api_url === '') {
+            return self::DEFAULT_API_URL;
+        }
+
+        return rtrim($api_url, '/');
+    }
+
+    private function recordCurlTimings(\CurlHandle $curl_handle): void
+    {
+        $mapping = [
+            CURLINFO_NAMELOOKUP_TIME => 'upstream_dns',
+            CURLINFO_CONNECT_TIME => 'upstream_connect',
+            CURLINFO_APPCONNECT_TIME => 'upstream_tls',
+            CURLINFO_PRETRANSFER_TIME => 'upstream_pretransfer',
+            CURLINFO_STARTTRANSFER_TIME => 'upstream_ttfb',
+            CURLINFO_TOTAL_TIME => 'upstream_total',
+        ];
+
+        foreach ($mapping as $curl_info_option => $timing_key) {
+            $value = curl_getinfo($curl_handle, $curl_info_option);
+            if (!is_numeric($value)) {
+                continue;
+            }
+
+            $this->last_timings[$timing_key] = max(0, (float)$value * 1000);
+        }
+    }
+
+    private function recordResponseTimings(mixed $response_data): void
+    {
+        if (!is_array($response_data) || !isset($response_data['processing_time']) || !is_numeric($response_data['processing_time'])) {
+            return;
+        }
+
+        $this->last_timings['upstream_processing'] = max(0, (float)$response_data['processing_time']);
+    }
+
+    private function buildResultCacheKeyFromUploadString(string $base64_image): string
+    {
+        $base64_image = trim($base64_image);
+        if (preg_match('/^data:image\/[a-zA-Z0-9.+-]+;base64,(.*)$/s', $base64_image, $matches) === 1) {
+            $image_data = base64_decode((string)$matches[1], true);
+            if (is_string($image_data)) {
+                return $this->buildResultCacheKeyFromBytes($image_data);
+            }
+        }
+
+        return $this->buildResultCacheKeyFromBytes($base64_image);
+    }
+
+    private function buildResultCacheKeyFromBytes(string $image_data): string
+    {
+        $context = hash_init('sha256');
+        hash_update($context, $this->resultCacheContext());
+        hash_update($context, "\0");
+        hash_update($context, $image_data);
+
+        return self::RESULT_CACHE_REDIS_KEY_PREFIX . hash_final($context);
+    }
+
+    private function resultCacheContext(): string
+    {
+        return self::RESULT_CACHE_CONTEXT;
+    }
+
+    protected function resultCacheStore(): ?object
+    {
+        return $this->runtimeConfigCacheStore();
+    }
+
+    private function readRecognitionResultCache(?object $cache, ?string $key): ?array
+    {
+        if ($cache === null || $key === null || !method_exists($cache, 'get')) {
+            return null;
+        }
+
+        try {
+            $cached = $cache->get($key);
+        } catch (\Throwable) {
+            return null;
+        }
+
+        if (!is_string($cached) || trim($cached) === '') {
+            return null;
+        }
+
+        $decoded = json_decode($cached, true);
+        if (!is_array($decoded) || !array_key_exists('success', $decoded)) {
+            return null;
+        }
+
+        return $decoded;
+    }
+
+    private function writeRecognitionResultCache(?object $cache, ?string $key, array $result): void
+    {
+        if ($cache === null || $key === null || !method_exists($cache, 'setEx')) {
+            return;
+        }
+
+        try {
+            $encoded = json_encode($result, JSON_UNESCAPED_SLASHES);
+            if (is_string($encoded)) {
+                $cache->setEx($key, $encoded, self::RESULT_CACHE_TTL_SECONDS);
+            }
+        } catch (\Throwable) {
+            // Scanner result cache is best-effort; Plate Recognizer remains the source of truth.
+        }
+    }
+
+    protected function buildPlateReaderPayload(string $base64_image): array
+    {
+        return $this->buildPlateReaderPayloadFromUpload($this->buildUploadValue($base64_image));
+    }
+
+    protected function buildPlateReaderPayloadFromUpload(string|\CURLFile|\CURLStringFile $upload): array
+    {
+        return [
+            'upload' => $upload,
+            'config' => self::PLATE_READER_CONFIG_JSON,
+            'regions' => self::PLATE_READER_REGIONS,
+        ];
+    }
+
+    private function buildUploadValue(string $base64_image): string|\CURLStringFile
+    {
+        $base64_image = trim($base64_image);
+        if (preg_match('/^data:(image\/[a-zA-Z0-9.+-]+);base64,(.*)$/s', $base64_image, $matches) !== 1) {
+            return $base64_image;
+        }
+
+        $image_data = base64_decode((string)$matches[2], true);
+        if ($image_data === false || !class_exists(\CURLStringFile::class)) {
+            return (string)$matches[2];
+        }
+
+        return new \CURLStringFile($image_data, self::DEFAULT_UPLOAD_FILE_NAME, (string)$matches[1]);
+    }
+
+    private function buildUploadValueFromBytes(string $image_data, string $mime_type): string|\CURLStringFile
+    {
+        $mime_type = trim($mime_type) !== '' ? trim($mime_type) : 'image/jpeg';
+        if (!str_starts_with($mime_type, 'image/')) {
+            $mime_type = 'image/jpeg';
+        }
+
+        if (!class_exists(\CURLStringFile::class)) {
+            return $image_data;
+        }
+
+        return new \CURLStringFile($image_data, self::DEFAULT_UPLOAD_FILE_NAME, $mime_type);
+    }
+
+    /**
+     * @throws Exception
+     */
+    private function buildUploadValueFromFile(string $image_path, string $mime_type): \CURLFile
+    {
+        $image_path = trim($image_path);
+        $mime_type = trim($mime_type) !== '' ? trim($mime_type) : 'image/jpeg';
+        if (!str_starts_with($mime_type, 'image/')) {
+            $mime_type = 'image/jpeg';
+        }
+
+        if ($image_path === '' || !is_file($image_path) || !class_exists(\CURLFile::class)) {
+            throw new Exception('Image upload file is invalid.');
+        }
+
+        return new \CURLFile($image_path, $mime_type, self::DEFAULT_UPLOAD_FILE_NAME);
+    }
+
+    protected function runtimeConfig(): array
+    {
+        if ($this->runtime_config !== null) {
+            return $this->runtime_config;
+        }
+
+        if ($this->shouldUseSharedRuntimeConfigCache()) {
+            $cached_config = self::getSharedRuntimeConfigCache();
+            if ($cached_config !== null) {
+                $this->runtime_config = $cached_config;
+
+                return $this->runtime_config;
+            }
+
+            $cached_config = $this->readRuntimeConfigCacheStore();
+            if ($cached_config !== null) {
+                self::$runtime_config_cache = [
+                    'values' => $cached_config,
+                    'cached_at' => microtime(true),
+                ];
+                $this->runtime_config = $cached_config;
+
+                return $this->runtime_config;
+            }
+        }
+
+        $values = $this->readRuntimeModuleConfig();
+
+        $this->runtime_config = [
+            'enabled' => $this->parseModuleConfigBool($values['enabled'] ?? false),
+            'api_key' => (string)($values['api_key'] ?? ''),
+        ];
+
+        if ($this->shouldUseSharedRuntimeConfigCache()) {
+            self::$runtime_config_cache = [
+                'values' => $this->runtime_config,
+                'cached_at' => microtime(true),
+            ];
+            $this->writeRuntimeConfigCacheStore($this->runtime_config);
+        }
+
+        return $this->runtime_config;
+    }
+
+    protected function shouldUseSharedRuntimeConfigCache(): bool
+    {
+        return static::class === self::class;
+    }
+
+    private static function getSharedRuntimeConfigCache(): ?array
+    {
+        if (self::$runtime_config_cache === null) {
+            return null;
+        }
+
+        $cache_age_seconds = microtime(true) - self::$runtime_config_cache['cached_at'];
+        if ($cache_age_seconds > self::RUNTIME_CONFIG_CACHE_TTL_SECONDS) {
+            self::$runtime_config_cache = null;
+
+            return null;
+        }
+
+        return self::$runtime_config_cache['values'];
+    }
+
+    protected function runtimeConfigCacheStore(): ?object
+    {
+        return defined('redis') ? constant('redis') : null;
+    }
+
+    private function readRuntimeConfigCacheStore(): ?array
+    {
+        $cache = $this->runtimeConfigCacheStore();
+        if ($cache === null || !method_exists($cache, 'get')) {
+            return null;
+        }
+
+        try {
+            $cached = $cache->get(self::RUNTIME_CONFIG_REDIS_CACHE_KEY);
+        } catch (\Throwable) {
+            return null;
+        }
+
+        if (!is_string($cached) || trim($cached) === '') {
+            return null;
+        }
+
+        $decoded = json_decode($cached, true);
+        if (!is_array($decoded)) {
+            return null;
+        }
+
+        if (!array_key_exists('enabled', $decoded) || !array_key_exists('api_key', $decoded)) {
+            return null;
+        }
+
+        return [
+            'enabled' => $this->parseModuleConfigBool($decoded['enabled']),
+            'api_key' => (string)$decoded['api_key'],
+        ];
+    }
+
+    /**
+     * @param array{enabled: bool, api_key: string} $config
+     */
+    private function writeRuntimeConfigCacheStore(array $config): void
+    {
+        $cache = $this->runtimeConfigCacheStore();
+        if ($cache === null || !method_exists($cache, 'setEx')) {
+            return;
+        }
+
+        try {
+            $encoded = json_encode($config, JSON_UNESCAPED_SLASHES);
+            if (is_string($encoded)) {
+                $cache->setEx(self::RUNTIME_CONFIG_REDIS_CACHE_KEY, $encoded, self::RUNTIME_CONFIG_CACHE_TTL_SECONDS);
+            }
+        } catch (\Throwable) {
+            // Scanner config cache is best-effort; DB remains the source of truth.
+        }
+    }
+
+    private function parseModuleConfigBool(mixed $value): bool
+    {
+        if (is_bool($value)) {
+            return $value;
+        }
+
+        if (is_numeric($value)) {
+            return (int)$value === 1;
+        }
+
+        return strtolower(trim((string)$value)) === 'true';
+    }
+
+    protected function readRuntimeModuleConfig(): array
+    {
+        global $db;
+
+        if ($db instanceof db) {
+            $module = $db->escape_string('licenseplaterecognizer');
+            $result = $db->query("SELECT variable, value FROM module_config WHERE module = '$module' AND variable IN ('enabled', 'api_key')");
+            $values = [];
+
+            if ($result instanceof \mysqli_result) {
+                while ($row = $result->fetch_assoc()) {
+                    $variable = (string)($row['variable'] ?? '');
+                    if ($variable !== '') {
+                        $values[$variable] = (string)($row['value'] ?? '');
+                    }
+                }
+            }
+
+            return $values;
+        }
+
+        if (!isset($this->config)) {
+            $this->config = new licenseplaterecognizer_c();
+        }
+
+        return [
+            'enabled' => (string)$this->config->enabled->getVariableValue(),
+            'api_key' => (string)$this->config->api_key->getVariableValue(),
+        ];
+    }
+
     /**
      * @inheritDoc
      * @throws Exception If the module is not enabled or if there is an error in the API request
@@ -100,8 +591,8 @@ class licenseplaterecognizer implements licenseplaterecognizer_i
      */
     public function get_usage(): licenseplaterecognizer_info
     {
-        // Require the module to be enabled
         $this->requireModuleEnabled();
+        $api_key = $this->runtimeConfig()['api_key'];
         $curl = curl_init();
         curl_setopt_array($curl, array(
             CURLOPT_URL => $this->api_url . '/info/',
@@ -112,9 +603,9 @@ class licenseplaterecognizer implements licenseplaterecognizer_i
             CURLOPT_FOLLOWLOCATION => true,
             CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_2TLS,
             CURLOPT_CUSTOMREQUEST => 'GET',
-            CURLOPT_HTTPHEADER => array(
+            CURLOPT_HTTPHEADER => [
-                'Authorization: Token ' . $this->config->api_key->getVariableValue()
+                'Authorization: Token ' . $api_key,
-            ),
+            ],
         ));
         $response = curl_exec($curl);
         curl_close($curl);
@@ -124,4 +615,4 @@ class licenseplaterecognizer implements licenseplaterecognizer_i
         }
         return new licenseplaterecognizer_info($response_data);
     }
-}
+}

services/nginx/app/classes/limited_backoffice_exception.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace classes;
+
+class limited_backoffice_exception extends \RuntimeException
+{
+    public function __construct(
+        string $message,
+        private readonly int $statusCode = 400,
+        private readonly ?array $payload = null
+    ) {
+        parent::__construct($message);
+    }
+
+    public function statusCode(): int
+    {
+        return $this->statusCode;
+    }
+
+    public function payload(): array|string
+    {
+        return $this->payload ?? $this->getMessage();
+    }
+}

services/nginx/app/classes/limited_backoffice_schema_bootstrap.php

@@ -0,0 +1,43 @@
+<?php
+
+namespace classes;
+
+class limited_backoffice_schema_bootstrap
+{
+    private static bool $initialized = false;
+
+    public static function ensureTables(): void
+    {
+        if (self::$initialized) {
+            return;
+        }
+
+        global $db;
+
+        if (!isset($db) || !is_object($db) || !method_exists($db, 'query')) {
+            return;
+        }
+
+        $db->query(<<<'SQL'
+CREATE TABLE IF NOT EXISTS `limited_backoffice_employees` (
+    `id` INT UNSIGNED NOT NULL AUTO_INCREMENT,
+    `user_id` INT NOT NULL,
+    `managed_group_id` INT NOT NULL,
+    `role_key` VARCHAR(64) NOT NULL,
+    `department_ids` LONGTEXT NOT NULL,
+    `created_by_user_id` INT NOT NULL,
+    `updated_by_user_id` INT NULL,
+    `deactivated_at` DATETIME NULL,
+    `created_at` DATETIME NULL DEFAULT CURRENT_TIMESTAMP,
+    `updated_at` DATETIME NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+    PRIMARY KEY (`id`),
+    UNIQUE KEY `uniq_limited_backoffice_employees_user_id` (`user_id`),
+    KEY `idx_limited_backoffice_employees_group_id` (`managed_group_id`),
+    KEY `idx_limited_backoffice_employees_role_key` (`role_key`),
+    KEY `idx_limited_backoffice_employees_deactivated_at` (`deactivated_at`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+SQL);
+
+        self::$initialized = true;
+    }
+}

services/nginx/app/classes/n8n.php

@@ -340,18 +340,49 @@ class n8n implements n8n_i
             throw new Exception('Webhook target must not be empty.');
         }
 
-        if (filter_var($target, FILTER_VALIDATE_URL) !== false) {
-            return $target;
-        }
-
         $baseUrl = trim((string)$this->config->webhook_base_url->getVariableValue());
         if ($baseUrl === '') {
             throw new Exception('n8n webhook base URL is not configured.');
         }
 
+        if (filter_var($target, FILTER_VALIDATE_URL) !== false) {
+            if (!$this->isAllowedWebhookAbsoluteUrl($target, $baseUrl)) {
+                throw new Exception('Webhook URL must use the configured n8n webhook host.');
+            }
+
+            return $target;
+        }
+
         return rtrim($baseUrl, '/') . '/' . ltrim($target, '/');
     }
 
+    private function isAllowedWebhookAbsoluteUrl(string $targetUrl, string $baseUrl): bool
+    {
+        $targetParts = parse_url($targetUrl);
+        $baseParts = parse_url($baseUrl);
+
+        if (!is_array($targetParts) || !is_array($baseParts)) {
+            return false;
+        }
+
+        $targetHost = strtolower((string)($targetParts['host'] ?? ''));
+        $baseHost = strtolower((string)($baseParts['host'] ?? ''));
+        if ($targetHost === '' || $baseHost === '' || $targetHost !== $baseHost) {
+            return false;
+        }
+
+        $targetScheme = strtolower((string)($targetParts['scheme'] ?? ''));
+        $baseScheme = strtolower((string)($baseParts['scheme'] ?? ''));
+        if ($targetScheme === '' || $baseScheme === '' || $targetScheme !== $baseScheme) {
+            return false;
+        }
+
+        $targetPort = (int)($targetParts['port'] ?? ($targetScheme === 'https' ? 443 : 80));
+        $basePort = (int)($baseParts['port'] ?? ($baseScheme === 'https' ? 443 : 80));
+
+        return $targetPort === $basePort;
+    }
+
     /**
      * @throws Exception
      */

services/nginx/app/classes/order_reference_suggestions_service.php

@@ -46,7 +46,7 @@ class order_reference_suggestions_service
         $rows = [
             ...$this->fetchBookingRows($departmentId, $search),
             ...$this->fetchOrderRows($departmentId, $search),
-            ...$this->fetchVehicleRows($customerId, $plates, $search),
+            ...$this->fetchVehicleRows($departmentId, $customerId, $plates, $search),
         ];
 
         $suggestions = $this->aggregateRows($rows, $search, $customerId, $plates);
@@ -137,7 +137,7 @@ class order_reference_suggestions_service
      * @param array<int, string> $plates
      * @return array<int, array<string, mixed>>
      */
-    private function fetchVehicleRows(?int $customerId, array $plates, string $search): array
+    private function fetchVehicleRows(int $departmentId, ?int $customerId, array $plates, string $search): array
     {
         $contextWhere = [];
         $params = [];
@@ -171,6 +171,10 @@ class order_reference_suggestions_service
             $params['search'] = '%' . $this->lower($search) . '%';
         }
 
+        $where[] = $this->vehicleDepartmentAccessPredicate();
+        $params['orders_department_id'] = $departmentId;
+        $params['bookings_department_id'] = $departmentId;
+
         $sql = "SELECT
                     'vehicle' AS source,
                     id AS origin_id,
@@ -190,6 +194,41 @@ class order_reference_suggestions_service
         return $this->fetchRows($sql, $params);
     }
 
+    private function vehicleDepartmentAccessPredicate(): string
+    {
+        $ordersWhere = [
+            'authorized_orders.department_id = :orders_department_id',
+            '(authorized_orders.customer_id = customer_vehicles.customer_id'
+                . " OR UPPER(REPLACE(authorized_orders.reg_1, ' ', '')) = UPPER(REPLACE(customer_vehicles.reg, ' ', ''))"
+                . " OR UPPER(REPLACE(authorized_orders.reg_2, ' ', '')) = UPPER(REPLACE(customer_vehicles.reg, ' ', ''))"
+                . " OR UPPER(REPLACE(authorized_orders.reg_3, ' ', '')) = UPPER(REPLACE(customer_vehicles.reg, ' ', '')))"
+        ];
+        if ($this->tableHasColumn('orders', 'deleted_at')) {
+            $ordersWhere[] = 'authorized_orders.deleted_at IS NULL';
+        }
+
+        $bookingsWhere = [
+            'authorized_bookings.department = :bookings_department_id',
+            '(authorized_bookings.customer_number = customer_vehicles.customer_id'
+                . " OR UPPER(REPLACE(authorized_bookings.reg_1, ' ', '')) = UPPER(REPLACE(customer_vehicles.reg, ' ', ''))"
+                . " OR UPPER(REPLACE(authorized_bookings.reg_2, ' ', '')) = UPPER(REPLACE(customer_vehicles.reg, ' ', ''))"
+                . " OR UPPER(REPLACE(authorized_bookings.reg_3, ' ', '')) = UPPER(REPLACE(customer_vehicles.reg, ' ', '')))"
+        ];
+        if ($this->tableHasColumn('order_bookings', 'deleted_at')) {
+            $bookingsWhere[] = 'authorized_bookings.deleted_at IS NULL';
+        }
+
+        return '(EXISTS (
+                    SELECT 1
+                    FROM orders authorized_orders
+                    WHERE ' . implode(' AND ', $ordersWhere) . '
+                ) OR EXISTS (
+                    SELECT 1
+                    FROM order_bookings authorized_bookings
+                    WHERE ' . implode(' AND ', $bookingsWhere) . '
+                ))';
+    }
+
     /**
      * @param array<string, mixed> $params
      * @return array<int, array<string, mixed>>

services/nginx/app/classes/orders_schema_bootstrap.php

@@ -58,6 +58,9 @@ class orders_schema_bootstrap
             || !self::columnExists($db, 'orders', 'booking_id')
             || !self::columnExists($db, 'orders', 'po')
             || !self::columnExists($db, 'order_bookings', 'po')
+            || !self::columnExists($db, 'order_bookings', 'customer_number')
+            || !self::columnExists($db, 'order_bookings', 'department')
+            || !self::columnExists($db, 'order_bookings', 'deleted_at')
         ) {
             return;
         }
@@ -65,6 +68,9 @@ class orders_schema_bootstrap
         $db->query(
             "UPDATE orders o
                 INNER JOIN order_bookings b ON b.id = o.booking_id
+                    AND b.customer_number = o.customer_id
+                    AND b.department = o.department_id
+                    AND b.deleted_at IS NULL
                 SET o.po = b.po
                 WHERE o.booking_id IS NOT NULL
                     AND o.booking_id > 0

services/nginx/app/classes/pdf_store.php

@@ -47,8 +47,12 @@ class pdf_store implements minio_pdfs_i
      */
     public function download(string $file): string
     {
+        if ($this->shouldUseLocalTestStorage()) {
+            return $this->getLocalTestObjectPath($file);
+        }
+
         $path = '/tmp/' . $file;
-        $result = self::getS3Client()->getObject([
+        self::getS3Client()->getObject([
             'Bucket' => self::getBucket(),
             'Key' => $file,
             'SaveAs' => $path

services/nginx/app/classes/redis.php

@@ -392,7 +392,19 @@ class redis implements redis_i
 
     private function invoicePeriodCacheKey(string $prefix, string $dateFrom, string $dateTo): string
     {
-        return $prefix . ':' . $dateFrom . ':' . $dateTo;
+        return $prefix . ':'
+            . $this->normalizeInvoicePeriodCacheDate($dateFrom, true) . ':'
+            . $this->normalizeInvoicePeriodCacheDate($dateTo, false);
+    }
+
+    private function normalizeInvoicePeriodCacheDate(string $date, bool $startOfDay): string
+    {
+        $timestamp = strtotime($date);
+        if ($timestamp === false) {
+            return $date;
+        }
+
+        return date($startOfDay ? 'Y-m-d 00:00:00' : 'Y-m-d 23:59:59', $timestamp);
     }
 
     private function workfeedEmployeeNameCacheKey(string $employeeId): string
@@ -512,7 +524,11 @@ class redis implements redis_i
      */
     public function enqueue_invoice_period_warming(string $dateFrom, string $dateTo): self
     {
-        $this->get_client()->sadd('invoice_period_warming_queue', [$dateFrom . '|' . $dateTo]);
+        $this->get_client()->sadd('invoice_period_warming_queue', [
+            $this->normalizeInvoicePeriodCacheDate($dateFrom, true)
+                . '|'
+                . $this->normalizeInvoicePeriodCacheDate($dateTo, false),
+        ]);
         return $this;
     }
 

services/nginx/app/classes/release_manager_schema_bootstrap.php

@@ -118,6 +118,35 @@ class release_manager_schema_bootstrap
                 INDEX idx_release_targets_coolify (coolify_instance_id, coolify_service_uuid)
             ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
 
+            "CREATE TABLE IF NOT EXISTS release_auto_sync_events (
+                id BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+                channel_id BIGINT UNSIGNED NOT NULL,
+                app VARCHAR(16) NOT NULL,
+                repository VARCHAR(255) NOT NULL,
+                branch VARCHAR(128) NOT NULL,
+                commit_sha VARCHAR(64) NOT NULL,
+                status VARCHAR(32) NOT NULL DEFAULT 'pending',
+                source VARCHAR(64) NULL,
+                workflow_url VARCHAR(512) NULL,
+                gate_operation_id BIGINT UNSIGNED NULL,
+                sync_operation_id BIGINT UNSIGNED NULL,
+                deployment_id BIGINT UNSIGNED NULL,
+                error_message TEXT NULL,
+                metadata_json LONGTEXT NULL,
+                received_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+                gate_passed_at DATETIME NULL,
+                synced_at DATETIME NULL,
+                promoted_at DATETIME NULL,
+                failed_at DATETIME NULL,
+                created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+                updated_at TIMESTAMP NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+                UNIQUE KEY uq_release_auto_sync_event (channel_id, app, repository, branch, commit_sha),
+                INDEX idx_release_auto_sync_channel_status (channel_id, status, updated_at),
+                INDEX idx_release_auto_sync_gate (gate_operation_id),
+                INDEX idx_release_auto_sync_sync (sync_operation_id),
+                INDEX idx_release_auto_sync_deployment (deployment_id)
+            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
+
             "CREATE TABLE IF NOT EXISTS release_service_sets (
                 id BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
                 channel_id BIGINT UNSIGNED NULL,
@@ -408,6 +437,7 @@ class release_manager_schema_bootstrap
             'release_versions',
             'release_channel_versions',
             'release_assignments',
+            'release_auto_sync_events',
             'release_service_sets',
             'release_deployments',
             'release_bundles',

services/nginx/app/classes/router.php

@@ -89,7 +89,7 @@ class router
         }
         // Regex
         $route = str_replace('/', '\/', $route);
-        $route = preg_replace('/{[a-zA-Z0-9]+}/', '([a-zA-Z0-9]+)', $route);
+        $route = preg_replace('/{[a-zA-Z0-9_]+}/', '([a-zA-Z0-9]+)', $route);
         if (preg_match('/^' . $route . '$/', $this->url)) {
             return true;
         }

services/nginx/app/classes/selfserve_schema_bootstrap.php

@@ -95,7 +95,7 @@ class selfserve_schema_bootstrap
                 session_id INT NOT NULL,
                 task_id INT NULL,
                 task_text VARCHAR(255) NOT NULL,
-                description VARCHAR(255) NULL,
+                description TEXT NULL,
                 services JSON NULL,
                 buttons JSON NULL,
                 dynamic_image_id INT NULL,
@@ -139,6 +139,28 @@ class selfserve_schema_bootstrap
                 UNIQUE KEY uniq_selfserve_vhw_department (department_id),
                 INDEX idx_selfserve_vhw_dept_updated (department_id, updated_at)
             ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
+
+            "CREATE TABLE IF NOT EXISTS department_selfserve_path_confirmations (
+                id INT AUTO_INCREMENT PRIMARY KEY,
+                department_id INT NOT NULL,
+                lane_id INT NULL,
+                vehicle_type_id INT NULL,
+                config_version_id INT NULL,
+                config_source VARCHAR(32) NOT NULL DEFAULT 'draft',
+                path_signature VARCHAR(128) NOT NULL,
+                result_signature VARCHAR(128) NOT NULL,
+                answers_json JSON NOT NULL,
+                result_json JSON NOT NULL,
+                scope_json JSON NULL,
+                confirmed_by INT NULL,
+                confirmed_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+                stale_reason VARCHAR(255) NULL,
+                created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+                updated_at TIMESTAMP NULL DEFAULT NULL ON UPDATE CURRENT_TIMESTAMP,
+                deleted_at TIMESTAMP NULL DEFAULT NULL,
+                INDEX idx_selfserve_path_conf_department_scope (department_id, lane_id, vehicle_type_id, config_version_id),
+                INDEX idx_selfserve_path_conf_signature (department_id, config_version_id, path_signature)
+            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
         ];
 
         foreach ($queries as $sql) {
@@ -175,6 +197,18 @@ class selfserve_schema_bootstrap
             'gate_ref_id',
             'ALTER TABLE department_selfserve_tasks ADD COLUMN gate_ref_id INT NULL AFTER gate_type'
         );
+        self::ensureColumnDataType(
+            'department_selfserve_tasks',
+            'description',
+            ['text', 'mediumtext', 'longtext'],
+            'ALTER TABLE department_selfserve_tasks MODIFY COLUMN description TEXT NULL AFTER task'
+        );
+        self::ensureColumnDataType(
+            'selfserve_wash_session_tasks',
+            'description',
+            ['text', 'mediumtext', 'longtext'],
+            'ALTER TABLE selfserve_wash_session_tasks MODIFY COLUMN description TEXT NULL AFTER task_text'
+        );
         self::ensureColumn(
             'selfserve_wash_session_tasks',
             'dynamic_images_vehicle_type',
@@ -217,4 +251,49 @@ class selfserve_schema_bootstrap
         }
         $db->query($alterSql);
     }
+
+    /**
+     * @param array<int,string> $acceptedDataTypes
+     */
+    public static function ensureColumnDataType(string $table, string $column, array $acceptedDataTypes, string $alterSql): void
+    {
+        global $db;
+
+        $columnInfo = self::columnInfo($table, $column);
+        if ($columnInfo === null) {
+            return;
+        }
+
+        $dataType = strtolower((string)($columnInfo['DATA_TYPE'] ?? ''));
+        $acceptedDataTypes = array_map(static fn(string $type): string => strtolower($type), $acceptedDataTypes);
+        if (in_array($dataType, $acceptedDataTypes, true)) {
+            return;
+        }
+
+        $db->query($alterSql);
+    }
+
+    /**
+     * @return array<string,mixed>|null
+     */
+    public static function columnInfo(string $table, string $column): ?array
+    {
+        global $db;
+        $table = $db->escape_string($table);
+        $column = $db->escape_string($column);
+        $database = $db->escape_string($db->getDatabase());
+
+        $sql = "SELECT DATA_TYPE, COLUMN_TYPE, IS_NULLABLE, CHARACTER_MAXIMUM_LENGTH
+                FROM information_schema.COLUMNS
+                WHERE TABLE_SCHEMA = '$database'
+                  AND TABLE_NAME = '$table'
+                  AND COLUMN_NAME = '$column'
+                LIMIT 1";
+        $result = $db->query($sql);
+        if (!$result) {
+            return null;
+        }
+        $row = $result->fetch_assoc();
+        return is_array($row) ? $row : null;
+    }
 }

services/nginx/app/classes/shelly.php

@@ -16,6 +16,8 @@ class shelly implements shelly_i
     private const SHELLY_RATE_LIMIT_WAIT_TIMEOUT_SECONDS = 20;
     private const SHELLY_RATE_LIMIT_WINDOW_MILLISECONDS = 2000;
     private const SHELLY_RATE_LIMIT_GATE_KEY = 'shelly_cloud_rate_limit_gate';
+    private const SHELLY_CONNECT_TIMEOUT_SECONDS = 2;
+    private const SHELLY_REQUEST_TIMEOUT_SECONDS = 5;
     /**
      * @var array<int,array<string,mixed>>
      */
@@ -178,6 +180,9 @@ class shelly implements shelly_i
         curl_setopt($ch, CURLOPT_HTTPHEADER, [
             'Content-Type: application/json',
         ]);
+        curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, self::SHELLY_CONNECT_TIMEOUT_SECONDS);
+        curl_setopt($ch, CURLOPT_TIMEOUT, self::SHELLY_REQUEST_TIMEOUT_SECONDS);
+        curl_setopt($ch, CURLOPT_NOSIGNAL, true);
         // Execute the request
         $response = curl_exec($ch);
         // Get the status code
@@ -224,6 +229,9 @@ class shelly implements shelly_i
         );
         curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
         curl_setopt($ch, CURLOPT_HTTPGET, true);
+        curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, self::SHELLY_CONNECT_TIMEOUT_SECONDS);
+        curl_setopt($ch, CURLOPT_TIMEOUT, self::SHELLY_REQUEST_TIMEOUT_SECONDS);
+        curl_setopt($ch, CURLOPT_NOSIGNAL, true);
 
         $response = curl_exec($ch);
         $status_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

services/nginx/app/classes/shelly_relay_inventory.php

@@ -33,7 +33,7 @@ class shelly_relay_inventory
      * @return array<int,array<string,mixed>>
      * @throws Exception
      */
-    public function listRelayOptions(): array
+    public function listRelayOptions(bool $include_sensitive_network_details = false): array
     {
         $devices_status = $this->fetchOwnedDevicesStatus();
         $device_catalog = $this->fetchOwnedDeviceCatalog();
@@ -49,7 +49,8 @@ class shelly_relay_inventory
 
             $option = $this->buildRelayOption(
                 $normalized_device,
-                is_array($catalog_entry) ? $catalog_entry : null
+                is_array($catalog_entry) ? $catalog_entry : null,
+                $include_sensitive_network_details
             );
             if ($option === null) {
                 continue;
@@ -160,7 +161,11 @@ class shelly_relay_inventory
      * @param array<string,mixed> $device
      * @return array<string,mixed>|null
      */
-    private function buildRelayOption(array $device, ?array $catalog_entry = null): ?array
+    private function buildRelayOption(
+        array $device,
+        ?array $catalog_entry = null,
+        bool $include_sensitive_network_details = false
+    ): ?array
     {
         if ($device === [] || !$this->isRelayCapableDevice($device)) {
             return null;
@@ -203,9 +208,8 @@ class shelly_relay_inventory
             $online = $this->normalizeBoolean($catalog_entry['cloud_online'] ?? null);
         }
         $status_color = $this->extractStatusColor($online);
-        $local_ip = $this->extractLocalIp($device, $catalog_entry);
 
-        return [
+        $option = [
             'id' => $device_id,
             'name' => $this->buildRelayLabel(
                 $device_type,
@@ -223,10 +227,15 @@ class shelly_relay_inventory
             'device_generation' => $device_generation,
             'control_type' => $control_type,
             'control_name' => $control_name !== '' ? $control_name : null,
-            'local_ip' => $local_ip,
             'status_color' => $status_color,
             'online' => $online,
         ];
+
+        if ($include_sensitive_network_details) {
+            $option['local_ip'] = $this->extractLocalIp($device, $catalog_entry);
+        }
+
+        return $option;
     }
 
     /**

services/nginx/app/classes/slack.php

@@ -6,13 +6,25 @@ use GuzzleHttp\Client;
 use interfaces\notification_i;
 use objects\departments_o;
 use objects\users_o;
+use slack\slack_c;
 use traits\notification_t;
 
+require_once WD . '/modules/slack/slack_c.php';
 
 class slack implements notification_i
 {
     use notification_t;
 
+    private ?slack_c $config = null;
+
+    public function getConfig(): slack_c
+    {
+        if ($this->config === null) {
+            $this->config = new slack_c();
+        }
+
+        return $this->config;
+    }
 
     /**
      * @inheritdoc
@@ -122,7 +134,7 @@ class slack implements notification_i
             . "Status: $status";
     }
 
-    public function send_message(string $string, string $module = null): void
+    public function send_message(string $string, ?string $module = null): void
     {
         global $SLACK_DEFAULT_WEBHOOK;
         // Format the message if a module is provided
@@ -132,4 +144,189 @@ class slack implements notification_i
         // Send the message to the slack webhook
         self::add_log(self::send_webhook_message($string, $SLACK_DEFAULT_WEBHOOK));
     }
-}
+
+    public function send_customer_registration_notification(int $customer_number): self
+    {
+        $webhook = $this->get_customer_registration_webhook_url();
+        if ($webhook === '') {
+            return $this;
+        }
+
+        self::add_log(self::send_webhook_message(
+            $this->format_customer_registration($customer_number),
+            $webhook
+        ));
+
+        return $this;
+    }
+
+    /**
+     * Send a sanitized customer-registration test notification to the saved Slack webhook.
+     *
+     * @return array{configured:bool,sent:bool,message:string}
+     */
+    public function test_customer_registration_webhook(): array
+    {
+        $webhook = $this->get_customer_registration_webhook_url();
+        if ($webhook === '') {
+            return [
+                'configured' => false,
+                'sent' => false,
+                'message' => 'Slack customer registration webhook URL is not configured.',
+            ];
+        }
+
+        $result = $this->send_webhook_message(
+            $this->format_customer_registration_test(),
+            $webhook
+        );
+        $sent = $this->is_webhook_send_successful($result);
+
+        self::add_log($sent
+            ? 'Slack customer registration test webhook sent successfully.'
+            : 'Slack customer registration test webhook failed.'
+        );
+
+        return [
+            'configured' => true,
+            'sent' => $sent,
+            'message' => $sent
+                ? 'Slack test message sent successfully.'
+                : 'Slack test message failed.',
+        ];
+    }
+
+    /**
+     * Send a sanitized internal department goal progress test notification to the saved Slack webhook.
+     *
+     * @return array{configured:bool,sent:bool,message:string}
+     */
+    public function test_internal_department_goal_progress_webhook(): array
+    {
+        $webhook = $this->get_internal_department_goal_progress_webhook_url();
+        if ($webhook === '') {
+            return [
+                'configured' => false,
+                'sent' => false,
+                'message' => 'Slack internal department goal progress webhook URL is not configured.',
+            ];
+        }
+
+        $result = $this->send_webhook_message(
+            $this->format_internal_department_goal_progress_test(),
+            $webhook
+        );
+        $sent = $this->is_webhook_send_successful($result);
+
+        self::add_log($sent
+            ? 'Slack internal department goal progress test webhook sent successfully.'
+            : 'Slack internal department goal progress test webhook failed.'
+        );
+
+        return [
+            'configured' => true,
+            'sent' => $sent,
+            'message' => $sent
+                ? 'Slack test message sent successfully.'
+                : 'Slack test message failed.',
+        ];
+    }
+
+    protected function get_customer_registration_webhook_url(): string
+    {
+        return trim((string)$this->getConfig()->customer_registration_webhook_url->getVariableValue());
+    }
+
+    public function get_internal_department_goal_progress_webhook_url(): string
+    {
+        return trim((string)$this->getConfig()->internal_department_goal_progress_webhook_url->getVariableValue());
+    }
+
+    /**
+     * @return int[]
+     */
+    public function get_internal_department_ids(): array
+    {
+        return $this->getConfig()->internal_department_ids->getDepartmentIds();
+    }
+
+    /**
+     * @param int[] $department_ids
+     * @throws \Exception
+     */
+    public function set_internal_department_goal_progress_config(string $webhook_url, array $department_ids): array
+    {
+        $this->getConfig()->internal_department_goal_progress_webhook_url->setVariableValue(trim($webhook_url));
+        $this->getConfig()->internal_department_ids->setVariableValue($department_ids);
+
+        return $this->get_internal_department_goal_progress_config();
+    }
+
+    public function get_internal_department_goal_progress_config(): array
+    {
+        $departments = (new departments_o())->getFieldsWhere(
+            [
+                'visible' => 1,
+                'archived' => 0,
+            ],
+            [
+                'id',
+                'name',
+                'order_priority',
+            ]
+        );
+
+        usort($departments, static function (array $a, array $b): int {
+            return (int)($a['order_priority'] ?? 0) <=> (int)($b['order_priority'] ?? 0)
+                ?: (int)($a['id'] ?? 0) <=> (int)($b['id'] ?? 0);
+        });
+
+        return [
+            'internal_department_goal_progress_webhook_url' => $this->get_internal_department_goal_progress_webhook_url(),
+            'internal_department_ids' => $this->get_internal_department_ids(),
+            'departments' => array_map(static function (array $department): array {
+                return [
+                    'id' => (int)$department['id'],
+                    'name' => (string)$department['name'],
+                    'order_priority' => (int)$department['order_priority'],
+                ];
+            }, $departments),
+        ];
+    }
+
+    public function is_webhook_send_successful(string $result): bool
+    {
+        return !str_starts_with($result, 'Failed to send message:');
+    }
+
+    public function format_customer_registration(int $customer_number): string
+    {
+        $customer = (new users_o())->getUserByCustomerNumber($customer_number);
+        $customerName = $customer->exists()
+            ? $customer->getCustomerName((int)$customer->customer_number->value())
+            : '';
+        $customerName = trim((string)$customerName);
+        if ($customerName === '') {
+            $customerName = 'Unknown customer';
+        }
+
+        $safeCustomerNumber = (int)$customer_number;
+        $customerUrl = 'https://truckwash.io/superuser/users?search=' . $safeCustomerNumber;
+
+        return "*New customer registered on Truck Wash*\n"
+            . "Customer: $customerName ($safeCustomerNumber)\n"
+            . "Open in Superuser: $customerUrl";
+    }
+
+    public function format_customer_registration_test(): string
+    {
+        return "*Truck Wash Slack test*\n"
+            . "Customer registration notifications are configured correctly.";
+    }
+
+    public function format_internal_department_goal_progress_test(): string
+    {
+        return "*Truck Wash Slack test*\n"
+            . "Internal department goal progress notifications are configured correctly.";
+    }
+}

services/nginx/app/classes/system_search_service.php

@@ -54,6 +54,7 @@ class system_search_service
         $allowedTypes = $this->normalizeTypes((array)($options['allowed_types'] ?? []));
         $ownOnlyTypes = $this->normalizeTypes((array)($options['own_only_types'] ?? []));
         $ownCustomerNumber = isset($options['own_customer_number']) ? (int)$options['own_customer_number'] : null;
+        $allowedDepartmentIds = array_values(array_unique(array_map('intval', (array)($options['allowed_department_ids'] ?? []))));
         $permissionsCatalogAll = (array)($options['permissions_catalog_all'] ?? []);
         $permissionsCatalogOwn = (array)($options['permissions_catalog_own'] ?? []);
         $moduleConfigVisibility = (array)($options['module_config_visibility'] ?? []);
@@ -107,6 +108,7 @@ class system_search_service
             'offset' => $offset,
             'own' => $ownCustomerNumber,
             'own_only' => $ownOnlyTypes,
+            'dept' => $allowedDepartmentIds,
             'assoc' => $includeAssociations,
             'dbg' => $debugIntent,
             'ctx' => $this->permissionContextFingerprint($permissionsCatalogAll, $permissionsCatalogOwn, $moduleConfigVisibility),
@@ -130,7 +132,8 @@ class system_search_service
             $ownCustomerNumber,
             $permissionsCatalogAll,
             $permissionsCatalogOwn,
-            $moduleConfigVisibility
+            $moduleConfigVisibility,
+            $allowedDepartmentIds
         );
 
         $intentAssociationHint = false;
@@ -180,7 +183,8 @@ class system_search_service
                     $ownCustomerNumber,
                     $permissionsCatalogAll,
                     $permissionsCatalogOwn,
-                    $moduleConfigVisibility
+                    $moduleConfigVisibility,
+                    $allowedDepartmentIds
                 );
             } else {
                 $intentMeta['status'] = 'fallback';
@@ -207,25 +211,29 @@ class system_search_service
                     $activeTypes,
                     $this->associationEntityTypes()
                 ));
-                foreach ($customerNumbers as $customerNumber) {
+                $associationTypes = array_values(array_diff($associationTypes, $ownOnlyTypes));
-                    $associated = $this->executeLexicalSearch(
+                if (!empty($associationTypes)) {
-                        $associationTypes,
+                    foreach ($customerNumbers as $customerNumber) {
-                        [(string)$customerNumber],
+                        $associated = $this->executeLexicalSearch(
-                        [],
+                            $associationTypes,
-                        $ownOnlyTypes,
+                            [(string)$customerNumber],
-                        $ownCustomerNumber,
+                            [],
-                        $permissionsCatalogAll,
+                            $ownOnlyTypes,
-                        $permissionsCatalogOwn,
+                            $ownCustomerNumber,
-                        $moduleConfigVisibility,
+                            $permissionsCatalogAll,
-                        [$customerNumber]
+                            $permissionsCatalogOwn,
-                    );
+                            $moduleConfigVisibility,
-                    foreach ($associated as &$item) {
+                            $allowedDepartmentIds,
-                        if (!isset($item['association_reason'])) {
+                            [$customerNumber]
-                            $item['association_reason'] = 'customer:' . $customerNumber;
+                        );
+                        foreach ($associated as &$item) {
+                            if (!isset($item['association_reason'])) {
+                                $item['association_reason'] = 'customer:' . $customerNumber;
+                            }
+                            $item['score'] = max((int)$item['score'], 35);
                         }
-                        $item['score'] = max((int)$item['score'], 35);
+                        $initialResults = $this->mergeResults($initialResults, $associated);
                     }
-                    $initialResults = $this->mergeResults($initialResults, $associated);
                 }
             }
         }
@@ -304,6 +312,7 @@ class system_search_service
      * @param array<string, string> $permissionsCatalogAll
      * @param array<int, string> $permissionsCatalogOwn
      * @param array<string, bool> $moduleConfigVisibility
+     * @param array<int, int> $allowedDepartmentIds
      * @param array<int, int> $forcedCustomerNumbers
      * @return array<int, array<string, mixed>>
      */
@@ -316,6 +325,7 @@ class system_search_service
         array $permissionsCatalogAll,
         array $permissionsCatalogOwn,
         array $moduleConfigVisibility,
+        array $allowedDepartmentIds = [],
         array $forcedCustomerNumbers = []
     ): array {
         $results = [];
@@ -334,6 +344,7 @@ class system_search_service
                     $ownOnly,
                     $ownCustomerNumber,
                     $moduleConfigVisibility,
+                    $allowedDepartmentIds,
                     $forcedCustomerNumbers
                 );
                 if (empty($rows)) {
@@ -346,6 +357,7 @@ class system_search_service
                         $permissionsCatalogAll,
                         $permissionsCatalogOwn,
                         $moduleConfigVisibility,
+                        $allowedDepartmentIds,
                         $forcedCustomerNumbers
                     );
                 }
@@ -359,6 +371,7 @@ class system_search_service
                     $permissionsCatalogAll,
                     $permissionsCatalogOwn,
                     $moduleConfigVisibility,
+                    $allowedDepartmentIds,
                     $forcedCustomerNumbers
                 );
             }
@@ -372,6 +385,7 @@ class system_search_service
      * @param array<string, string> $permissionsCatalogAll
      * @param array<int, string> $permissionsCatalogOwn
      * @param array<string, bool> $moduleConfigVisibility
+     * @param array<int, int> $allowedDepartmentIds
      * @param array<int, int> $forcedCustomerNumbers
      * @return array<int, array<string, mixed>>
      */
@@ -384,6 +398,7 @@ class system_search_service
         array $permissionsCatalogAll,
         array $permissionsCatalogOwn,
         array $moduleConfigVisibility,
+        array $allowedDepartmentIds,
         array $forcedCustomerNumbers
     ): array {
         if ($this->isGenericEntityType($entityType)) {
@@ -393,6 +408,7 @@ class system_search_service
                 $entityBoost,
                 $ownOnly,
                 $ownCustomerNumber,
+                $allowedDepartmentIds,
                 $forcedCustomerNumbers
             );
         }
@@ -439,9 +455,24 @@ class system_search_service
         return empty(array_intersect($normalizedDirty, system_search_registry::sourceTablesForEntityType($entityType)));
     }
 
+    private function indexedEntitySupportsDepartmentFilter(string $entityType): bool
+    {
+        $entityType = trim(mb_strtolower($entityType));
+        if (in_array($entityType, ['orders', 'objects'], true)) {
+            return true;
+        }
+
+        $config = system_search_registry::genericEntityConfigs()[$entityType] ?? null;
+        return is_array($config)
+            && isset($config['department_field'])
+            && is_string($config['department_field'])
+            && trim($config['department_field']) !== '';
+    }
+
     /**
      * @param array<int, string> $terms
      * @param array<string, bool> $moduleConfigVisibility
+     * @param array<int, int> $allowedDepartmentIds
      * @param array<int, int> $forcedCustomerNumbers
      * @return array<int, array<string, mixed>>
      */
@@ -452,6 +483,7 @@ class system_search_service
         bool $ownOnly,
         ?int $ownCustomerNumber,
         array $moduleConfigVisibility,
+        array $allowedDepartmentIds,
         array $forcedCustomerNumbers
     ): array {
         global $db;
@@ -473,6 +505,9 @@ class system_search_service
         if (!empty($customerNumbers)) {
             $wheres[] = "`customer_number` IN (" . implode(',', array_map('intval', $customerNumbers)) . ")";
         }
+        if (!empty($allowedDepartmentIds) && $this->indexedEntitySupportsDepartmentFilter($entityType)) {
+            $wheres[] = "`department_id` IN (" . implode(',', array_map('intval', $allowedDepartmentIds)) . ")";
+        }
 
         $booleanQuery = $this->buildBooleanFullTextQuery($terms);
         $rows = [];
@@ -1488,6 +1523,7 @@ class system_search_service
 
     /**
      * @param array<int, string> $terms
+     * @param array<int, int> $allowedDepartmentIds
      * @param array<int, int> $forcedCustomerNumbers
      * @return array<int, array<string, mixed>>
      */
@@ -1497,6 +1533,7 @@ class system_search_service
         int $entityBoost,
         bool $ownOnly,
         ?int $ownCustomerNumber,
+        array $allowedDepartmentIds = [],
         array $forcedCustomerNumbers = []
     ): array {
         if (empty($terms)) {
@@ -1602,7 +1639,9 @@ class system_search_service
             $customerNumbers,
             $customerField,
             $customerFieldMode,
-            $fixedConditions
+            $fixedConditions,
+            $allowedDepartmentIds,
+            $departmentField
         );
 
         $this->primeCustomerContexts(array_values(array_unique(array_filter(
@@ -1798,6 +1837,8 @@ class system_search_service
      * @param string|null $customerField
      * @param string $customerFieldMode
      * @param array<string, mixed> $fixedConditions
+     * @param array<int, int> $departmentIds
+     * @param string|null $departmentField
      * @return array<int, array<string, mixed>>
      */
     private function searchTable(
@@ -1808,7 +1849,9 @@ class system_search_service
         array $customerNumbers = [],
         ?string $customerField = null,
         string $customerFieldMode = 'default',
-        array $fixedConditions = []
+        array $fixedConditions = [],
+        array $departmentIds = [],
+        ?string $departmentField = null
     ): array {
         global $db;
 
@@ -1844,6 +1887,10 @@ class system_search_service
             }
         }
 
+        if (!empty($departmentIds) && $departmentField !== null && in_array($departmentField, $fields, true)) {
+            $wheres[] = "`$departmentField` IN (" . implode(',', array_map('intval', $departmentIds)) . ")";
+        }
+
         $termClauses = [];
         foreach ($terms as $term) {
             $escaped = $db->escape_string($term);

services/nginx/app/classes/workfeed.php

@@ -6,6 +6,7 @@ require_once WD . '/modules/workfeed/workfeed_c.php';
 
 use Exception;
 use interfaces\workfeed_i;
+use workfeed\config\workfeed_api_url_c;
 use workfeed\workfeed_c;
 
 class workfeed implements workfeed_i
@@ -84,7 +85,7 @@ class workfeed implements workfeed_i
         $companyId = $this->requireConfiguredCompanyId();
 
         $url = $this->buildUrl(
-            $this->config->api_url->getVariableValue(),
+            workfeed_api_url_c::normalizeApiUrlForValidation((string)$this->config->api_url->getVariableValue()),
             '/companies/' . rawurlencode($companyId) . '/' . ltrim($path, '/'),
             $query
         );
@@ -182,7 +183,10 @@ class workfeed implements workfeed_i
     private function requireConfiguredApiUrl(): void
     {
         $url = trim((string)$this->config->api_url->getVariableValue());
-        if ($url === '' || filter_var($this->normalizeUrlForValidation($url), FILTER_VALIDATE_URL) === false) {
+        if ($url === ''
+            || filter_var(workfeed_api_url_c::normalizeApiUrlForValidation($url), FILTER_VALIDATE_URL) === false
+            || !workfeed_api_url_c::isTrustedApiUrl($url)
+        ) {
             throw new Exception('Invalid Workfeed API URL configured.');
         }
     }
@@ -210,15 +214,6 @@ class workfeed implements workfeed_i
         return $companyId;
     }
 
-    private function normalizeUrlForValidation(string $url): string
-    {
-        if (preg_match('#^https?://#i', $url)) {
-            return $url;
-        }
-
-        return 'https://' . ltrim($url, '/');
-    }
-
     /**
      * @throws Exception
      */

services/nginx/app/composer.json

@@ -1,6 +1,10 @@
 {
     "scripts": {
         "test": "composer test:unit",
+        "analyse": "vendor/bin/phpstan analyse --configuration=phpstan.neon.dist --memory-limit=1G --no-progress",
+        "static": "@analyse",
+        "rector:dry-run": "@php -d error_reporting=0 -d display_errors=0 -d log_errors=0 vendor/bin/rector process --dry-run --config rector.php",
+        "rector:fix": "@php -d error_reporting=0 -d display_errors=0 -d log_errors=0 vendor/bin/rector process --config rector.php",
         "test:unit": "vendor/bin/pest --testsuite=Unit --colors=always",
         "test:integration": "vendor/bin/pest --testsuite=Integration --colors=always",
         "test:api": [

services/nginx/app/cron/Cron.php

@@ -19,6 +19,8 @@ use classes\slack as Slack;
 use classes\email as Email;
 use classes\gatewayapi as GatewayAPI;
 use dynamicimages\images\machine_1;
+use modules\selfserve\config\selfserve_dynamic_image_size_c;
+use modules\selfserve\selfserve_c;
 use goals\classes\goals_criteria;
 use goals\services\goals_progress_alert_renderer;
 use goals\helpers\goals_criteria_progress_alert_destination as Dest;
@@ -33,6 +35,8 @@ use objects\users_o;
 use routes\moduleWeatherAPIRoute;
 
 require_once __DIR__ . '/../classes/economic_transfer_executor.php';
+
+const DYNAMIC_IMAGE_RELEVANT_MAX_WIDTH = 1600;
 require_once __DIR__ . '/../classes/economic_transfer_queue_schema_bootstrap.php';
 require_once __DIR__ . '/../classes/economic_transfer_queue.php';
 require_once __DIR__ . '/../classes/workfeed_employee_name_formatter.php';
@@ -930,6 +934,7 @@ function buildDynamicImageCacheKey(array $variant): string
         'current_step' => (int)($variant['current_step'] ?? 0),
         'only_current_step' => (bool)($variant['only_current_step'] ?? false),
         'vehicle_type' => $variant['vehicle_type'] ?? null,
+        'dynamic_image_size' => getSelfServeDynamicImageSizeModeForCron(),
     ];
 
     $json = json_encode($cacheParams);
@@ -962,16 +967,11 @@ function renderDynamicImageVariant(int $dynamicImageId, ?array $buttons, int $cu
         $image->current_step = max(0, $currentStep);
         $image->only_generate_current_step = $onlyCurrentStep;
         $image->setup();
+        if (getSelfServeDynamicImageSizeModeForCron() === selfserve_dynamic_image_size_c::SIZE_RELEVANT) {
+            $image->resizeToMaxWidth(DYNAMIC_IMAGE_RELEVANT_MAX_WIDTH);
+        }
 
-        $dataUri = $image->exportAsBase64('png');
+        return $image->exportBinary('png');
-        if (!preg_match('/^data:image\/png;base64,(.*)$/', $dataUri, $matches)) {
-            return null;
-        }
-        $imageData = base64_decode($matches[1], true);
-        if ($imageData === false) {
-            return null;
-        }
-        return $imageData;
     } catch (Throwable $e) {
         warn('PreRenderDynamicImagesCron: render failed for dynamic_image_id=' . $dynamicImageId . ': ' . $e->getMessage());
         return null;
@@ -985,6 +985,19 @@ function renderDynamicImageVariant(int $dynamicImageId, ?array $buttons, int $cu
     }
 }
 
+function getSelfServeDynamicImageSizeModeForCron(): string
+{
+    try {
+        $mode = (string)(new selfserve_c())->dynamic_image_size->getVariableValue();
+    } catch (Throwable) {
+        return selfserve_dynamic_image_size_c::SIZE_ORIGINAL;
+    }
+
+    return in_array($mode, [selfserve_dynamic_image_size_c::SIZE_ORIGINAL, selfserve_dynamic_image_size_c::SIZE_RELEVANT], true)
+        ? $mode
+        : selfserve_dynamic_image_size_c::SIZE_ORIGINAL;
+}
+
 /**
  * @param mixed $value
  * @return array<int|string>

services/nginx/app/file_server.php

@@ -5,6 +5,21 @@ $isPreview = $_GET['preview'] ?? false;
 // Remove query string if present
 $file = strtok($file, '?');
 
+// Require authentication for direct /files/ access
+if (str_contains($file, '/files/')) {
+    $headers = getallheaders();
+    $token = $_GET['token'] ?? $_POST['token'] ?? ($headers['Authorization'] ?? null);
+    if (!empty($token)) {
+        $token = str_replace('Bearer ', '', $token);
+    }
+
+    if (empty($token) || !(new \classes\authentication())->validate_token($token)) {
+        header('HTTP/1.1 401 Unauthorized');
+        echo 'Unauthorized';
+        exit;
+    }
+}
+
 $isPDF = false;
 $isPDFStore = false;
 $isAttachment = false;
@@ -40,20 +55,6 @@ if ($isPDF && $isPDFStore) {
 
     // Check if the certificate exists
     if (!$wash_certificate_store->isFileInStore($file)) {
-        // Try the PDF store
-        $pdf_store = new \classes\pdf_store();
-        if ($pdf_store->isFileInStore(str_replace('/files/', '', $file))) {
-            // Download the certificate from the PDF store to /tmp
-            $certificate_path = $pdf_store->download(str_replace('/files/', '', $file));
-            // Send the certificate to the client
-            header('Content-Type: application/pdf');
-            header('Content-Disposition: inline; filename="' . str_replace('/files/', '', $file) . '"');
-            header('Content-Length: ' . filesize($certificate_path));
-            readfile($certificate_path);
-            // Delete the certificate from /tmp after sending it
-            unlink($certificate_path);
-            exit;
-        }
         echo 'Certificate not found in store' . $file;
         //header('HTTP/1.1 404 Not Found');
         exit;
@@ -118,4 +119,4 @@ if (!$isPDF) {
     // Delete the file from /tmp after sending it
     unlink($file_path);
     exit;
-}
+}

services/nginx/app/index.php

@@ -61,6 +61,17 @@ try {
 spl_autoload_register(function (string $class): void {
     $class = ltrim($class, '\\');
     $cache_key = 'autoload:' . $class;
+    $wdReal = rtrim((string) realpath(WD), DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR;
+    $modulesRoot = $wdReal . 'modules' . DIRECTORY_SEPARATOR;
+    $isPathInside = static function (string $path, string $root): bool {
+        $resolved = realpath($path);
+        if ($resolved === false) {
+            return false;
+        }
+
+        $resolved = rtrim($resolved, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR;
+        return str_starts_with($resolved, $root);
+    };
     $is_loaded = static function (string $candidate): bool {
         return class_exists($candidate, false)
             || interface_exists($candidate, false)
@@ -73,11 +84,13 @@ spl_autoload_register(function (string $class): void {
         try {
             $cached = redis->get($cache_key);
             if (is_string($cached) && $cached !== '' && is_file($cached)) {
-                require_once $cached;
+                if ($isPathInside($cached, $wdReal)) {
-                if ($is_loaded($class)) {
+                    require_once $cached;
-                    return;
+                    if ($is_loaded($class)) {
+                        return;
+                    }
                 }
-                // Stale class mapping in cache, continue with normal lookup.
+                // Stale, invalid, or unsafe class mapping in cache; continue with normal lookup.
                 redis->delete($cache_key);
             } elseif (is_string($cached) && $cached !== '') {
                 // Remove non-existing cached path to avoid repeated failed lookups.
@@ -120,6 +133,18 @@ spl_autoload_register(function (string $class): void {
                     $module_dirs = redis->get_array('autoload:module_dirs');
                 } catch (\Throwable $e) {}
             }
+
+            if (is_array($module_dirs)) {
+                $module_dirs = array_values(array_filter($module_dirs, static function ($item) use ($base, $modulesRoot, $isPathInside): bool {
+                    if (!is_string($item) || $item === '' || str_contains($item, DIRECTORY_SEPARATOR) || str_contains($item, '..')) {
+                        return false;
+                    }
+
+                    $candidate = $base . 'modules' . DIRECTORY_SEPARATOR . $item;
+                    return is_dir($candidate) && $isPathInside($candidate, $modulesRoot);
+                }));
+            }
+
             if ($module_dirs === null) {
                 $module_dirs = array_filter(scandir($base . 'modules'), function($item) use ($base) {
                     return $item !== '.' && $item !== '..' && is_dir($base . 'modules' . DIRECTORY_SEPARATOR . $item);
@@ -237,11 +262,6 @@ if (php_sapi_name() === 'cli' || isset($_GET['internalCronCall'])) {
     exit;
 }
 
-// If the route ends with .php, then require the file_server.php
-if (str_contains($_SERVER['REQUEST_URI'], '.pdf')) {
-    require_once 'file_server.php';
-    exit;
-}
 // If the route ends with a MIME type, then require the file_server.php
 if ((preg_match('/\.(jpg|jpeg|png)$/', $_SERVER['REQUEST_URI']) || str_contains($_SERVER['REQUEST_URI'], '/files/'))) {
     require_once 'file_server.php';

services/nginx/app/interfaces/licenseplaterecognizer_i.php

@@ -12,10 +12,35 @@ interface licenseplaterecognizer_i extends universal_module_i
      * @return array An array containing the plate number and other relevant information.
      */
     public function licenseplaterecognizer(string $base64_image): array;
+
+    /**
+     * Get the plate number from raw uploaded image bytes.
+     * @param string $image_data Raw uploaded image bytes.
+     * @param string $mime_type The image MIME type.
+     * @return array An array containing the plate number and other relevant information.
+     */
+    public function licenseplaterecognizerUpload(string $image_data, string $mime_type = 'image/jpeg'): array;
+
+    /**
+     * Get the plate number from raw uploaded image bytes without building an exact-result cache key.
+     * @param string $image_data Raw uploaded image bytes.
+     * @param string $mime_type The image MIME type.
+     * @return array An array containing the plate number and other relevant information.
+     */
+    public function licenseplaterecognizerUploadUncached(string $image_data, string $mime_type = 'image/jpeg'): array;
+
+    /**
+     * Get the plate number from a PHP upload temp file without copying it into memory.
+     * @param string $image_path The uploaded image temp-file path.
+     * @param string $mime_type The image MIME type.
+     * @return array An array containing the plate number and other relevant information.
+     */
+    public function licenseplaterecognizerUploadFile(string $image_path, string $mime_type = 'image/jpeg'): array;
+
     /**
      * Get usage information about the license plate recognizer module.
      * @returns licenseplaterecognizer_info An object containing usage statistics and information.
      * @see licenseplaterecognizer_info
      */
     public function get_usage(): licenseplaterecognizer_info;
-}
+}

services/nginx/app/modules/attachments/helpers/attachment_content.php

@@ -5,6 +5,7 @@ namespace attachments\helpers;
 class attachment_content
 {
     const OTHER_TYPE_WASH_CERTIFICATE = 'WASH_CERTIFICATE';
+    const OTHER_TYPE_SELF_SERVE_WASH = 'SELF_SERVE_WASH';
     public ?string $image; // Used to store the attachment object name, in the attachment store.
     public ?string $document; // Used to store the attachment object name, in the attachment store.
     public ?attachment_relation $relation; // Used to store the attachment relation object.
@@ -49,4 +50,4 @@ class attachment_content
         $this->relation = $relation;
         return $this;
     }
-}
+}

services/nginx/app/modules/coolify/config/coolify_github_runner_backend_repository_c.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace modules\coolify\config;
+
+use traits\module_config_variable;
+
+class coolify_github_runner_backend_repository_c
+{
+    use module_config_variable;
+
+    public function __construct()
+    {
+        $this->setupConfigVariable(
+            'Coolify',
+            'github_runner_backend_repository',
+            'string',
+            false,
+            null,
+            'GitHub backend repository that receives Coolify-managed self-hosted runners.',
+            'copenhagentruckwash/api',
+            false,
+            'copenhagentruckwash/api'
+        );
+    }
+}

services/nginx/app/modules/coolify/config/coolify_github_runner_count_per_repo_c.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace modules\coolify\config;
+
+use traits\module_config_variable;
+
+class coolify_github_runner_count_per_repo_c
+{
+    use module_config_variable;
+
+    public function __construct()
+    {
+        $this->setupConfigVariable(
+            'Coolify',
+            'github_runner_count_per_repo',
+            'int',
+            false,
+            null,
+            'Number of self-hosted GitHub runner containers to deploy per repository.',
+            '1',
+            false,
+            '1'
+        );
+    }
+}

services/nginx/app/modules/coolify/config/coolify_github_runner_frontend_repository_c.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace modules\coolify\config;
+
+use traits\module_config_variable;
+
+class coolify_github_runner_frontend_repository_c
+{
+    use module_config_variable;
+
+    public function __construct()
+    {
+        $this->setupConfigVariable(
+            'Coolify',
+            'github_runner_frontend_repository',
+            'string',
+            false,
+            null,
+            'GitHub frontend repository that receives Coolify-managed self-hosted runners.',
+            'copenhagentruckwash/pleno-vue',
+            false,
+            'copenhagentruckwash/pleno-vue'
+        );
+    }
+}

services/nginx/app/modules/coolify/config/coolify_github_runner_labels_c.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace modules\coolify\config;
+
+use traits\module_config_variable;
+
+class coolify_github_runner_labels_c
+{
+    use module_config_variable;
+
+    public function __construct()
+    {
+        $this->setupConfigVariable(
+            'Coolify',
+            'github_runner_labels',
+            'string',
+            false,
+            null,
+            'Comma-separated GitHub Actions runner labels registered on each Coolify-managed runner.',
+            'self-hosted,Linux,X64,default',
+            false,
+            'self-hosted,Linux,X64,default'
+        );
+    }
+}

services/nginx/app/modules/coolify/config/coolify_github_runner_service_uuid_c.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace modules\coolify\config;
+
+use traits\module_config_variable;
+
+class coolify_github_runner_service_uuid_c
+{
+    use module_config_variable;
+
+    public function __construct()
+    {
+        $this->setupConfigVariable(
+            'Coolify',
+            'github_runner_service_uuid',
+            'string',
+            false,
+            null,
+            'Coolify service UUID for the managed GitHub self-hosted runner stack.',
+            'abc123...',
+            false,
+            ''
+        );
+    }
+}

services/nginx/app/modules/coolify/config/coolify_github_runner_token_c.php

@@ -0,0 +1,38 @@
+<?php
+
+namespace modules\coolify\config;
+
+use classes\replication_secret_box;
+use traits\module_config_variable;
+
+class coolify_github_runner_token_c
+{
+    use module_config_variable {
+        setVariableValue as private traitSetVariableValue;
+    }
+
+    public function __construct()
+    {
+        $this->setupConfigVariable(
+            'Coolify',
+            'github_runner_token',
+            'string',
+            false,
+            null,
+            'GitHub PAT used to register Coolify-managed self-hosted repository runners.',
+            'github_pat_...',
+            true,
+            ''
+        );
+    }
+
+    public function setVariableValue(mixed $value): void
+    {
+        $value = trim((string)($value ?? ''));
+        if ($value !== '' && !str_starts_with($value, 'twsec:v1:')) {
+            $value = replication_secret_box::encrypt($value);
+        }
+
+        $this->traitSetVariableValue($value);
+    }
+}

services/nginx/app/modules/dynamicimages/interfaces/dynamicimages_image_i.php

@@ -86,6 +86,14 @@ interface dynamicimages_image_i
      */
     public function exportAsBase64(?string $format = null, int $quality = 90): string;
 
+    /**
+     * Export the composed image as binary image data.
+     * @param string|null $format Optional target format (e.g. 'png', 'jpeg')
+     * @param int $quality Quality for lossy formats (0-100)
+     * @return string binary image data
+     */
+    public function exportBinary(?string $format = null, int $quality = 90): string;
+
     /**
      * Directly serve the composed image to the client with proper headers.
      * Convenience wrapper for outputting binary image data.
@@ -94,4 +102,4 @@ interface dynamicimages_image_i
      * @param int $quality Quality for lossy formats (0-100)
      */
     public function servePicture(?string $format = null, int $quality = 90): void;
-}
+}

services/nginx/app/modules/dynamicimages/traits/dynamicimages_image_t.php

@@ -226,6 +226,20 @@ trait dynamicimages_image_t
         return $this;
     }
 
+    public function resizeToMaxWidth(int $maxWidth): dynamicimages_image_i
+    {
+        $this->assertCanvasInitialized();
+        if ($maxWidth <= 0) {
+            throw new \InvalidArgumentException('Resize max width must be a positive integer.');
+        }
+        if ($this->canvasWidth === null || $this->canvasHeight === null || $this->canvasWidth <= $maxWidth) {
+            return $this;
+        }
+
+        $height = (int)round($this->canvasHeight * ($maxWidth / $this->canvasWidth));
+        return $this->resize($maxWidth, max(1, $height));
+    }
+
     public function crop(int $width, int $height, int $x, int $y): dynamicimages_image_i
     {
         $this->assertCanvasInitialized();
@@ -307,20 +321,8 @@ trait dynamicimages_image_t
      */
     public function exportAsBase64(?string $format = null, int $quality = 90): string
     {
-        // If a canvas is initialized, export that as PNG by default
         if ($this->image instanceof \Imagick) {
-            $img = clone $this->image;
+            return 'data:image/png;base64,' . base64_encode($this->exportBinary($format, $quality));
-            $img->setImageFormat('png');
-            // Quality influences compression for PNG differently; keep as hint
-            if ($format !== null && strtolower($format) !== 'png') {
-                // For now we only support PNG for composed images as requested
-            }
-            // Strip metadata to reduce size
-            $img->stripImage();
-            $blob = $img->getImageBlob();
-            $img->clear();
-            $img->destroy();
-            return 'data:image/png;base64,' . base64_encode($blob);
         }
 
         // Fallback: export first asset as-is
@@ -341,6 +343,40 @@ trait dynamicimages_image_t
         return 'data:' . $mime . ';base64,' . base64_encode($data);
     }
 
+    public function exportBinary(?string $format = null, int $quality = 90): string
+    {
+        // If a canvas is initialized, export that as PNG by default
+        if ($this->image instanceof \Imagick) {
+            $img = clone $this->image;
+            $img->setImageFormat('png');
+            // Quality influences compression for PNG differently; keep as hint
+            if ($format !== null && strtolower($format) !== 'png') {
+                // For now we only support PNG for composed images as requested
+            }
+            // Strip metadata to reduce size
+            $img->stripImage();
+            $blob = $img->getImageBlob();
+            $img->clear();
+            $img->destroy();
+            return $blob;
+        }
+
+        // Fallback: export first asset as-is
+        if (empty($this->assets)) {
+            throw new \RuntimeException('No assets available to export.');
+        }
+        $asset = $this->assets[0];
+        $path = $asset->getPath();
+        if (!is_readable($path)) {
+            throw new \RuntimeException('Asset is not readable: ' . $path);
+        }
+        $data = file_get_contents($path);
+        if ($data === false) {
+            throw new \RuntimeException('Failed to read asset: ' . $path);
+        }
+        return $data;
+    }
+
     public function getAsset(string $asset_name): ?dynamicimages_asset
     {
         foreach ($this->assets as $asset) {
@@ -357,22 +393,18 @@ trait dynamicimages_image_t
      */
     public function outputImage(?string $format = null, int $quality = 90): void
     {
-        $dataUri = $this->exportAsBase64($format, $quality);
+        $mimeType = 'image/png';
-        // Extract mime type and base64 data
+        if (!$this->image instanceof \Imagick && !empty($this->assets)) {
-        if (preg_match('/^data:(image\/[a-zA-Z0-9+.-]+);base64,(.*)$/', $dataUri, $matches)) {
+            $asset = $this->assets[0];
-            $mimeType = $matches[1];
+            $path = $asset->getPath();
-            $base64Data = $matches[2];
+            $imgInfo = is_readable($path) ? @getimagesize($path) : false;
-            // Decode base64 data
+            $mimeType = is_array($imgInfo) && isset($imgInfo['mime']) ? $imgInfo['mime'] : 'application/octet-stream';
-            $imageData = base64_decode($base64Data);
-            if ($imageData !== false) {
-                // Send appropriate headers
-                header('Content-Type: ' . $mimeType);
-                header('Content-Length: ' . strlen($imageData));
-                // Output the image data
-                echo $imageData;
-                exit;
-            }
         }
+        $imageData = $this->exportBinary($format, $quality);
+        header('Content-Type: ' . $mimeType);
+        header('Content-Length: ' . strlen($imageData));
+        echo $imageData;
+        exit;
     }
 
     /**
@@ -382,4 +414,4 @@ trait dynamicimages_image_t
     {
         $this->outputImage($format, $quality);
     }
-}
+}

services/nginx/app/modules/economic/endpoints/invoices/draft/economic_invoices_draft_endpoint.php

@@ -61,19 +61,47 @@ class economic_invoices_draft_endpoint
      * @throws Exception If the request fails
      */
     public function add_order(int $invoiceDraftId, orders_o $order, string $currency = 'DKK'): void
+    {
+        $this->add_orders($invoiceDraftId, [$order], $currency);
+    }
+
+    /**
+     * Add many orders to a draft invoice and flush their lines in batches.
+     *
+     * @param orders_o[] $orders
+     * @return array{order_count:int,orders_with_invoice_lines:int,line_count:int,batch_count:int,batch_sizes:array<int,int>}
+     * @throws Exception If the request fails
+     */
+    public function add_orders(int $invoiceDraftId, array $orders, string $currency = 'DKK', int $line_batch_size = 500): array
     {
         $draftInvoice = (new economic())->getInvoiceDraft($invoiceDraftId, strtoupper($currency), true);
-        // Check if the order includes any items that should be included in the invoice
+        $orders_with_invoice_lines = 0;
-        if ($order->getIncludeInInvoiceCount() > 0) {
+
+        foreach ( $orders as $order ) {
+            if (!$order instanceof orders_o) {
+                throw new Exception('Order payload must contain orders_o instances');
+            }
+            // Check if the order includes any items that should be included in the invoice
+            if ($order->getIncludeInInvoiceCount() <= 0) {
+                continue;
+            }
+
+            $orders_with_invoice_lines++;
             // Add the transaction header (Timestamp, department, etc.)
             $draftInvoice->addNewTransactionHeader($order);
             // Add the order lines
             $draftInvoice->addOrderItemLines($order);
             // Add an empty line, so the invoice is not empty
             $draftInvoice->addTextLine('');
-            // Save the draft invoice lines
-            $draftInvoice->addLines();
         }
+
+        $metrics = $draftInvoice->flushLinesInBatches($line_batch_size);
+
+        return [
+            'order_count' => count($orders),
+            'orders_with_invoice_lines' => $orders_with_invoice_lines,
+            ...$metrics,
+        ];
     }
 
     /**
@@ -151,4 +179,4 @@ class economic_invoices_draft_endpoint
             $draft_invoice->addLines();
         }
     }
-}
+}

services/nginx/app/modules/economic/helpers/economic_invoice_draft.php

@@ -10,6 +10,8 @@ use objects\orders_o;
 
 class economic_invoice_draft
 {
+    public const DEFAULT_LINE_BATCH_SIZE = 500;
+
     /**
      * The Economic draftInvoiceNumber
      * @var int $draft_invoice_number
@@ -110,13 +112,55 @@ class economic_invoice_draft
     }
 
     /**
-     * Add the lines to the draft invoice
+     * Add the lines to the draft invoice.
-     * @return void
      */
     public function addLines(): void
+    {
+        $this->flushLinesInBatches();
+    }
+
+    /**
+     * Add queued draft lines using chunked requests.
+     *
+     * @return array{line_count:int,batch_count:int,batch_sizes:array<int,int>}
+     */
+    public function flushLinesInBatches(int $batch_size = self::DEFAULT_LINE_BATCH_SIZE): array
+    {
+        $lines = array_values($this->draft_lines);
+        $line_count = count($lines);
+        if ($line_count === 0) {
+            return [
+                'line_count' => 0,
+                'batch_count' => 0,
+                'batch_sizes' => [],
+            ];
+        }
+
+        $batch_size = max(1, $batch_size);
+        $batch_sizes = [];
+        foreach (array_chunk($lines, $batch_size) as $batch) {
+            $this->sendDraftLines($batch);
+            $batch_sizes[] = count($batch);
+        }
+
+        $this->draft_lines = [];
+
+        return [
+            'line_count' => $line_count,
+            'batch_count' => count($batch_sizes),
+            'batch_sizes' => $batch_sizes,
+        ];
+    }
+
+    public function pendingLineCount(): int
+    {
+        return count($this->draft_lines);
+    }
+
+    protected function sendDraftLines(array $draft_lines): object
     {
         $economic = new economic();
-        $economic->invoices->draft->add_lines($this->draft_invoice_number, $this->draft_lines);
+        return $economic->invoices->draft->add_lines($this->draft_invoice_number, $draft_lines);
     }
 
     /**

services/nginx/app/modules/edgegateway/classes/edge_gateway_agent_artifact_locator.php

@@ -6,6 +6,7 @@ use Exception;
 
 class edge_gateway_agent_artifact_locator
 {
+    private const EDGE_AGENT_BUILD_ARTIFACT_DIRECTORY = 'build/install';
     private const ROUTER_ARTIFACT_DIRECTORY = 'resources/edge-gateway-agent';
     private const DEFAULT_MOUNTED_ARTIFACT_DIRECTORY = '/services/edge-agent/php-agent';
     private const DEFAULT_BAKED_ARTIFACT_DIRECTORY = '/opt/truckwash-edge-agent-artifacts';
@@ -30,6 +31,10 @@ class edge_gateway_agent_artifact_locator
 
         $candidateDirectories[] = self::routerArtifactDirectory($basePath);
 
+        foreach (self::edgeAgentBuildDirectories($basePath) as $directory) {
+            $candidateDirectories[] = $directory;
+        }
+
         $mountedArtifactDirectory = $mountedArtifactDirectory ?? self::mountedArtifactDirectory();
         if ($mountedArtifactDirectory !== null) {
             $candidateDirectories[] = self::normalizePath($mountedArtifactDirectory);
@@ -40,9 +45,9 @@ class edge_gateway_agent_artifact_locator
             $candidateDirectories[] = self::normalizePath($bakedArtifactDirectory);
         }
 
-        $candidateDirectories[] = self::normalizePath(dirname($basePath, 3) . DIRECTORY_SEPARATOR . 'services' . DIRECTORY_SEPARATOR . 'edge-agent' . DIRECTORY_SEPARATOR . 'php-agent');
+        foreach (self::legacyPhpAgentDirectories($basePath) as $directory) {
-        $candidateDirectories[] = self::normalizePath(dirname($basePath, 2) . DIRECTORY_SEPARATOR . 'edge-agent' . DIRECTORY_SEPARATOR . 'php-agent');
+            $candidateDirectories[] = $directory;
-        $candidateDirectories[] = self::normalizePath(dirname($basePath) . DIRECTORY_SEPARATOR . 'edge-agent' . DIRECTORY_SEPARATOR . 'php-agent');
+        }
 
         $paths = [];
         foreach (array_values(array_unique($candidateDirectories)) as $directory) {
@@ -102,6 +107,42 @@ class edge_gateway_agent_artifact_locator
         return self::normalizePath($basePath . DIRECTORY_SEPARATOR . self::ROUTER_ARTIFACT_DIRECTORY);
     }
 
+    /**
+     * @return array<int,string>
+     */
+    private static function edgeAgentBuildDirectories(string $basePath): array
+    {
+        $relative = str_replace('/', DIRECTORY_SEPARATOR, self::EDGE_AGENT_BUILD_ARTIFACT_DIRECTORY);
+        $directories = [
+            dirname($basePath, 4) . DIRECTORY_SEPARATOR . 'edge-agent' . DIRECTORY_SEPARATOR . $relative,
+            dirname($basePath, 3) . DIRECTORY_SEPARATOR . 'services' . DIRECTORY_SEPARATOR . 'edge-agent' . DIRECTORY_SEPARATOR . $relative,
+            dirname($basePath, 2) . DIRECTORY_SEPARATOR . 'edge-agent' . DIRECTORY_SEPARATOR . $relative,
+            dirname($basePath) . DIRECTORY_SEPARATOR . 'edge-agent' . DIRECTORY_SEPARATOR . $relative,
+        ];
+
+        if (DIRECTORY_SEPARATOR === '/') {
+            array_unshift($directories, '/edge-agent/' . self::EDGE_AGENT_BUILD_ARTIFACT_DIRECTORY);
+            $directories[] = '/services/edge-agent/' . self::EDGE_AGENT_BUILD_ARTIFACT_DIRECTORY;
+        }
+
+        return array_values(array_unique(array_map(
+            static fn(string $directory): string => self::normalizePath($directory),
+            $directories
+        )));
+    }
+
+    /**
+     * @return array<int,string>
+     */
+    private static function legacyPhpAgentDirectories(string $basePath): array
+    {
+        return [
+            self::normalizePath(dirname($basePath, 3) . DIRECTORY_SEPARATOR . 'services' . DIRECTORY_SEPARATOR . 'edge-agent' . DIRECTORY_SEPARATOR . 'php-agent'),
+            self::normalizePath(dirname($basePath, 2) . DIRECTORY_SEPARATOR . 'edge-agent' . DIRECTORY_SEPARATOR . 'php-agent'),
+            self::normalizePath(dirname($basePath) . DIRECTORY_SEPARATOR . 'edge-agent' . DIRECTORY_SEPARATOR . 'php-agent'),
+        ];
+    }
+
     private static function mountedArtifactDirectory(): ?string
     {
         if (DIRECTORY_SEPARATOR !== '/') {

services/nginx/app/modules/edgegateway/classes/edge_gateway_install_service.php

@@ -7,6 +7,7 @@ use Exception;
 class edge_gateway_install_service
 {
     private const ARTIFACTS = [
+        'manifest.json' => 'application/json; charset=utf-8',
         'agent.php' => 'application/x-httpd-php; charset=utf-8',
         'lan-worker.php' => 'application/x-httpd-php; charset=utf-8',
         'auto-updater.php' => 'application/x-httpd-php; charset=utf-8',
@@ -26,7 +27,7 @@ class edge_gateway_install_service
 
     public function buildInstallScript(string $plainToken): string
     {
-        return $this->manager()->buildInstallScript($plainToken);
+        return $this->normalizeLineEndings($this->manager()->buildInstallScript($plainToken));
     }
 
     /**
@@ -42,13 +43,17 @@ class edge_gateway_install_service
      */
     public function readArtifact(string $fileName): string
     {
+        if ($fileName === 'manifest.json') {
+            return $this->buildManifest();
+        }
+
         $path = $this->artifactPath($fileName);
         $contents = file_get_contents($path);
         if ($contents === false) {
             throw new Exception('Unable to read edge agent artifact');
         }
 
-        return $contents;
+        return $this->normalizeLineEndings($contents);
     }
 
     public function contentType(string $fileName): string
@@ -66,15 +71,55 @@ class edge_gateway_install_service
      */
     public function artifactPath(string $fileName): string
     {
-        if (!array_key_exists($fileName, self::ARTIFACTS)) {
+        if (!array_key_exists($fileName, self::ARTIFACTS) || $fileName === 'manifest.json') {
             throw new Exception('Unknown edge agent artifact');
         }
 
         return edge_gateway_agent_artifact_locator::resolve($fileName);
     }
 
+    /**
+     * @throws Exception
+     */
+    private function buildManifest(): string
+    {
+        $artifacts = [];
+        foreach (self::ARTIFACTS as $fileName => $contentType) {
+            if ($fileName === 'manifest.json') {
+                continue;
+            }
+
+            $path = $this->artifactPath($fileName);
+            $sha256 = hash_file('sha256', $path);
+            $bytes = filesize($path);
+            if ($sha256 === false || $bytes === false) {
+                throw new Exception('Unable to inspect edge agent artifact: ' . $fileName);
+            }
+
+            $artifacts[] = [
+                'name' => $fileName,
+                'sha256' => $sha256,
+                'bytes' => $bytes,
+                'content_type' => $contentType,
+            ];
+        }
+
+        return json_encode([
+            'schema_version' => 1,
+            'package' => 'truckwash-edge-agent',
+            'version' => edge_gateway_manager::DEFAULT_INSTALL_VERSION,
+            'generated_at' => gmdate('c'),
+            'artifacts' => $artifacts,
+        ], JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES) . PHP_EOL;
+    }
+
     private function manager(): edge_gateway_manager
     {
         return $this->manager ?? new edge_gateway_manager();
     }
+
+    private function normalizeLineEndings(string $contents): string
+    {
+        return str_replace(["\r\n", "\r"], "\n", $contents);
+    }
 }

services/nginx/app/modules/edgegateway/classes/edge_gateway_schema_bootstrap.php

@@ -18,8 +18,7 @@ class edge_gateway_schema_bootstrap
             return;
         }
 
-        global $db;
+        $pdo = self::pdo();
-
         $queries = [
             "CREATE TABLE IF NOT EXISTS edge_gateways (
                 id INT AUTO_INCREMENT PRIMARY KEY,
@@ -124,6 +123,31 @@ class edge_gateway_schema_bootstrap
                 INDEX idx_edge_gateway_command_type (command_type)
             ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
 
+            "CREATE TABLE IF NOT EXISTS edge_gateway_expected_relay_states (
+                id INT AUTO_INCREMENT PRIMARY KEY,
+                gateway_id INT NOT NULL,
+                department_id INT NOT NULL,
+                lane_id INT NOT NULL,
+                role VARCHAR(32) NOT NULL,
+                relay_id VARCHAR(255) NOT NULL,
+                device_id VARCHAR(255) NULL,
+                local_ip VARCHAR(64) NULL,
+                device_type VARCHAR(64) NOT NULL DEFAULT 'UNKNOWN',
+                expected_state TINYINT(1) NOT NULL DEFAULT 0,
+                updated_at DATETIME NOT NULL,
+                completed_at DATETIME NULL,
+                last_attempted_at DATETIME NULL,
+                last_error TEXT NULL,
+                metadata_json JSON NULL,
+                created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+                row_updated_at TIMESTAMP NULL DEFAULT NULL ON UPDATE CURRENT_TIMESTAMP,
+                deleted_at TIMESTAMP NULL DEFAULT NULL,
+                UNIQUE KEY uniq_edge_gateway_expected_relay_state (gateway_id, lane_id, role),
+                INDEX idx_edge_gateway_expected_relay_gateway (gateway_id),
+                INDEX idx_edge_gateway_expected_relay_department (department_id),
+                INDEX idx_edge_gateway_expected_relay_pending (gateway_id, completed_at)
+            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
+
             "CREATE TABLE IF NOT EXISTS edge_gateway_operations (
                 id INT AUTO_INCREMENT PRIMARY KEY,
                 gateway_id INT NOT NULL,
@@ -233,11 +257,18 @@ class edge_gateway_schema_bootstrap
         ];
 
         foreach ($queries as $sql) {
-            $db->query($sql);
+            $pdo->exec($sql);
         }
 
         self::ensureColumn('edge_gateway_command_jobs', 'delivery_json', 'JSON NULL AFTER response_json');
 
+        self::ensureColumn('edge_gateway_expected_relay_states', 'device_type', "VARCHAR(64) NOT NULL DEFAULT 'UNKNOWN' AFTER local_ip");
+        self::ensureColumn('edge_gateway_expected_relay_states', 'last_attempted_at', 'DATETIME NULL AFTER completed_at');
+        self::ensureColumn('edge_gateway_expected_relay_states', 'last_error', 'TEXT NULL AFTER last_attempted_at');
+        self::ensureColumn('edge_gateway_expected_relay_states', 'metadata_json', 'JSON NULL AFTER last_error');
+        self::ensureColumn('edge_gateway_expected_relay_states', 'row_updated_at', 'TIMESTAMP NULL DEFAULT NULL ON UPDATE CURRENT_TIMESTAMP AFTER created_at');
+        self::ensureColumn('edge_gateway_expected_relay_states', 'deleted_at', 'TIMESTAMP NULL DEFAULT NULL AFTER row_updated_at');
+
         self::ensureColumn('edge_gateway_relay_bindings', 'fallback_mode', "VARCHAR(32) NOT NULL DEFAULT 'PREFER_LOCAL' AFTER channel");
 
         self::ensureColumn('edge_gateway_operations', 'type', "VARCHAR(32) NOT NULL DEFAULT 'DISCOVERY' AFTER gateway_id");
@@ -304,8 +335,6 @@ class edge_gateway_schema_bootstrap
 
     private static function ensureColumn(string $table, string $column, string $definition): void
     {
-        global $db;
-
         if (self::tableHasColumn($table, $column)) {
             return;
         }
@@ -314,7 +343,7 @@ class edge_gateway_schema_bootstrap
             throw new \RuntimeException('Invalid schema bootstrap identifier');
         }
 
-        $db->query(
+        self::pdo()->exec(
             "ALTER TABLE `$table`
              ADD COLUMN `$column` $definition"
         );
@@ -327,8 +356,6 @@ class edge_gateway_schema_bootstrap
         string $definition,
         ?string $afterColumn = null
     ): void {
-        global $db;
-
         if (!self::tableHasColumn($table, $from) || self::tableHasColumn($table, $to)) {
             return;
         }
@@ -342,7 +369,7 @@ class edge_gateway_schema_bootstrap
 
         $positionClause = $afterColumn === null ? '' : " AFTER `$afterColumn`";
 
-        $db->query(
+        self::pdo()->exec(
             "ALTER TABLE `$table`
              CHANGE COLUMN `$from` `$to` $definition$positionClause"
         );
@@ -350,38 +377,35 @@ class edge_gateway_schema_bootstrap
 
     private static function tableHasColumn(string $table, string $column): bool
     {
-        global $db;
+        if (!preg_match('/^[A-Za-z0-9_]+$/', $table) || !preg_match('/^[A-Za-z0-9_]+$/', $column)) {
-
+            throw new \RuntimeException('Invalid schema bootstrap identifier');
-        $table = $db->escape_string($table);
-        $column = $db->escape_string($column);
-        $database = $db->escape_string($db->getDatabase());
-
-        $result = $db->query(
-            "SELECT COUNT(*) AS c
-             FROM information_schema.COLUMNS
-             WHERE TABLE_SCHEMA = '$database'
-               AND TABLE_NAME = '$table'
-               AND COLUMN_NAME = '$column'"
-        );
-
-        if (!$result) {
-            return false;
         }
 
-        $row = $result->fetch_assoc();
+        $statement = self::pdo()->prepare(
+            "SELECT COUNT(*) AS c
+             FROM information_schema.COLUMNS
+             WHERE TABLE_SCHEMA = DATABASE()
+               AND TABLE_NAME = :table
+               AND COLUMN_NAME = :column"
+        );
+        $statement->execute([
+            ':table' => $table,
+            ':column' => $column,
+        ]);
+
+        $row = $statement->fetch();
         return ((int)($row['c'] ?? 0)) > 0;
     }
 
     private static function syncOperationTypeColumns(): void
     {
-        global $db;
-
         if (!self::tableHasColumn('edge_gateway_operations', 'type')
             || !self::tableHasColumn('edge_gateway_operations', 'operation_type')) {
             return;
         }
 
-        $db->query(
+        $pdo = self::pdo();
+        $pdo->exec(
             "UPDATE edge_gateway_operations
              SET type = operation_type
              WHERE operation_type IS NOT NULL
@@ -389,7 +413,7 @@ class edge_gateway_schema_bootstrap
                AND (type IS NULL OR type = '' OR type <> operation_type)"
         );
 
-        $db->query(
+        $pdo->exec(
             "UPDATE edge_gateway_operations
              SET operation_type = type
              WHERE type IS NOT NULL
@@ -397,4 +421,88 @@ class edge_gateway_schema_bootstrap
                AND (operation_type IS NULL OR operation_type = '')"
         );
     }
+
+    private static function pdo(): \PDO
+    {
+        $envConfig = self::databaseConfigFromEnvironment();
+        if ($envConfig !== null) {
+            return self::connectPdo($envConfig);
+        }
+
+        if (!class_exists(db::class, false)) {
+            $dbClassPath = __DIR__ . '/../../../classes/db.php';
+            if (is_file($dbClassPath)) {
+                require_once $dbClassPath;
+            }
+        }
+
+        if (!class_exists(db::class)) {
+            throw new \RuntimeException('Database connection helper is not available.');
+        }
+
+        return db::getPDO();
+    }
+
+    /**
+     * @return array{host:string,user:string,password:string,database:string,port:int}|null
+     */
+    private static function databaseConfigFromEnvironment(): ?array
+    {
+        $target = strtolower(self::envString('CONFIG_DB_TARGET') ?: 'live');
+        if ($target !== 'debug') {
+            $target = 'live';
+        }
+
+        $host = self::databaseEnvValue('HOST', $target);
+        $user = self::databaseEnvValue('USER', $target);
+        $database = self::databaseEnvValue('DATABASE', $target);
+        if ($host === '' || $user === '' || $database === '') {
+            return null;
+        }
+
+        return [
+            'host' => $host,
+            'user' => $user,
+            'password' => self::databaseEnvValue('PASSWORD', $target),
+            'database' => $database,
+            'port' => (int)(self::databaseEnvValue('PORT', $target) ?: 3306),
+        ];
+    }
+
+    private static function databaseEnvValue(string $key, string $target): string
+    {
+        $liveValue = self::envString('CONFIG_DB_' . $key);
+        $debugValue = self::envString('CONFIG_DB_DEBUG_' . $key);
+
+        if ($target === 'debug' && $debugValue !== '') {
+            return $debugValue;
+        }
+
+        return $liveValue;
+    }
+
+    private static function envString(string $key): string
+    {
+        $value = getenv($key);
+        if ($value === false || $value === null) {
+            $value = $_ENV[$key] ?? $_SERVER[$key] ?? '';
+        }
+
+        return trim((string)$value);
+    }
+
+    /**
+     * @param array{host:string,user:string,password:string,database:string,port:int} $config
+     */
+    private static function connectPdo(array $config): \PDO
+    {
+        $port = $config['port'] > 0 ? $config['port'] : 3306;
+        $dsn = "mysql:host={$config['host']};port={$port};dbname={$config['database']};charset=utf8mb4";
+
+        return new \PDO($dsn, $config['user'], $config['password'], [
+            \PDO::ATTR_ERRMODE => \PDO::ERRMODE_EXCEPTION,
+            \PDO::ATTR_DEFAULT_FETCH_MODE => \PDO::FETCH_ASSOC,
+            \PDO::ATTR_EMULATE_PREPARES => false,
+        ]);
+    }
 }

services/nginx/app/modules/edgegateway/edgegateway_c.php

@@ -41,7 +41,6 @@ class edgegateway_c
             edgegateway_broker_url_c::class,
             edgegateway_public_broker_url_c::class,
             edgegateway_broker_auth_mode_c::class,
-            edgegateway_broker_shared_secret_c::class,
         ]);
         $this->enabled = new edgegateway_enabled_c();
         $this->default_release_channel = new edgegateway_default_release_channel_c();

services/nginx/app/modules/edgegateway/routes/edgeGatewayConfigRoute.php

@@ -39,7 +39,15 @@ class edgeGatewayConfigRoute
         }
 
         (new logs_o())->add('edgegateway_config', 'global', 1, $user->id, 'EDGEGATEWAY_CONFIG', 'Successfully fetched edge gateway config');
-        $response->success((new edgegateway())->config->getConfigRequest());
+        $config = (new edgegateway())->config->getConfigRequest();
+        foreach ($config as &$entry) {
+            if (($entry['variable'] ?? null) === 'broker_shared_secret') {
+                $entry['value'] = '';
+            }
+        }
+        unset($entry);
+
+        $response->success($config);
     }
 
     private function handlePostConfig(): void
@@ -71,7 +79,12 @@ class edgeGatewayConfigRoute
         }
 
         $payload = self::getParametersAsArray();
+        $diagnosticOptions = array_intersect_key($payload, array_flip([
+            'target',
+            'broker_auth_mode',
+            'broker_shared_secret',
+        ]));
         (new logs_o())->add('edgegateway_config', 'global', 1, $user->id, 'EDGEGATEWAY_BROKER_DIAGNOSTICS', 'Tested edge gateway broker config');
-        $response->success((new edge_gateway_manager())->diagnoseBrokerConfiguration($payload));
+        $response->success((new edge_gateway_manager())->diagnoseBrokerConfiguration($diagnosticOptions));
     }
 }

services/nginx/app/modules/edgegateway/routes/edgeGatewaysRoute.php

@@ -81,6 +81,7 @@ class edgeGatewaysRoute
         $this->get('/edge-agent/install-token/verify', fn() => $this->handleInstallTokenVerify());
         $this->post('/edge-agent/install-token/status', fn() => $this->handleAgentInstallTokenStatus());
         $this->get('/edge-agent/install.sh', fn() => $this->renderInstallScript());
+        $this->get('/edge-agent/artifacts/manifest.json', fn() => $this->renderArtifact('manifest.json'));
         $this->get('/edge-agent/artifacts/agent.php', fn() => $this->renderArtifact('agent.php'));
         $this->get('/edge-agent/artifacts/lan-worker.php', fn() => $this->renderArtifact('lan-worker.php'));
         $this->get('/edge-agent/artifacts/auto-updater.php', fn() => $this->renderArtifact('auto-updater.php'));
@@ -98,6 +99,8 @@ class edgeGatewaysRoute
         $this->post('/edge-agent/gateways/{id}/operations/{operationId}/complete', fn() => $this->handleAgentOperationComplete());
         $this->post('/edge-agent/gateways/{id}/commands/poll', fn() => $this->handleAgentCommandPoll());
         $this->post('/edge-agent/gateways/{id}/commands/{jobId}/result', fn() => $this->handleAgentCommandResult());
+        $this->post('/edge-agent/gateways/{id}/expected-relay-states', fn() => $this->handleAgentExpectedRelayStates());
+        $this->post('/edge-agent/gateways/{id}/relay-state-results', fn() => $this->handleAgentRelayStateResults());
         $this->post('/edge-agent/gateways/{id}/presence', fn() => $this->handleAgentPresence());
         $this->post('/edge-agent/gateways/{id}/selfserve/machine-signal-bindings', fn() => $this->handleAgentSelfserveMachineSignalBindings());
         $this->post('/edge-agent/gateways/{id}/selfserve/machine-signal', fn() => $this->handleAgentSelfserveMachineSignal());
@@ -109,6 +112,7 @@ class edgeGatewaysRoute
         $this->post('/edge-agent/internal/gateways/{id}/operations/{operationId}/events', fn() => $this->handleBrokerOperationEvent());
         $this->post('/edge-agent/internal/gateways/{id}/operations/{operationId}/complete', fn() => $this->handleBrokerOperationComplete());
         $this->post('/edge-agent/internal/gateways/{id}/logs', fn() => $this->handleBrokerGatewayLogEntry());
+        $this->post('/edge-agent/internal/gateways/{id}/selfserve/machine-signal', fn() => $this->handleBrokerSelfserveMachineSignal());
         $this->post('/edge-agent/internal/browser-streams/validate', fn() => $this->handleBrokerBrowserStreamValidate());
         $this->post('/edge-agent/internal/shell-sessions/validate', fn() => $this->handleBrokerShellSessionValidate());
         $this->post('/edge-agent/internal/shell-sessions/opened', fn() => $this->handleBrokerShellSessionOpened());
@@ -398,7 +402,11 @@ class edgeGatewaysRoute
             $response->error('Missing token', 400);
         }
 
-        $response->success($this->install()->verifyInstallToken($token));
+        try {
+            $response->success($this->install()->verifyInstallToken($token));
+        } catch (Exception $exception) {
+            $response->error($exception->getMessage(), 400);
+        }
     }
 
     private function handleAgentInstallTokenStatus(): void
@@ -407,17 +415,21 @@ class edgeGatewaysRoute
         self::requireParameters(['token', 'status']);
 
         $payload = self::getParametersAsArray();
-        $response->success($this->registry()->reportInstallTokenStatus(
+        try {
-            (string)$payload['token'],
+            $response->success($this->registry()->reportInstallTokenStatus(
-            [
+                (string)$payload['token'],
-                'status' => (string)$payload['status'],
+                [
-                'step' => isset($payload['step']) ? (string)$payload['step'] : null,
+                    'status' => (string)$payload['status'],
-                'message' => isset($payload['message']) ? (string)$payload['message'] : null,
+                    'step' => isset($payload['step']) ? (string)$payload['step'] : null,
-                'diagnostics' => isset($payload['diagnostics']) && is_array($payload['diagnostics']) ? (array)$payload['diagnostics'] : [],
+                    'message' => isset($payload['message']) ? (string)$payload['message'] : null,
-                'gateway_id' => isset($payload['gateway_id']) ? (int)$payload['gateway_id'] : null,
+                    'diagnostics' => isset($payload['diagnostics']) && is_array($payload['diagnostics']) ? (array)$payload['diagnostics'] : [],
-                'last_error' => isset($payload['last_error']) ? (string)$payload['last_error'] : null,
+                    'gateway_id' => isset($payload['gateway_id']) ? (int)$payload['gateway_id'] : null,
-            ]
+                    'last_error' => isset($payload['last_error']) ? (string)$payload['last_error'] : null,
-        ));
+                ]
+            ));
+        } catch (Exception $exception) {
+            $response->error($exception->getMessage(), 400);
+        }
     }
 
     private function renderArtifact(string $fileName): void
@@ -439,15 +451,19 @@ class edgeGatewaysRoute
         self::requireParameters(['token']);
         $payload = self::getParametersAsArray();
 
-        $response->success(
+        try {
-            $this->registry()->claimGateway(
+            $response->success(
-                (string)$payload['token'],
+                $this->registry()->claimGateway(
-                trim((string)($payload['hostname'] ?? gethostname() ?: 'unknown-gateway')),
+                    (string)$payload['token'],
-                isset($payload['installed_version']) ? (string)$payload['installed_version'] : null,
+                    trim((string)($payload['hostname'] ?? gethostname() ?: 'unknown-gateway')),
-                isset($payload['metadata']) && is_array($payload['metadata']) ? (array)$payload['metadata'] : []
+                    isset($payload['installed_version']) ? (string)$payload['installed_version'] : null,
-            ),
+                    isset($payload['metadata']) && is_array($payload['metadata']) ? (array)$payload['metadata'] : []
-            201
+                ),
-        );
+                201
+            );
+        } catch (Exception $exception) {
+            $response->error($exception->getMessage(), 400);
+        }
     }
 
     private function handleAgentHeartbeat(): void
@@ -555,6 +571,31 @@ class edgeGatewaysRoute
         ));
     }
 
+    private function handleAgentExpectedRelayStates(): void
+    {
+        global /** @var response $response */ $response;
+        $gatewayId = (int)$this->fromRoute('id');
+        $payload = self::getParametersAsArray();
+        $response->success($this->manager()->buildExpectedRelayStatesForAgent(
+            $gatewayId,
+            $this->requireAgentToken($payload),
+            isset($payload['wait_seconds']) ? (int)$payload['wait_seconds'] : 0
+        ));
+    }
+
+    private function handleAgentRelayStateResults(): void
+    {
+        global /** @var response $response */ $response;
+        $gatewayId = (int)$this->fromRoute('id');
+        $payload = self::getParametersAsArray();
+        $results = isset($payload['results']) && is_array($payload['results']) ? (array)$payload['results'] : [];
+        $response->success($this->manager()->recordExpectedRelayStateResults(
+            $gatewayId,
+            $this->requireAgentToken($payload),
+            $results
+        ));
+    }
+
     private function handleAgentPresence(): void
     {
         global /** @var response $response */ $response;
@@ -706,6 +747,21 @@ class edgeGatewaysRoute
         ));
     }
 
+    private function handleBrokerSelfserveMachineSignal(): void
+    {
+        global /** @var response $response */ $response;
+        $this->requireBrokerSecret();
+        $gatewayId = (int)$this->fromRoute('id');
+        $payload = self::getParametersAsArray();
+
+        try {
+            $result = (new selfserve_machine_signal())->recordBrokerEdgeGatewaySignal($gatewayId, $payload);
+            $response->success($result, !empty($result['recorded']) ? 201 : 202);
+        } catch (\Throwable $exception) {
+            $response->error($exception->getMessage(), 400);
+        }
+    }
+
     private function handleBrokerBrowserStreamValidate(): void
     {
         global /** @var response $response */ $response;

services/nginx/app/modules/email/templates/email_template_new_customer.php

@@ -2,7 +2,8 @@
 
 namespace email\templates;
 
-use email\helpers\email_template;use objects\users_o;
+use email\helpers\email_template;
+use objects\users_o;
 
 class email_template_new_customer
 {
@@ -52,6 +53,7 @@ class email_template_new_customer
      */
     public function generate_html(): string
     {
+        $customer_label = htmlspecialchars($this->getCustomerRegistrationLabel(), ENT_QUOTES, 'UTF-8');
         ob_start();
         # Start of the html
         ?>
@@ -73,7 +75,7 @@ class email_template_new_customer
 
                                 <!-- Intro -->
                                 <p class="container-text-md" style="color:#000000;font-size:16px;line-height:1.5;margin:0 0 18px 0;mso-line-height-rule:exactly;">
-                                    Tak for din registrering af <?=((new users_o())->getCustomerName((int)$this->customer_number))?><?=(((new users_o())->getCustomerEcocomicData((int)$this->customer_number)->economic_customer->corporateIdentificationNumber) ? ' (' . (new users_o())->getCustomerEcocomicData((int)$this->customer_number)->economic_customer->corporateIdentificationNumber . ')' : '')?> som kunde hos Truck Wash.
+                                    Tak for din registrering af <?=$customer_label?> som kunde hos Truck Wash.
                                 </p>
 
                                 <!-- You can now wash your trucks -->
@@ -185,4 +187,19 @@ class email_template_new_customer
         # End of the html
         return ob_get_clean();
     }
+
+    private function getCustomerRegistrationLabel(): string
+    {
+        $customer = (new users_o())->getUserByCustomerNumber($this->customer_number);
+        $customer_name = trim((string)($customer->getCustomerName($this->customer_number) ?? ''));
+        $customer_label = $customer_name === '' ? 'virksomhed (CVR)' : $customer_name;
+
+        $customer->getCustomerEcocomicData($this->customer_number);
+        $corporate_identification_number = trim((string)($customer->economic_customer->corporateIdentificationNumber ?? ''));
+        if ($corporate_identification_number !== '') {
+            $customer_label .= ' (' . $corporate_identification_number . ')';
+        }
+
+        return $customer_label;
+    }
 }

services/nginx/app/modules/limble/classes/limble_request.php

@@ -29,8 +29,8 @@ class limble_request implements limble_request_i
         curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
         // Set options to return the response and handle SSL
         curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
+        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
-        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
+        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
         // Execute the request
         $response = curl_exec($ch);
         // Check for errors
@@ -44,11 +44,7 @@ class limble_request implements limble_request_i
         // Check if the response is successful
         if ($httpCode < 200 || $httpCode >= 300) {
             $slack = new \classes\slack();
-            echo 'Attempting credentials: ' . $url . ' with method: ' . $method . ' and data: ' . json_encode($data) . "\n";
+            $slack->send_message('Limble Request Failed with status code: ' . $httpCode, 'Limble Request Error');
-            echo 'Response: ' . $response . "\n";
-            echo 'HTTP Code: ' . $httpCode . "\n";
-            echo 'Headers: ' . json_encode($headers) . "\n";
-            $slack->send_message('Limble Request Failed: ' . $response, 'Limble Request Error');
             throw new \Exception('Request failed with status code ' . $httpCode);
         }
         // Check if the response is valid JSON
@@ -68,4 +64,4 @@ class limble_request implements limble_request_i
         // Generate the Basic Auth header using the client ID and secret
         return 'Authorization: Basic ' . base64_encode($client_id . ':' . $client_secret);
     }
-}
+}

services/nginx/app/modules/selfserve/classes/selfserve_lane_command_arguments.php

@@ -6,6 +6,8 @@ class selfserve_lane_command_arguments
 {
     public ?string $license_plate = null;
     public ?int $customer_number = null;
+    public ?int $subuser_id = null;
+    public ?string $wash_mode = null;
     public bool $defer_relay_side_effects = false;
 
     /**
@@ -25,6 +27,28 @@ class selfserve_lane_command_arguments
         return $this;
     }
 
+    public function setSubuserId(?int $subuser_id): self
+    {
+        $this->subuser_id = $subuser_id !== null && $subuser_id > 0 ? $subuser_id : null;
+        return $this;
+    }
+
+    public function setWashMode(?string $wash_mode): self
+    {
+        $normalized = strtolower(trim((string)$wash_mode));
+        if ($wash_mode === null || $normalized === '') {
+            $this->wash_mode = null;
+            return $this;
+        }
+
+        if (!in_array($normalized, ['manual', 'machine'], true)) {
+            throw new \InvalidArgumentException('Invalid wash type: ' . $wash_mode);
+        }
+
+        $this->wash_mode = $normalized;
+        return $this;
+    }
+
     public function setDeferRelaySideEffects(bool $defer_relay_side_effects): self
     {
         $this->defer_relay_side_effects = $defer_relay_side_effects;
@@ -40,6 +64,15 @@ class selfserve_lane_command_arguments
             if (array_key_exists('customer_number', $params)) {
                 $this->setCustomerNumber($params['customer_number']);
             }
+            if (array_key_exists('subuser_id', $params)) {
+                $this->setSubuserId($params['subuser_id'] === null ? null : (int)$params['subuser_id']);
+            }
+            if (array_key_exists('wash_type', $params)) {
+                $this->setWashMode($params['wash_type'] === null ? null : (string)$params['wash_type']);
+            }
+            if (array_key_exists('wash_mode', $params)) {
+                $this->setWashMode($params['wash_mode'] === null ? null : (string)$params['wash_mode']);
+            }
             if (array_key_exists('defer_relay_side_effects', $params)) {
                 $this->setDeferRelaySideEffects(filter_var(
                     $params['defer_relay_side_effects'],

services/nginx/app/modules/selfserve/classes/selfserve_machine_signal.php

@@ -148,6 +148,25 @@ class selfserve_machine_signal
         $gateway = (new edge_gateway_manager())->authenticateGateway($gatewayId, $agentToken);
         $departmentId = (int)$gateway->department_id->value();
 
+        return $this->recordEdgeGatewaySignalForDepartment($gatewayId, $departmentId, $payload);
+    }
+
+    /**
+     * @param array<string,mixed> $payload
+     * @return array<string,mixed>
+     */
+    public function recordBrokerEdgeGatewaySignal(int $gatewayId, array $payload): array
+    {
+        $gateway = (new edge_gateway_manager())->getGateway($gatewayId);
+        return $this->recordEdgeGatewaySignalForDepartment($gatewayId, (int)$gateway['department_id'], $payload);
+    }
+
+    /**
+     * @param array<string,mixed> $payload
+     * @return array<string,mixed>
+     */
+    private function recordEdgeGatewaySignalForDepartment(int $gatewayId, int $departmentId, array $payload): array
+    {
         return $this->recordCloudShellySignal(
             $departmentId,
             isset($payload['lane_id']) ? (int)$payload['lane_id'] : null,

services/nginx/app/modules/selfserve/classes/selfserve_studio_action_runner.php

@@ -83,7 +83,7 @@ class selfserve_studio_action_runner
                 continue;
             }
             $conditionId = $action['condition_id'];
-            if ($conditionId !== null && $conditionResults !== null && (($conditionResults[$conditionId] ?? false) !== true)) {
+            if ($conditionId !== null && (($conditionResults[$conditionId] ?? false) !== true)) {
                 continue;
             }
             $actions[] = $action;

services/nginx/app/modules/selfserve/classes/selfserve_wash_flow.php

@@ -103,49 +103,79 @@ class selfserve_wash_flow implements selfserve_wash_flow_i
     public function synchronizeSession(int $laneId, string $reg, ?int $customerNumber = null, bool $activateMachine = true, ?int $vehicleTypeIdOverride = null, bool $syncRelayState = true, array $options = []): array
     {
         $snapshot = $this->buildEligibilitySnapshot($laneId, $reg, $customerNumber, $vehicleTypeIdOverride, $options);
-        $session = $this->findLatestOpenSession($laneId, $snapshot['reg'], $snapshot['customer_number']);
+        $mutationResult = $this->withSessionMutationLock(
+            $laneId,
+            $snapshot['reg'],
+            $snapshot['customer_number'],
+            function () use ($laneId, $snapshot, $options): array {
+                $session = $this->findLatestOpenSession($laneId, $snapshot['reg'], $snapshot['customer_number']);
+                $createSession = (bool)($options['create_session'] ?? true);
 
-        if (($snapshot['evaluation_trace']['disabled_lane'] ?? false) === true) {
+                if (($snapshot['evaluation_trace']['disabled_lane'] ?? false) === true) {
-            return $session->exists()
+                    return [
-                ? $this->getSessionSummary((int)$session->id)
+                        'session' => $session,
-                : $this->formatBlockedSessionSummary($snapshot);
+                        'response' => $session->exists()
+                            ? $this->getSessionSummary((int)$session->id)
+                            : $this->formatBlockedSessionSummary($snapshot),
+                    ];
+                }
+
+                if (!$session->exists() && !$createSession) {
+                    return [
+                        'session' => $session,
+                        'response' => $this->formatSnapshotResponse($snapshot, null),
+                    ];
+                }
+
+                if (!$session->exists()) {
+                    $session = (new selfserve_wash_sessions_o())->add(
+                        $laneId,
+                        (int)$snapshot['lane']['department'],
+                        $snapshot['machine_type']['id'] ?? null,
+                        $snapshot['customer_number'],
+                        $snapshot['reg'],
+                        $snapshot['vehicle']['id'] ?? null,
+                        $snapshot['vehicle']['type'] ?? null,
+                        $this->deriveBaseStatus($snapshot),
+                        (bool)$snapshot['allowed'],
+                        $this->buildSessionMetadata($snapshot),
+                    );
+                } else {
+                    $session->machine_type_id->set($snapshot['machine_type']['id'] ?? null);
+                    $session->customer_number->set($snapshot['customer_number']);
+                    $session->vehicle_id->set($snapshot['vehicle']['id'] ?? null);
+                    $session->vehicle_type_id->set($snapshot['vehicle_type_id']);
+                    $session->reg->set($snapshot['reg']);
+                    $session->allowed->set((bool)$snapshot['allowed']);
+                    $session->metadata_json->set($this->buildSessionMetadata($snapshot));
+                    $session->updateStatus($this->deriveCurrentStatus($snapshot, $session));
+                }
+
+                $this->syncSessionAnswers((int)$session->id, $snapshot['questions']);
+                $this->syncSessionTasks((int)$session->id, $snapshot['tasks']);
+                $this->logSessionEvent((int)$session->id, selfserve_wash_event_type::SESSION_SYNCED, [
+                    'allowed' => (bool)$snapshot['allowed'],
+                    'all_visible_questions_answered' => (bool)$snapshot['all_visible_questions_answered'],
+                    'allowed_services' => $snapshot['allowed_services'],
+                    'task_ids' => array_map(static fn(array $task): int => (int)$task['id'], $snapshot['tasks']),
+                ]);
+
+                return [
+                    'session' => $session,
+                    'response' => null,
+                ];
+            }
+        );
+
+        $session = $mutationResult['session'];
+        if ($mutationResult['response'] !== null) {
+            return $mutationResult['response'];
         }
 
-        if (!$session->exists()) {
-            $session = (new selfserve_wash_sessions_o())->add(
-                $laneId,
-                (int)$snapshot['lane']['department'],
-                $snapshot['machine_type']['id'] ?? null,
-                $snapshot['customer_number'],
-                $snapshot['reg'],
-                $snapshot['vehicle']['id'] ?? null,
-                $snapshot['vehicle']['type'] ?? null,
-                $this->deriveBaseStatus($snapshot),
-                (bool)$snapshot['allowed'],
-                $this->buildSessionMetadata($snapshot),
-            );
-        } else {
-            $session->machine_type_id->set($snapshot['machine_type']['id'] ?? null);
-            $session->customer_number->set($snapshot['customer_number']);
-            $session->vehicle_id->set($snapshot['vehicle']['id'] ?? null);
-            $session->vehicle_type_id->set($snapshot['vehicle_type_id']);
-            $session->reg->set($snapshot['reg']);
-            $session->allowed->set((bool)$snapshot['allowed']);
-            $session->metadata_json->set($this->buildSessionMetadata($snapshot));
-            $session->updateStatus($this->deriveCurrentStatus($snapshot, $session));
-        }
-
-        $this->syncSessionAnswers((int)$session->id, $snapshot['questions']);
-        $this->syncSessionTasks((int)$session->id, $snapshot['tasks']);
-        $this->logSessionEvent((int)$session->id, selfserve_wash_event_type::SESSION_SYNCED, [
-            'allowed' => (bool)$snapshot['allowed'],
-            'all_visible_questions_answered' => (bool)$snapshot['all_visible_questions_answered'],
-            'allowed_services' => $snapshot['allowed_services'],
-            'task_ids' => array_map(static fn(array $task): int => (int)$task['id'], $snapshot['tasks']),
-        ]);
-
         if ($syncRelayState) {
-            $this->syncMachineRelayFromVisibleServices($snapshot, $session, $activateMachine);
+            if ($session->exists()) {
+                $this->syncMachineRelayFromVisibleServices($snapshot, $session, $activateMachine);
+            }
         }
 
         return $this->getSessionSummary((int)$session->id);
@@ -273,28 +303,19 @@ class selfserve_wash_flow implements selfserve_wash_flow_i
                 return;
             }
 
-            $this->turnOffRelayIfConfiguredAndOn($lane, selfserve_lane_relay::MACHINE);
+            $this->turnOffRelayIfConfigured($lane, selfserve_lane_relay::MACHINE);
-            $this->turnOffRelayIfConfiguredAndOn($lane, selfserve_lane_relay::MACHINE_CLEANER);
+            $this->turnOffRelayIfConfigured($lane, selfserve_lane_relay::MACHINE_CLEANER);
         } catch (\Throwable) {
             // Best effort only; session completion flow must continue.
         }
     }
 
-    protected function turnOffRelayIfConfiguredAndOn(selfserve_lane $lane, selfserve_lane_relay $relay): void
+    protected function turnOffRelayIfConfigured(selfserve_lane $lane, selfserve_lane_relay $relay): void
     {
         if (!$this->isRelayConfiguredForLane($lane, $relay)) {
             return;
         }
 
-        try {
-            $status = $lane->getRelayStatus($relay);
-            if ((bool)($status['on'] ?? false) !== true) {
-                return;
-            }
-        } catch (\Throwable) {
-            // If relay status can't be read, still attempt turn-off as best effort.
-        }
-
         try {
             $lane->setRelayStatusHard($relay, false);
         } catch (\Throwable) {
@@ -339,9 +360,13 @@ class selfserve_wash_flow implements selfserve_wash_flow_i
         $allowedServices = $this->normalizeServiceNames(
             is_array($metadata['allowed_services'] ?? null) ? (array)$metadata['allowed_services'] : []
         );
-        $machineAvailable = array_key_exists('machine_available', $metadata)
+        $machineWashEnabled = $this->isMachineWashEnabled();
+        if (!$machineWashEnabled) {
+            $allowedServices = $this->withoutMachineService($allowedServices);
+        }
+        $machineAvailable = $machineWashEnabled && (array_key_exists('machine_available', $metadata)
             ? (bool)$metadata['machine_available']
-            : ($lane->exists() && !empty($lane->relay_machine_id->value()));
+            : ($lane->exists() && !empty($lane->relay_machine_id->value())));
         $allVisibleQuestionsAnswered = array_key_exists('all_visible_questions_answered', $metadata)
             ? (bool)$metadata['all_visible_questions_answered']
             : true;
@@ -387,6 +412,7 @@ class selfserve_wash_flow implements selfserve_wash_flow_i
             'events' => $events,
             'allowed_services' => $allowedServices,
             'machine_available' => $machineAvailable,
+            'machine_wash_enabled' => $machineWashEnabled,
             'all_visible_questions_answered' => $allVisibleQuestionsAnswered,
             'allowed' => (bool)$session->allowed->value(),
             'config_version_id' => $metadata['config_version_id'] ?? null,
@@ -404,7 +430,7 @@ class selfserve_wash_flow implements selfserve_wash_flow_i
         return $this->getSessionSummary((int)$session->id);
     }
 
-    public function completeLatestSessionForLane(int $laneId, ?string $reg = null, ?int $customerNumber = null, ?int $orderId = null): ?array
+    public function completeLatestSessionForLane(int $laneId, ?string $reg = null, ?int $customerNumber = null, ?int $orderId = null, bool $disableRelays = true): ?array
     {
         $session = $reg !== null
             ? $this->findLatestOpenSession($laneId, selfserve::standardize_registration($reg), $customerNumber)
@@ -414,8 +440,12 @@ class selfserve_wash_flow implements selfserve_wash_flow_i
             return null;
         }
 
-        $session->markCompleted($orderId);
+        if (!$session->markCompletedIfOpen($orderId)) {
-        $this->disableMachineRelayForCompletedWash($laneId);
+            return $this->getSessionSummary((int)$session->id);
+        }
+        if ($disableRelays) {
+            $this->disableMachineRelayForCompletedWash($laneId);
+        }
         $this->logSessionEvent((int)$session->id, selfserve_wash_event_type::SESSION_COMPLETED, [
             'lane_id' => $laneId,
             'reg' => $reg === null ? (string)$session->reg->value() : selfserve::standardize_registration($reg),
@@ -459,9 +489,12 @@ class selfserve_wash_flow implements selfserve_wash_flow_i
                 'runtime_before_reset' => $runtimeSnapshot,
                 'forced_at' => date('Y-m-d H:i:s'),
             ];
-            $session->markForceStopped($orderId, $eventPayload);
+            if (!$session->markForceStoppedIfOpen($orderId, $eventPayload)) {
-            $this->logSessionEvent((int)$session->id, selfserve_wash_event_type::SESSION_FORCE_STOPPED, $eventPayload);
+                $summary = $this->getSessionSummary((int)$session->id);
-            $summary = $this->getSessionSummary((int)$session->id);
+            } else {
+                $this->logSessionEvent((int)$session->id, selfserve_wash_event_type::SESSION_FORCE_STOPPED, $eventPayload);
+                $summary = $this->getSessionSummary((int)$session->id);
+            }
         }
 
         $lane->execute(selfserve_lane_command::RESET, new selfserve_lane_command_arguments());
@@ -659,7 +692,12 @@ class selfserve_wash_flow implements selfserve_wash_flow_i
             }
         }
 
-        $machineAvailable = !empty($lane->relay_machine_id->value());
+        $machineWashEnabled = $this->isMachineWashEnabled();
+        if (!$machineWashEnabled) {
+            $allowedServices = $this->withoutMachineService($allowedServices);
+        }
+
+        $machineAvailable = $machineWashEnabled && !empty($lane->relay_machine_id->value());
         $allVisibleQuestionsAnswered = true;
         foreach ($visibleQuestions as $question) {
             if ($question['answer'] === null) {
@@ -698,8 +736,10 @@ class selfserve_wash_flow implements selfserve_wash_flow_i
             'tasks' => $visibleTasks,
             'allowed_services' => $allowedServices,
             'machine_available' => $machineAvailable,
+            'machine_wash_enabled' => $machineWashEnabled,
             'all_visible_questions_answered' => $allVisibleQuestionsAnswered,
             'allowed' => $machineAllowed,
+            'blocked_reason' => !$machineWashEnabled ? 'Machine wash is disabled globally.' : null,
             'config_version_id' => $publishedConfigVersionId === null ? null : (int)$publishedConfigVersionId,
             'config_source' => $configSource,
             'evaluation_trace' => [
@@ -723,14 +763,14 @@ class selfserve_wash_flow implements selfserve_wash_flow_i
 
     protected function enableMachineRelayIfAllowed(array $snapshot, selfserve_wash_sessions_o $session): void
     {
-        if ((bool)$session->machine_relay_enabled->value() === true) {
-            return;
-        }
-
         $laneId = (int)$snapshot['lane']['id'];
         $lane = (new selfserve())->lane($laneId);
         $this->enableCleanerRelayForStartedWash($lane);
 
+        if ((bool)$session->machine_relay_enabled->value() === true) {
+            return;
+        }
+
         $session->markRelayEnabled();
         $this->logSessionEvent((int)$session->id, selfserve_wash_event_type::MACHINE_RELAY_ENABLED, [
             'lane_id' => $laneId,
@@ -798,6 +838,7 @@ class selfserve_wash_flow implements selfserve_wash_flow_i
             'tasks' => $snapshot['tasks'],
             'allowed_services' => $snapshot['allowed_services'],
             'machine_available' => $snapshot['machine_available'],
+            'machine_wash_enabled' => $snapshot['machine_wash_enabled'] ?? true,
             'all_visible_questions_answered' => $snapshot['all_visible_questions_answered'],
             'allowed' => $snapshot['allowed'],
             'blocked_reason' => $snapshot['blocked_reason'] ?? null,
@@ -2408,11 +2449,20 @@ class selfserve_wash_flow implements selfserve_wash_flow_i
 
     protected function taskUsesProgramPicker(array $task): bool
     {
-        return in_array(
+        if (in_array(
             'PROGRAM_PICKER',
             $this->normalizeServiceNames($this->normalizeJsonArray($task['services'] ?? null)),
             true
-        );
+        )) {
+            return true;
+        }
+
+        return in_array('program_picker', $this->normalizeButtonList($task['buttons'] ?? null), true);
+    }
+
+    protected function isProgramNumberButton(mixed $button): bool
+    {
+        return is_int($button) && $button >= 0 && $button <= 11;
     }
 
     protected function dynamicImageButtonSequenceForTask(array $task): array
@@ -2422,7 +2472,15 @@ class selfserve_wash_flow implements selfserve_wash_flow_i
             return $buttons;
         }
 
-        return $this->normalizeButtonList(array_merge(['program_picker'], $buttons));
+        $sequence = ['program_picker'];
+        foreach ($buttons as $button) {
+            if ($button === 'program_picker' || $this->isProgramNumberButton($button)) {
+                continue;
+            }
+            $sequence[] = $button;
+        }
+
+        return $this->normalizeButtonList($sequence);
     }
 
     /**
@@ -2954,7 +3012,7 @@ class selfserve_wash_flow implements selfserve_wash_flow_i
 
             return array_values(array_filter($questions, static function (array $question) use ($departmentId, $laneId, $vehicleTypeId): bool {
                 return (int)($question['department'] ?? 0) === $departmentId
-                    && (int)($question['lane'] ?? 0) === $laneId
+                    && ((int)($question['lane'] ?? 0) === 0 || (int)($question['lane'] ?? 0) === $laneId)
                     && (int)($question['product'] ?? 0) === $vehicleTypeId;
             }));
         }
@@ -2997,7 +3055,7 @@ class selfserve_wash_flow implements selfserve_wash_flow_i
             return array_values(array_filter($conditions, static function (array $condition) use ($departmentId, $laneId, $vehicleTypeId): bool {
                 return (int)($condition['machine_type_id'] ?? 0) === 0
                     && (int)($condition['department'] ?? 0) === $departmentId
-                    && (int)($condition['lane'] ?? 0) === $laneId
+                    && ((int)($condition['lane'] ?? 0) === 0 || (int)($condition['lane'] ?? 0) === $laneId)
                     && (int)($condition['product'] ?? 0) === $vehicleTypeId;
             }));
         }
@@ -3041,7 +3099,7 @@ class selfserve_wash_flow implements selfserve_wash_flow_i
             return array_values(array_filter($tasks, static function (array $task) use ($departmentId, $laneId, $vehicleTypeId): bool {
                 return (int)($task['machine_type_id'] ?? 0) === 0
                     && (int)($task['department'] ?? 0) === $departmentId
-                    && (int)($task['lane'] ?? 0) === $laneId
+                    && ((int)($task['lane'] ?? 0) === 0 || (int)($task['lane'] ?? 0) === $laneId)
                     && (int)($task['product'] ?? 0) === $vehicleTypeId;
             }));
         }
@@ -3180,11 +3238,92 @@ class selfserve_wash_flow implements selfserve_wash_flow_i
         (new selfserve_wash_session_events_o())->add($sessionId, $eventType, $payload);
     }
 
+    /**
+     * @param callable():array<string,mixed> $callback
+     * @return array<string,mixed>
+     */
+    protected function withSessionMutationLock(int $laneId, string $reg, ?int $customerNumber, callable $callback): array
+    {
+        $lockKey = $this->sessionMutationLockKey($laneId, $reg, $customerNumber);
+        $lock = $this->acquireSessionMutationLock($lockKey);
+
+        try {
+            return $callback();
+        } finally {
+            $this->releaseSessionMutationLock($lock);
+        }
+    }
+
+    /**
+     * @return array{driver:string,key:string,token:?string}
+     */
+    protected function acquireSessionMutationLock(string $lockKey): array
+    {
+        if (defined('redis') && method_exists(redis, 'set_if_absent_with_expiration')) {
+            $token = bin2hex(random_bytes(16));
+            if (!redis->set_if_absent_with_expiration($lockKey, $token, 15)) {
+                throw new \RuntimeException('Self-serve wash session is busy. Try again.');
+            }
+
+            return [
+                'driver' => 'redis',
+                'key' => $lockKey,
+                'token' => $token,
+            ];
+        }
+
+        global $db;
+        $result = $db->query("SELECT GET_LOCK('" . $db->escape_string($lockKey) . "', 5) AS acquired");
+        $row = $db->fetch_assoc($result);
+        if ((int)($row['acquired'] ?? 0) !== 1) {
+            throw new \RuntimeException('Self-serve wash session is busy. Try again.');
+        }
+
+        return [
+            'driver' => 'mysql',
+            'key' => $lockKey,
+            'token' => null,
+        ];
+    }
+
+    /**
+     * @param array{driver:string,key:string,token:?string} $lock
+     */
+    protected function releaseSessionMutationLock(array $lock): void
+    {
+        try {
+            if ($lock['driver'] === 'redis' && defined('redis')) {
+                if (method_exists(redis, 'get') && redis->get($lock['key']) !== $lock['token']) {
+                    return;
+                }
+                if (method_exists(redis, 'delete')) {
+                    redis->delete($lock['key']);
+                }
+                return;
+            }
+
+            if ($lock['driver'] === 'mysql') {
+                global $db;
+                $db->query("SELECT RELEASE_LOCK('" . $db->escape_string($lock['key']) . "')");
+            }
+        } catch (\Throwable) {
+            // Locks have TTLs or connection scope; release failures must not mask API results.
+        }
+    }
+
+    protected function sessionMutationLockKey(int $laneId, string $reg, ?int $customerNumber): string
+    {
+        return 'selfserve_session_mutation:' . (int)$laneId . ':' . sha1(
+            selfserve::standardize_registration($reg) . ':' . ($customerNumber === null ? 'anon' : (string)(int)$customerNumber)
+        );
+    }
+
     protected function buildSessionMetadata(array $snapshot): array
     {
         return [
             'allowed_services' => $snapshot['allowed_services'],
             'machine_available' => (bool)$snapshot['machine_available'],
+            'machine_wash_enabled' => (bool)($snapshot['machine_wash_enabled'] ?? true),
             'all_visible_questions_answered' => (bool)$snapshot['all_visible_questions_answered'],
             'config_version_id' => $snapshot['config_version_id'] ?? null,
             'evaluation_trace' => $snapshot['evaluation_trace'] ?? null,
@@ -3483,6 +3622,27 @@ class selfserve_wash_flow implements selfserve_wash_flow_i
         ));
     }
 
+    protected function isMachineWashEnabled(): bool
+    {
+        try {
+            return (new selfserve())->config->machine_wash_enabled->isTrue();
+        } catch (\Throwable) {
+            return true;
+        }
+    }
+
+    /**
+     * @param array<int,string> $services
+     * @return array<int,string>
+     */
+    protected function withoutMachineService(array $services): array
+    {
+        return array_values(array_filter(
+            $this->normalizeServiceNames($services),
+            static fn(string $service): bool => $service !== selfserve_lane_services::MACHINE->name
+        ));
+    }
+
     protected function taskUsesMachineControls(array $task): bool
     {
         if (in_array(selfserve_lane_services::MACHINE->name, $this->normalizeServiceNames($this->normalizeJsonArray($task['services'] ?? null)), true)) {

services/nginx/app/modules/selfserve/config/selfserve_dynamic_image_size_c.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace modules\selfserve\config;
+
+use Exception;
+use traits\module_config_variable;
+
+class selfserve_dynamic_image_size_c
+{
+    use module_config_variable;
+
+    public const SIZE_ORIGINAL = 'original';
+    public const SIZE_RELEVANT = 'relevant';
+
+    /**
+     * @throws Exception
+     */
+    public function __construct()
+    {
+        self::setupConfigVariable(
+            'selfserve',
+            'dynamic_image_size',
+            'string',
+            true,
+            [self::SIZE_ORIGINAL, self::SIZE_RELEVANT],
+            'Whether self-serve dynamic images are served in the original rendered size or resized to the relevant terminal size',
+            self::SIZE_RELEVANT,
+            false,
+            self::SIZE_ORIGINAL
+        );
+    }
+}

services/nginx/app/modules/selfserve/config/selfserve_machine_wash_enabled_c.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace modules\selfserve\config;
+
+use Exception;
+use traits\module_config_variable;
+
+class selfserve_machine_wash_enabled_c
+{
+    use module_config_variable;
+
+    /**
+     * @throws Exception
+     */
+    public function __construct()
+    {
+        self::setupConfigVariable(
+            'selfserve',
+            'machine_wash_enabled',
+            'bool',
+            true,
+            null,
+            'Whether machine wash is available in customer-facing self-serve flows',
+            '1',
+            false,
+            true
+        );
+    }
+}

services/nginx/app/modules/selfserve/interfaces/selfserve_wash_flow_i.php

@@ -14,7 +14,7 @@ interface selfserve_wash_flow_i
 
     public function getLatestSessionSummary(int $laneId, string $reg): array;
 
-    public function completeLatestSessionForLane(int $laneId, ?string $reg = null, ?int $customerNumber = null, ?int $orderId = null): ?array;
+    public function completeLatestSessionForLane(int $laneId, ?string $reg = null, ?int $customerNumber = null, ?int $orderId = null, bool $disableRelays = true): ?array;
 
     public function forceStopLane(int $laneId, ?int $sessionId = null, bool $bill = false, ?string $reason = null, ?int $userId = null): array;
 }

services/nginx/app/modules/selfserve/selfserve.md

@@ -439,7 +439,7 @@ Public methods:
 | `recordMachineStartWebhook(int $laneId, ?string $reg = null, array $payload = [])` | The machine button or hardware event fired. | Full session summary after the machine-start event. |
 | `getSessionSummary(int $sessionId)` | You have a session id already. | Full session summary. |
 | `getLatestSessionSummary(int $laneId, string $reg)` | You want the latest session for a lane and vehicle. | Full session summary. |
-| `completeLatestSessionForLane(int $laneId, ?string $reg = null, ?int $customerNumber = null, ?int $orderId = null)` | STOP has finished and you want to close the latest open session. | Full summary, or `null` if no open session exists. |
+| `completeLatestSessionForLane(int $laneId, ?string $reg = null, ?int $customerNumber = null, ?int $orderId = null, bool $disableRelays = true)` | STOP has finished and you want to close the latest open session. Normal STOP passes `false` because it already disabled relays before opening the exit port. | Full summary, or `null` if no open session exists. |
 
 Key implementation details:
 

services/nginx/app/modules/selfserve/selfserve_c.php

@@ -2,10 +2,14 @@
 
 namespace modules\selfserve;
 require_once WD . '/modules/selfserve/config/selfserve_enabled_c.php';
+require_once WD . '/modules/selfserve/config/selfserve_machine_wash_enabled_c.php';
 require_once WD . '/modules/selfserve/config/selfserve_minute_product_c.php';
 require_once WD . '/modules/selfserve/config/selfserve_machine_wash_minutes_included_c.php';
+require_once WD . '/modules/selfserve/config/selfserve_dynamic_image_size_c.php';
 
+use modules\selfserve\config\selfserve_dynamic_image_size_c;
 use modules\selfserve\config\selfserve_enabled_c;
+use modules\selfserve\config\selfserve_machine_wash_enabled_c;
 use modules\selfserve\config\selfserve_machine_wash_minutes_included_c;
 use modules\selfserve\config\selfserve_minute_product_c;
 use traits\module_config_t;
@@ -19,6 +23,11 @@ class selfserve_c
      * @var selfserve_enabled_c $enabled
      */
     public selfserve_enabled_c $enabled;
+    /**
+     * Whether machine wash is available in customer-facing self-serve flows
+     * @var selfserve_machine_wash_enabled_c $machine_wash_enabled
+     */
+    public selfserve_machine_wash_enabled_c $machine_wash_enabled;
     /**
      * The product ID used for minute-based self-serve billing
      * @var selfserve_minute_product_c $minute_product
@@ -29,17 +38,26 @@ class selfserve_c
      * @var selfserve_machine_wash_minutes_included_c $machine_wash_minutes_included
      */
     public selfserve_machine_wash_minutes_included_c $machine_wash_minutes_included;
+    /**
+     * Dynamic image output size mode for self-serve terminals
+     * @var selfserve_dynamic_image_size_c $dynamic_image_size
+     */
+    public selfserve_dynamic_image_size_c $dynamic_image_size;
 
     public function __construct()
     {
         $this->setupConfig('selfserve');
         $this->allowUpdate([
             selfserve_enabled_c::class,
+            selfserve_machine_wash_enabled_c::class,
             selfserve_minute_product_c::class,
-            selfserve_machine_wash_minutes_included_c::class
+            selfserve_machine_wash_minutes_included_c::class,
+            selfserve_dynamic_image_size_c::class
         ]);
         $this->enabled = new selfserve_enabled_c();
+        $this->machine_wash_enabled = new selfserve_machine_wash_enabled_c();
         $this->minute_product = new selfserve_minute_product_c();
         $this->machine_wash_minutes_included = new selfserve_machine_wash_minutes_included_c();
+        $this->dynamic_image_size = new selfserve_dynamic_image_size_c();
     }
 }

services/nginx/app/modules/selfserve/traits/selfserve_lane_cache_t.php

@@ -9,6 +9,7 @@ trait selfserve_lane_cache_t
 {
     const CACHE_SELFSERVE_PREFIX = 'selfserve_lane_';
     const CACHE_SELFSERVE_LANE_KEY_STATUS = self::CACHE_SELFSERVE_PREFIX . 'status';
+    const CACHE_SELFSERVE_LANE_KEY_STATUS_AUDIT = self::CACHE_SELFSERVE_PREFIX . 'status_audit';
     const CACHE_SELFSERVE_LANE_KEY_STATE = self::CACHE_SELFSERVE_PREFIX . 'state';
     const CACHE_SELFSERVE_LANE_KEY_MODE = self::CACHE_SELFSERVE_PREFIX . 'mode';
     const CACHE_SELFSERVE_LANE_KEY_WASH_START_TIME = self::CACHE_SELFSERVE_PREFIX . 'wash_start_time';
@@ -77,4 +78,4 @@ trait selfserve_lane_cache_t
         redis->delete($this->getLaneCacheKey($laneId, $property));
         return $this;
     }
-}
+}