fix inter instance config broken stuffs

docs/server-admin-container-migration.md

@@ -6,7 +6,8 @@ This document is the live implementation tracker for the migration.
 
 - [x] Phase 1, step 1: Establish the single data-directory contract
 - [x] Phase 1, steps 2-5: Configuration database, manual setup-file import, setup, and centralized admin UI
-- [ ] Phase 1, steps 6-9: Backup/restore, restart, and internal video proxy
+- [x] Phase 1, steps 6-8: Restart, backup/restore, and internal video proxy
+- [ ] Phase 1, step 9: Complete the remaining legacy-deployment integration and hardware verification
 - [ ] Phase 2: Containerization, GHCR publishing, and container lifecycle controls
 
 The single data-directory implementation and local verification are complete. Real snapshot generation, legacy-directory cleanup, and runtime filesystem tracing remain deployment checks for the actual server; they do not leave the implementation step open.
@@ -20,8 +21,12 @@ Phase 1 must be complete and verified before Phase 2 begins. Containerization mu
 
 ## Decision log
 
+- 2026-09-14: Apply every committed configuration revision immediately. The configuration coordinator atomically replaces the process-wide snapshot, compares top-level service sections, serially reloads only affected service runtimes, and then refreshes all sessions. Long-lived HTTP/socket handlers remain registered once and delegate to the current runtime; integrations may reconnect or replace their own child process, worker, client, timers, and subscriptions without restarting Node.
 - 2026-09-14: Render the schema-driven configuration editor as a YAML-like tree inside one `CardFrame`. Every object or array introduces an ordered header and one indentation guide, every scalar occupies one key/value row, and array operations remain beside their item instead of moving to the far edge. Keep all route-specific RJSF styling in `webui/src/admin/styles.css`, outside the shared global stylesheet.
-- 2026-09-14: Treat container deployment as a fresh installation. Neither startup nor the installer searches for, imports, removes, or otherwise manages an old `config.yaml`; the only old-file path retained is an operator-selected YAML upload on `/setup`. The separate command-line importer and its dry-run mode are removed. Internal SQLite schema migrations remain because they evolve the active database rather than discovering an old installation.
+- 2026-09-14: Restart only the application process, never the host. A lockdown administrator with recent password confirmation requests one audited restart, Node acknowledges and announces it, then sends itself SIGTERM. Existing service signal handlers clean up their owned children, while systemd `Restart=always` and the later container restart policy start the application again.
+- 2026-09-14: Keep backup and restore together in one server service after application restart exists. Neither operation stops running services or writers, and no command-line interface is maintained. Backup uses online SQLite snapshots and stable copies of non-database files; restore validates and stages an uploaded archive, records a marker, and uses the normal application restart to replace the data directory during earliest startup.
+- 2026-09-14: Define this server's canonical `publicUrl` once at the top of configuration beside `timezone`. Discord links, inter-instance identity, page metadata, and MediaMTX's primary public ICE hostname derive from it. Browser WHEP and WHIP signaling always uses the same-origin `/video` path; `media.additionalHosts` remains only for genuinely additional ICE names or addresses.
+- 2026-09-14: Treat container deployment as a fresh installation. Neither startup nor the installer searches for, imports, removes, or otherwise manages an old `config.yaml`; the only old-file paths retained are operator-selected YAML uploads on `/setup` and the protected Configuration page. The separate command-line importer and its dry-run mode are removed. Internal SQLite schema migrations remain because they evolve the active database rather than discovering an old installation.
 - 2026-09-14: Keep the one-time first-run setup code in `data/setup-code.txt` with owner-only permissions instead of writing the credential into server logs. Reuse it across restarts and delete it permanently when setup completes.
 - 2026-09-14: Feature enablement is exactly the service-owned `enabled` boolean. A service-owned configuration definition marks itself with `feature: true` when that switch belongs in the public feature map; the configuration system derives the map for sessions and command availability, including nested service definitions, without a separate feature registry. Missing credentials, hardware, connections, data, or enabled dependencies are runtime health conditions and never silently change that choice.
 - 2026-09-14: Keep configuration as one ordered hierarchical document, matching the former YAML layout. The admin application presents one continuous configuration page and saves the complete document as one revision. There are no artificial Hardware, Integrations, Media, or similar configuration categories and no backend or frontend section registries.
@@ -35,7 +40,7 @@ Phase 1 must be complete and verified before Phase 2 begins. Containerization mu
 - All operator-controlled server configuration is stored in a validated database and managed through the web UI.
 - All mutable runtime state, generated files, caches, snapshots, recordings, and databases live under one server data directory.
 - A complete backup can capture that one data directory consistently, and a restore can safely replace it.
-- `/setup` may initialize the database from a YAML file explicitly selected by the operator; no automatic host migration exists.
+- `/setup` may initialize the database from a YAML file explicitly selected by the operator, and the protected Configuration page may explicitly replace configuration from one later; no automatic host migration or persistent YAML source exists.
 - A dedicated `/admin` application contains all server administration.
 - The public `/video` route is proxied to MediaMTX by the Node server, eliminating the special external MediaMTX proxy rule.
 - The completed server is packaged as a replaceable container whose only persistent mount is the data directory.
@@ -132,7 +137,7 @@ Implementation architecture:
 - The database validates and commits that complete document as one coherent immutable revision.
 - The admin UI presents one continuous configuration page in the same top-to-bottom order as the former YAML file.
 - Nested cards make object relationships readable, but do not create separate categories, navigation destinations, persistence boundaries, or registries.
-- Shared editor infrastructure owns loading, dirty state, validation errors, revision conflicts, secret operations, and restart-required status for the whole document.
+- Shared editor infrastructure owns loading, dirty state, validation errors, revision conflicts, secret operations, and live-application status for the whole document.
 - The browser receives this same schema from the protected admin endpoint and renders it with a maintained JSON Schema form library.
 - Standard JSON Schema types drive ordinary fields, nested objects, enums, and arrays. One field-agnostic widget handles every `writeOnly` secret; there are no feature-specific configuration components in React.
 
@@ -186,11 +191,15 @@ Configuration changes use one intentionally simple application rule:
 
 1. Validate the complete proposed document.
 2. Commit it as a new database revision.
-3. Report that an application restart is required.
-4. Let the administrator restart immediately or later.
-5. Load one coherent configuration snapshot at the next process start.
+3. Atomically replace the process-wide configuration snapshot.
+4. Compare the old and new top-level sections.
+5. Reload every service that owns a changed section, replacing its complete internal runtime when necessary.
+6. Report per-service application failures without preventing unrelated services from applying the revision.
+7. Refresh sessions only after all affected service reloads finish.
 
-Operational actions such as changing server mode, locking a rover, or issuing a rover command remain live actions and do not become restart-required configuration edits.
+HTTP routes, Socket.IO connection handlers, and process signal handlers are registered once. They consult live state or delegate to the current service runtime, preventing duplicate listeners after repeated saves. Service reloads may reconnect an integration or restart an application-owned child such as MediaMTX, ffmpeg, Kinect, or the Balance Board worker, but never restart the Node application.
+
+Operational actions such as changing server mode, locking a rover, or issuing a rover command remain direct live actions rather than configuration edits.
 
 After migration is complete:
 
@@ -199,25 +208,35 @@ After migration is complete:
 - Remove `config.yaml` and `config.example.yaml` from the repository and installation process.
 - Remove `js-yaml` if MediaMTX generation is changed to avoid it or if it is otherwise no longer needed. Generated MediaMTX YAML is an internal artifact, not operator configuration, so retaining `js-yaml` solely for that generator is acceptable.
 
-## 3. Add optional configuration-file upload to setup
+## 3. Add explicit configuration-file upload to setup and administration
 
-Container deployment starts with a new data directory and never discovers an old installation automatically. As a convenience, the first-run setup page may initialize the empty database from a YAML configuration file deliberately selected by the operator. This is not a startup loader, installer migration, command-line workflow, or permanent second source of truth.
+Container deployment starts with a new data directory and never discovers an old installation automatically. As a convenience, the first-run setup page may initialize the empty database from a YAML configuration file deliberately selected by the operator. The protected Configuration page may later replace only the configuration from another explicitly selected legacy file. Neither path is a startup loader, installer migration, command-line workflow, or permanent second source of truth.
 
-The setup upload must:
+Every upload must:
 
-- Accept only an explicitly selected YAML file from `/setup`.
-- Require the one-time setup code before processing it.
+- Accept only an explicitly selected YAML file from `/setup` or the protected Configuration page.
 - Parse the complete document.
 - Map every recognized field into the new configuration schema.
-- Preserve existing bcrypt administrator password hashes.
-- Preserve lockdown roles and Discord IDs.
 - Preserve secrets without printing them.
 - Apply current defaults for absent fields.
 - Ignore fields that do not exist in the current schema, while reporting invalid values supplied for current fields.
 - Validate the entire result before writing anything.
+- Record the uploaded filename without storing secret values in the audit event.
+
+The setup upload additionally must:
+
+- Require the one-time setup code before processing it.
+- Preserve existing bcrypt administrator password hashes, lockdown roles, and Discord IDs.
 - Refuse to replace an already-configured database.
 - Write the configuration, administrators, and audit event atomically.
-- Record the uploaded filename without storing secret values in the audit event.
+
+The initialized-server upload additionally must:
+
+- Require a lockdown administrator with recent password confirmation.
+- Use optimistic revision checking so it cannot overwrite an intervening edit.
+- Ignore the entire legacy `admins` collection and leave all current accounts unchanged.
+- Preserve stored secrets omitted from the file, replace supplied secrets, and clear explicitly empty secrets.
+- Commit through the normal revision path and immediately reload affected services.
 
 The browser uploads the selected contents directly. The server never scans the host for a file, and it does not retain, watch, remove, or reuse the uploaded YAML after the database transaction completes.
 
@@ -262,9 +281,26 @@ Authorization rules:
 
 Configuration uses one schema-generated typed form rather than a raw YAML or JSON text editor. Repeatable values such as cameras, entities, links, and buttons receive the form library's generic add, remove, and reorder workflow.
 
-## 6. Implement complete backup and restore
+## 6. Standardize application restart
 
-Everything durable living under one data directory makes the backup boundary simple, but copying live SQLite files and JSON files without coordination would not guarantee a consistent backup. The implementation must create a consistent snapshot before archiving it.
+Replace the current host reboot operation with one deployment-neutral **Restart application** operation.
+
+The restart operation must:
+
+1. Require a lockdown administrator and recent password confirmation.
+2. Reject a second request while one is already pending.
+3. Persist an audit event, acknowledge the requester, and notify connected browsers.
+4. Stop accepting new HTTP connections and send SIGTERM to the Node process after a short acknowledgement delay.
+5. Reuse the cleanup hooks already owned by MediaMTX, ffmpeg, Kinect, Balance Board, and other child-process services.
+6. Exit normally and rely on the process supervisor to start the application again.
+
+During Phase 1, systemd uses `Restart=always`. During Phase 2, the container uses a restart policy such as `unless-stopped`. An explicit operator `systemctl stop` or container stop remains stopped; only a process exit is restarted. The browser shows the announced reconnect state and reloads the active administration snapshot after Socket.IO reconnects.
+
+Host rebooting is a separate privilege and is not part of this application contract. The server never invokes `systemctl reboot`.
+
+## 7. Implement complete backup and restore
+
+Everything durable living under one data directory makes the backup boundary simple. Backup and restore remain together under one `backupRestoreService`; there is no generic maintenance framework and no command-line workflow.
 
 ### Full backup
 
@@ -279,29 +315,25 @@ The primary admin action is **Download full backup**. A full backup includes the
 - Generated and cached files that are part of the current server state
 - A manifest describing the application and schema versions
 
-The backup service must:
+The backup operation must:
 
 1. Require a lockdown administrator and recent password confirmation.
-2. Enter a short maintenance/snapshot state that prevents new persistent mutations.
-3. Ask services with buffered state to flush it, stop active audio/replay workers, and clear `runtime/` so FIFOs and incomplete scratch files are never archived.
-4. Create consistent SQLite snapshots using SQLite's supported backup/checkpoint facilities rather than copying active WAL files blindly.
-5. Copy non-database durable files into temporary staging.
+2. Leave every service and writer running.
+3. Create consistent SQLite snapshots using SQLite's online backup support rather than copying active WAL files.
+4. Copy non-database durable files and verify their size and modification time before and after each copy, retrying a file that changed during the copy.
+5. Exclude `runtime/`, backup/restore staging, SQLite WAL/SHM files, and incomplete files that never become stable during bounded retries.
 6. Produce a manifest containing creation time, application version, schema versions, included paths, sizes, and checksums.
-7. Create the archive in temporary storage and stream it to the browser.
-8. Remove temporary staging whether the operation succeeds or fails.
-9. Resume normal mutations after the consistent snapshot has been captured; archive compression does not need to hold the server in maintenance mode.
+7. Stream the completed archive to the authorized browser and remove temporary staging afterward.
 
 The downloaded archive contains credentials and integration secrets. The UI must say so clearly. It must not be exposed through a permanent public URL or retained indefinitely inside the data directory.
 
-`runtime/` is inside the filesystem boundary but is not durable backup content. Excluding it is necessary because an audio FIFO is a live process primitive rather than a regular file, and incomplete uploads or replay builds have no restore value. The backup coordinator must quiesce the owning services before clearing it so exclusion cannot disrupt active work.
-
-An optional smaller **Download settings and state backup** may exclude explicitly regenerable, high-volume snapshots, replay segments, completed replays, and caches. This is secondary; the full backup remains the authoritative complete-server backup.
+`runtime/` is inside the filesystem boundary but is not durable backup content. Audio FIFOs, incomplete uploads, and in-progress replay builds have no restore value and are excluded without stopping their owners. The initial implementation provides only the authoritative full backup.
 
 ### Restore
 
 Restore cannot safely overwrite databases underneath running services. It must be a staged, restart-bound operation.
 
-The restore service must:
+The restore operation must:
 
 1. Require a lockdown administrator and recent password confirmation.
 2. Upload the archive into bounded staging controlled by the data directory.
@@ -312,45 +344,14 @@ The restore service must:
 7. Display exactly what will be replaced.
 8. Require a final explicit confirmation.
 9. Record a pending-restore marker.
-10. Gracefully stop the application.
+10. Request the normal application restart.
 11. Apply the restore before ordinary services open their databases on the next start.
 12. Run database migrations against the restored data when necessary.
 13. Start the application and verify its health.
 
 The startup restore path must preserve a local rollback snapshot until the restored server passes validation. If extraction, migration, or startup validation fails, it must put the prior data back and report the failure. Restore coordination files may live under `data/system/restore`, but they must be excluded from the restored payload where necessary to avoid recursively restoring an in-progress operation.
 
-Restoring configuration also restores administrator accounts and secrets. The initiating browser may therefore lose authentication after restart; the reconnect UI must explain this and return to login normally.
-
-### Command-line recovery
-
-Backup and restore must also have command-line entry points that use the same implementation as the admin UI. They are needed when the web server cannot start or authentication data is damaged.
-
-The command-line tools must support:
-
-- Creating a consistent backup while the server is stopped
-- Validating a backup without applying it
-- Restoring while the server is stopped
-- Printing a concise manifest summary
-- Refusing unsafe or malformed archives
-
-The UI and command line must not develop separate archive formats or validation behavior.
-
-## 7. Standardize graceful application restart
-
-Replace the current host reboot operation with a deployment-neutral **Restart application** operation.
-
-The restart coordinator must:
-
-1. Authorize and acknowledge the request.
-2. Stop accepting new persistent mutations.
-3. Flush or close persistent stores.
-4. Stop MediaMTX, ffmpeg, and native workers.
-5. Close HTTP and socket listeners within a bounded timeout.
-6. Exit with the status expected by the current supervisor.
-
-During Phase 1, systemd restarts the process. During Phase 2, the container restart policy or lifecycle service restarts it. The browser should show a reconnect state and confirm the active configuration revision after reconnecting.
-
-Host rebooting is a separate privilege and is not part of this application restart contract.
+Restoring configuration also restores administrator accounts and secrets. The initiating browser may therefore lose authentication after restart; the reconnect UI must explain this and return to login normally. Backup and restore exist only in the protected admin application.
 
 ## 8. Internalize MediaMTX WHEP signaling
 
@@ -398,7 +399,7 @@ Phase 1 is complete only when all of the following are true:
 - Configuration, administrator accounts, and secrets survive restart.
 - The final lockdown administrator cannot be removed accidentally.
 - All administrative surfaces are available through `/admin` with server-side authorization.
-- Configuration changes create auditable revisions and apply after restart.
+- Configuration changes create auditable revisions and apply to the running services without an application restart.
 - `/video` works through Node without a special public proxy rule for MediaMTX.
 - Rover sockets, RTSP publishing, WHEP playback, snapshots, replays, PTZ, Discord, Home Assistant, Kinect, Balance Board, and reporting retain their intended behavior when enabled.
 
@@ -439,6 +440,8 @@ Implemented on 2026-09-14:
 - Redacted secrets from browser responses and audit data. The one complete save operation preserves stored secrets unless the administrator explicitly replaces or clears them.
 - Converted every runtime configuration consumer to the synchronous database-backed configuration service and removed the YAML loader, `SERVER_CONFIG`, and the tracked example YAML.
 - Added an explicit one-time YAML upload to `/setup`. Existing bcrypt hashes, lockdown roles, Discord identities, configuration, and secrets can be imported only when the operator selects the file; the installer and startup perform no automatic discovery or migration, and there is no command-line importer.
+- Added the same explicit legacy YAML picker to the protected Configuration page for replacing an initialized server's configuration. It requires recent lockdown-password confirmation, ignores every YAML administrator entry, filters nonexistent settings, validates current fields, preserves omitted secrets, applies explicitly supplied or empty secrets, uses optimistic revision checking, records the selected filename in audit history, and reloads affected services immediately.
+- The one-time setup upload now passes its committed configuration through the same live-application coordinator, so a fresh installation does not need an immediate restart after importing YAML.
 - Made setup-file import recursively retain only fields present in the current schema. Stale keys from the permissive YAML era are ignored without aliases or historical translations, while invalid values for real current settings still fail validation; stream-only and snapshot-only room-camera entries remain accepted as they were by the runtime.
 - Added safe empty-data startup, a file-backed one-time setup code, the restricted `/setup` route, and a console administrator-recovery command. The credential persists at `data/setup-code.txt` across restarts with `0600` permissions, never appears in logs, and is deleted when setup completes.
 - Added the centralized `/admin` route with Overview, Fleet operations, Users and administrators, and one schema-generated hierarchical Configuration page in legacy YAML order.
@@ -449,20 +452,36 @@ Implemented on 2026-09-14:
 - Restored the former example YAML's installation-specific values as both schema-owned input examples and the actual initial values for non-secret settings and collection shapes. The only intentionally empty defaults are the three credentials and active driver HTML; their placeholders still explain the expected input without falsely marking credentials as configured or publishing sample content.
 - Strengthened top-level hierarchy with a 1.5-rem sibling gap while retaining compact spacing within each configuration section.
 - Extended `CardFrame` with an optional explicit accent while preserving its assigned-rover default, then gave every configuration nesting level its own complete header-and-border accent. Nested CardFrames themselves now carry the YAML-like indentation, scalar contents remain aligned with their owning card, and descriptions use a larger, higher-contrast treatment.
+- Added an opt-in sticky-header behavior to the shared `CardFrame`. Top-level configuration titles use it beneath the independently sticky action toolbar while nested titles remain in normal flow to prevent overlap, and scalar key labels are now visually stronger than their descriptions.
 - Traced all 156 schema nodes to their runtime consumers and added operator-facing descriptions for every root, section, collection, array item, and scalar option. A recursive configuration test now rejects any future schema node without a description; currently reserved settings explicitly state that they have no runtime effect.
 - Converged feature control into service-owned configuration: each public feature opts in beside its own schema, and the configuration system derives those exact `enabled` switches for sessions and command discovery. The former server feature registry was removed; configuration completeness and hardware availability remain visible as runtime status instead of becoming hidden enablement rules.
 - Lazy-loaded setup and administration so the schema-form dependency is not included in ordinary driver-page downloads.
 - Reused the existing fleet and identity administration surfaces, added password reconfirmation for sensitive operations, and prevented removal or demotion of the final lockdown administrator.
-- Added configuration revision history, rollback, audit history, and restart-required reporting. Graceful restart itself remains step 7.
+- Added configuration revision history, rollback, audit history, and immediate application reporting.
+- Added a serialized live-configuration coordinator and converted configurable service runtimes to apply changed sections without restarting Node. Passive policies read the current immutable snapshot; network, hardware, timer, and child-process services replace or retune their owned runtime while stable HTTP/socket handlers continue delegating to it. The admin editor reports any service-specific reload failure after the revision is safely committed.
+- Replaced the privileged host-reboot action with one lockdown-only, recently confirmed, audited application restart on the admin Overview. Node announces the restart, stops accepting new HTTP connections, and signals itself after acknowledging the browser; the existing service signal hooks clean up owned child processes, and systemd now restarts clean application exits without making `systemctl stop` ineffective.
+- Added one protected backup-and-restore service and admin page. Backups keep the application online, use SQLite's online snapshot API for all three databases, make verified stable copies of the remaining durable files, and produce a checksummed archive through a short-lived one-use download. Restore uploads are size-limited, reject unsafe archive entries, verify the complete manifest, checksums, SQLite integrity, and supported schema versions, then remain staged until explicit recent-password confirmation.
+- Restore now uses the normal application restart rather than stopping services itself. The earliest server startup swaps the validated replacement into the data directory, retains one rollback copy, and removes that copy only after the restored application reaches a stabilization point; an interrupted or failed first startup automatically puts the previous data back on the following start. Backup/restore control files and all staging remain inside `data/backup-restore`.
+- Fixed production WAL-mode snapshots creating unmanifested SQLite `-wal` and `-shm` files during schema inspection. Backup and restore validation now remove only those temporary staged sidecars before archiving or applying data, and the regression fixture uses WAL mode to match the real databases.
+- Added the early streaming `/video` middleware with `http-proxy-middleware`. Express removes the public prefix before forwarding WHEP/WHIP requests to `127.0.0.1:8889`, while root-relative MediaMTX session locations receive the prefix again so subsequent browser `PATCH` and `DELETE` requests follow the same path. MediaMTX signaling now binds to loopback; its ICE UDP/TCP listener remains directly reachable on port 8189.
+- Replaced Discord's `siteUrl`, the inter-instance profile's `publicUrl`, and media `whepBaseUrl` with one top-level `publicUrl`. A numbered internal database migration transforms every saved configuration revision before current validation, and the media section now contains only optional additional ICE hosts. WHEP and microphone WHIP URLs are fixed relative paths, so they work through the current origin without knowing its hostname.
+- Fixed inter-instance public payload generation to read feature flags and social links from the same live configuration revision. Social links enabled through the new configuration system no longer trigger an undefined legacy-config reference and an HTTP 500 response.
 
 Local verification completed:
 
-- All 107 server tests passed, including populated legacy-style default coverage, complete schema-description and input-example coverage, file-backed setup-code lifecycle and symlink rejection, service-definition-derived feature projection, schema-derived secret paths, configuration defaults and strict validation, full-document revision conflicts, secret preservation, administrator invariants, explicit setup-file import with recursive removal of nonexistent fields, and the earlier filesystem coverage.
+- All 119 server tests passed, including populated legacy-style default coverage, complete schema-description and input-example coverage, file-backed setup-code lifecycle and symlink rejection, service-definition-derived feature projection, schema-derived secret paths, configuration defaults and strict validation, full-document revision conflicts, secret preservation, administrator invariants, setup and initialized-server YAML import safety, recursive removal of nonexistent fields, inter-instance payload generation with social links enabled, and the earlier filesystem coverage.
+- All 27 server test files passed after live application, backup/restore, the internal media proxy, and the inter-instance regression coverage were added. The media tests stream exact SDP and trickle-ICE bodies through `POST`, `PATCH`, and `DELETE`, preserve headers, verify prefix and session-location rewriting, confirm loopback-only signaling, and derive the public ICE hostname from the canonical URL. The database migration and production-style WAL backup/restore paths are also covered. Application restart was not signaled on the development machine.
 - Focused admin, route, and identity UI lint passed.
 - All 20 existing focused web UI tests passed.
 - The production web UI build completed successfully and regenerated the checked-in server assets.
 - Installer syntax and repository whitespace checks passed.
 - A local startup smoke test reached listener initialization. MediaMTX then exited because `/usr/local/bin/mediamtx` is intentionally absent on this development machine; actual enabled integrations and media remain deployment checks for the real server.
+- A second empty-data startup smoke test loaded every reloadable service and reached the HTTP listener without listener-limit warnings. A deliberately substituted failing MediaMTX executable then ended the process as expected; enabled hardware and external integrations still require verification on the actual server.
+
+Testing-server verification completed:
+
+- A full backup created from the running application successfully validated and restored through the admin UI after the WAL-sidecar fix.
+- WHEP video playback works when the testing server is published through an ordinary whole-application reverse proxy. No special `/video` upstream, prefix rewrite, buffering rule, or direct public MediaMTX signaling route is present, confirming that Node now owns the complete public signaling path.
 
 # Phase 2: containerization and image delivery
 
@@ -672,9 +691,10 @@ Within the two hard phase boundaries, the safest order is:
 - [x] Converge optional feature control into service-owned `enabled` switches and derive the public feature map from those definitions.
 - [x] Build the centralized admin configuration UI.
 - [x] Add persistent audit history.
-- [ ] Implement coordinated backup and staged restore.
-- [ ] Standardize graceful application restart.
-- [ ] Add the internal `/video` proxy and remove the special external route.
+- [x] Apply every configuration revision to running services without restarting the application.
+- [x] Standardize graceful application restart.
+- [x] Implement online backup and restart-bound staged restore in one service.
+- [x] Add the internal `/video` proxy and make the special external route unnecessary.
 - [ ] Run the full Phase 1 completion gate on the legacy deployment.
 - [ ] Build and verify the production application image.
 - [ ] Add Compose, data mounting, networking, and hardware access.

server/index.js

@@ -1,3 +1,10 @@
+const backupRestoreService = require('./src/services/backupRestoreService');
+
+// A staged restore must replace data before configuration, identity, or report
+// services open SQLite. Requiring the service here is safe because its runtime
+// HTTP/socket dependencies remain lazy until register() is called below.
+backupRestoreService.applyPendingRestore();
+
 require('./src/globals/logger');
 require('./src/globals/config');
 require('./src/globals/http');
@@ -66,4 +73,5 @@ require('./src/services/replayEngineV2');
 // Discord feature so web requests always have a local delivery path.
 require('./src/services/replayDeliveryService');
 require('./src/services/discordBotService');
+backupRestoreService.register();
 require('./src/services/httpServer');

server/install_server.sh

@@ -305,7 +305,10 @@ Environment=NODE_ENV=production
 Environment=SERVER_DATA_DIR=$DATA_DIR
 Environment=ROVER_SNAPSHOT_WRITER_BIN=$ROVER_SNAPSHOT_WRITER_BIN
 ExecStart=$NODE_BIN $SERVER_DIR/index.js
-Restart=on-failure
+# Application-requested restarts use the same clean SIGTERM path as an
+# operator stop. Restart=always lets that process exit come back automatically,
+# while an explicit `systemctl stop` still remains stopped by systemd design.
+Restart=always
 RestartSec=2
 SuccessExitStatus=130 143
 

server/package.json

@@ -17,6 +17,7 @@
     "express": "^4.19.2",
     "fuse.js": "^7.4.2",
     "home-assistant-js-websocket": "^3.1.2",
+    "http-proxy-middleware": "^3.0.7",
     "js-yaml": "^4.1.1",
     "kokoro-js": "^1.2.1",
     "luxon": "^3.7.2",
@@ -27,6 +28,7 @@
     "reolink-nvr-api": "^0.3.0",
     "sharp": "^0.33.5",
     "socket.io": "^4.7.5",
+    "tar": "^7.5.22",
     "uuid": "^9.0.1",
     "ws": "^8.18.0"
   },

server/public/assets/AdminApp-BdcpFmKl.css

@@ -1 +0,0 @@
-.configuration-tree{margin-top:.25rem}.configuration-tree>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(1.5rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(1.5rem * var(--tw-space-y-reverse))}.configuration-card{min-width:0px}.configuration-card .configuration-card{margin-left:1rem;width:calc(100% - 1rem)}.configuration-card-body>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(.125rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(.125rem * var(--tw-space-y-reverse))}.configuration-card-body{padding:.125rem}.configuration-children>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(.125rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(.125rem * var(--tw-space-y-reverse))}.configuration-line{display:grid;min-width:0px;grid-template-columns:repeat(1,minmax(0,1fr));align-items:flex-start;gap:.125rem;border-radius:.375rem;--tw-bg-opacity: 1;background-color:rgb(38 38 38 / var(--tw-bg-opacity));padding:.125rem}@media(min-width:640px){.configuration-line{grid-template-columns:minmax(9rem,16rem) minmax(12rem,40rem)}}.configuration-line{justify-content:start}.configuration-key,.configuration-value{min-width:0px}.configuration-root-description,.configuration-branch-description,.configuration-item-description,.configuration-value-description{display:block;font-size:.875rem;line-height:1.25rem;line-height:1.375;--tw-text-opacity: 1;color:rgb(203 213 225 / var(--tw-text-opacity));margin-top:.125rem}.configuration-root-description{margin-bottom:.25rem}.configuration-branch-description,.configuration-item-description{max-width:56rem}.configuration-value-description{margin-bottom:.125rem;max-width:40rem}.configuration-value input:not([type=checkbox]),.configuration-value select,.configuration-value textarea{width:100%;border-radius:.375rem;border-width:1px;--tw-border-opacity: 1;border-color:rgb(82 82 82 / var(--tw-border-opacity));--tw-bg-opacity: 1;background-color:rgb(64 64 64 / var(--tw-bg-opacity));padding:.125rem;--tw-text-opacity: 1;color:rgb(255 255 255 / var(--tw-text-opacity))}.configuration-value input:not([type=checkbox])::-moz-placeholder,.configuration-value select::-moz-placeholder,.configuration-value textarea::-moz-placeholder{--tw-text-opacity: 1;color:rgb(148 163 184 / var(--tw-text-opacity))}.configuration-value input:not([type=checkbox])::placeholder,.configuration-value select::placeholder,.configuration-value textarea::placeholder{--tw-text-opacity: 1;color:rgb(148 163 184 / var(--tw-text-opacity))}.configuration-value input:not([type=checkbox]):focus,.configuration-value select:focus,.configuration-value textarea:focus{outline:2px solid transparent;outline-offset:2px;--tw-ring-offset-shadow: var(--tw-ring-inset) 0 0 0 var(--tw-ring-offset-width) var(--tw-ring-offset-color);--tw-ring-shadow: var(--tw-ring-inset) 0 0 0 calc(1px + var(--tw-ring-offset-width)) var(--tw-ring-color);box-shadow:var(--tw-ring-offset-shadow),var(--tw-ring-shadow),var(--tw-shadow, 0 0 #0000);--tw-ring-opacity: 1;--tw-ring-color: rgb(14 165 233 / var(--tw-ring-opacity))}.configuration-value input[type=checkbox]{height:1rem;width:1rem;vertical-align:middle;accent-color:#0ea5e9}.configuration-value .checkbox label{display:flex;min-height:1.75rem;align-items:center;--tw-text-opacity: 1;color:rgb(241 245 249 / var(--tw-text-opacity))}.configuration-value .error-detail{margin-top:.125rem;font-size:.75rem;line-height:1rem;--tw-text-opacity: 1;color:rgb(252 165 165 / var(--tw-text-opacity))}.configuration-value .help-block{margin-top:.125rem;display:block;font-size:.7rem;--tw-text-opacity: 1;color:rgb(100 116 139 / var(--tw-text-opacity))}.configuration-secret{min-width:0px}.configuration-item-actions,.configuration-array-actions{display:flex;flex-wrap:wrap;gap:.125rem}

server/public/assets/AdminApp-C7dustWw.css

@@ -0,0 +1 @@
+.configuration-tree{margin-top:.25rem}.configuration-tree>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(1.5rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(1.5rem * var(--tw-space-y-reverse))}.configuration-card{min-width:0px}.configuration-card-header{top:var(--configuration-sticky-top, 0px)}.configuration-card .configuration-card{margin-left:1rem;width:calc(100% - 1rem)}.configuration-card-body>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(.125rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(.125rem * var(--tw-space-y-reverse))}.configuration-card-body{padding:.125rem}.configuration-children>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(.125rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(.125rem * var(--tw-space-y-reverse))}.configuration-line{display:grid;min-width:0px;grid-template-columns:repeat(1,minmax(0,1fr));align-items:flex-start;gap:.125rem;border-radius:.375rem;--tw-bg-opacity: 1;background-color:rgb(38 38 38 / var(--tw-bg-opacity));padding:.125rem}@media(min-width:640px){.configuration-line{grid-template-columns:minmax(9rem,16rem) minmax(12rem,40rem)}}.configuration-line{justify-content:start}.configuration-key,.configuration-value{min-width:0px}.configuration-key-label{font-size:1rem;line-height:1.5rem;font-weight:600;line-height:1.375;--tw-text-opacity: 1;color:rgb(241 245 249 / var(--tw-text-opacity))}.configuration-root-description,.configuration-branch-description,.configuration-item-description,.configuration-value-description{display:block;font-size:.875rem;line-height:1.25rem;line-height:1.375;--tw-text-opacity: 1;color:rgb(203 213 225 / var(--tw-text-opacity));margin-top:.125rem}.configuration-root-description{margin-bottom:.25rem}.configuration-branch-description,.configuration-item-description{max-width:56rem}.configuration-value-description{margin-bottom:.125rem;max-width:40rem}.configuration-value input:not([type=checkbox]),.configuration-value select,.configuration-value textarea{width:100%;border-radius:.375rem;border-width:1px;--tw-border-opacity: 1;border-color:rgb(82 82 82 / var(--tw-border-opacity));--tw-bg-opacity: 1;background-color:rgb(64 64 64 / var(--tw-bg-opacity));padding:.125rem;--tw-text-opacity: 1;color:rgb(255 255 255 / var(--tw-text-opacity))}.configuration-value input:not([type=checkbox])::-moz-placeholder,.configuration-value select::-moz-placeholder,.configuration-value textarea::-moz-placeholder{--tw-text-opacity: 1;color:rgb(148 163 184 / var(--tw-text-opacity))}.configuration-value input:not([type=checkbox])::placeholder,.configuration-value select::placeholder,.configuration-value textarea::placeholder{--tw-text-opacity: 1;color:rgb(148 163 184 / var(--tw-text-opacity))}.configuration-value input:not([type=checkbox]):focus,.configuration-value select:focus,.configuration-value textarea:focus{outline:2px solid transparent;outline-offset:2px;--tw-ring-offset-shadow: var(--tw-ring-inset) 0 0 0 var(--tw-ring-offset-width) var(--tw-ring-offset-color);--tw-ring-shadow: var(--tw-ring-inset) 0 0 0 calc(1px + var(--tw-ring-offset-width)) var(--tw-ring-color);box-shadow:var(--tw-ring-offset-shadow),var(--tw-ring-shadow),var(--tw-shadow, 0 0 #0000);--tw-ring-opacity: 1;--tw-ring-color: rgb(14 165 233 / var(--tw-ring-opacity))}.configuration-value input[type=checkbox]{height:1rem;width:1rem;vertical-align:middle;accent-color:#0ea5e9}.configuration-value .checkbox label{display:flex;min-height:1.75rem;align-items:center;--tw-text-opacity: 1;color:rgb(241 245 249 / var(--tw-text-opacity))}.configuration-value .error-detail{margin-top:.125rem;font-size:.75rem;line-height:1rem;--tw-text-opacity: 1;color:rgb(252 165 165 / var(--tw-text-opacity))}.configuration-value .help-block{margin-top:.125rem;display:block;font-size:.7rem;--tw-text-opacity: 1;color:rgb(100 116 139 / var(--tw-text-opacity))}.configuration-secret{min-width:0px}.configuration-item-actions,.configuration-array-actions{display:flex;flex-wrap:wrap;gap:.125rem}

server/public/assets/SetupApp-BiB6Mx6k.js

@@ -1,2 +1,2 @@
-import{e as F,r as s,j as e,S as P,C as c,L as $}from"./index-CqMkCfQw.js";import{e as q,f as D,i as I}from"./api-C0PIt_OP.js";function R(){const l=F(),[a,m]=s.useState(null),[n,b]=s.useState(""),[d,C]=s.useState(""),[p,N]=s.useState(""),[r,S]=s.useState(""),[f,v]=s.useState(""),[o,w]=s.useState(null),[x,h]=s.useState(!1),[g,i]=s.useState("");s.useEffect(()=>{q(l).then(t=>m(t.required)).catch(t=>i(t.message))},[l]);async function j(t){h(!0),i("");try{await t(),m(!1),i("Setup completed. You can now open the administration application and log in.")}catch(u){const E=Array.isArray(u.validationErrors)?` ${u.validationErrors.map(y=>`${y.path}: ${y.message}`).join("; ")}`:"";i(`${u.message}${E}`)}finally{h(!1)}}function k(t){if(t.preventDefault(),r!==f){i("Passwords do not match.");return}j(()=>D(l,{setupCode:n,username:d,discordId:p,password:r}))}function A(t){t.preventDefault(),o&&j(async()=>I(l,{setupCode:n,fileName:o.name,yaml:await o.text()}))}return e.jsxs("div",{className:"min-h-screen bg-neutral-950 p-1 text-slate-100",children:[e.jsx(P,{}),e.jsxs("main",{className:"mx-auto flex min-h-screen w-full max-w-3xl flex-col justify-center gap-0.5",children:[e.jsxs(c,{title:"MultiRover setup",meta:a===null?"checking":a?"required":"complete",bodyClassName:"space-y-0.5 p-1 text-sm",children:[a?e.jsx("p",{children:"Enter the one-time code from setup-code.txt in the server data folder, then create the first lockdown administrator or import an existing configuration."}):null,a===!1?e.jsx($,{className:"button-dark inline-block",to:"/admin",children:"Open administration"}):null,g?e.jsx("p",{className:"surface p-1 text-sm text-slate-200",children:g}):null]}),a?e.jsxs(e.Fragment,{children:[e.jsxs(c,{title:"Setup authorization",bodyClassName:"p-1",children:[e.jsx("label",{className:"block text-xs font-semibold text-slate-200",children:"One-time setup code"}),e.jsx("input",{className:"field-input mt-0.5 w-full font-mono",value:n,onChange:t=>b(t.target.value)})]}),e.jsx(c,{title:"Create first administrator",bodyClassName:"p-1",children:e.jsxs("form",{className:"grid gap-0.5 md:grid-cols-2",onSubmit:k,children:[e.jsx("input",{className:"field-input",placeholder:"Username",value:d,onChange:t=>C(t.target.value)}),e.jsx("input",{className:"field-input",placeholder:"Discord id (optional)",value:p,onChange:t=>N(t.target.value)}),e.jsx("input",{className:"field-input",type:"password",placeholder:"Password",value:r,onChange:t=>S(t.target.value)}),e.jsx("input",{className:"field-input",type:"password",placeholder:"Confirm password",value:f,onChange:t=>v(t.target.value)}),e.jsx("button",{className:"button-dark md:col-span-2",type:"submit",disabled:x||!n||!d||!r,children:"Create lockdown administrator"})]})}),e.jsxs(c,{title:"Import configuration file",bodyClassName:"space-y-0.5 p-1 text-sm",children:[e.jsx("p",{className:"text-xs text-slate-400",children:"Choose an existing YAML configuration explicitly. The server validates and imports it once, and its secrets are never displayed back in the browser."}),e.jsxs("form",{className:"flex flex-col gap-0.5 md:flex-row",onSubmit:A,children:[e.jsx("input",{className:"field-input flex-1",type:"file",accept:".yaml,.yml,text/yaml",onChange:t=>w(t.target.files?.[0]||null)}),e.jsx("button",{className:"button-dark",type:"submit",disabled:x||!n||!o,children:"Import selected YAML"})]})]})]}):null]})]})}export{R as default};
-//# sourceMappingURL=SetupApp-C2cP8ApY.js.map
+import{e as F,r as s,j as e,S as P,C as c,L as $}from"./index-DyvmFiy4.js";import{l as q,m as D,n as I}from"./api-BVIrbPAA.js";function R(){const l=F(),[a,m]=s.useState(null),[n,b]=s.useState(""),[d,C]=s.useState(""),[p,N]=s.useState(""),[r,S]=s.useState(""),[f,v]=s.useState(""),[o,w]=s.useState(null),[x,h]=s.useState(!1),[g,i]=s.useState("");s.useEffect(()=>{q(l).then(t=>m(t.required)).catch(t=>i(t.message))},[l]);async function j(t){h(!0),i("");try{await t(),m(!1),i("Setup completed. You can now open the administration application and log in.")}catch(u){const E=Array.isArray(u.validationErrors)?` ${u.validationErrors.map(y=>`${y.path}: ${y.message}`).join("; ")}`:"";i(`${u.message}${E}`)}finally{h(!1)}}function k(t){if(t.preventDefault(),r!==f){i("Passwords do not match.");return}j(()=>D(l,{setupCode:n,username:d,discordId:p,password:r}))}function A(t){t.preventDefault(),o&&j(async()=>I(l,{setupCode:n,fileName:o.name,yaml:await o.text()}))}return e.jsxs("div",{className:"min-h-screen bg-neutral-950 p-1 text-slate-100",children:[e.jsx(P,{}),e.jsxs("main",{className:"mx-auto flex min-h-screen w-full max-w-3xl flex-col justify-center gap-0.5",children:[e.jsxs(c,{title:"MultiRover setup",meta:a===null?"checking":a?"required":"complete",bodyClassName:"space-y-0.5 p-1 text-sm",children:[a?e.jsx("p",{children:"Enter the one-time code from setup-code.txt in the server data folder, then create the first lockdown administrator or import an existing configuration."}):null,a===!1?e.jsx($,{className:"button-dark inline-block",to:"/admin",children:"Open administration"}):null,g?e.jsx("p",{className:"surface p-1 text-sm text-slate-200",children:g}):null]}),a?e.jsxs(e.Fragment,{children:[e.jsxs(c,{title:"Setup authorization",bodyClassName:"p-1",children:[e.jsx("label",{className:"block text-xs font-semibold text-slate-200",children:"One-time setup code"}),e.jsx("input",{className:"field-input mt-0.5 w-full font-mono",value:n,onChange:t=>b(t.target.value)})]}),e.jsx(c,{title:"Create first administrator",bodyClassName:"p-1",children:e.jsxs("form",{className:"grid gap-0.5 md:grid-cols-2",onSubmit:k,children:[e.jsx("input",{className:"field-input",placeholder:"Username",value:d,onChange:t=>C(t.target.value)}),e.jsx("input",{className:"field-input",placeholder:"Discord id (optional)",value:p,onChange:t=>N(t.target.value)}),e.jsx("input",{className:"field-input",type:"password",placeholder:"Password",value:r,onChange:t=>S(t.target.value)}),e.jsx("input",{className:"field-input",type:"password",placeholder:"Confirm password",value:f,onChange:t=>v(t.target.value)}),e.jsx("button",{className:"button-dark md:col-span-2",type:"submit",disabled:x||!n||!d||!r,children:"Create lockdown administrator"})]})}),e.jsxs(c,{title:"Import configuration file",bodyClassName:"space-y-0.5 p-1 text-sm",children:[e.jsx("p",{className:"text-xs text-slate-400",children:"Choose an existing YAML configuration explicitly. The server validates and imports it once, and its secrets are never displayed back in the browser."}),e.jsxs("form",{className:"flex flex-col gap-0.5 md:flex-row",onSubmit:A,children:[e.jsx("input",{className:"field-input flex-1",type:"file",accept:".yaml,.yml,text/yaml",onChange:t=>w(t.target.files?.[0]||null)}),e.jsx("button",{className:"button-dark",type:"submit",disabled:x||!n||!o,children:"Import selected YAML"})]})]})]}):null]})]})}export{R as default};
+//# sourceMappingURL=SetupApp-BiB6Mx6k.js.map

server/public/assets/api-BVIrbPAA.js

@@ -0,0 +1,2 @@
+function o(t,i,a={}){return new Promise((e,s)=>{t.emit(i,a,(r={})=>{if(r?.error){const n=new Error(r.error);n.code=r.code||null,n.validationErrors=r.validationErrors||[],n.currentRevision=r.currentRevision||null,s(n);return}e(r)})})}const c=t=>o(t,"adminConfig:get"),u=(t,i)=>o(t,"adminConfig:confirmPassword",{password:i}),d=(t,i)=>o(t,"adminConfig:updateConfiguration",i),m=(t,i)=>o(t,"adminConfig:importConfigurationFile",i),f=(t,i)=>o(t,"adminConfig:restoreRevision",i),p=(t,i)=>o(t,"adminConfig:createAdministrator",i),l=(t,i)=>o(t,"adminConfig:updateAdministrator",i),g=(t,i)=>o(t,"adminConfig:deleteAdministrator",{id:i}),C=t=>o(t,"server:restartApplication"),A=t=>o(t,"backupRestore:status"),R=t=>o(t,"backupRestore:createBackup"),k=t=>o(t,"backupRestore:createRestoreUpload"),v=(t,i)=>o(t,"backupRestore:confirmRestore",{restoreId:i}),F=t=>o(t,"setup:status"),b=(t,i)=>o(t,"setup:createAdministrator",i),w=(t,i)=>o(t,"setup:importConfigurationFile",i);export{C as a,R as b,p as c,g as d,k as e,v as f,A as g,d as h,m as i,c as j,u as k,F as l,b as m,w as n,f as r,l as u};
+//# sourceMappingURL=api-BVIrbPAA.js.map

server/public/assets/api-BVIrbPAA.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-BVIrbPAA.js","sources":["../../../webui/src/admin/api.js"],"sourcesContent":["// Admin Socket API\n// Purpose: Gives the setup and administration applications one promise-based boundary around acknowledged socket events.\n// Scope: Preserves server error codes and validation details so shared UI infrastructure can respond consistently.\nexport function emitAdminRequest(socket, eventName, payload = {}) {\n  return new Promise((resolve, reject) => {\n    socket.emit(eventName, payload, (response = {}) => {\n      if (response?.error) {\n        const error = new Error(response.error);\n        error.code = response.code || null;\n        error.validationErrors = response.validationErrors || [];\n        error.currentRevision = response.currentRevision || null;\n        reject(error);\n        return;\n      }\n      resolve(response);\n    });\n  });\n}\n\nexport const getAdminSnapshot = (socket) => emitAdminRequest(socket, 'adminConfig:get');\nexport const confirmAdminPassword = (socket, password) => emitAdminRequest(socket, 'adminConfig:confirmPassword', { password });\nexport const updateConfiguration = (socket, payload) => emitAdminRequest(socket, 'adminConfig:updateConfiguration', payload);\nexport const importAdminConfigurationFile = (socket, payload) => emitAdminRequest(socket, 'adminConfig:importConfigurationFile', payload);\nexport const restoreConfigurationRevision = (socket, payload) => emitAdminRequest(socket, 'adminConfig:restoreRevision', payload);\nexport const createAdministrator = (socket, payload) => emitAdminRequest(socket, 'adminConfig:createAdministrator', payload);\nexport const updateAdministrator = (socket, payload) => emitAdminRequest(socket, 'adminConfig:updateAdministrator', payload);\nexport const deleteAdministrator = (socket, id) => emitAdminRequest(socket, 'adminConfig:deleteAdministrator', { id });\nexport const restartApplication = (socket) => emitAdminRequest(socket, 'server:restartApplication');\nexport const getBackupRestoreStatus = (socket) => emitAdminRequest(socket, 'backupRestore:status');\nexport const createFullBackup = (socket) => emitAdminRequest(socket, 'backupRestore:createBackup');\nexport const createRestoreUpload = (socket) => emitAdminRequest(socket, 'backupRestore:createRestoreUpload');\nexport const confirmFullRestore = (socket, restoreId) => emitAdminRequest(socket, 'backupRestore:confirmRestore', { restoreId });\n\nexport const getSetupStatus = (socket) => emitAdminRequest(socket, 'setup:status');\nexport const createFirstAdministrator = (socket, payload) => emitAdminRequest(socket, 'setup:createAdministrator', payload);\nexport const importConfigurationFile = (socket, payload) => emitAdminRequest(socket, 'setup:importConfigurationFile', payload);\n"],"names":["emitAdminRequest","socket","eventName","payload","resolve","reject","response","error","getAdminSnapshot","confirmAdminPassword","password","updateConfiguration","importAdminConfigurationFile","restoreConfigurationRevision","createAdministrator","updateAdministrator","deleteAdministrator","id","restartApplication","getBackupRestoreStatus","createFullBackup","createRestoreUpload","confirmFullRestore","restoreId","getSetupStatus","createFirstAdministrator","importConfigurationFile"],"mappings":"AAGO,SAASA,EAAiBC,EAAQC,EAAWC,EAAU,CAAA,EAAI,CAChE,OAAO,IAAI,QAAQ,CAACC,EAASC,IAAW,CACtCJ,EAAO,KAAKC,EAAWC,EAAS,CAACG,EAAW,CAAA,IAAO,CACjD,GAAIA,GAAU,MAAO,CACnB,MAAMC,EAAQ,IAAI,MAAMD,EAAS,KAAK,EACtCC,EAAM,KAAOD,EAAS,MAAQ,KAC9BC,EAAM,iBAAmBD,EAAS,kBAAoB,CAAA,EACtDC,EAAM,gBAAkBD,EAAS,iBAAmB,KACpDD,EAAOE,CAAK,EACZ,MACF,CACAH,EAAQE,CAAQ,CAClB,CAAC,CACH,CAAC,CACH,CAEY,MAACE,EAAoBP,GAAWD,EAAiBC,EAAQ,iBAAiB,EACzEQ,EAAuB,CAACR,EAAQS,IAAaV,EAAiBC,EAAQ,8BAA+B,CAAE,SAAAS,CAAQ,CAAE,EACjHC,EAAsB,CAACV,EAAQE,IAAYH,EAAiBC,EAAQ,kCAAmCE,CAAO,EAC9GS,EAA+B,CAACX,EAAQE,IAAYH,EAAiBC,EAAQ,sCAAuCE,CAAO,EAC3HU,EAA+B,CAACZ,EAAQE,IAAYH,EAAiBC,EAAQ,8BAA+BE,CAAO,EACnHW,EAAsB,CAACb,EAAQE,IAAYH,EAAiBC,EAAQ,kCAAmCE,CAAO,EAC9GY,EAAsB,CAACd,EAAQE,IAAYH,EAAiBC,EAAQ,kCAAmCE,CAAO,EAC9Ga,EAAsB,CAACf,EAAQgB,IAAOjB,EAAiBC,EAAQ,kCAAmC,CAAE,GAAAgB,CAAE,CAAE,EACxGC,EAAsBjB,GAAWD,EAAiBC,EAAQ,2BAA2B,EACrFkB,EAA0BlB,GAAWD,EAAiBC,EAAQ,sBAAsB,EACpFmB,EAAoBnB,GAAWD,EAAiBC,EAAQ,4BAA4B,EACpFoB,EAAuBpB,GAAWD,EAAiBC,EAAQ,mCAAmC,EAC9FqB,EAAqB,CAACrB,EAAQsB,IAAcvB,EAAiBC,EAAQ,+BAAgC,CAAE,UAAAsB,CAAS,CAAE,EAElHC,EAAkBvB,GAAWD,EAAiBC,EAAQ,cAAc,EACpEwB,EAA2B,CAACxB,EAAQE,IAAYH,EAAiBC,EAAQ,4BAA6BE,CAAO,EAC7GuB,EAA0B,CAACzB,EAAQE,IAAYH,EAAiBC,EAAQ,gCAAiCE,CAAO"}

server/public/assets/api-C0PIt_OP.js

@@ -1,2 +0,0 @@
-function n(t,i,a={}){return new Promise((e,s)=>{t.emit(i,a,(r={})=>{if(r?.error){const o=new Error(r.error);o.code=r.code||null,o.validationErrors=r.validationErrors||[],o.currentRevision=r.currentRevision||null,s(o);return}e(r)})})}const d=t=>n(t,"adminConfig:get"),m=(t,i)=>n(t,"adminConfig:confirmPassword",{password:i}),u=(t,i)=>n(t,"adminConfig:updateConfiguration",i),c=(t,i)=>n(t,"adminConfig:restoreRevision",i),f=(t,i)=>n(t,"adminConfig:createAdministrator",i),g=(t,i)=>n(t,"adminConfig:updateAdministrator",i),C=(t,i)=>n(t,"adminConfig:deleteAdministrator",{id:i}),A=t=>n(t,"setup:status"),l=(t,i)=>n(t,"setup:createAdministrator",i),p=(t,i)=>n(t,"setup:importConfigurationFile",i);export{u as a,m as b,f as c,C as d,A as e,l as f,d as g,p as i,c as r,g as u};
-//# sourceMappingURL=api-C0PIt_OP.js.map

server/public/assets/api-C0PIt_OP.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-C0PIt_OP.js","sources":["../../../webui/src/admin/api.js"],"sourcesContent":["// Admin Socket API\n// Purpose: Gives the setup and administration applications one promise-based boundary around acknowledged socket events.\n// Scope: Preserves server error codes and validation details so shared UI infrastructure can respond consistently.\nexport function emitAdminRequest(socket, eventName, payload = {}) {\n  return new Promise((resolve, reject) => {\n    socket.emit(eventName, payload, (response = {}) => {\n      if (response?.error) {\n        const error = new Error(response.error);\n        error.code = response.code || null;\n        error.validationErrors = response.validationErrors || [];\n        error.currentRevision = response.currentRevision || null;\n        reject(error);\n        return;\n      }\n      resolve(response);\n    });\n  });\n}\n\nexport const getAdminSnapshot = (socket) => emitAdminRequest(socket, 'adminConfig:get');\nexport const confirmAdminPassword = (socket, password) => emitAdminRequest(socket, 'adminConfig:confirmPassword', { password });\nexport const updateConfiguration = (socket, payload) => emitAdminRequest(socket, 'adminConfig:updateConfiguration', payload);\nexport const restoreConfigurationRevision = (socket, payload) => emitAdminRequest(socket, 'adminConfig:restoreRevision', payload);\nexport const createAdministrator = (socket, payload) => emitAdminRequest(socket, 'adminConfig:createAdministrator', payload);\nexport const updateAdministrator = (socket, payload) => emitAdminRequest(socket, 'adminConfig:updateAdministrator', payload);\nexport const deleteAdministrator = (socket, id) => emitAdminRequest(socket, 'adminConfig:deleteAdministrator', { id });\n\nexport const getSetupStatus = (socket) => emitAdminRequest(socket, 'setup:status');\nexport const createFirstAdministrator = (socket, payload) => emitAdminRequest(socket, 'setup:createAdministrator', payload);\nexport const importConfigurationFile = (socket, payload) => emitAdminRequest(socket, 'setup:importConfigurationFile', payload);\n"],"names":["emitAdminRequest","socket","eventName","payload","resolve","reject","response","error","getAdminSnapshot","confirmAdminPassword","password","updateConfiguration","restoreConfigurationRevision","createAdministrator","updateAdministrator","deleteAdministrator","id","getSetupStatus","createFirstAdministrator","importConfigurationFile"],"mappings":"AAGO,SAASA,EAAiBC,EAAQC,EAAWC,EAAU,CAAA,EAAI,CAChE,OAAO,IAAI,QAAQ,CAACC,EAASC,IAAW,CACtCJ,EAAO,KAAKC,EAAWC,EAAS,CAACG,EAAW,CAAA,IAAO,CACjD,GAAIA,GAAU,MAAO,CACnB,MAAMC,EAAQ,IAAI,MAAMD,EAAS,KAAK,EACtCC,EAAM,KAAOD,EAAS,MAAQ,KAC9BC,EAAM,iBAAmBD,EAAS,kBAAoB,CAAA,EACtDC,EAAM,gBAAkBD,EAAS,iBAAmB,KACpDD,EAAOE,CAAK,EACZ,MACF,CACAH,EAAQE,CAAQ,CAClB,CAAC,CACH,CAAC,CACH,CAEY,MAACE,EAAoBP,GAAWD,EAAiBC,EAAQ,iBAAiB,EACzEQ,EAAuB,CAACR,EAAQS,IAAaV,EAAiBC,EAAQ,8BAA+B,CAAE,SAAAS,CAAQ,CAAE,EACjHC,EAAsB,CAACV,EAAQE,IAAYH,EAAiBC,EAAQ,kCAAmCE,CAAO,EAC9GS,EAA+B,CAACX,EAAQE,IAAYH,EAAiBC,EAAQ,8BAA+BE,CAAO,EACnHU,EAAsB,CAACZ,EAAQE,IAAYH,EAAiBC,EAAQ,kCAAmCE,CAAO,EAC9GW,EAAsB,CAACb,EAAQE,IAAYH,EAAiBC,EAAQ,kCAAmCE,CAAO,EAC9GY,EAAsB,CAACd,EAAQe,IAAOhB,EAAiBC,EAAQ,kCAAmC,CAAE,GAAAe,CAAE,CAAE,EAExGC,EAAkBhB,GAAWD,EAAiBC,EAAQ,cAAc,EACpEiB,EAA2B,CAACjB,EAAQE,IAAYH,EAAiBC,EAAQ,4BAA6BE,CAAO,EAC7GgB,EAA0B,CAAClB,EAAQE,IAAYH,EAAiBC,EAAQ,gCAAiCE,CAAO"}

server/public/index.html

@@ -12,8 +12,8 @@
     <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />
     <!-- site-metadata:inject -->
     <!-- analytics:inject -->
-    <script type="module" crossorigin src="/assets/index-CqMkCfQw.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-1O6avznD.css">
+    <script type="module" crossorigin src="/assets/index-DyvmFiy4.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-D0j33plX.css">
   </head>
   <body>
     <div id="root"></div>

server/src/configuration/configuration.test.js

@@ -6,11 +6,18 @@ const assert = require('node:assert/strict');
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
+const { execFileSync } = require('child_process');
+const Database = require('better-sqlite3');
 const { defaultConfig, normalizeConfig, assertValidConfig } = require('./validation');
 const { definitions, rootSchema, secretPaths, featureDefinitions } = require('./definition');
+const { migrations } = require('./migrations');
 const { getFeatureFlags } = require('./index');
 const { createConfigurationDatabase } = require('./database');
-const { parseConfigurationFile, importConfigurationFile } = require('./configurationFileImporter');
+const {
+  parseConfigurationFile,
+  buildSecretOperationsForImport,
+  importConfigurationFile,
+} = require('./configurationFileImporter');
 
 const temporaryRoots = [];
 
@@ -210,14 +217,12 @@ test('generated feature flags use only each declared enabled switch', () => {
 });
 
 test('normalization fills missing legacy fields but strict validation rejects unknown fields', () => {
-  const normalized = normalizeConfig({ media: { whepBaseUrl: 'http://localhost:8889/video' } });
-  // Missing fields now receive the same populated template defaults as a new
-  // installation; normalization must not silently revert this one collection
-  // to the former empty-safe-default policy.
-  assert.deepEqual(normalized.media.additionalHosts, ['rover.example.com', 'media-server.local']);
+  const normalized = normalizeConfig({ media: { additionalHosts: [] } });
+  assert.equal(normalized.publicUrl, 'https://rover.example.com');
+  assert.deepEqual(normalized.media.additionalHosts, []);
   assert.doesNotThrow(() => assertValidConfig(normalized));
 
-  const invalid = normalizeConfig({ media: { whepBaseUrl: 'http://localhost:8889/video', misspelledHost: 'x' } });
+  const invalid = normalizeConfig({ media: { additionalHosts: [], misspelledHost: 'x' } });
   assert.throws(() => assertValidConfig(invalid), (error) => {
     assert.equal(error.code, 'CONFIG_VALIDATION_FAILED');
     assert.ok(error.validationErrors.some((entry) => entry.path.includes('misspelledHost')));
@@ -225,6 +230,40 @@ test('normalization fills missing legacy fields but strict validation rejects un
   });
 });
 
+test('database migration consolidates existing public URLs and removes obsolete media addressing', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'multirover-public-url-migration-'));
+  temporaryRoots.push(root);
+  const databasePath = path.join(root, 'configuration.sqlite');
+  const legacyDatabase = new Database(databasePath);
+  legacyDatabase.exec(`
+    CREATE TABLE schema_migrations (version INTEGER PRIMARY KEY, applied_at INTEGER NOT NULL);
+    ${migrations[0].sql}
+  `);
+  legacyDatabase.prepare('INSERT INTO schema_migrations (version, applied_at) VALUES (1, ?)').run(Date.now());
+
+  const legacyConfig = structuredClone(defaultConfig);
+  delete legacyConfig.publicUrl;
+  legacyConfig.interInstance.profile.publicUrl = 'https://rover.example.com';
+  legacyConfig.discord.enabled = true;
+  legacyConfig.discord.siteUrl = 'https://canonical.example.com';
+  legacyConfig.media.whepBaseUrl = 'http://127.0.0.1:8889/video';
+  const inserted = legacyDatabase.prepare(`
+    INSERT INTO configuration_revisions (config_json, created_at, actor, source)
+    VALUES (?, ?, 'test', 'legacy-shape')
+  `).run(JSON.stringify(legacyConfig), Date.now());
+  legacyDatabase.prepare('INSERT INTO configuration_state (singleton, active_revision_id) VALUES (1, ?)')
+    .run(inserted.lastInsertRowid);
+  legacyDatabase.close();
+
+  const migrated = createConfigurationDatabase({ databasePath });
+  const active = migrated.getActiveConfigurationRecord().config;
+  assert.equal(active.publicUrl, 'https://canonical.example.com');
+  assert.equal(Object.hasOwn(active.interInstance.profile, 'publicUrl'), false);
+  assert.equal(Object.hasOwn(active.discord, 'siteUrl'), false);
+  assert.equal(Object.hasOwn(active.media, 'whepBaseUrl'), false);
+  migrated.close();
+});
+
 test('full-document updates preserve secrets and reject a stale browser revision', () => {
   const database = createTestDatabase();
   const initial = database.getActiveConfigurationRecord();
@@ -286,6 +325,7 @@ admins:
     password_hash: "$2b$10$preservedHash"
     discord_id: "1234"
     lockdown: true
+publicUrl: https://production.example.com
 timezone: America/Chicago
 media:
   whepBaseUrl: http://localhost:8889/video
@@ -315,6 +355,7 @@ fleetReports:
     immediateCriticalAlerts: true
 `;
   const parsed = parseConfigurationFile(yamlText);
+  assert.equal(parsed.config.publicUrl, 'https://production.example.com');
   assert.equal(parsed.config.timezone, 'America/Chicago');
   assert.equal(parsed.administrators[0].passwordHash, '$2b$10$preservedHash');
   assert.equal(Object.hasOwn(parsed.config.overseerControl, 'heartbeatMs'), false);
@@ -353,3 +394,115 @@ bandwidthSavings:
     return true;
   });
 });
+
+test('an administrative YAML replacement ignores accounts and only changes secrets present in the file', () => {
+  const database = createTestDatabase();
+  const initial = database.getClientConfiguration();
+  const seededRevision = database.updateConfiguration({
+    value: initial.config,
+    expectedRevision: initial.revision,
+    actor: 'secret-seed',
+    secretOperations: {
+      'homeAssistant.token': { action: 'replace', value: 'preserve-this-token' },
+      'ptzCamera.password': { action: 'replace', value: 'clear-this-password' },
+      'discord.token': { action: 'replace', value: 'replace-this-token' },
+    },
+  });
+  const yamlText = `
+admins:
+  - this obsolete account entry is deliberately malformed
+timezone: America/Chicago
+ptzCamera:
+  password:
+discord:
+  token: new-discord-token
+`;
+
+  /*
+    An initialized installation treats the YAML as configuration data only.
+    Even malformed account data is ignored, while presence-aware secret
+    operations preserve an omitted credential, clear an explicit empty value,
+    and replace an explicit non-empty value.
+  */
+  const parsed = parseConfigurationFile(yamlText, { includeAdministrators: false });
+  assert.deepEqual(parsed.administrators, []);
+  assert.equal(parsed.uploadedAdministratorCount, 1);
+  assert.deepEqual(parsed.providedSecretPaths, ['ptzCamera.password', 'discord.token']);
+  const revision = database.updateConfiguration({
+    value: parsed.config,
+    expectedRevision: seededRevision,
+    secretOperations: buildSecretOperationsForImport(parsed),
+    actor: 'admin-import-test',
+    source: 'admin-yaml:production.yaml',
+  });
+
+  const active = database.getActiveConfigurationRecord();
+  assert.equal(active.revision, revision);
+  assert.equal(active.source, 'admin-yaml:production.yaml');
+  assert.equal(active.config.homeAssistant.token, 'preserve-this-token');
+  assert.equal(active.config.ptzCamera.password, '');
+  assert.equal(active.config.discord.token, 'new-discord-token');
+  assert.equal(active.config.timezone, 'America/Chicago');
+  assert.equal(database.listAdministrators().length, 0);
+  database.close();
+});
+
+test('committed revisions replace the live snapshot and isolate service reload failures', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'multirover-live-configuration-'));
+  temporaryRoots.push(root);
+  const serverRoot = path.resolve(__dirname, '../..');
+  const script = `
+    const configuration = require('./src/configuration');
+    const applied = [];
+    configuration.registerConfigurationHandler('timezone', (next, previous) => {
+      applied.push({ section: 'timezone', next, previous });
+    });
+    configuration.registerConfigurationHandler('media', () => {
+      throw new Error('simulated media reload failure');
+    });
+    const database = configuration.getConfigurationDatabase();
+    const record = database.getClientConfiguration();
+    const next = structuredClone(record.config);
+    next.timezone = 'America/Chicago';
+    next.media.additionalHosts = ['media.example.test'];
+    database.updateConfiguration({
+      value: next,
+      expectedRevision: record.revision,
+      actor: 'live-configuration-test',
+    });
+    configuration.applyCommittedConfiguration().then((application) => {
+      console.log(JSON.stringify({
+        application,
+        applied,
+        liveTimezone: configuration.loadConfig().timezone,
+        liveRevision: configuration.getRuntimeConfigurationRevision(),
+      }));
+      database.close();
+    });
+  `;
+  const output = execFileSync(process.execPath, ['-e', script], {
+    cwd: serverRoot,
+    env: { ...process.env, SERVER_DATA_DIR: root },
+    encoding: 'utf8',
+  });
+  const result = JSON.parse(output.trim());
+
+  /*
+    A failing integration remains visible in application status but cannot
+    roll back the valid revision or prevent an unrelated service from seeing
+    it. This is the central guarantee that makes live application usable on a
+    server where optional hardware may be offline during an ordinary edit.
+  */
+  assert.equal(result.liveTimezone, 'America/Chicago');
+  assert.equal(result.liveRevision, result.application.revision);
+  assert.deepEqual(result.application.changedSections, ['timezone', 'media']);
+  assert.deepEqual(result.applied, [{
+    section: 'timezone',
+    next: 'America/Chicago',
+    previous: defaultConfig.timezone,
+  }]);
+  assert.deepEqual(result.application.services, [
+    { section: 'timezone', status: 'applied' },
+    { section: 'media', status: 'failed', error: 'simulated media reload failure' },
+  ]);
+});

server/src/configuration/configurationFileImporter.js

@@ -1,8 +1,44 @@
 // Configuration File Importer
-// Purpose: Validates one YAML file deliberately uploaded during first-run setup and stores it in the configuration database.
-// Scope: This is an explicit setup action only; startup and installation never search for or consume configuration files.
+// Purpose: Validates a deliberately uploaded legacy YAML file for first-run setup or an explicit administrative replacement.
+// Scope: Startup and installation never search for or consume configuration files; every import begins with a browser-selected file.
 const yaml = require('js-yaml');
-const { rootSchema, normalizeConfig, assertValidConfig } = require('./validation');
+const {
+  rootSchema,
+  secretPaths,
+  normalizeConfig,
+  assertValidConfig,
+} = require('./validation');
+
+const MAX_CONFIGURATION_FILE_BYTES = 1024 * 1024;
+
+function getAtPath(object, dottedPath) {
+  return String(dottedPath || '').split('.').filter(Boolean)
+    .reduce((value, key) => value?.[key], object);
+}
+
+function setAtPath(object, dottedPath, value) {
+  const parts = String(dottedPath || '').split('.').filter(Boolean);
+  let cursor = object;
+  parts.slice(0, -1).forEach((key) => {
+    cursor = cursor[key];
+  });
+  cursor[parts.at(-1)] = value;
+}
+
+function hasAtPath(object, dottedPath) {
+  /*
+    Presence, rather than truthiness, distinguishes an omitted legacy secret
+    from an explicitly empty one. An omitted credential must preserve the
+    running installation's value, while an empty YAML value deliberately
+    clears it through the same operation used by the schema form.
+  */
+  let cursor = object;
+  for (const key of String(dottedPath || '').split('.').filter(Boolean)) {
+    if (cursor === null || typeof cursor !== 'object' || !Object.hasOwn(cursor, key)) return false;
+    cursor = cursor[key];
+  }
+  return true;
+}
 
 function keepCurrentSchemaFields(value, schema) {
   /*
@@ -46,28 +82,65 @@ function normalizeUploadedAdministrator(entry, index) {
   };
 }
 
-function parseConfigurationFile(text) {
+function parseConfigurationFile(text, { includeAdministrators = true } = {}) {
   const parsed = yaml.load(String(text || ''));
   if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
     throw new Error('The configuration file must contain a YAML object.');
   }
 
-  const administrators = Array.isArray(parsed.admins)
-    ? parsed.admins.map(normalizeUploadedAdministrator)
+  const uploadedAdministrators = Array.isArray(parsed.admins) ? parsed.admins : [];
+  /*
+    First-run setup is the sole workflow allowed to create accounts from the
+    legacy file. An initialized server ignores the entire admins collection,
+    including obsolete or malformed entries, so importing configuration can
+    never rename accounts, replace password hashes, or remove the last
+    lockdown administrator.
+  */
+  const administrators = includeAdministrators
+    ? uploadedAdministrators.map(normalizeUploadedAdministrator)
     : [];
   const configInput = Object.fromEntries(
     Object.entries(parsed).filter(([key]) => key !== 'admins'),
   );
+  secretPaths.forEach((secretPath) => {
+    /*
+      YAML commonly represents `token:` as null even though the application
+      models an unconfigured credential as an empty string. Translate null only
+      for known secret fields so a plainly empty legacy credential has the same
+      clear meaning as the admin form; null in any ordinary current field still
+      fails its schema normally.
+    */
+    if (hasAtPath(configInput, secretPath) && getAtPath(configInput, secretPath) === null) {
+      setAtPath(configInput, secretPath, '');
+    }
+  });
   const config = normalizeConfig(keepCurrentSchemaFields(configInput, rootSchema));
+  const providedSecretPaths = secretPaths.filter((secretPath) => hasAtPath(configInput, secretPath));
 
   // Filtering applies only to nonexistent keys. Values retained for current
   // schema fields still have to satisfy every type, range, and format rule
   // before the importer can atomically initialize the database.
   assertValidConfig(config);
-  if (!administrators.some((admin) => admin.role === 'lockdown')) {
-    throw new Error('The configuration file must contain at least one lockdown administrator.');
-  }
-  return { config, administrators };
+  return {
+    config,
+    administrators,
+    uploadedAdministratorCount: uploadedAdministrators.length,
+    providedSecretPaths,
+  };
+}
+
+function buildSecretOperationsForImport({ config, providedSecretPaths = [] }) {
+  return Object.fromEntries(providedSecretPaths.map((secretPath) => {
+    const value = getAtPath(config, secretPath);
+    /*
+      Current secret schemas are strings. Keeping this conversion beside the
+      importer produces the database's narrow replace/clear contract and
+      avoids granting the import route a way around ordinary secret handling.
+    */
+    return value === ''
+      ? [secretPath, { action: 'clear' }]
+      : [secretPath, { action: 'replace', value }];
+  }));
 }
 
 function importConfigurationFile({ text, database, actor = 'setup-file-upload', source = 'uploaded-config.yaml' }) {
@@ -85,6 +158,8 @@ function importConfigurationFile({ text, database, actor = 'setup-file-upload',
 }
 
 module.exports = {
+  MAX_CONFIGURATION_FILE_BYTES,
   parseConfigurationFile,
+  buildSecretOperationsForImport,
   importConfigurationFile,
 };

server/src/configuration/database.js

@@ -161,7 +161,13 @@ function createConfigurationDatabase({ databasePath = DEFAULT_DATABASE_PATH } =
     return { ...record, ...redacted };
   }
 
-  function updateConfiguration({ value, expectedRevision, secretOperations = {}, actor }) {
+  function updateConfiguration({
+    value,
+    expectedRevision,
+    secretOperations = {},
+    actor,
+    source = 'admin-ui',
+  }) {
     const active = getActiveConfigurationRecord();
     const candidate = clone(value);
 
@@ -187,7 +193,12 @@ function createConfigurationDatabase({ databasePath = DEFAULT_DATABASE_PATH } =
     return commitRevisionTransaction(candidate, {
       expectedRevision,
       actor,
-      source: 'admin-ui',
+      /*
+        Administrative imports use this same safe update path but identify the
+        selected filename in revision and audit history. The source remains
+        server-controlled metadata and never contains configuration values.
+      */
+      source,
     });
   }
 
@@ -331,6 +342,16 @@ function createConfigurationDatabase({ databasePath = DEFAULT_DATABASE_PATH } =
     }));
   }
 
+  function recordAuditEvent(actor, action, details = {}) {
+    /*
+      Operational admin services need the same persistent audit trail as
+      configuration changes, but they must not gain access to the underlying
+      statement or database handle. This narrow method retains the existing
+      redacted-details contract at the database boundary.
+    */
+    writeAudit(actor, action, details);
+  }
+
   const importConfigurationFileTransaction = db.transaction(({ config, administrators, actor, source }) => {
     // A setup upload initializes an empty installation; it is deliberately not
     // a general-purpose replacement path for a running server's configuration.
@@ -351,6 +372,15 @@ function createConfigurationDatabase({ databasePath = DEFAULT_DATABASE_PATH } =
     return importConfigurationFileTransaction(payload);
   }
 
+  function backupDatabase(destinationPath) {
+    /*
+      SQLite's online backup API produces one coherent database file while the
+      live WAL-backed connection remains open. The backup service receives only
+      this narrow operation, never the private database handle.
+    */
+    return db.backup(destinationPath);
+  }
+
   return {
     databasePath,
     getActiveConfigurationRecord,
@@ -366,7 +396,9 @@ function createConfigurationDatabase({ databasePath = DEFAULT_DATABASE_PATH } =
     countLockdownAdministrators,
     isSetupComplete,
     listAuditEvents,
+    recordAuditEvent,
     importConfigurationFile,
+    backupDatabase,
     close: () => db.close(),
   };
 }

server/src/configuration/definition.js

@@ -30,6 +30,7 @@ const fleetReports = require('../services/fleetReportService/configuration');
   those fragments are placed independently at their historical positions.
 */
 const definitions = [
+  sessionConfiguration.publicUrl,
   sessionConfiguration.timezone,
   interInstance,
   llmCommentary,
@@ -61,7 +62,7 @@ const properties = Object.fromEntries(
 );
 const rootSchema = strictObject(properties, {
   title: 'Configuration',
-  description: 'Complete server configuration. Changes are validated and saved as one revision, then loaded when the application restarts.',
+  description: 'Complete server configuration. Changes are validated, saved as one revision, and applied live by reloading affected services.',
   required: definitions.map(({ key }) => key),
 });
 

server/src/configuration/index.js

@@ -1,22 +1,34 @@
 // Configuration Service
-// Purpose: Exposes the process-wide synchronous configuration snapshot and the underlying administration store.
-// Scope: Keeps existing require-time startup semantics while making SQLite the only runtime configuration source.
+// Purpose: Exposes the process-wide live configuration snapshot, service reload registry, and administration store.
+// Scope: Makes SQLite the durable source while applying each committed revision coherently to the running process.
+const EventEmitter = require('events');
+const { isDeepStrictEqual } = require('util');
 const { createConfigurationDatabase } = require('./database');
-const { rootSchema, featureDefinitions } = require('./definition');
+const { definitions, rootSchema, featureDefinitions } = require('./definition');
 
 let singleton;
+let runtimeConfiguration;
 let runtimeConfigurationRevision = null;
+let applicationQueue = Promise.resolve();
+let lastApplication = null;
+const reloadHandlers = new Map();
+const configurationEvents = new EventEmitter();
 
 function getConfigurationDatabase() {
   if (!singleton) {
     singleton = createConfigurationDatabase();
-    /*
-      Capture the active revision once when the process opens its configuration
-      store. Later admin saves are intentionally restart-bound, so comparing
-      against this value gives every reconnecting browser an authoritative
-      pending-restart indicator.
-    */
-    runtimeConfigurationRevision = singleton.getActiveConfigurationRecord().revision;
+    // Durable state is read once at startup and then replaced atomically after
+    // each committed save or rollback. Every caller therefore sees one complete
+    // revision rather than independently rereading SQLite mid-application.
+    const active = singleton.getActiveConfigurationRecord();
+    runtimeConfiguration = Object.freeze(active.config);
+    runtimeConfigurationRevision = active.revision;
+    lastApplication = {
+      revision: active.revision,
+      changedSections: [],
+      services: [],
+      appliedAt: Date.now(),
+    };
   }
   return singleton;
 }
@@ -27,16 +39,78 @@ function getRuntimeConfigurationRevision() {
 }
 
 function loadConfig() {
-  /*
-    Services intentionally receive one coherent snapshot for this process.
-    Configuration commits are restart-bound, so re-reading during runtime would
-    let only some modules observe the new revision and create a split-brain
-    process. The database remains queryable through its administrative API.
-  */
-  if (!loadConfig.cached) {
-    loadConfig.cached = Object.freeze(getConfigurationDatabase().getActiveConfigurationRecord().config);
+  getConfigurationDatabase();
+  return runtimeConfiguration;
+}
+
+function registerConfigurationHandler(section, handler) {
+  if (!rootSchema.properties?.[section]) {
+    throw new Error(`Cannot register configuration handler for unknown section ${section}.`);
   }
-  return loadConfig.cached;
+  if (typeof handler !== 'function') {
+    throw new Error(`Configuration handler for ${section} must be a function.`);
+  }
+  const handlers = reloadHandlers.get(section) || new Set();
+  handlers.add(handler);
+  reloadHandlers.set(section, handlers);
+  return () => handlers.delete(handler);
+}
+
+async function applyCommittedConfiguration() {
+  /*
+    Saves are serialized even though SQLite commits synchronously. A service
+    reload may need to close a worker or network client asynchronously, and a
+    later revision must never overtake that cleanup and start a second runtime.
+  */
+  const apply = async () => {
+    const active = getConfigurationDatabase().getActiveConfigurationRecord();
+    const previous = loadConfig();
+    const next = Object.freeze(active.config);
+    const changedSections = definitions
+      .map(({ key }) => key)
+      .filter((key) => !isDeepStrictEqual(previous[key], next[key]));
+
+    // Swap the complete document before invoking handlers. Any service helper
+    // consulted during a reload consequently observes the same new revision.
+    runtimeConfiguration = next;
+    runtimeConfigurationRevision = active.revision;
+
+    const services = [];
+    for (const section of changedSections) {
+      for (const handler of reloadHandlers.get(section) || []) {
+        try {
+          // Sequential application preserves the server's existing dependency
+          // order, notably Home Assistant before its Neato and lift consumers.
+          await handler(next[section], previous[section], next, previous);
+          services.push({ section, status: 'applied' });
+        } catch (error) {
+          // One unavailable integration must not prevent unrelated services or
+          // the session feature map from receiving the committed revision.
+          services.push({ section, status: 'failed', error: error.message });
+        }
+      }
+    }
+
+    lastApplication = {
+      revision: active.revision,
+      changedSections,
+      services,
+      appliedAt: Date.now(),
+    };
+    configurationEvents.emit('applied', lastApplication);
+    return lastApplication;
+  };
+
+  const queued = applicationQueue.then(apply, apply);
+  // Retain a fulfilled tail even if an unexpected coordinator error escapes;
+  // otherwise one failure would permanently poison every later save.
+  applicationQueue = queued.catch(() => undefined);
+  return queued;
+}
+
+function getLastConfigurationApplication() {
+  getConfigurationDatabase();
+  return lastApplication;
 }
 
 function getValueAtPath(value, path) {
@@ -62,6 +136,10 @@ function isFeatureEnabled(featureName) {
 module.exports = {
   getConfigurationDatabase,
   getRuntimeConfigurationRevision,
+  getLastConfigurationApplication,
+  registerConfigurationHandler,
+  applyCommittedConfiguration,
+  configurationEvents,
   loadConfig,
   getFeatureFlags,
   isFeatureEnabled,

server/src/configuration/migrations.js

@@ -37,6 +37,41 @@ const migrations = [
       );
     `,
   },
+  {
+    version: 2,
+    run(db) {
+      const rows = db.prepare('SELECT id, config_json FROM configuration_revisions').all();
+      const update = db.prepare('UPDATE configuration_revisions SET config_json = ? WHERE id = ?');
+
+      rows.forEach((row) => {
+        const config = JSON.parse(row.config_json);
+        /*
+          publicUrl was formerly repeated under inter-instance, Discord, and
+          media settings. Preserve the public identity already selected by the
+          operator: enabled consumers win first, then non-example values, with
+          inter-instance winning an otherwise equal conflict. Remove only the
+          three fields replaced by the root setting and fixed /video proxy.
+        */
+        const previousInterInstanceUrl = config.interInstance?.profile?.publicUrl;
+        const previousDiscordUrl = config.discord?.siteUrl;
+        const previousCandidates = [
+          config.interInstance?.enabled ? previousInterInstanceUrl : '',
+          config.discord?.enabled ? previousDiscordUrl : '',
+          previousInterInstanceUrl !== 'https://rover.example.com' ? previousInterInstanceUrl : '',
+          previousDiscordUrl !== 'https://rover.example.com' ? previousDiscordUrl : '',
+          previousInterInstanceUrl,
+          previousDiscordUrl,
+        ];
+        config.publicUrl = config.publicUrl
+          || previousCandidates.find((value) => typeof value === 'string' && value.trim())
+          || 'https://rover.example.com';
+        if (config.interInstance?.profile) delete config.interInstance.profile.publicUrl;
+        if (config.discord) delete config.discord.siteUrl;
+        if (config.media) delete config.media.whepBaseUrl;
+        update.run(JSON.stringify(config), row.id);
+      });
+    },
+  },
 ];
 
 function applySchemaMigrations(db) {
@@ -57,7 +92,8 @@ function applySchemaMigrations(db) {
       changed database whose version incorrectly appears current.
     */
     db.transaction(() => {
-      db.exec(migration.sql);
+      if (migration.sql) db.exec(migration.sql);
+      if (migration.run) migration.run(db);
       record.run(migration.version, Date.now());
     })();
   });

server/src/globals/http.js

@@ -4,9 +4,17 @@ const http = require('http');
 const express = require('express');
 const morgan = require('morgan');
 const config = require('./config');
+const logger = require('./logger').child('mediaMtxProxy');
+const { PUBLIC_MEDIA_PREFIX, createMediaMtxProxy } = require('../services/mediaMtxService/proxy');
 
 const app = express();
 app.use(morgan('dev'));
+/*
+  Mount signaling before body parsers so SDP offers and trickle-ICE fragments
+  remain untouched streams. Express removes the /video mount prefix while the
+  proxy is active, giving MediaMTX its native /<path>/whep or /<path>/whip URL.
+*/
+app.use(PUBLIC_MEDIA_PREFIX, createMediaMtxProxy({ logger }));
 app.use(express.json());
 app.use(express.static(config.staticDir, { index: false }));
 

server/src/globals/io.js

@@ -13,8 +13,13 @@ const io = new SocketIOServer(httpServer, {
   maxHttpBufferSize: 16 * 1024 * 1024,
 });
 
-// Allow more service listeners without warnings.
-io.sockets.setMaxListeners(30);
-io.of('/').setMaxListeners(30);
+/*
+  Optional feature gateways now remain registered while disabled so an admin
+  can enable them live without adding a second listener tree. Forty is a small
+  explicit allowance for those one-time service owners, not an unlimited value
+  that could hide duplicate registrations during repeated configuration saves.
+*/
+io.sockets.setMaxListeners(40);
+io.of('/').setMaxListeners(40);
 
 module.exports = io;

server/src/helpers/bandwidthSavings.js

@@ -83,9 +83,9 @@ function buildBandwidthSavingsPolicy(config = loadConfig()) {
 
 function getBandwidthSavingsPolicy() {
   /*
-    loadConfig() is cached by configuration service, so rebuilding this small object per
-    caller is cheap while still letting tests pass explicit config objects into
-    buildBandwidthSavingsPolicy().
+    The configuration service returns an in-memory snapshot, so rebuilding this
+    small normalized object per caller is cheap and immediately follows a newly
+    applied revision. Tests may still supply explicit documents directly.
   */
   return buildBandwidthSavingsPolicy(loadConfig());
 }

server/src/helpers/siteMetadata.js

@@ -87,6 +87,7 @@ function resolveSiteMetadata(config = loadConfig()) {
   const interInstance = config?.interInstance;
   const profile = interInstance?.profile;
   const profileName = asTrimmedString(profile?.name);
+  const publicUrl = normalizePublicUrl(config?.publicUrl);
 
   /*
     A partially filled profile must not unexpectedly rename the site. The
@@ -95,7 +96,11 @@ function resolveSiteMetadata(config = loadConfig()) {
     the coherent default set above.
   */
   if (interInstance?.enabled !== true || !profileName) {
-    return { ...DEFAULT_SITE_METADATA, accentTextColor: getReadableAccentText(DEFAULT_SITE_METADATA.accentColor) };
+    return {
+      ...DEFAULT_SITE_METADATA,
+      publicUrl,
+      accentTextColor: getReadableAccentText(DEFAULT_SITE_METADATA.accentColor),
+    };
   }
 
   const accentColor = normalizeHexColor(profile.color) || DEFAULT_SITE_METADATA.accentColor;
@@ -110,7 +115,7 @@ function resolveSiteMetadata(config = loadConfig()) {
       BACKGROUND_BLEND_AMOUNT,
     ),
     accentTextColor: getReadableAccentText(accentColor),
-    publicUrl: normalizePublicUrl(profile.publicUrl),
+    publicUrl,
   };
 }
 

server/src/services/adminConfigurationService/index.js

@@ -7,8 +7,15 @@ const logger = require('../../globals/logger').child('adminConfigurationService'
 const {
   getConfigurationDatabase,
   getRuntimeConfigurationRevision,
+  getLastConfigurationApplication,
+  applyCommittedConfiguration,
   rootSchema,
 } = require('../../configuration');
+const {
+  MAX_CONFIGURATION_FILE_BYTES,
+  parseConfigurationFile,
+  buildSecretOperationsForImport,
+} = require('../../configuration/configurationFileImporter');
 const { getRole } = require('../roleService');
 
 const PASSWORD_CONFIRMATION_WINDOW_MS = 5 * 60 * 1000;
@@ -32,6 +39,18 @@ function actorFor(socket) {
   return socket?.data?.user?.username || socket.id;
 }
 
+function safeUploadedFileName(value) {
+  /*
+    The filename is audit metadata only and is never opened on the server.
+    Removing control characters keeps logs and history readable while
+    retaining the operator-visible name that identifies the imported file.
+  */
+  return String(value || 'uploaded-config.yaml')
+    .replace(/[\u0000-\u001f\u007f]/g, '')
+    .trim()
+    .slice(0, 255) || 'uploaded-config.yaml';
+}
+
 function errorPayload(error) {
   return {
     error: error.message,
@@ -69,7 +88,8 @@ function buildAdminSnapshot() {
       a second field definition.
     */
     configuration: { ...configuration, schema: rootSchema },
-    restartRequired: configuration.revision !== getRuntimeConfigurationRevision(),
+    appliedRevision: getRuntimeConfigurationRevision(),
+    configurationApplication: getLastConfigurationApplication(),
     administrators: database.listAdministrators(),
     revisions: database.listConfigurationRevisions(),
     auditEvents: database.listAuditEvents(),
@@ -88,23 +108,56 @@ io.on('connection', (socket) => {
     return { confirmedUntil: socket.data.adminPasswordConfirmedAt + PASSWORD_CONFIRMATION_WINDOW_MS };
   });
 
-  ackHandler(socket, 'adminConfig:updateConfiguration', requireRecentPassword, (payload) => {
+  ackHandler(socket, 'adminConfig:updateConfiguration', requireRecentPassword, async (payload) => {
     const revision = database.updateConfiguration({
       value: payload.value,
       expectedRevision: payload.expectedRevision,
       secretOperations: payload.secretOperations,
       actor: actorFor(socket),
     });
-    return { revision, snapshot: buildAdminSnapshot(), restartRequired: true };
+    const application = await applyCommittedConfiguration();
+    return { revision, application, snapshot: buildAdminSnapshot() };
   });
 
-  ackHandler(socket, 'adminConfig:restoreRevision', requireRecentPassword, (payload) => {
+  ackHandler(socket, 'adminConfig:importConfigurationFile', requireRecentPassword, async (payload) => {
+    const yamlText = String(payload.yaml || '');
+    if (!yamlText || Buffer.byteLength(yamlText, 'utf8') > MAX_CONFIGURATION_FILE_BYTES) {
+      throw new Error('The YAML configuration file must be present and no larger than 1 MiB.');
+    }
+
+    /*
+      Parsing deliberately excludes administrators on an initialized server.
+      Configuration is still filtered to today's schema and strictly
+      validated, then committed through the ordinary optimistic update path so
+      missing secrets survive and explicitly supplied secrets replace or clear
+      their current values.
+    */
+    const parsed = parseConfigurationFile(yamlText, { includeAdministrators: false });
+    const fileName = safeUploadedFileName(payload.fileName);
+    const revision = database.updateConfiguration({
+      value: parsed.config,
+      expectedRevision: payload.expectedRevision,
+      secretOperations: buildSecretOperationsForImport(parsed),
+      actor: actorFor(socket),
+      source: `admin-yaml:${fileName}`,
+    });
+    const application = await applyCommittedConfiguration();
+    return {
+      revision,
+      application,
+      ignoredAdministratorCount: parsed.uploadedAdministratorCount,
+      snapshot: buildAdminSnapshot(),
+    };
+  });
+
+  ackHandler(socket, 'adminConfig:restoreRevision', requireRecentPassword, async (payload) => {
     const revision = database.restoreConfigurationRevision({
       revision: payload.revision,
       expectedRevision: payload.expectedRevision,
       actor: actorFor(socket),
     });
-    return { revision, snapshot: buildAdminSnapshot(), restartRequired: true };
+    const application = await applyCommittedConfiguration();
+    return { revision, application, snapshot: buildAdminSnapshot() };
   });
 
   ackHandler(socket, 'adminConfig:createAdministrator', requireRecentPassword, async (payload) => {
@@ -155,4 +208,5 @@ io.on('connection', (socket) => {
 module.exports = {
   PASSWORD_CONFIRMATION_WINDOW_MS,
   requireLockdownAdministrator,
+  requireRecentPassword,
 };

server/src/services/audioForwardService/hooks.js

@@ -7,7 +7,7 @@ function registerAudioForwardHooks(deps) {
     roverManager,
     turnService,
     logger,
-    serviceEnabled,
+    isServiceEnabled,
     workers,
     whipOwners,
     ensureWorker,
@@ -57,7 +57,7 @@ function registerAudioForwardHooks(deps) {
       stopWorker(roverId);
       return;
     }
-    if (action === 'upsert' && serviceEnabled && !workers.has(roverId)) {
+    if (action === 'upsert' && isServiceEnabled() && !workers.has(roverId)) {
       // A rover coming online should not create ffmpeg publishers by itself.
       // The audio worker is intentionally lazy because uploads, mic forwarding,
       // and automatic sounds are the moments that actually need a media pipe;

server/src/services/audioForwardService/index.js

@@ -5,7 +5,7 @@ const path = require('path');
 const EventEmitter = require('events');
 const io = require('../../globals/io');
 const logger = require('../../globals/logger').child('audioForwardService');
-const { loadConfig } = require('../../configuration');
+const { loadConfig, registerConfigurationHandler } = require('../../configuration');
 const { resolveRuntimePath } = require('../../helpers/dataPaths');
 const roverManager = require('../roverManager');
 const turnService = require('../turnService');
@@ -17,18 +17,7 @@ const { registerAudioForwardHooks } = require('./hooks');
 const { registerChargeCompleteSound } = require('./chargeCompleteSound');
 
 const audioForwardEvents = new EventEmitter();
-const config = loadConfig();
-const audioForwardConfig = config.audioForward || {};
-const mediaConfig = config.media || {};
-// Configuration defaults always provide this boolean. Treat only an explicit
-// true as enabled so no credential, path, or historical fallback can opt the
-// service in on the operator's behalf.
-const serviceEnabled = Boolean(audioForwardConfig.enabled);
-const ffmpegBin = audioForwardConfig.ffmpegBin || 'ffmpeg';
-const streamSuffix =
-  typeof audioForwardConfig.streamSuffix === 'string' && audioForwardConfig.streamSuffix.trim()
-    ? audioForwardConfig.streamSuffix.trim()
-    : '-fwd';
+let serviceEnabled = false;
 /*
   FIFOs and uploaded clips are disposable, but they are deliberately created
   and managed by this application. A fixed path below SERVER_DATA_DIR keeps the
@@ -37,9 +26,6 @@ const streamSuffix =
 */
 const runtimeDir = resolveRuntimePath('audio-forward');
 const uploadsDir = path.join(runtimeDir, 'uploads');
-const maxUploadBytes = Number.isFinite(audioForwardConfig.maxUploadBytes)
-  ? Math.max(256 * 1024, Math.floor(audioForwardConfig.maxUploadBytes))
-  : 8 * 1024 * 1024;
 
 const states = new Map(); // roverId -> { state, source, error, startedAt, updatedAt }
 const workers = new Map(); // roverId -> worker
@@ -70,51 +56,65 @@ function getAudioForwardState() {
   return payload;
 }
 
-const audioForwardPolicy = createAudioForwardPolicy({
-  isVerified,
-  isMuted,
-  roverManager,
-  turnService,
-  streamSuffix,
-  mediaConfig,
-});
-const {
-  ensureAudioForwardPermission,
-  resolveForwardUrl,
-  resolveForwardPathId,
-  buildWhipUrl,
-} = audioForwardPolicy;
+let operations;
 
-const workerEngine = createAudioForwardWorkerEngine({
-  logger,
-  io,
-  roverManager,
-  turnService,
-  videoSessions,
-  serviceEnabled,
-  ffmpegBin,
-  runtimeDir,
-  uploadsDir,
-  maxUploadBytes,
-  workers,
-  whipOwners,
-  setState,
-  resolveForwardUrl,
-  resolveForwardPathId,
-});
+function replaceAudioForwardRuntime(fullConfig) {
+  operations?.stopAllWorkers('configuration-change');
+  const audioForwardConfig = fullConfig.audioForward || {};
+  serviceEnabled = Boolean(audioForwardConfig.enabled);
+  const streamSuffix = typeof audioForwardConfig.streamSuffix === 'string' && audioForwardConfig.streamSuffix.trim()
+    ? audioForwardConfig.streamSuffix.trim()
+    : '-fwd';
+  const policy = createAudioForwardPolicy({
+    isVerified,
+    isMuted,
+    roverManager,
+    turnService,
+    streamSuffix,
+  });
+  const maxUploadBytes = Number.isFinite(audioForwardConfig.maxUploadBytes)
+    ? Math.max(256 * 1024, Math.floor(audioForwardConfig.maxUploadBytes))
+    : 8 * 1024 * 1024;
+  operations = {
+    ...policy,
+    ...createAudioForwardWorkerEngine({
+      logger,
+      io,
+      roverManager,
+      turnService,
+      videoSessions,
+      serviceEnabled,
+      ffmpegBin: audioForwardConfig.ffmpegBin || 'ffmpeg',
+      runtimeDir,
+      uploadsDir,
+      maxUploadBytes,
+      workers,
+      whipOwners,
+      setState,
+      resolveForwardUrl: policy.resolveForwardUrl,
+      resolveForwardPathId: policy.resolveForwardPathId,
+    }),
+  };
+}
 
-const {
-  ensureWorker,
-  stopWorker,
-  stopAllWorkers,
-  playUploadedAudio,
-  playServerAudioFile,
-  stopPlayback,
-  revokeWhipSessionForRover,
-  stopWhipForRover,
-  stopOwnedAudioIfUnauthorized,
-  startSilenceWriter,
-} = workerEngine;
+replaceAudioForwardRuntime(loadConfig());
+
+// Stable delegates keep the one-time socket/event registrations below pointed
+// at the newest policy and worker engine after audio-forward changes.
+const delegate = (name) => (...args) => operations[name](...args);
+const ensureWorker = delegate('ensureWorker');
+const stopWorker = delegate('stopWorker');
+const stopAllWorkers = delegate('stopAllWorkers');
+const playUploadedAudio = delegate('playUploadedAudio');
+const playServerAudioFile = delegate('playServerAudioFile');
+const stopPlayback = delegate('stopPlayback');
+const revokeWhipSessionForRover = delegate('revokeWhipSessionForRover');
+const stopWhipForRover = delegate('stopWhipForRover');
+const stopOwnedAudioIfUnauthorized = delegate('stopOwnedAudioIfUnauthorized');
+const startSilenceWriter = delegate('startSilenceWriter');
+const ensureAudioForwardPermission = delegate('ensureAudioForwardPermission');
+const resolveForwardPathId = delegate('resolveForwardPathId');
+const buildWhipUrl = delegate('buildWhipUrl');
 
 function installShutdownHooks() {
   const shutdown = (signal) => {
@@ -136,7 +136,7 @@ registerAudioForwardHooks({
   roverManager,
   turnService,
   logger,
-  serviceEnabled,
+  isServiceEnabled: () => serviceEnabled,
   workers,
   whipOwners,
   ensureWorker,
@@ -161,6 +161,10 @@ registerChargeCompleteSound({
   playServerAudioFile,
 });
 
+registerConfigurationHandler('audioForward', (_section, _previous, nextConfig) => {
+  replaceAudioForwardRuntime(nextConfig);
+});
+
 module.exports = {
   getAudioForwardState,
   audioForwardEvents,

server/src/services/audioForwardService/policy.js

@@ -1,6 +1,8 @@
 // audio Forward Service policy
 // Purpose: Encapsulates permission checks and media path/url derivation helpers.
 // Scope: Keeps runtime behavior unchanged while isolating validation and path-construction logic.
+const { PUBLIC_MEDIA_PREFIX } = require('../mediaMtxService/proxy');
+
 function createAudioForwardPolicy(deps) {
   const {
     isVerified,
@@ -8,7 +10,6 @@ function createAudioForwardPolicy(deps) {
     roverManager,
     turnService,
     streamSuffix,
-    mediaConfig,
   } = deps;
 
   function ensureVipVerified(socket) {
@@ -43,23 +44,8 @@ function createAudioForwardPolicy(deps) {
     return `${roverId}${streamSuffix}`;
   }
 
-  function getMediaPrefix() {
-    const base = mediaConfig.whepBaseUrl;
-    if (!base) return '';
-    try {
-      const parsed = new URL(base);
-      return `${parsed.origin}${parsed.pathname}`.replace(/\/+$/, '');
-    } catch {
-      return String(base).replace(/\/+$/, '');
-    }
-  }
-
   function buildWhipUrl(pathId) {
-    const prefix = getMediaPrefix();
-    if (!prefix) {
-      throw new Error('Server media base URL missing');
-    }
-    return `${prefix}/${encodeURIComponent(pathId)}/whip`;
+    return `${PUBLIC_MEDIA_PREFIX}/${encodeURIComponent(pathId)}/whip`;
   }
 
   return {

server/src/services/audioForwardService/policy.test.js

@@ -12,7 +12,6 @@ function createPolicy({ verified = true, muted = false, driver = true, canDrive
     roverManager: { isDriver: () => driver },
     turnService: { canDrive: () => canDrive },
     streamSuffix: '-fwd',
-    mediaConfig: {},
   });
 }
 
@@ -30,3 +29,8 @@ test('publishes forwarded audio to the local MediaMTX RTSP path', () => {
   const policy = createPolicy();
   assert.equal(policy.resolveForwardUrl('rover one'), 'rtsp://127.0.0.1:8554/rover%20one-fwd');
 });
+
+test('publishes browser microphone signaling through the same-origin proxy', () => {
+  const policy = createPolicy();
+  assert.equal(policy.buildWhipUrl('rover one-fwd'), '/video/rover%20one-fwd/whip');
+});

server/src/services/audioLevelsService/index.js

@@ -5,7 +5,7 @@ const fs = require('fs');
 const EventEmitter = require('events');
 const io = require('../../globals/io');
 const logger = require('../../globals/logger').child('audioLevelsService');
-const { loadConfig } = require('../../configuration');
+const { loadConfig, registerConfigurationHandler } = require('../../configuration');
 const { resolveDataDir, resolveDataPath } = require('../../helpers/dataPaths');
 const { isAdmin, roleEvents } = require('../roleService');
 const roverManager = require('../roverManager');
@@ -344,6 +344,32 @@ io.on('connection', (socket) => {
 
 loadState();
 
+registerConfigurationHandler('audioLevels', async (nextConfig) => {
+  /*
+    Audio levels also have a durable operational store because administrators
+    can adjust them outside the configuration editor. Applying a configuration
+    revision intentionally updates that same live state, rather than changing
+    startup fallbacks that an existing store would immediately override.
+  */
+  const current = loadState();
+  persistState({
+    ...current,
+    hornGain: clampGain(nextConfig.hornGain, current.hornGain),
+    ttsGain: clampGain(nextConfig.ttsGain, current.ttsGain),
+    forwardGain: clampGain(nextConfig.forwardGain, current.forwardGain),
+    maxPersonalAdjustmentPercent: clampMaximumAdjustmentPercent(
+      nextConfig.maxPersonalAdjustmentPercent,
+      current.maxPersonalAdjustmentPercent,
+    ),
+    updatedAt: Date.now(),
+    updatedBy: 'configuration',
+    adjustmentRangeUpdatedAt: Date.now(),
+    adjustmentRangeUpdatedBy: 'configuration',
+  });
+  pushLevelsToAllRovers();
+  emitChange('configuration_applied');
+});
+
 module.exports = {
   ADJUSTMENT_FIELDS,
   PERSONAL_ADJUSTMENT_PERMISSION,

server/src/services/backupRestoreService/backup.js

@@ -0,0 +1,199 @@
+// Full Data Backup
+// Purpose: Creates one validated archive of the durable server data without stopping live services or writers.
+// Scope: Uses service-owned online database snapshots and stable file copies inside the canonical data directory.
+const fs = require('fs');
+const fsp = require('fs/promises');
+const path = require('path');
+const crypto = require('crypto');
+const tar = require('tar');
+const Database = require('better-sqlite3');
+const { resolveDataDir, resolveDataPath } = require('../../helpers/dataPaths');
+const packageInfo = require('../../../package.json');
+
+const FORMAT_VERSION = 1;
+const CONTROL_DIR_NAME = 'backup-restore';
+const EXCLUDED_TOP_LEVEL_NAMES = new Set([CONTROL_DIR_NAME, 'runtime']);
+const DATABASE_NAMES = ['configuration.sqlite', 'identity.sqlite', 'fleet-reports.sqlite'];
+const DATABASE_FILES = new Set(DATABASE_NAMES.flatMap((name) => [name, `${name}-wal`, `${name}-shm`]));
+const FILE_COPY_ATTEMPTS = 3;
+
+async function removeSnapshotSidecars(payloadDir) {
+  /*
+    SQLite online backup produces a complete standalone main database file.
+    Reopening that snapshot to inspect its schema can still create empty WAL
+    and shared-memory coordination files because the database retains WAL as
+    its journal mode. Those files describe no durable backup content and must
+    be removed before the manifest inventory and tar archive are produced.
+  */
+  await Promise.all(DATABASE_NAMES.flatMap((name) => [
+    fsp.rm(path.join(payloadDir, `${name}-wal`), { force: true }),
+    fsp.rm(path.join(payloadDir, `${name}-shm`), { force: true }),
+  ]));
+}
+
+function readDatabaseSchemaVersions(payloadDir) {
+  const configuration = new Database(path.join(payloadDir, 'configuration.sqlite'), { readonly: true });
+  const identity = new Database(path.join(payloadDir, 'identity.sqlite'), { readonly: true });
+  const fleetReports = new Database(path.join(payloadDir, 'fleet-reports.sqlite'), { readonly: true });
+  try {
+    return {
+      configuration: Number(configuration.prepare('SELECT MAX(version) AS version FROM schema_migrations').get()?.version) || 0,
+      identity: Number(identity.pragma('user_version', { simple: true })) || 0,
+      // Fleet reporting currently evolves with additive startup checks and has
+      // no numbered migration table, so zero accurately identifies that scheme.
+      fleetReports: Number(fleetReports.pragma('user_version', { simple: true })) || 0,
+    };
+  } finally {
+    configuration.close();
+    identity.close();
+    fleetReports.close();
+  }
+}
+
+function sha256File(filePath) {
+  return new Promise((resolve, reject) => {
+    const hash = crypto.createHash('sha256');
+    const stream = fs.createReadStream(filePath);
+    stream.on('error', reject);
+    stream.on('data', (chunk) => hash.update(chunk));
+    stream.on('end', () => resolve(hash.digest('hex')));
+  });
+}
+
+async function copyStableFile(sourcePath, destinationPath) {
+  for (let attempt = 0; attempt < FILE_COPY_ATTEMPTS; attempt += 1) {
+    try {
+      const before = await fsp.stat(sourcePath);
+      if (!before.isFile()) throw new Error(`Backup source is not a regular file: ${sourcePath}`);
+      await fsp.mkdir(path.dirname(destinationPath), { recursive: true });
+      await fsp.copyFile(sourcePath, destinationPath);
+      await fsp.chmod(destinationPath, before.mode & 0o777);
+
+      /*
+        A writer may replace or append to a media file while it is copied. Size
+        and timestamp checks catch ordinary changes, while comparing hashes
+        catches a same-size replacement. Only the unstable file is retried;
+        no owning service is paused.
+      */
+      const [sourceHash, destinationHash] = await Promise.all([
+        sha256File(sourcePath),
+        sha256File(destinationPath),
+      ]);
+      // Read the final metadata only after both hashes finish. Starting this
+      // stat concurrently could miss a write that occurred during hashing.
+      const after = await fsp.stat(sourcePath);
+      if (before.size === after.size
+        && before.mtimeMs === after.mtimeMs
+        && sourceHash === destinationHash) return true;
+    } catch (error) {
+      if (error.code !== 'ENOENT') throw error;
+      // A rotating snapshot can disappear between directory enumeration and
+      // copying. Treat that exact race like any other unstable active file.
+    }
+    await fsp.rm(destinationPath, { force: true });
+  }
+  return false;
+}
+
+async function copyDurableTree(sourceDir, destinationDir, relativeDir = '') {
+  let entries;
+  try {
+    entries = await fsp.readdir(path.join(sourceDir, relativeDir), { withFileTypes: true });
+  } catch (error) {
+    if (error.code === 'ENOENT') return [];
+    throw error;
+  }
+
+  const skipped = [];
+  for (const entry of entries) {
+    const relativePath = path.join(relativeDir, entry.name);
+    if (!relativeDir && EXCLUDED_TOP_LEVEL_NAMES.has(entry.name)) continue;
+    if (!relativeDir && DATABASE_FILES.has(entry.name)) continue;
+    if (entry.isSymbolicLink()) throw new Error(`Backup cannot include symbolic link: ${relativePath}`);
+    if (entry.isDirectory()) {
+      skipped.push(...await copyDurableTree(sourceDir, destinationDir, relativePath));
+      continue;
+    }
+    if (!entry.isFile()) throw new Error(`Backup cannot include special file: ${relativePath}`);
+    const copied = await copyStableFile(
+      path.join(sourceDir, relativePath),
+      path.join(destinationDir, relativePath),
+    );
+    if (!copied) skipped.push(relativePath.split(path.sep).join('/'));
+  }
+  return skipped;
+}
+
+async function listManifestFiles(rootDir, relativeDir = '') {
+  const entries = await fsp.readdir(path.join(rootDir, relativeDir), { withFileTypes: true });
+  const files = [];
+  for (const entry of entries) {
+    const relativePath = path.join(relativeDir, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...await listManifestFiles(rootDir, relativePath));
+      continue;
+    }
+    if (!entry.isFile()) throw new Error(`Backup staging contains a special file: ${relativePath}`);
+    const filePath = path.join(rootDir, relativePath);
+    const stat = await fsp.stat(filePath);
+    files.push({
+      path: relativePath.split(path.sep).join('/'),
+      size: stat.size,
+      sha256: await sha256File(filePath),
+    });
+  }
+  return files.sort((left, right) => left.path.localeCompare(right.path));
+}
+
+async function createFullBackup({ configurationDatabase, identityService, fleetReportService, jobId }) {
+  const dataDir = resolveDataDir();
+  const jobDir = resolveDataPath(path.join(CONTROL_DIR_NAME, `backup-${jobId}`));
+  const payloadDir = path.join(jobDir, 'data');
+  const archivePath = path.join(jobDir, 'multirover-backup.tar.gz');
+  await fsp.rm(jobDir, { recursive: true, force: true });
+  await fsp.mkdir(payloadDir, { recursive: true });
+
+  try {
+    // Each database owner remains live and writes a coherent SQLite snapshot
+    // directly into the same staging tree as the ordinary durable files.
+    await Promise.all([
+      configurationDatabase.backupDatabase(path.join(payloadDir, DATABASE_NAMES[0])),
+      identityService.backupDatabase(path.join(payloadDir, DATABASE_NAMES[1])),
+      fleetReportService.backupDatabase(path.join(payloadDir, DATABASE_NAMES[2])),
+    ]);
+    const skippedUnstableFiles = await copyDurableTree(dataDir, payloadDir);
+    /*
+      Finish every operation that can create a staged file before inventorying
+      the payload. Production databases use WAL mode, so schema inspection must
+      precede both sidecar cleanup and the final immutable file list.
+    */
+    const databaseSchemaVersions = readDatabaseSchemaVersions(payloadDir);
+    await removeSnapshotSidecars(payloadDir);
+    const files = await listManifestFiles(payloadDir);
+    const manifest = {
+      format: 'multirover-full-backup',
+      formatVersion: FORMAT_VERSION,
+      applicationVersion: packageInfo.version,
+      createdAt: Date.now(),
+      databaseSchemaVersions,
+      files,
+      skippedUnstableFiles,
+    };
+    await fsp.writeFile(path.join(jobDir, 'manifest.json'), `${JSON.stringify(manifest, null, 2)}\n`, 'utf8');
+    await tar.c({ cwd: jobDir, file: archivePath, gzip: true, portable: true }, ['manifest.json', 'data']);
+    return { archivePath, jobDir, manifest };
+  } catch (error) {
+    await fsp.rm(jobDir, { recursive: true, force: true });
+    throw error;
+  }
+}
+
+module.exports = {
+  CONTROL_DIR_NAME,
+  DATABASE_NAMES,
+  FORMAT_VERSION,
+  createFullBackup,
+  readDatabaseSchemaVersions,
+  removeSnapshotSidecars,
+  sha256File,
+};

server/src/services/backupRestoreService/backupRestore.test.js

@@ -0,0 +1,146 @@
+// Backup and Restore Service Tests
+// Purpose: Verifies complete archive round trips, exclusions, malicious entry rejection, startup replacement, and rollback.
+// Scope: Uses one isolated SERVER_DATA_DIR and injected SQLite owners; it never reads or changes development server data.
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const fsp = require('fs/promises');
+const os = require('os');
+const path = require('path');
+const Database = require('better-sqlite3');
+const tar = require('tar');
+
+const temporaryRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'multirover-backup-restore-'));
+process.env.SERVER_DATA_DIR = temporaryRoot;
+
+const { createFullBackup } = require('./backup');
+const { inspectArchive, prepareRestoreArchive, validateExtractedRestore } = require('./restore');
+const startupRestore = require('./startupRestore');
+const VALID_RESTORE_ID = 'a'.repeat(64);
+
+function createSourceDatabase(name) {
+  /*
+    Real service databases use WAL mode. Keeping fixture sources under the
+    excluded runtime directory both mirrors that behavior and ensures their
+    own live WAL files are not mistaken for ordinary durable backup content.
+  */
+  const sourceDirectory = path.join(temporaryRoot, 'runtime', 'database-sources');
+  fs.mkdirSync(sourceDirectory, { recursive: true });
+  const filePath = path.join(sourceDirectory, name);
+  const database = new Database(filePath);
+  database.pragma('journal_mode = WAL');
+  database.exec('CREATE TABLE example (value TEXT NOT NULL); INSERT INTO example VALUES (\'preserved\');');
+  if (name === 'configuration.sqlite') {
+    database.exec('CREATE TABLE schema_migrations (version INTEGER PRIMARY KEY); INSERT INTO schema_migrations VALUES (1);');
+  } else if (name === 'identity.sqlite') {
+    database.pragma('user_version = 4');
+  }
+  return database;
+}
+
+test.after(() => {
+  fs.rmSync(temporaryRoot, { recursive: true, force: true });
+});
+
+test('creates and validates a complete backup while excluding runtime and control data', async () => {
+  await fsp.writeFile(path.join(temporaryRoot, 'state.json'), '{"preserved":true}\n');
+  await fsp.mkdir(path.join(temporaryRoot, 'replays'), { recursive: true });
+  await fsp.writeFile(path.join(temporaryRoot, 'replays', 'complete.mp4'), 'complete replay');
+  await fsp.mkdir(path.join(temporaryRoot, 'runtime'), { recursive: true });
+  await fsp.writeFile(path.join(temporaryRoot, 'runtime', 'active.tmp'), 'discard me');
+
+  const sources = ['configuration.sqlite', 'identity.sqlite', 'fleet-reports.sqlite']
+    .map(createSourceDatabase);
+  const owners = sources.map((database) => ({
+    backupDatabase: (destinationPath) => database.backup(destinationPath),
+  }));
+  const result = await createFullBackup({
+    configurationDatabase: owners[0],
+    identityService: owners[1],
+    fleetReportService: owners[2],
+    jobId: 'test-backup',
+  });
+
+  assert.ok(fs.statSync(result.archivePath).size > 0);
+  assert.ok(result.manifest.files.some((entry) => entry.path === 'state.json'));
+  assert.ok(result.manifest.files.some((entry) => entry.path === 'replays/complete.mp4'));
+  assert.equal(result.manifest.files.some((entry) => entry.path.includes('runtime')), false);
+  assert.equal(result.manifest.files.some((entry) => entry.path.includes('backup-restore')), false);
+  assert.equal(result.manifest.files.some((entry) => entry.path.endsWith('-wal') || entry.path.endsWith('-shm')), false);
+
+  const restoreJob = path.join(temporaryRoot, 'backup-restore', `restore-${VALID_RESTORE_ID}`);
+  await fsp.mkdir(restoreJob, { recursive: true });
+  const uploadedArchive = path.join(restoreJob, 'upload.tar.gz');
+  await fsp.copyFile(result.archivePath, uploadedArchive);
+  const summary = await prepareRestoreArchive({ archivePath: uploadedArchive, jobDir: restoreJob, actor: 'test' });
+  assert.equal(summary.fileCount, result.manifest.files.length);
+  const restoredNames = await fsp.readdir(path.join(restoreJob, 'extracted', 'data'));
+  assert.equal(restoredNames.some((name) => name.endsWith('-wal') || name.endsWith('-shm')), false);
+
+  sources.forEach((database) => database.close());
+});
+
+test('rejects a staged restore whose contents no longer match the manifest', async () => {
+  const restoreJob = path.join(temporaryRoot, 'backup-restore', `restore-${VALID_RESTORE_ID}`);
+  const statePath = path.join(restoreJob, 'extracted', 'data', 'state.json');
+  await fsp.writeFile(statePath, '{"tampered":true}\n');
+  await assert.rejects(validateExtractedRestore(path.join(restoreJob, 'extracted')), /checksum or size mismatch/);
+  // Restore the known source content so the following startup-application test
+  // continues to exercise a genuinely validated replacement payload.
+  await fsp.writeFile(statePath, '{"preserved":true}\n');
+});
+
+test('rejects symbolic links before extracting an archive', async () => {
+  const unsafeRoot = path.join(temporaryRoot, 'unsafe-archive');
+  await fsp.mkdir(path.join(unsafeRoot, 'data'), { recursive: true });
+  await fsp.writeFile(path.join(unsafeRoot, 'manifest.json'), '{}');
+  await fsp.symlink('/etc/passwd', path.join(unsafeRoot, 'data', 'escape'));
+  const archivePath = path.join(temporaryRoot, 'unsafe.tar.gz');
+  await tar.c({ cwd: unsafeRoot, file: archivePath, gzip: true }, ['manifest.json', 'data']);
+  await assert.rejects(inspectArchive(archivePath), /unsupported entry type/);
+});
+
+test('applies validated replacement data and removes rollback only after startup succeeds', () => {
+  const restoreId = VALID_RESTORE_ID;
+  const jobDir = path.join(temporaryRoot, 'backup-restore', `restore-${restoreId}`);
+  fs.writeFileSync(path.join(temporaryRoot, 'old-state.txt'), 'old');
+  fs.mkdirSync(path.join(temporaryRoot, 'runtime'), { recursive: true });
+  fs.writeFileSync(path.join(temporaryRoot, 'runtime', 'active.tmp'), 'discard during restore');
+  startupRestore.writeJson(startupRestore.pendingPath, {
+    restoreId,
+    state: 'pending',
+    requestedAt: Date.now(),
+    actor: 'test',
+  });
+
+  const applied = startupRestore.applyPendingRestore();
+  assert.equal(applied.status, 'awaiting-health');
+  assert.equal(fs.existsSync(path.join(temporaryRoot, 'old-state.txt')), false);
+  assert.equal(fs.existsSync(path.join(temporaryRoot, 'runtime')), false);
+  assert.equal(fs.readFileSync(path.join(temporaryRoot, 'state.json'), 'utf8'), '{"preserved":true}\n');
+  assert.equal(fs.existsSync(path.join(temporaryRoot, 'backup-restore', 'rollback', 'old-state.txt')), true);
+
+  const completed = startupRestore.markStartupSuccessful();
+  assert.equal(completed.status, 'restored');
+  assert.equal(fs.existsSync(jobDir), false);
+  assert.equal(fs.existsSync(startupRestore.pendingPath), false);
+});
+
+test('restores the rollback copy when a replaced application did not reach health', () => {
+  const restoreId = 'b'.repeat(64);
+  const rollbackDir = path.join(temporaryRoot, 'backup-restore', 'rollback');
+  fs.mkdirSync(rollbackDir, { recursive: true });
+  fs.writeFileSync(path.join(rollbackDir, 'state.json'), 'previous state');
+  fs.writeFileSync(path.join(temporaryRoot, 'state.json'), 'failed replacement');
+  startupRestore.writeJson(startupRestore.pendingPath, {
+    restoreId,
+    state: 'awaiting-health',
+    requestedAt: Date.now(),
+    actor: 'test',
+  });
+
+  const result = startupRestore.applyPendingRestore();
+  assert.equal(result.status, 'rolled-back');
+  assert.equal(fs.readFileSync(path.join(temporaryRoot, 'state.json'), 'utf8'), 'previous state');
+  assert.equal(startupRestore.getLastRestoreResult().status, 'rolled-back');
+});

server/src/services/backupRestoreService/index.js

@@ -0,0 +1,267 @@
+// Backup and Restore Service
+// Purpose: Owns full-data archive creation, browser transfer, staged restore confirmation, startup replacement, and rollback.
+// Scope: All backup/restore orchestration stays in this service; database owners expose only their online snapshot operations.
+const fs = require('fs');
+const fsp = require('fs/promises');
+const path = require('path');
+const crypto = require('crypto');
+const { Transform } = require('stream');
+const { pipeline } = require('stream/promises');
+const { resolveDataPath } = require('../../helpers/dataPaths');
+const { CONTROL_DIR_NAME, createFullBackup } = require('./backup');
+const { MAX_ARCHIVE_BYTES, prepareRestoreArchive } = require('./restore');
+const startupRestore = require('./startupRestore');
+
+const TOKEN_LIFETIME_MS = 10 * 60 * 1000;
+const controlDir = resolveDataPath(CONTROL_DIR_NAME);
+const downloads = new Map();
+const uploads = new Map();
+let backupInProgress = false;
+let registered = false;
+let app;
+let io;
+let logger;
+let getConfigurationDatabase;
+let identityService;
+let fleetReportService;
+let requireLockdownAdministrator;
+let requireRecentPassword;
+let requestApplicationRestart;
+let isApplicationRestartPending;
+
+function actorFor(socket) {
+  return socket?.data?.user?.username || socket.id;
+}
+
+function createToken() {
+  return crypto.randomBytes(32).toString('hex');
+}
+
+function pruneExpiredTransfers() {
+  const now = Date.now();
+  for (const [token, transfer] of [...downloads, ...uploads]) {
+    if (transfer.expiresAt > now) continue;
+    downloads.delete(token);
+    uploads.delete(token);
+    if (transfer.jobDir) fsp.rm(transfer.jobDir, { recursive: true, force: true }).catch(() => undefined);
+  }
+}
+
+function responseError(cb, error) {
+  logger.warn('Backup or restore request failed', { error: error.message });
+  cb({ error: error.message, code: error.code || null });
+}
+
+function removeOrphanedStaging() {
+  let pendingRestoreId = null;
+  try {
+    pendingRestoreId = JSON.parse(fs.readFileSync(startupRestore.pendingPath, 'utf8')).restoreId || null;
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+  }
+  for (const entry of fs.readdirSync(controlDir, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const preservedName = pendingRestoreId ? `restore-${pendingRestoreId}` : null;
+    if ((entry.name.startsWith('backup-') || entry.name.startsWith('restore-'))
+      && entry.name !== preservedName) {
+      /*
+        Transfer authorization lives only in process memory. After a restart,
+        an unconfirmed upload or undownloaded archive can no longer be reached,
+        so deleting it prevents abandoned full-data copies from accumulating.
+      */
+      fs.rmSync(path.join(controlDir, entry.name), { recursive: true, force: true });
+    }
+  }
+}
+
+function registerSocketApi() {
+  io.on('connection', (socket) => {
+    socket.on('backupRestore:status', (_payload = {}, cb = () => {}) => {
+      try {
+        requireLockdownAdministrator(socket);
+        cb({ success: true, lastRestore: startupRestore.getLastRestoreResult() });
+      } catch (error) {
+        responseError(cb, error);
+      }
+    });
+
+    socket.on('backupRestore:createBackup', (_payload = {}, cb = () => {}) => {
+      Promise.resolve().then(async () => {
+        requireRecentPassword(socket);
+        if (backupInProgress) throw new Error('A full backup is already being created.');
+        backupInProgress = true;
+        try {
+          pruneExpiredTransfers();
+          const jobId = createToken();
+          const result = await createFullBackup({
+            configurationDatabase: getConfigurationDatabase(),
+            identityService,
+            fleetReportService,
+            jobId,
+          });
+          const token = createToken();
+          downloads.set(token, {
+            archivePath: result.archivePath,
+            jobDir: result.jobDir,
+            expiresAt: Date.now() + TOKEN_LIFETIME_MS,
+          });
+          getConfigurationDatabase().recordAuditEvent(actorFor(socket), 'backup.created', {
+            fileCount: result.manifest.files.length,
+            skippedUnstableFileCount: result.manifest.skippedUnstableFiles.length,
+          });
+          cb({
+            success: true,
+            downloadUrl: `/admin-api/backup/${token}`,
+            fileCount: result.manifest.files.length,
+            skippedUnstableFiles: result.manifest.skippedUnstableFiles,
+          });
+        } finally {
+          backupInProgress = false;
+        }
+      }).catch((error) => responseError(cb, error));
+    });
+
+    socket.on('backupRestore:createRestoreUpload', (_payload = {}, cb = () => {}) => {
+      try {
+        requireRecentPassword(socket);
+        pruneExpiredTransfers();
+        const token = createToken();
+        uploads.set(token, {
+          actor: actorFor(socket),
+          expiresAt: Date.now() + TOKEN_LIFETIME_MS,
+        });
+        cb({ success: true, uploadUrl: `/admin-api/restore/${token}` });
+      } catch (error) {
+        responseError(cb, error);
+      }
+    });
+
+    socket.on('backupRestore:confirmRestore', ({ restoreId } = {}, cb = () => {}) => {
+      try {
+        requireRecentPassword(socket);
+        const safeRestoreId = String(restoreId || '');
+        if (!/^[a-f0-9]{64}$/.test(safeRestoreId)) throw new Error('Validated restore was not found.');
+        if (isApplicationRestartPending()) throw new Error('Application restart already pending.');
+        if (fs.existsSync(startupRestore.pendingPath)) throw new Error('A restore is already pending.');
+        const jobDir = path.join(controlDir, `restore-${safeRestoreId}`);
+        if (!fs.existsSync(path.join(jobDir, 'validated.json'))) throw new Error('Validated restore was not found.');
+        startupRestore.writeJson(startupRestore.pendingPath, {
+          restoreId: safeRestoreId,
+          state: 'pending',
+          requestedAt: Date.now(),
+          actor: actorFor(socket),
+        });
+        getConfigurationDatabase().recordAuditEvent(actorFor(socket), 'restore.requested', { restoreId: safeRestoreId });
+        requestApplicationRestart({ actor: actorFor(socket), reason: 'restore-requested' });
+        cb({ success: true });
+      } catch (error) {
+        responseError(cb, error);
+      }
+    });
+  });
+}
+
+function registerHttpApi() {
+  app.get('/admin-api/backup/:token', (req, res) => {
+    pruneExpiredTransfers();
+    const transfer = downloads.get(String(req.params.token || ''));
+    if (!transfer) {
+      res.status(404).send('Backup download is missing or expired.');
+      return;
+    }
+    downloads.delete(req.params.token);
+    res.set({
+      'Content-Type': 'application/gzip',
+      'Content-Disposition': `attachment; filename="multirover-backup-${new Date().toISOString().slice(0, 10)}.tar.gz"`,
+      'Cache-Control': 'no-store',
+    });
+    const cleanup = () => fsp.rm(transfer.jobDir, { recursive: true, force: true }).catch(() => undefined);
+    res.once('close', cleanup);
+    fs.createReadStream(transfer.archivePath).on('error', (error) => {
+      logger.warn('Backup download failed', { error: error.message });
+      if (!res.headersSent) res.status(500).end();
+      else res.destroy(error);
+    }).pipe(res);
+  });
+
+  app.put('/admin-api/restore/:token', async (req, res) => {
+    pruneExpiredTransfers();
+    const token = String(req.params.token || '');
+    const transfer = uploads.get(token);
+    uploads.delete(token);
+    if (!transfer) {
+      res.status(404).json({ error: 'Restore upload is missing or expired.' });
+      return;
+    }
+    const contentLength = Number(req.headers['content-length']);
+    if (Number.isFinite(contentLength) && contentLength > MAX_ARCHIVE_BYTES) {
+      res.status(413).json({ error: 'Backup archive exceeds the restore size limit.' });
+      return;
+    }
+
+    const restoreId = createToken();
+    const jobDir = path.join(controlDir, `restore-${restoreId}`);
+    const archivePath = path.join(jobDir, 'upload.tar.gz');
+    try {
+      await fsp.mkdir(jobDir, { recursive: true });
+      let receivedBytes = 0;
+      const limiter = new Transform({
+        transform(chunk, _encoding, callback) {
+          receivedBytes += chunk.length;
+          callback(receivedBytes > MAX_ARCHIVE_BYTES
+            ? new Error('Backup archive exceeds the restore size limit.')
+            : null, chunk);
+        },
+      });
+      await pipeline(req, limiter, fs.createWriteStream(archivePath, { mode: 0o600 }));
+      const summary = await prepareRestoreArchive({ archivePath, jobDir, actor: transfer.actor });
+      getConfigurationDatabase().recordAuditEvent(transfer.actor, 'restore.validated', {
+        restoreId,
+        fileCount: summary.fileCount,
+        totalBytes: summary.totalBytes,
+      });
+      res.set('Cache-Control', 'no-store').json({ success: true, restoreId, summary });
+    } catch (error) {
+      await fsp.rm(jobDir, { recursive: true, force: true });
+      logger.warn('Restore upload failed validation', { actor: transfer.actor, error: error.message });
+      res.status(error.message.includes('size limit') ? 413 : 400).json({ error: error.message });
+    }
+  });
+}
+
+function register() {
+  if (registered) return;
+  registered = true;
+  /*
+    These runtime dependencies are deliberately loaded only after earliest
+    startup restore has run. Several of them open SQLite immediately, so
+    importing them at module scope would make replacement too late and unsafe.
+  */
+  ({ app } = require('../../globals/http'));
+  io = require('../../globals/io');
+  logger = require('../../globals/logger').child('backupRestoreService');
+  ({ getConfigurationDatabase } = require('../../configuration'));
+  identityService = require('../identityService');
+  fleetReportService = require('../fleetReportService');
+  ({ requireLockdownAdministrator, requireRecentPassword } = require('../adminConfigurationService'));
+  ({ isApplicationRestartPending, requestApplicationRestart } = require('../serverControlService'));
+  fs.mkdirSync(controlDir, { recursive: true });
+  removeOrphanedStaging();
+  registerHttpApi();
+  registerSocketApi();
+}
+
+function markStartupSuccessful() {
+  const result = startupRestore.markStartupSuccessful();
+  if (result) {
+    const configuration = require('../../configuration');
+    configuration.getConfigurationDatabase().recordAuditEvent('system', 'restore.completed', { restoreId: result.restoreId });
+  }
+  return result;
+}
+
+module.exports = {
+  applyPendingRestore: startupRestore.applyPendingRestore,
+  markStartupSuccessful,
+  register,
+};

server/src/services/backupRestoreService/restore.js

@@ -0,0 +1,216 @@
+// Full Data Restore Validation
+// Purpose: Safely extracts and validates an uploaded MultiRover backup before it can become a pending restore.
+// Scope: Never changes active data; startupRestore owns the later replacement and rollback transaction.
+const fs = require('fs');
+const fsp = require('fs/promises');
+const path = require('path');
+const Database = require('better-sqlite3');
+const tar = require('tar');
+const {
+  DATABASE_NAMES,
+  FORMAT_VERSION,
+  readDatabaseSchemaVersions,
+  removeSnapshotSidecars,
+  sha256File,
+} = require('./backup');
+
+const MAX_ARCHIVE_BYTES = 100 * 1024 * 1024 * 1024;
+const MAX_EXTRACTED_BYTES = 200 * 1024 * 1024 * 1024;
+const MAX_ARCHIVE_ENTRIES = 100000;
+const RESERVED_DATA_NAMES = new Set(['backup-restore', 'runtime']);
+const SUPPORTED_DATABASE_SCHEMA_VERSIONS = {
+  configuration: 2,
+  identity: 4,
+  fleetReports: 0,
+};
+
+function normalizeArchivePath(value) {
+  const raw = String(value || '');
+  if (!raw || raw.includes('\\') || path.posix.isAbsolute(raw)) return null;
+  const withoutTrailingSlash = raw.replace(/\/+$/, '');
+  const normalized = path.posix.normalize(withoutTrailingSlash);
+  if (!normalized || normalized === '.' || normalized === '..' || normalized.startsWith('../')) return null;
+  return normalized;
+}
+
+function assertAllowedArchiveEntry(entry) {
+  const normalized = normalizeArchivePath(entry.path);
+  if (!normalized || (normalized !== 'manifest.json' && normalized !== 'data' && !normalized.startsWith('data/'))) {
+    throw new Error(`Backup contains an invalid archive path: ${entry.path}`);
+  }
+  if (!['File', 'Directory'].includes(entry.type)) {
+    throw new Error(`Backup contains unsupported entry type ${entry.type}: ${entry.path}`);
+  }
+  if (normalized.startsWith('data/')) {
+    const topLevelName = normalized.slice('data/'.length).split('/')[0];
+    if (RESERVED_DATA_NAMES.has(topLevelName)) {
+      throw new Error(`Backup contains reserved data path: ${entry.path}`);
+    }
+  }
+  return normalized;
+}
+
+async function inspectArchive(archivePath) {
+  let entryCount = 0;
+  let extractedBytes = 0;
+  const paths = new Set();
+  let validationError = null;
+  await tar.t({
+    file: archivePath,
+    strict: true,
+    onentry: (entry) => {
+      if (validationError) return;
+      try {
+        entryCount += 1;
+        extractedBytes += Number(entry.size) || 0;
+        if (entryCount > MAX_ARCHIVE_ENTRIES) throw new Error('Backup contains too many files.');
+        if (extractedBytes > MAX_EXTRACTED_BYTES) throw new Error('Backup expands beyond the restore size limit.');
+        const normalized = assertAllowedArchiveEntry(entry);
+        if (paths.has(normalized)) throw new Error(`Backup contains duplicate path: ${normalized}`);
+        paths.add(normalized);
+      } catch (error) {
+        /*
+          tar invokes onentry from its parser event stack, where throwing would
+          become an uncaught exception instead of rejecting tar.t(). Retain the
+          first failure and raise it immediately after the bounded listing.
+        */
+        validationError = error;
+      }
+    },
+  });
+  if (validationError) throw validationError;
+  if (!paths.has('manifest.json') || !paths.has('data')) {
+    throw new Error('Backup must contain manifest.json and one data directory.');
+  }
+}
+
+async function listExtractedFiles(rootDir, relativeDir = '') {
+  const entries = await fsp.readdir(path.join(rootDir, relativeDir), { withFileTypes: true });
+  const files = [];
+  for (const entry of entries) {
+    const relativePath = path.join(relativeDir, entry.name);
+    const fullPath = path.join(rootDir, relativePath);
+    const stat = await fsp.lstat(fullPath);
+    if (stat.isSymbolicLink()) throw new Error(`Restored data contains symbolic link: ${relativePath}`);
+    if (stat.isDirectory()) {
+      files.push(...await listExtractedFiles(rootDir, relativePath));
+      continue;
+    }
+    if (!stat.isFile()) throw new Error(`Restored data contains special file: ${relativePath}`);
+    files.push({
+      path: relativePath.split(path.sep).join('/'),
+      size: stat.size,
+      sha256: await sha256File(fullPath),
+    });
+  }
+  return files.sort((left, right) => left.path.localeCompare(right.path));
+}
+
+function verifySqliteDatabase(filePath, name) {
+  const database = new Database(filePath, { readonly: true, fileMustExist: true });
+  try {
+    const result = database.pragma('quick_check', { simple: true });
+    if (result !== 'ok') throw new Error(`${name} failed SQLite integrity validation.`);
+  } finally {
+    database.close();
+  }
+}
+
+async function validateExtractedRestore(extractDir) {
+  const manifestPath = path.join(extractDir, 'manifest.json');
+  const payloadDir = path.join(extractDir, 'data');
+  const manifestStat = await fsp.stat(manifestPath);
+  if (manifestStat.size > 10 * 1024 * 1024) throw new Error('Backup manifest is unreasonably large.');
+  const manifest = JSON.parse(await fsp.readFile(manifestPath, 'utf8'));
+  if (manifest.format !== 'multirover-full-backup' || manifest.formatVersion !== FORMAT_VERSION) {
+    throw new Error('Backup format or version is not supported.');
+  }
+  if (!Array.isArray(manifest.files)) throw new Error('Backup manifest has no file inventory.');
+
+  const expected = [...manifest.files].sort((left, right) => String(left.path).localeCompare(String(right.path)));
+  const actual = await listExtractedFiles(payloadDir);
+  if (expected.length !== actual.length) {
+    /*
+      Keep the strict complete-inventory check, but identify a few differences
+      so an operator can distinguish a missing file from an unexpected archive
+      entry without weakening restore validation or exposing file contents.
+    */
+    const expectedPaths = new Set(expected.map((entry) => entry.path));
+    const actualPaths = new Set(actual.map((entry) => entry.path));
+    const missing = expected.filter((entry) => !actualPaths.has(entry.path)).map((entry) => entry.path).slice(0, 5);
+    const unexpected = actual.filter((entry) => !expectedPaths.has(entry.path)).map((entry) => entry.path).slice(0, 5);
+    const details = [
+      missing.length ? `missing: ${missing.join(', ')}` : '',
+      unexpected.length ? `unexpected: ${unexpected.join(', ')}` : '',
+    ].filter(Boolean).join('; ');
+    throw new Error(`Backup file inventory does not match the archive${details ? ` (${details})` : ''}.`);
+  }
+  for (let index = 0; index < expected.length; index += 1) {
+    const wanted = expected[index];
+    const found = actual[index];
+    if (wanted.path !== found.path || wanted.size !== found.size || wanted.sha256 !== found.sha256) {
+      throw new Error(`Backup checksum or size mismatch: ${wanted.path || found.path}`);
+    }
+  }
+
+  for (const databaseName of DATABASE_NAMES) {
+    if (!actual.some((entry) => entry.path === databaseName)) {
+      throw new Error(`Backup is missing required database: ${databaseName}`);
+    }
+    verifySqliteDatabase(path.join(payloadDir, databaseName), databaseName);
+  }
+  const actualSchemaVersions = readDatabaseSchemaVersions(payloadDir);
+  for (const [databaseName, version] of Object.entries(actualSchemaVersions)) {
+    // JSON object property order has no meaning. Compare each known database by
+    // name so an otherwise valid manifest is not rejected merely because a
+    // different JSON writer emitted its keys in another order.
+    if (Number(manifest.databaseSchemaVersions?.[databaseName]) !== version) {
+      throw new Error('Backup database schema versions do not match its manifest.');
+    }
+    if (version > SUPPORTED_DATABASE_SCHEMA_VERSIONS[databaseName]) {
+      throw new Error(`Backup ${databaseName} database is newer than this application supports.`);
+    }
+  }
+  /*
+    Integrity and schema reads can create fresh WAL coordination files even
+    though the uploaded snapshot initially matched its manifest exactly. Remove
+    those validation-only files so startup applies only inventoried content.
+  */
+  await removeSnapshotSidecars(payloadDir);
+  return manifest;
+}
+
+async function prepareRestoreArchive({ archivePath, jobDir, actor }) {
+  const archiveStat = await fsp.stat(archivePath);
+  if (!archiveStat.isFile() || archiveStat.size <= 0 || archiveStat.size > MAX_ARCHIVE_BYTES) {
+    throw new Error('Backup archive is empty or exceeds the restore size limit.');
+  }
+  await inspectArchive(archivePath);
+  const extractDir = path.join(jobDir, 'extracted');
+  await fsp.rm(extractDir, { recursive: true, force: true });
+  await fsp.mkdir(extractDir, { recursive: true });
+  // Data files never need executable or set-id permissions from an uploaded
+  // archive. Let the server account's umask choose safe extraction modes.
+  await tar.x({ cwd: extractDir, file: archivePath, strict: true, preservePaths: false, noChmod: true });
+  const manifest = await validateExtractedRestore(extractDir);
+  const summary = {
+    createdAt: manifest.createdAt,
+    applicationVersion: manifest.applicationVersion,
+    fileCount: manifest.files.length,
+    totalBytes: manifest.files.reduce((total, entry) => total + Number(entry.size || 0), 0),
+    skippedUnstableFiles: Array.isArray(manifest.skippedUnstableFiles) ? manifest.skippedUnstableFiles : [],
+  };
+  await fsp.writeFile(
+    path.join(jobDir, 'validated.json'),
+    `${JSON.stringify({ actor, validatedAt: Date.now(), summary }, null, 2)}\n`,
+    { encoding: 'utf8', mode: 0o600 },
+  );
+  return summary;
+}
+
+module.exports = {
+  MAX_ARCHIVE_BYTES,
+  inspectArchive,
+  prepareRestoreArchive,
+  validateExtractedRestore,
+};

server/src/services/backupRestoreService/startupRestore.js

@@ -0,0 +1,143 @@
+// Startup Data Restore
+// Purpose: Applies a previously validated restore before any application database opens and rolls back an interrupted start.
+// Scope: Operates only on top-level entries inside SERVER_DATA_DIR while preserving backupRestoreService control state.
+const fs = require('fs');
+const path = require('path');
+const { resolveDataDir, resolveDataPath } = require('../../helpers/dataPaths');
+const { CONTROL_DIR_NAME } = require('./backup');
+
+const controlDir = resolveDataPath(CONTROL_DIR_NAME);
+const pendingPath = path.join(controlDir, 'pending.json');
+const rollbackDir = path.join(controlDir, 'rollback');
+const lastResultPath = path.join(controlDir, 'last-result.json');
+
+function writeJson(filePath, value) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  const temporaryPath = `${filePath}.tmp`;
+  fs.writeFileSync(temporaryPath, `${JSON.stringify(value, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+  fs.renameSync(temporaryPath, filePath);
+}
+
+function readPending() {
+  try {
+    return JSON.parse(fs.readFileSync(pendingPath, 'utf8'));
+  } catch (error) {
+    if (error.code === 'ENOENT') return null;
+    throw error;
+  }
+}
+
+function listActiveDataEntries({ includeRuntime = true } = {}) {
+  fs.mkdirSync(resolveDataDir(), { recursive: true });
+  return fs.readdirSync(resolveDataDir()).filter((name) => (
+    name !== CONTROL_DIR_NAME && (includeRuntime || name !== 'runtime')
+  ));
+}
+
+function removeActiveData() {
+  for (const name of listActiveDataEntries()) {
+    fs.rmSync(path.join(resolveDataDir(), name), { recursive: true, force: true });
+  }
+}
+
+function moveChildren(sourceDir, destinationDir) {
+  fs.mkdirSync(destinationDir, { recursive: true });
+  for (const name of fs.readdirSync(sourceDir)) {
+    fs.renameSync(path.join(sourceDir, name), path.join(destinationDir, name));
+  }
+}
+
+function restoreRollback(pending, errorMessage) {
+  removeActiveData();
+  moveChildren(rollbackDir, resolveDataDir());
+  writeJson(lastResultPath, {
+    status: 'rolled-back',
+    restoreId: pending.restoreId,
+    completedAt: Date.now(),
+    error: errorMessage,
+  });
+  fs.rmSync(pendingPath, { force: true });
+}
+
+function applyPendingRestore() {
+  const pending = readPending();
+  if (!pending) return null;
+
+  /*
+    Reaching startup again in either state means the replacement process did
+    not reach the HTTP-listening success marker. The complete rollback copy was
+    created before active data was touched, so restoring it is deterministic.
+  */
+  if (pending.state === 'applying' || pending.state === 'awaiting-health') {
+    restoreRollback(pending, 'The restored application did not finish starting.');
+    return { status: 'rolled-back', restoreId: pending.restoreId };
+  }
+
+  const jobDir = path.join(controlDir, `restore-${pending.restoreId}`);
+  const replacementDir = path.join(jobDir, 'extracted', 'data');
+  if (!fs.existsSync(path.join(jobDir, 'validated.json'))
+    || !fs.existsSync(replacementDir)
+    || !fs.statSync(replacementDir).isDirectory()) {
+    fs.rmSync(pendingPath, { force: true });
+    writeJson(lastResultPath, {
+      status: 'failed',
+      restoreId: pending.restoreId,
+      completedAt: Date.now(),
+      error: 'Validated restore staging is missing.',
+    });
+    return { status: 'failed', restoreId: pending.restoreId };
+  }
+
+  try {
+    fs.rmSync(rollbackDir, { recursive: true, force: true });
+    fs.mkdirSync(rollbackDir, { recursive: true });
+    // Startup runs before any database or writer opens. Copying the entire
+    // current payload first gives every later replacement step one complete,
+    // local rollback source even if the process is interrupted halfway through.
+    for (const name of listActiveDataEntries({ includeRuntime: false })) {
+      fs.cpSync(path.join(resolveDataDir(), name), path.join(rollbackDir, name), { recursive: true });
+    }
+    writeJson(pendingPath, { ...pending, state: 'applying', applyingAt: Date.now() });
+    removeActiveData();
+    moveChildren(replacementDir, resolveDataDir());
+    writeJson(pendingPath, { ...pending, state: 'awaiting-health', appliedAt: Date.now() });
+    return { status: 'awaiting-health', restoreId: pending.restoreId };
+  } catch (error) {
+    if (fs.existsSync(rollbackDir)) restoreRollback(pending, error.message);
+    else fs.rmSync(pendingPath, { force: true });
+    return { status: 'rolled-back', restoreId: pending.restoreId, error: error.message };
+  }
+}
+
+function markStartupSuccessful() {
+  const pending = readPending();
+  if (!pending || pending.state !== 'awaiting-health') return null;
+  const jobDir = path.join(controlDir, `restore-${pending.restoreId}`);
+  fs.rmSync(rollbackDir, { recursive: true, force: true });
+  fs.rmSync(jobDir, { recursive: true, force: true });
+  fs.rmSync(pendingPath, { force: true });
+  const result = {
+    status: 'restored',
+    restoreId: pending.restoreId,
+    completedAt: Date.now(),
+  };
+  writeJson(lastResultPath, result);
+  return result;
+}
+
+function getLastRestoreResult() {
+  try {
+    return JSON.parse(fs.readFileSync(lastResultPath, 'utf8'));
+  } catch (error) {
+    if (error.code === 'ENOENT') return null;
+    throw error;
+  }
+}
+
+module.exports = {
+  applyPendingRestore,
+  getLastRestoreResult,
+  markStartupSuccessful,
+  pendingPath,
+  writeJson,
+};

server/src/services/balanceBoardService/configuration.js

@@ -8,7 +8,7 @@ module.exports = {
   feature: true,
   defaultValue: { enabled: false, simulate: false },
   schema: strictObject({
-    enabled: boolean({ description: 'Starts the Wii Balance Board service and exposes its readings and controls after restart.' }),
+    enabled: boolean({ description: 'Immediately starts the Wii Balance Board service and exposes its readings and controls.' }),
     simulate: boolean({ description: 'Runs the native worker with generated cyclic sensor data instead of connecting to Bluetooth hardware.' }),
   }, {
     title: 'Balance Board',

server/src/services/balanceBoardService/index.js

@@ -7,15 +7,15 @@ const { promisify } = require('util');
 const EventEmitter = require('events');
 const io = require('../../globals/io');
 const logger = require('../../globals/logger').child('balanceBoardService');
-const { loadConfig } = require('../../configuration');
+const { loadConfig, registerConfigurationHandler } = require('../../configuration');
 const { resolveDataDir, resolveDataPath } = require('../../helpers/dataPaths');
 const { isAdmin } = require('../roleService');
 const { sendAlert } = require('../alertService');
 const { createBalanceBoardHardware } = require('./hardware');
 
 const events = new EventEmitter();
-const rawConfig = loadConfig().balanceBoard || {};
-const enabled = Boolean(rawConfig.enabled);
+let rawConfig = loadConfig().balanceBoard || {};
+let enabled = Boolean(rawConfig.enabled);
 const DATA_DIR = resolveDataDir();
 const STORE_PATH = resolveDataPath('balance-board.json');
 const FRAME_ROOM = 'balance-board-viewers';
@@ -452,12 +452,14 @@ function handleWorkerMessage(message = {}) {
 
 io.on('connection', (socket) => {
   socket.on('balanceBoard:subscribe', (_payload = {}, cb = () => {}) => {
+    if (!enabled) return cb({ error: 'Balance Board is disabled' });
     socket.join(FRAME_ROOM);
     if (latestFrame) socket.emit('balanceBoard:frame', latestFrame);
     cb({ success: true });
   });
   socket.on('balanceBoard:unsubscribe', () => socket.leave(FRAME_ROOM));
   socket.on('balanceBoard:zero', (_payload = {}, cb = () => {}) => {
+    if (!enabled) return cb({ error: 'Balance Board is disabled' });
     if (!isAdmin(socket)) {
       cb({ error: 'Admin access required' });
       return;
@@ -470,6 +472,7 @@ io.on('connection', (socket) => {
     }
   });
   socket.on('balanceBoard:resetRecord', (_payload = {}, cb = () => {}) => {
+    if (!enabled) return cb({ error: 'Balance Board is disabled' });
     if (!isAdmin(socket)) {
       cb({ error: 'Admin access required' });
       return;
@@ -484,6 +487,7 @@ io.on('connection', (socket) => {
     }
   });
   socket.on('balanceBoard:unpair', async (_payload = {}, cb = () => {}) => {
+    if (!enabled) return cb({ error: 'Balance Board is disabled' });
     if (!isAdmin(socket)) {
       cb({ error: 'Admin access required' });
       return;
@@ -546,7 +550,7 @@ io.on('connection', (socket) => {
   });
 });
 
-if (enabled) {
+function startHardware() {
   hardware = createBalanceBoardHardware({
     logger,
     address: store.address,
@@ -554,10 +558,38 @@ if (enabled) {
   });
   hardware.events.on('message', handleWorkerMessage);
   hardware.start();
+}
+
+if (enabled) {
+  startHardware();
 } else {
   logger.info('Balance Board disabled by config');
 }
 
+registerConfigurationHandler('balanceBoard', (nextConfig = {}) => {
+  const wasEnabled = enabled;
+  hardware?.stop();
+  hardware = null;
+  clearZeroTimer();
+  rawConfig = nextConfig;
+  enabled = Boolean(rawConfig.enabled);
+  if (!wasEnabled && enabled) store = loadStore();
+  connected = false;
+  batteryPercent = null;
+  latestFrame = null;
+  latestRawCorners = null;
+  latestRawFrameAt = 0;
+  if (enabled) {
+    status = store.address ? 'waiting' : 'starting';
+    detail = store.address ? 'Press the front power button.' : 'Starting Bluetooth discovery.';
+    startHardware();
+  } else {
+    status = 'disabled';
+    detail = 'Balance Board support is disabled.';
+  }
+  events.emit('change', getState());
+});
+
 function installShutdownHooks() {
   const shutdown = () => {
     clearZeroTimer();

server/src/services/barcodeGameService/index.js

@@ -5,7 +5,7 @@
 // remain thin IO surfaces that subscribe to state and send votes/scans.
 const io = require('../../globals/io');
 const logger = require('../../globals/logger').child('barcodeGameService');
-const { loadConfig } = require('../../configuration');
+const { loadConfig, registerConfigurationHandler } = require('../../configuration');
 const { subscribe } = require('../eventBus');
 const { sendSystemMessage } = require('../chatService');
 const { getActiveDrivers } = require('../turnService');
@@ -28,11 +28,17 @@ const RESULTS_WINDOW_MS = 45 * 1000;
 
 const GAME_DEFINITIONS = [scanQuest, scansPerSecond, mostItems];
 const GAMES_BY_ID = Object.fromEntries(GAME_DEFINITIONS.map((game) => [game.id, game]));
-const config = loadConfig();
-const barcodeGamesConfig = config.barcodeGames || {};
-const enabled = Boolean(barcodeGamesConfig.enabled);
-const botName = String(barcodeGamesConfig.botName || 'Barcode Games').trim() || 'Barcode Games';
-const botProfileImageUrl = String(barcodeGamesConfig.profileImageUrl || '').trim() || null;
+let enabled;
+let botName;
+let botProfileImageUrl;
+
+function applyBarcodeGameConfig(barcodeGamesConfig = {}) {
+  enabled = Boolean(barcodeGamesConfig.enabled);
+  botName = String(barcodeGamesConfig.botName || 'Barcode Games').trim() || 'Barcode Games';
+  botProfileImageUrl = String(barcodeGamesConfig.profileImageUrl || '').trim() || null;
+}
+
+applyBarcodeGameConfig(loadConfig().barcodeGames || {});
 
 function sendBarcodeGameChat(text) {
   const message = String(text || '').trim();
@@ -767,6 +773,7 @@ function settleActiveGameIfNeeded() {
 }
 
 function handleScan(scan) {
+  if (!enabled) return;
   const now = Number.isFinite(scan?.scannedAt) ? scan.scannedAt : Date.now();
   withGameStore((draft) => {
     updateGlobalCounters(draft, scan, now);
@@ -1121,15 +1128,9 @@ function broadcastState() {
   });
 }
 
-if (enabled) {
-  /*
-    Barcode games are an optional layer on top of the physical scanner station.
-    The game's own switch controls whether its sockets and subscriptions exist.
-    Scanner availability is runtime state and must not silently override the
-    operator's explicit choice to enable the game service.
-  */
-  io.on('connection', (socket) => {
+io.on('connection', (socket) => {
     socket.on('barcodeGame:subscribe', (_payload = {}, cb = () => {}) => {
+      if (!enabled) return cb({ error: 'barcode games disabled' });
       socket.join(GAME_SOCKET_ROOM);
       const state = buildStatePayload(socket);
       socket.emit('barcodeGame:state', state);
@@ -1137,6 +1138,7 @@ if (enabled) {
     });
 
     socket.on('barcodeGame:vote', ({ gameId } = {}, cb = () => {}) => {
+      if (!enabled) return cb({ error: 'barcode games disabled' });
       try {
         cb(setVote(socket, gameId));
       } catch (err) {
@@ -1145,9 +1147,9 @@ if (enabled) {
       }
     });
 
-  });
+});
 
-  subscribe('barcode.scanned', (event) => {
+subscribe('barcode.scanned', (event) => {
     try {
       handleScan(event.payload);
     } catch (err) {
@@ -1155,21 +1157,25 @@ if (enabled) {
       // are logged and skipped so the scanner page can keep resolving barcodes.
       logger.warn('Barcode game scan handling failed', { error: err.message });
     }
-  });
-} else {
+});
+
+if (!enabled) {
   logger.info('Barcode games disabled by config');
 }
 
+registerConfigurationHandler('barcodeGames', (barcodeGamesConfig = {}) => {
+  applyBarcodeGameConfig(barcodeGamesConfig);
+  broadcastState();
+});
+
 module.exports = {
   buildStatePayload,
   handleScan,
   setVote,
 };
 
-if (enabled) {
-  setInterval(() => {
-    if (settleActiveGameIfNeeded()) {
-      broadcastState();
-    }
-  }, GAME_TICK_MS).unref?.();
-}
+setInterval(() => {
+  if (enabled && settleActiveGameIfNeeded()) {
+    broadcastState();
+  }
+}, GAME_TICK_MS).unref?.();

server/src/services/barcodeScannerService/configuration.js

@@ -8,7 +8,7 @@ module.exports = {
   feature: true,
   defaultValue: { enabled: false },
   schema: strictObject({
-    enabled: boolean({ description: 'Registers barcode scanning, barcode administration, and scan-triggered server behavior after restart.' }),
+    enabled: boolean({ description: 'Immediately enables barcode scanning, barcode administration, and scan-triggered server behavior.' }),
   }, {
     title: 'Barcode scanner',
     description: 'Optional physical barcode scanning and barcode registry service.',

server/src/services/barcodeScannerService/index.js

@@ -4,7 +4,7 @@
 const fs = require('fs');
 const io = require('../../globals/io');
 const logger = require('../../globals/logger').child('barcodeScannerService');
-const { loadConfig } = require('../../configuration');
+const { loadConfig, registerConfigurationHandler } = require('../../configuration');
 const { resolveDataDir, resolveDataPath } = require('../../helpers/dataPaths');
 const { getMode, MODES, modeEvents } = require('../modeManager');
 const { publishEvent } = require('../eventBus');
@@ -15,7 +15,7 @@ const REGISTRY_PATH = resolveDataPath('barcode-registry.json');
 const RECENT_SCAN_LIMIT = 8;
 const VALID_CODE_PATTERN = /^[a-z][0-9]{3}$/;
 const SCANNER_SOCKET_ROOM = 'barcode-scanner';
-const enabled = Boolean(loadConfig().barcodeScanner?.enabled);
+let enabled = Boolean(loadConfig().barcodeScanner?.enabled);
 
 let lastKnownGoodRegistry = null;
 let lastRegistryError = null;
@@ -312,19 +312,16 @@ async function applyScan(rawCode) {
   return { result };
 }
 
-if (enabled) {
-  /*
-    Barcode scanning is tied to a physical scanner station. Disabled installs
-    should not create the registry file or expose scanner socket commands.
-  */
-  io.on('connection', (socket) => {
+io.on('connection', (socket) => {
     socket.on('barcode:subscribe', (_payload = {}, cb = () => {}) => {
+      if (!enabled) return cb({ error: 'barcode scanner disabled' });
       socket.join(SCANNER_SOCKET_ROOM);
       socket.emit('barcode:state', buildStatePayload());
       cb({ success: true, state: buildStatePayload() });
     });
 
     socket.on('barcode:scan', async ({ code } = {}, cb = () => {}) => {
+      if (!enabled) return cb({ error: 'barcode scanner disabled' });
       try {
         const { result } = await applyScan(code);
         cb({ success: true, result, state: buildStatePayload() });
@@ -336,20 +333,28 @@ if (enabled) {
         cb({ error: err.message || 'barcode scan failed' });
       }
     });
-  });
+});
 
-  modeEvents.on('change', () => {
+modeEvents.on('change', () => {
     // Access-mode changes affect whether the scanner page should beep when it
     // submits a code, so scanner clients need a fresh state packet even without a
     // new scan.
     broadcastState();
-  });
+});
 
+if (enabled) {
   loadRegistryForScan();
 } else {
   logger.info('Barcode scanner disabled by config');
 }
 
+registerConfigurationHandler('barcodeScanner', (scannerConfig = {}) => {
+  const wasEnabled = enabled;
+  enabled = Boolean(scannerConfig.enabled);
+  if (!wasEnabled && enabled) loadRegistryForScan();
+  broadcastState();
+});
+
 module.exports = {
   REGISTRY_PATH,
   applyScan: (...args) => {

server/src/services/buttonBoxService/configuration.js

@@ -8,7 +8,7 @@ module.exports = {
   feature: true,
   defaultValue: { enabled: false },
   schema: strictObject({
-    enabled: boolean({ description: 'Registers the physical button-box input route and enables its persistent button rewards and effects after restart.' }),
+    enabled: boolean({ description: 'Immediately enables the physical button-box input route and its persistent button rewards and effects.' }),
   }, {
     title: 'Button box',
     description: 'Optional physical button-box input and reward system.',

server/src/services/buttonBoxService/httpRoute.js

@@ -10,6 +10,7 @@ function registerButtonBoxRoute(deps) {
     buttonCount,
     normalizeIp,
     isLocalNetwork,
+    isEnabled,
     applyPress,
   } = deps;
 
@@ -39,6 +40,13 @@ function registerButtonBoxRoute(deps) {
   }
 
   app.post('/buttonbox/press', express.text({ type: 'text/plain' }), async (req, res) => {
+    // The route stays registered for the life of Express, but the service gate
+    // is evaluated per request so the physical endpoint enables and disables
+    // immediately without accumulating duplicate routes.
+    if (!isEnabled()) {
+      res.status(503).json({ error: 'Button box is disabled' });
+      return;
+    }
     if (denyIfNotLocal(req, res)) return;
     const buttonId = parseButtonId(req.body);
     if (!Number.isFinite(buttonId) || buttonId < 1 || buttonId > buttonCount) {

server/src/services/buttonBoxService/index.js

@@ -4,7 +4,7 @@
 const { app } = require('../../globals/http');
 const io = require('../../globals/io');
 const logger = require('../../globals/logger').child('buttonBoxService');
-const { loadConfig } = require('../../configuration');
+const { loadConfig, registerConfigurationHandler } = require('../../configuration');
 const { resolveDataDir, resolveDataPath } = require('../../helpers/dataPaths');
 const { publishEvent } = require('../eventBus');
 const { getRewardById, listRewards } = require('../../rewards');
@@ -30,7 +30,7 @@ const DATA_DIR = resolveDataDir();
 const STORE_PATH = resolveDataPath('buttonbox-state.json');
 const BUTTON_COUNT = 4;
 const STORE_VERSION = 1;
-const enabled = Boolean(loadConfig().buttonBox?.enabled);
+let enabled = Boolean(loadConfig().buttonBox?.enabled);
 
 const store = createButtonBoxStore({
   logger,
@@ -73,28 +73,38 @@ const core = createButtonBoxCore({
   store,
 });
 
-if (enabled) {
-  /*
-    The button box is physical local hardware, so disabled public installs
-    should not expose its LAN-only press endpoint or initialize its reward file.
-  */
-  registerButtonBoxRoute({
-    app,
-    logger,
-    buttonCount: BUTTON_COUNT,
-    normalizeIp,
-    isLocalNetwork,
-    applyPress: core.applyPress,
-  });
+registerButtonBoxRoute({
+  app,
+  logger,
+  buttonCount: BUTTON_COUNT,
+  normalizeIp,
+  isLocalNetwork,
+  isEnabled: () => enabled,
+  applyPress: core.applyPress,
+});
 
+function enableButtonBox() {
   store.loadState();
   core.recoverEffects().catch((err) => {
     logger.warn('Button box effect recovery failed', err.message);
   });
+}
+
+if (enabled) {
+  enableButtonBox();
 } else {
   logger.info('Button box disabled by config');
 }
 
+registerConfigurationHandler('buttonBox', (buttonBoxConfig = {}) => {
+  const wasEnabled = enabled;
+  enabled = Boolean(buttonBoxConfig.enabled);
+  // Persistent state is loaded only on the transition to enabled. The core has
+  // no long-running hardware client, so disabling is completely represented by
+  // the route and public-method gates.
+  if (!wasEnabled && enabled) enableButtonBox();
+});
+
 module.exports = {
   getButtonBoxState: () => {
     /*

server/src/services/chatService/textCommands.js

@@ -43,11 +43,8 @@ const {
   createReplaySourceResolver,
 } = require('../replayDeliveryService/workflow');
 
-const config = loadConfig();
-const discordConfig = config.discord || {};
-
 function isTextCommand(text) {
-  return parseCommandText(text, config).matched;
+  return parseCommandText(text).matched;
 }
 
 function sanitizeMentions(text) {
@@ -142,6 +139,11 @@ function createChatCommandRequest({ socket, text, sendSystemMessage }) {
 
 async function runChatTextCommand({ text, socket, sendSystemMessage }) {
   if (!isTextCommand(text)) return false;
+  // Commands are assembled per message already, so reading the live snapshot
+  // here applies prefix, URL, and integration settings without retaining a
+  // stale dependency object between configuration revisions.
+  const config = loadConfig();
+  const discordConfig = config.discord || {};
   // ReplayEngineV2 has startup side effects by design. Loading it lazily here
   // keeps ordinary chatService initialization from changing the service boot
   // order, while still letting `rs replay` use the existing replay pipeline.
@@ -201,7 +203,7 @@ async function runChatTextCommand({ text, socket, sendSystemMessage }) {
     isAdminUser: (id) => String(id) === String(socket.id) && isAdmin(socket),
     isLockdownAdminUser: (id) => String(id) === String(socket.id) && isLockdownAdmin(socket),
     discordConfig,
-    siteUrl: String(discordConfig.siteUrl || ''),
+    publicUrl: String(config.publicUrl || ''),
     config,
     createReplayTextCommand: createWebReplayTextCommand(socket, sendSystemMessage, replayApi),
   };

server/src/services/discordBotService/commands/replay.js

@@ -33,7 +33,7 @@ function createReplayCommand({
   getActiveDrivers,
   getNickname,
   rovers,
-  discordConfig,
+  config,
 }) {
   const sourceResolver = createReplaySourceResolver({
     rovers,
@@ -137,8 +137,8 @@ function createReplayCommand({
           if (progressMessage?.edit) {
             await progressMessage.edit({ content: sanitizeMentions(buildStatusMessage(job, 'ready')), allowedMentions: DEFAULT_ALLOWED_MENTIONS });
           }
-          const siteUrl = String(discordConfig?.siteUrl || '').replace(/\/$/, '');
-          const publicUrl = siteUrl ? `${siteUrl}${media.url}` : media.url;
+          const publicBaseUrl = String(config?.publicUrl || '').replace(/\/$/, '');
+          const publicUrl = publicBaseUrl ? `${publicBaseUrl}${media.url}` : media.url;
           await progressMessage.reply({ content: `Replay hosted by the rover server: ${publicUrl}`, allowedMentions: DEFAULT_ALLOWED_MENTIONS });
           return;
         } catch (fallbackError) {

server/src/services/discordBotService/commands/timeStatus.js

@@ -3,12 +3,12 @@
 // Scope: Builds a concise time embed for common zones and server local zone.
 const { EmbedBuilder } = require('discord.js');
 
-function createTimeStatusCommand({ config, discordConfig }) {
+function createTimeStatusCommand({ config }) {
   function buildEmbed({ title, description, color, includeSiteUrl = true }) {
     const embed = new EmbedBuilder().setTitle(title || 'Update').setColor(color || 0x2196f3);
-    const siteUrl = includeSiteUrl && discordConfig.siteUrl ? String(discordConfig.siteUrl) : '';
-    if (description) embed.setDescription(siteUrl ? `${description}\n\n${siteUrl}` : description);
-    else if (siteUrl) embed.setDescription(siteUrl);
+    const publicUrl = includeSiteUrl && config.publicUrl ? String(config.publicUrl) : '';
+    if (description) embed.setDescription(publicUrl ? `${description}\n\n${publicUrl}` : description);
+    else if (publicUrl) embed.setDescription(publicUrl);
     embed.setTimestamp(new Date());
     return embed;
   }

server/src/services/discordBotService/configuration.js

@@ -12,7 +12,6 @@ module.exports = {
     enabled: false,
     token: '',
     guildId: '123456789012345678',
-    siteUrl: 'https://rover.example.com',
     channels: {
       general: '123456789012345678',
       announcements: '123456789012345678',
@@ -28,10 +27,9 @@ module.exports = {
     },
   },
   schema: strictObject({
-    enabled: boolean({ description: 'Logs the Discord bot in and enables commands, chat bridges, replay delivery, and configured announcements after restart.' }),
+    enabled: boolean({ description: 'Logs the Discord bot in and immediately enables commands, chat bridges, replay delivery, and configured announcements.' }),
     token: string({ title: 'Bot token', description: 'Discord bot token used to log in. The saved value is never returned to the browser.', examples: ['DISCORD_BOT_TOKEN'], writeOnly: true, maxLength: 10000 }),
     guildId: string({ title: 'Guild id', description: 'Reserved Discord server identifier. The current bot runtime does not restrict commands or events using this value.', examples: ['123456789012345678'], maxLength: 100 }),
-    siteUrl: string({ title: 'Public site URL', description: 'Public base URL appended to announcement embeds and server-hosted replay links.', examples: ['https://rover.example.com'], maxLength: 2048 }),
     channels: strictObject({
       general: string({ description: 'Channel ID used by the button-box stalker-role and everyone-ping rewards.', examples: ['123456789012345678'], maxLength: 100 }),
       announcements: string({ description: 'Channel ID used for public-mode openings, objective changes, and all-rovers-unlocked announcements.', examples: ['123456789012345678'], maxLength: 100 }),
@@ -55,7 +53,7 @@ module.exports = {
     }),
   }, {
     title: 'Discord',
-    description: 'Optional Discord bot credentials, public URL, and notification routing.',
-    required: ['enabled', 'token', 'guildId', 'siteUrl', 'channels', 'roles'],
+    description: 'Optional Discord bot credentials and notification routing; public links use the top-level public URL.',
+    required: ['enabled', 'token', 'guildId', 'channels', 'roles'],
   }),
 };

server/src/services/discordBotService/index.js

@@ -9,7 +9,12 @@ const {
 } = require('discord.js');
 const logger = require('../../globals/logger').child('discordBot');
 const io = require('../../globals/io');
-const { loadConfig, getConfigurationDatabase, isFeatureEnabled } = require('../../configuration');
+const {
+  loadConfig,
+  getConfigurationDatabase,
+  isFeatureEnabled,
+  registerConfigurationHandler,
+} = require('../../configuration');
 const { parseCommandText } = require('../operatorCommandService/config');
 const roverManager = require('../roverManager');
 const { getRoster, lockRover, rovers } = roverManager;
@@ -79,9 +84,12 @@ const {
   buildStatusMessage,
 } = require('../replayDeliveryService/workflow');
 
-const config = loadConfig();
+// Discord helper modules retain references to these objects. Mutating those
+// references on configuration application updates command and integration
+// behavior without registering a second tree of Discord/event listeners.
+const config = structuredClone(loadConfig());
 const discordConfig = config.discord || {};
-const enabled = Boolean(discordConfig.enabled);
+let enabled = Boolean(discordConfig.enabled);
 // These normalized command names mirror the command router. Bridge-channel
 // command replies are mirrored into web chat, so this entrypoint needs to know
 // the configured command names before it wraps message.reply.
@@ -89,10 +97,7 @@ const configuredAdministrators = getConfigurationDatabase().listAdministrators()
 const adminIds = new Set(configuredAdministrators.map((admin) => String(admin.discordId || '').trim()).filter(Boolean));
 const lockdownAdminIds = new Set(configuredAdministrators.filter((admin) => admin.role === 'lockdown').map((admin) => String(admin.discordId || '').trim()).filter(Boolean));
 
-if (!enabled) {
-  logger.info('Discord disabled by config');
-  return;
-}
+if (!enabled) logger.info('Discord disabled by config');
 
 const intents = [
   GatewayIntentBits.Guilds,
@@ -157,10 +162,10 @@ const replayCaption = createReplayCaptionBuilder({
 // Discord is the preferred replay host only while this optional feature is
 // active. The core replay delivery service owns generation and automatically
 // falls back to its local media store when any operation below fails.
-if (discordConfig?.channels?.replay) {
-  registerPreferredDeliveryProvider({
+registerPreferredDeliveryProvider({
     async begin(job) {
-      const channelId = discordConfig.channels.replay;
+      const channelId = discordConfig.channels?.replay;
+      if (!enabled || !channelId) throw new Error('Discord replay delivery is disabled');
       const progressMessage = await channelIO.sendToChannel(channelId, buildAcceptedMessage(job), {}, DEFAULT_ALLOWED_MENTIONS);
       if (!progressMessage) throw new Error('Discord replay progress message could not be sent');
       const channel = await channelIO.fetchChannel(channelId);
@@ -201,8 +206,8 @@ if (discordConfig?.channels?.replay) {
       }
     },
     async completeFallback({ context, media }) {
-      const siteUrl = String(discordConfig.siteUrl || '').replace(/\/$/, '');
-      const publicUrl = siteUrl ? `${siteUrl}${media.url}` : media.url;
+      const publicBaseUrl = String(config.publicUrl || '').replace(/\/$/, '');
+      const publicUrl = publicBaseUrl ? `${publicBaseUrl}${media.url}` : media.url;
       if (context?.progressMessage?.reply) {
         await context.progressMessage.reply({
           content: `Replay hosted by the rover server: ${publicUrl}`,
@@ -210,8 +215,7 @@ if (discordConfig?.channels?.replay) {
         });
       }
     },
-  });
-}
+});
 
 const commandDependencies = {
   logger,
@@ -366,24 +370,78 @@ client.on('messageCreate', async (message) => {
   }
 });
 
-client.once('ready', () => {
-  logger.info('Discord bot logged in', { tag: client.user?.tag });
-  presence.schedulePresenceRotation();
-  // Discord is only a delivery consumer. Starting its scheduler after the bot
-  // is ready avoids failed sends during login while the collector continues to
-  // operate independently of Discord availability.
-  createFleetDailyReports({
+let fleetDailyReports = null;
+
+function restartFleetDailyReports() {
+  fleetDailyReports?.stop();
+  fleetDailyReports = createFleetDailyReports({
     logger,
     discordConfig,
     fleetConfig: config.fleetReports || {},
     fleetReportService,
     roverManager,
     sendToChannel: channelIO.sendToChannel,
-  }).start();
+  });
+  fleetDailyReports.start();
+}
+
+client.on('ready', () => {
+  logger.info('Discord bot logged in', { tag: client.user?.tag });
+  presence.schedulePresenceRotation();
+  // Discord is only a delivery consumer. Starting its scheduler after the bot
+  // is ready avoids failed sends during login while the collector continues to
+  // operate independently of Discord availability.
+  restartFleetDailyReports();
 });
 
-client.login(discordConfig.token).catch((err) => {
-  logger.error('Discord login failed', err.message);
+function replaceObject(target, source = {}) {
+  Object.keys(target).forEach((key) => delete target[key]);
+  Object.assign(target, structuredClone(source));
+}
+
+function applyDiscordConfig(nextDiscordConfig = {}) {
+  const wasEnabled = enabled;
+  const previousToken = discordConfig.token;
+  replaceObject(discordConfig, nextDiscordConfig);
+  config.discord = discordConfig;
+  enabled = Boolean(discordConfig.enabled);
+
+  if (!enabled) {
+    fleetDailyReports?.stop();
+    fleetDailyReports = null;
+    if (wasEnabled) client.destroy();
+    return;
+  }
+  if (!wasEnabled || previousToken !== discordConfig.token) {
+    if (wasEnabled) client.destroy();
+    // Login health is reported by Discord itself; do not hold the committed
+    // configuration request open while an external network service connects.
+    client.login(discordConfig.token).catch((err) => {
+      logger.error('Discord login failed after configuration change', err.message);
+    });
+  } else if (client.isReady()) {
+    restartFleetDailyReports();
+  }
+}
+
+function applySharedConfigSection(section, value) {
+  config[section] = structuredClone(value);
+  // Fleet delivery owns a timer derived from both Discord and fleet settings.
+  // Reconnecting is unnecessary; rebuild only that scheduler when ready.
+  if (section === 'fleetReports' && client.isReady()) {
+    restartFleetDailyReports();
+  }
+}
+
+registerConfigurationHandler('discord', applyDiscordConfig);
+['commands', 'publicUrl', 'timezone', 'fleetReports'].forEach((section) => {
+  registerConfigurationHandler(section, (value) => applySharedConfigSection(section, value));
 });
 
+if (enabled) {
+  client.login(discordConfig.token).catch((err) => {
+    logger.error('Discord login failed', err.message);
+  });
+}
+
 module.exports = {};

server/src/services/discordBotService/integrations/busEvents.js

@@ -5,15 +5,15 @@ const { EmbedBuilder, AttachmentBuilder } = require('discord.js');
 const { buildBatteryStatusEmbed, buildBatteryCaption } = require('../batteryEmbeds');
 
 function createBusEventHandler(deps) {
-  const { logger, discordConfig, roverManager, rovers, schedulePresenceRotation, formatDuration, sendToChannel } = deps;
+  const { logger, config, discordConfig, roverManager, rovers, schedulePresenceRotation, formatDuration, sendToChannel } = deps;
   const ADMIN_ALERT_EVENT_TYPES = new Set(['rover.online', 'rover.offline', 'rover.dockGuard', 'rover.helpNeeded', 'rover.helpCleared', 'battery.warn', 'battery.urgent', 'battery.docked', 'battery.undocked', 'battery.charging.start', 'battery.charging.stop', 'battery.locked', 'battery.unlocked']);
   let skippedFirstModeAnnouncement = false;
 
   function buildEmbed({ title, description, color, includeSiteUrl = true }) {
     const embed = new EmbedBuilder().setTitle(title || 'Update').setColor(color || 0x2196f3);
-    const siteUrl = includeSiteUrl && discordConfig.siteUrl ? String(discordConfig.siteUrl) : '';
-    if (description) embed.setDescription(siteUrl ? `${description}\n\n${siteUrl}` : description);
-    else if (siteUrl) embed.setDescription(siteUrl);
+    const publicUrl = includeSiteUrl && config.publicUrl ? String(config.publicUrl) : '';
+    if (description) embed.setDescription(publicUrl ? `${description}\n\n${publicUrl}` : description);
+    else if (publicUrl) embed.setDescription(publicUrl);
     embed.setTimestamp(new Date());
     return embed;
   }

server/src/services/discordBotService/userAnnouncements.js

@@ -14,6 +14,7 @@ const WATCHED_EVENT_TYPES = new Set([
 function createUserAnnouncements(deps) {
   const {
     discordConfig,
+    config,
     getMode,
     rovers,
     roverManager,
@@ -22,9 +23,12 @@ function createUserAnnouncements(deps) {
     schedulePresenceRotation,
   } = deps;
 
-  const announcementChannelId = discordConfig?.channels?.announcements || null;
-  const announcementRoleId = discordConfig?.roles?.announcementPing || null;
-  const siteUrl = discordConfig?.siteUrl ? String(discordConfig.siteUrl) : '';
+  // The parent Discord service preserves this object identity and updates its
+  // contents on live configuration application. Resolve individual values at
+  // send/render time so announcements do not retain stale channel or site data.
+  const getAnnouncementChannelId = () => discordConfig?.channels?.announcements || null;
+  const getAnnouncementRoleId = () => discordConfig?.roles?.announcementPing || null;
+  const getPublicUrl = () => (config?.publicUrl ? String(config.publicUrl) : '');
 
   let previousSnapshot = buildSnapshot();
   let skippedFirstModeChange = false;
@@ -124,10 +128,11 @@ function createUserAnnouncements(deps) {
       });
     }
 
-    if (siteUrl) {
+    const publicUrl = getPublicUrl();
+    if (publicUrl) {
       embed.addFields({
         name: 'Join',
-        value: siteUrl,
+        value: publicUrl,
         inline: false,
       });
     }
@@ -136,6 +141,8 @@ function createUserAnnouncements(deps) {
   }
 
   async function sendAnnouncement({ content, embeds, ping = false }) {
+    const announcementChannelId = getAnnouncementChannelId();
+    const announcementRoleId = getAnnouncementRoleId();
     if (!announcementChannelId) return;
     const shouldPing = Boolean(ping && announcementRoleId);
     const body = shouldPing ? `<@&${announcementRoleId}> ${content || ''}`.trim() : content;

server/src/services/fleetReportService/configuration.js

@@ -14,7 +14,7 @@ module.exports = {
     privacy: { retainChatBodies: true },
   },
   schema: strictObject({
-    enabled: boolean({ description: 'Starts persistent fleet metric collection, reports, retention cleanup, and configured daily delivery after restart.' }),
+    enabled: boolean({ description: 'Immediately starts persistent fleet metric collection, reports, retention cleanup, and configured daily delivery.' }),
     retention: strictObject({
       detailedDays: integer({ description: 'Days to retain detailed events, command observations, sessions, and other non-minute fleet records. Zero retains them indefinitely.', minimum: 0, maximum: 36500 }),
       minuteSamplesDays: integer({ description: 'Days to retain per-minute rover metric aggregates. Zero retains them indefinitely.', minimum: 0, maximum: 36500 }),

server/src/services/fleetReportService/index.js

@@ -1,25 +1,44 @@
 // Fleet Report Service
-// Purpose: Composes optional passive collection, storage, analysis, retention, and read-only transport.
-// Scope: This is the sole feature boundary; disabled installations register no collectors, timers, database, or sockets.
-const { loadConfig } = require('../../configuration');
+// Purpose: Owns the replaceable collection/report runtime and its stable browser API.
+// Scope: Applies the complete fleetReports section without restarting the Node process.
+const { loadConfig, registerConfigurationHandler } = require('../../configuration');
 const logger = require('../../globals/logger').child('fleetReportService');
+const { subscribeAll } = require('../eventBus');
+const roverManager = require('../roverManager');
+const { commandEvents } = require('../commandService');
+const { odometerEvents } = require('../odometerService');
+const { createStorage } = require('./storage');
+const { createCollector } = require('./collector');
+const { createReportBuilder } = require('./reportBuilder');
+const { registerSocketGateway } = require('./socketGateway');
 
-const config = loadConfig().fleetReports || {};
+let runtime = null;
+let storage = null;
 
-if (!config.enabled) {
-  module.exports = {
-    enabled: false,
-    getDailyReport: () => null,
-  };
-} else {
-  const { subscribeAll } = require('../eventBus');
-  const roverManager = require('../roverManager');
-  const { commandEvents } = require('../commandService');
-  const { odometerEvents } = require('../odometerService');
-  const { createStorage } = require('./storage');
-  const { createCollector } = require('./collector');
-  const { createReportBuilder } = require('./reportBuilder');
-  const { registerSocketGateway } = require('./socketGateway');
+function retentionDays(value, fallback) {
+  const number = Number(value);
+  return Number.isFinite(number) && number >= 0 ? number : fallback;
+}
+
+function stopRuntime() {
+  if (!runtime) return;
+  runtime.unsubscribeEvents();
+  if (runtime.batteryEnabled) roverManager.managerEvents.off('sensor', runtime.collector.collectSensor);
+  commandEvents.off('observation', runtime.collector.collectCommand);
+  odometerEvents.off('update', runtime.collector.collectOdometer);
+  runtime.managerEventHandlers.forEach((handler, kind) => roverManager.managerEvents.off(kind, handler));
+  clearInterval(runtime.flushTimer);
+  clearInterval(runtime.retentionTimer);
+  runtime.collector.flushMinutes();
+  runtime = null;
+}
+
+function startRuntime(config = {}) {
+  stopRuntime();
+  if (!config.enabled) {
+    logger.info('Fleet reporting disabled by config');
+    return;
+  }
 
   const batteryConfig = config.battery || {};
   const retentionConfig = config.retention || {};
@@ -31,11 +50,14 @@ if (!config.enabled) {
     10,
     Math.min(100, Number(batteryConfig.minimumCapacityTestDepthPercent) || 60),
   );
-  // Battery collection follows its own explicit nested switch. Defaults are
-  // supplied by the validated configuration document, so a missing value does
-  // not need a compatibility fallback that could accidentally enable it.
   const batteryEnabled = Boolean(batteryConfig.enabled);
-  const storage = createStorage({ logger });
+
+  // Keep one SQLite connection for the process lifetime. Configuration reloads
+  // replace collectors and timers, not the durable database they share.
+  if (!storage) {
+    storage = createStorage({ logger });
+    storage.open();
+  }
   const collector = createCollector({
     storage,
     logger,
@@ -43,8 +65,6 @@ if (!config.enabled) {
     minimumCapacityTestDepthPercent,
   });
   const reportBuilder = createReportBuilder({ storage, collector, roverManager });
-
-  storage.open();
   const unsubscribeEvents = subscribeAll(collector.collectEvent);
   if (batteryEnabled) roverManager.managerEvents.on('sensor', collector.collectSensor);
   commandEvents.on('observation', collector.collectCommand);
@@ -55,18 +75,9 @@ if (!config.enabled) {
     roverManager.managerEvents.on(kind, handler);
     return [kind, handler];
   }));
-  registerSocketGateway({ roverManager, reportBuilder, storage, collector, logger });
 
-  // Periodic upserts bound data-loss on an unclean shutdown while still
-  // avoiding writes at the 20 Hz sensor-frame rate.
   const flushTimer = setInterval(() => collector.flushMinutes(), 30 * 1000);
   flushTimer.unref?.();
-
-  function retentionDays(value, fallback) {
-    const number = Number(value);
-    return Number.isFinite(number) && number >= 0 ? number : fallback;
-  }
-
   function pruneNow() {
     const now = Date.now();
     const detailedDays = retentionDays(retentionConfig.detailedDays, 0);
@@ -80,43 +91,62 @@ if (!config.enabled) {
   const retentionTimer = setInterval(pruneNow, 6 * 60 * 60 * 1000);
   retentionTimer.unref?.();
 
-  function getDailyReport({ since, until, roverIds } = {}) {
-    const end = Number(until) || Date.now();
-    return reportBuilder.build({
-      since: Number(since) || end - 24 * 60 * 60 * 1000,
-      until: end,
-      roverIds: Array.isArray(roverIds) ? roverIds : undefined,
-      // Daily Discord output is intentionally metric-only. Avoiding the event
-      // query here also prevents irrelevant event volume from bloating the
-      // durable daily snapshot that supports delivery idempotency.
-      includeEvents: false,
-    });
-  }
-
+  runtime = {
+    batteryEnabled,
+    storage,
+    collector,
+    reportBuilder,
+    unsubscribeEvents,
+    managerEventHandlers,
+    flushTimer,
+    retentionTimer,
+  };
   logger.info('Fleet reporting enabled', {
     databaseAvailable: storage.getDiagnostics().available,
     maximumIntegrationGapMs,
     minimumCapacityTestDepthPercent,
     batteryEnabled,
   });
-
-  module.exports = {
-    enabled: true,
-    getDailyReport,
-    collector,
-    storage,
-    reportBuilder,
-    // Exposed for controlled tests and graceful future shutdown wiring. Normal
-    // runtime leaves subscriptions active for the lifetime of the server.
-    stop() {
-      unsubscribeEvents();
-      if (batteryEnabled) roverManager.managerEvents.off('sensor', collector.collectSensor);
-      commandEvents.off('observation', collector.collectCommand);
-      odometerEvents.off('update', collector.collectOdometer);
-      managerEventHandlers.forEach((handler, kind) => roverManager.managerEvents.off(kind, handler));
-      clearInterval(flushTimer);
-      clearInterval(retentionTimer);
-      collector.flushMinutes();
-    },
-  };
 }
+
+registerSocketGateway({ roverManager, getRuntime: () => runtime, logger });
+startRuntime(loadConfig().fleetReports || {});
+registerConfigurationHandler('fleetReports', startRuntime);
+
+module.exports = {
+  get enabled() {
+    return Boolean(runtime);
+  },
+  getDailyReport({ since, until, roverIds } = {}) {
+    if (!runtime) return null;
+    const end = Number(until) || Date.now();
+    return runtime.reportBuilder.build({
+      since: Number(since) || end - 24 * 60 * 60 * 1000,
+      until: end,
+      roverIds: Array.isArray(roverIds) ? roverIds : undefined,
+      includeEvents: false,
+    });
+  },
+  get collector() {
+    return runtime?.collector || null;
+  },
+  get storage() {
+    return runtime?.storage || storage;
+  },
+  get reportBuilder() {
+    return runtime?.reportBuilder || null;
+  },
+  backupDatabase(destinationPath) {
+    /*
+      Backups include reporting history even when collection is currently
+      disabled. Lazily opening the existing store keeps this one operation
+      behind the report service's normal database ownership boundary.
+    */
+    if (!storage) {
+      storage = createStorage({ logger });
+      storage.open();
+    }
+    return storage.backupDatabase(destinationPath);
+  },
+  stop: stopRuntime,
+};

server/src/services/fleetReportService/socketGateway.js

@@ -17,10 +17,13 @@ function normalizeRange(payload = {}) {
   return { since, until: Math.max(since + 1, until) };
 }
 
-function registerSocketGateway({ roverManager, reportBuilder, storage, collector, logger }) {
+function registerSocketGateway({ roverManager, getRuntime, logger }) {
   io.on('connection', (socket) => {
     socket.on('fleetReports:get', (payload = {}, cb = () => {}) => {
       try {
+        const runtime = getRuntime();
+        if (!runtime) throw new Error('Fleet reports are disabled');
+        const { reportBuilder } = runtime;
         const { since, until } = normalizeRange(payload);
         // getRosterForSocket is the canonical live private-rover visibility
         // resolver. Historical queries use precisely those currently visible
@@ -59,6 +62,9 @@ function registerSocketGateway({ roverManager, reportBuilder, storage, collector
 
     socket.on('fleetReports:replaceBattery', (payload = {}, cb = () => {}) => {
       try {
+        const runtime = getRuntime();
+        if (!runtime) throw new Error('Fleet reports are disabled');
+        const { storage, collector } = runtime;
         if (!isAdmin(socket)) throw new Error('Admin access required');
         const roverId = String(payload.roverId || '').trim();
         if (!roverId || !roverManager.rovers.has(roverId)) throw new Error('Known online rover required');

server/src/services/fleetReportService/storage.js

@@ -508,6 +508,16 @@ function createStorage({ logger }) {
     }), { available: false, path: DB_PATH });
   }
 
+  function backupDatabase(destinationPath) {
+    /*
+      Fleet collection may continue during an online SQLite backup. Each
+      resulting database file represents a valid point-in-time snapshot even
+      when new telemetry commits before the copy completes.
+    */
+    if (!open()) throw new Error('Fleet report database is unavailable.');
+    return db.backup(destinationPath);
+  }
+
   return {
     open,
     insertEvent,
@@ -525,6 +535,7 @@ function createStorage({ logger }) {
     getActiveBattery,
     replaceBattery,
     getDiagnostics,
+    backupDatabase,
   };
 }
 

server/src/services/homeAssistantService/configuration.js

@@ -52,7 +52,7 @@ module.exports = {
     ],
   },
   schema: strictObject({
-    enabled: boolean({ description: 'Connects to Home Assistant and enables configured room entities, physical-button triggers, Neato controls, and lift controls after restart.' }),
+    enabled: boolean({ description: 'Immediately connects to Home Assistant and enables configured room entities, physical-button triggers, Neato controls, and lift controls.' }),
     url: string({ title: 'Server URL', description: 'Base URL of the Home Assistant server used for its REST and WebSocket APIs.', format: 'uri', maxLength: 2048 }),
     token: string({ title: 'Long-lived access token', description: 'Home Assistant long-lived access token used to authenticate every API request. The saved value is never returned to the browser.', examples: ['REPLACE_WITH_LONG_LIVED_TOKEN'], writeOnly: true, maxLength: 20000 }),
     [neato.key]: neato.schema,

server/src/services/homeAssistantService/hooks.js

@@ -8,7 +8,7 @@ const { isAdmin, isLockdownAdmin } = require('../roleService');
 function registerHomeAssistantHooks(deps) {
   const {
     logger,
-    haConfig,
+    getHaConfig,
     isLightControlLocked,
     setLightsLockedOn,
     toggleEntity,
@@ -110,7 +110,9 @@ function registerHomeAssistantHooks(deps) {
       }
       try {
         if (!entityId) throw new Error('entityId required');
-        await setLightWhite(entityId, haConfig?.whiteKelvin);
+        // Resolve configuration at interaction time because the socket handler
+        // is intentionally registered once and survives service reloads.
+        await setLightWhite(entityId, getHaConfig()?.whiteKelvin);
         cb({ success: true });
       } catch (err) {
         cb({ error: err.message });

server/src/services/homeAssistantService/index.js

@@ -2,83 +2,88 @@
 // Purpose: Composes Home Assistant transport, runtime automation engine, and event/socket hooks.
 // Scope: Exposes stable room-control APIs while delegating internals to focused modules.
 const logger = require('../../globals/logger').child('homeAssistantService');
-const { loadConfig } = require('../../configuration');
+const { loadConfig, registerConfigurationHandler } = require('../../configuration');
 const { events } = require('./state');
 const { createRuntimeEngine } = require('./runtimeEngine');
 const { createTransport } = require('./transport');
 const { registerHomeAssistantHooks } = require('./hooks');
 
-const config = loadConfig();
-const haConfig = config.homeAssistant || {};
-const enabled = Boolean(haConfig.enabled);
+let current;
 
-let callHomeAssistantServiceImpl = async () => {
-  throw new Error('Home Assistant not connected');
-};
-
-const runtimeEngine = createRuntimeEngine({
-  logger,
-  enabled,
-  haConfig,
-  callHomeAssistantService: (...args) => callHomeAssistantServiceImpl(...args),
-});
-
-const transport = createTransport({
-  logger,
-  enabled,
-  haConfig,
-  onSnapshot: runtimeEngine.handleEntitySnapshot,
-  onStatus: () => runtimeEngine.emitStatus(runtimeEngine.getState),
-});
-
-callHomeAssistantServiceImpl = transport.callHomeAssistantService;
-
-runtimeEngine.loadEntityConfig();
-runtimeEngine.loadTriggerConfig();
-
-if (enabled) {
-  /*
-    Loading the module should be harmless on rover-only installs. The explicit
-    service-owned switch alone decides whether connection should be attempted;
-    missing credentials are then reported as a runtime connection failure.
-  */
-  transport.connect();
-}
-
-if (enabled) {
-  /*
-    Socket routes are part of the visible Home Assistant feature. Register them
-    only when enabled so disabled installs do not expose hidden controls that
-    the UI has intentionally removed.
-  */
-  registerHomeAssistantHooks({
+function createHomeAssistantRuntime(haConfig = {}) {
+  const enabled = Boolean(haConfig.enabled);
+  let callHomeAssistantServiceImpl = async () => {
+    throw new Error('Home Assistant not connected');
+  };
+  const runtimeEngine = createRuntimeEngine({
     logger,
+    enabled,
     haConfig,
-    isLightControlLocked: runtimeEngine.isLightControlLocked,
-    setLightsLockedOn: runtimeEngine.setLightsLockedOn,
-    toggleEntity: runtimeEngine.toggleEntity,
-    setEntityState: runtimeEngine.setEntityState,
-    setLightColor: runtimeEngine.setLightColor,
-    setLightWhite: runtimeEngine.setLightWhite,
+    callHomeAssistantService: (...args) => callHomeAssistantServiceImpl(...args),
   });
+  const transport = createTransport({
+    logger,
+    enabled,
+    haConfig,
+    onSnapshot: runtimeEngine.handleEntitySnapshot,
+    onStatus: () => runtimeEngine.emitStatus(runtimeEngine.getState),
+  });
+  callHomeAssistantServiceImpl = transport.callHomeAssistantService;
+  runtimeEngine.loadEntityConfig();
+  runtimeEngine.loadTriggerConfig();
+  if (enabled) {
+    // A service reload creates one fresh transport with the new credentials and
+    // entity schema. Disabled installations perform no network work.
+    transport.connect();
+  }
+  return { enabled, haConfig, runtimeEngine, transport };
 }
 
+function replaceHomeAssistantRuntime(haConfig) {
+  current?.transport.disconnect();
+  current = createHomeAssistantRuntime(haConfig);
+}
+
+replaceHomeAssistantRuntime(loadConfig().homeAssistant || {});
+
+/*
+  Browser and mode hooks are registered exactly once. Their delegates resolve
+  `current` for every call, so a configuration save does not duplicate socket
+  listeners while still routing existing connections into the new runtime.
+*/
+registerHomeAssistantHooks({
+  logger,
+  getHaConfig: () => current.haConfig,
+  isLightControlLocked: (...args) => current.runtimeEngine.isLightControlLocked(...args),
+  setLightsLockedOn: (...args) => current.runtimeEngine.setLightsLockedOn(...args),
+  toggleEntity: (...args) => current.runtimeEngine.toggleEntity(...args),
+  setEntityState: (...args) => current.runtimeEngine.setEntityState(...args),
+  setLightColor: (...args) => current.runtimeEngine.setLightColor(...args),
+  setLightWhite: (...args) => current.runtimeEngine.setLightWhite(...args),
+});
+
+registerConfigurationHandler('homeAssistant', (haConfig) => {
+  replaceHomeAssistantRuntime(haConfig || {});
+});
+
 module.exports = {
-  getState: runtimeEngine.getState,
-  isConnected: transport.isConnected,
-  enabled,
-  getLightPolicyState: runtimeEngine.getLightPolicyState,
-  isLightControlLocked: runtimeEngine.isLightControlLocked,
-  getRawEntitySnapshot: runtimeEngine.getRawEntitySnapshot,
-  getControllableEntityIds: runtimeEngine.getControllableEntityIds,
-  callHomeAssistantService: transport.callHomeAssistantService,
-  toggleEntity: runtimeEngine.toggleEntity,
-  setEntityState: runtimeEngine.setEntityState,
-  setLightColor: runtimeEngine.setLightColor,
-  setLightWhite: runtimeEngine.setLightWhite,
-  setAllControllableEntitiesState: runtimeEngine.setAllControllableEntitiesState,
-  setRandomColorScene: runtimeEngine.setRandomColorScene,
-  setLightsLockedOn: runtimeEngine.setLightsLockedOn,
-  toggleLightsLockedOn: runtimeEngine.toggleLightsLockedOn,
+  getState: (...args) => current.runtimeEngine.getState(...args),
+  isConnected: (...args) => current.transport.isConnected(...args),
+  get enabled() {
+    return current.enabled;
+  },
+  getLightPolicyState: (...args) => current.runtimeEngine.getLightPolicyState(...args),
+  isLightControlLocked: (...args) => current.runtimeEngine.isLightControlLocked(...args),
+  getRawEntitySnapshot: (...args) => current.runtimeEngine.getRawEntitySnapshot(...args),
+  getControllableEntityIds: (...args) => current.runtimeEngine.getControllableEntityIds(...args),
+  callHomeAssistantService: (...args) => current.transport.callHomeAssistantService(...args),
+  toggleEntity: (...args) => current.runtimeEngine.toggleEntity(...args),
+  setEntityState: (...args) => current.runtimeEngine.setEntityState(...args),
+  setLightColor: (...args) => current.runtimeEngine.setLightColor(...args),
+  setLightWhite: (...args) => current.runtimeEngine.setLightWhite(...args),
+  setAllControllableEntitiesState: (...args) => current.runtimeEngine.setAllControllableEntitiesState(...args),
+  setRandomColorScene: (...args) => current.runtimeEngine.setRandomColorScene(...args),
+  setLightsLockedOn: (...args) => current.runtimeEngine.setLightsLockedOn(...args),
+  toggleLightsLockedOn: (...args) => current.runtimeEngine.toggleLightsLockedOn(...args),
   homeAssistantEvents: events,
 };

server/src/services/homeAssistantService/transport.js

@@ -11,6 +11,9 @@ if (!global.WebSocket) {
 
 function createTransport(deps) {
   const { logger, enabled, haConfig, onSnapshot, onStatus } = deps;
+  let active = true;
+  let connection = null;
+  let unsubscribeEntities = null;
   function getCallerFrame() {
     const stack = new Error().stack || '';
     const lines = stack.split('\n').slice(2).map((line) => line.trim());
@@ -37,33 +40,40 @@ function createTransport(deps) {
   }
 
   function teardownConnection() {
-    if (runtime.unsubscribeEntities) {
+    const ownedUnsubscribe = unsubscribeEntities;
+    unsubscribeEntities = null;
+    if (ownedUnsubscribe) {
       try {
-        runtime.unsubscribeEntities();
+        ownedUnsubscribe();
       } catch (err) {
         logger.warn('Failed to unsubscribe entity stream', err.message);
       }
     }
-    runtime.unsubscribeEntities = null;
-
-    if (runtime.connection) {
+    const ownedConnection = connection;
+    connection = null;
+    if (ownedConnection) {
       try {
-        runtime.connection.close();
+        ownedConnection.close();
       } catch (err) {
         logger.warn('Error closing Home Assistant connection', err.message);
       }
     }
 
-    runtime.connection = null;
-    const wasConnected = runtime.connected;
-    runtime.connected = false;
-    if (wasConnected) {
-      onStatus();
+    // An old transport's delayed disconnected event must not clear the newer
+    // transport stored in shared runtime state after a configuration reload.
+    if (runtime.connection === ownedConnection) {
+      runtime.connection = null;
+      runtime.unsubscribeEntities = null;
+      const wasConnected = runtime.connected;
+      runtime.connected = false;
+      if (wasConnected) onStatus();
     }
   }
 
   function scheduleReconnect(delayMs = 5000) {
-    if (!enabled) return;
+    // A replaced transport must never reconnect after its successor has taken
+    // ownership of the shared Home Assistant connection state.
+    if (!active || !enabled) return;
     if (runtime.reconnectTimer) return;
     runtime.reconnectTimer = setTimeout(() => {
       runtime.reconnectTimer = null;
@@ -72,23 +82,30 @@ function createTransport(deps) {
   }
 
   async function connect() {
-    if (!enabled) {
+    if (!active || !enabled) {
       // Disabled and misconfigured are intentionally different states. The
       // explicit switch prevents connection attempts; missing credentials are
       // surfaced by buildAuth() as a runtime connection failure when enabled.
       logger.info('Home Assistant disabled by config');
       return;
     }
-    if (runtime.connection) return;
+    if (connection) return;
 
     try {
       const auth = buildAuth();
-      runtime.connection = await createConnection({ auth, setupRetry: 0 });
+      const nextConnection = await createConnection({ auth, setupRetry: 0 });
+      if (!active) {
+        nextConnection.close();
+        return;
+      }
+      connection = nextConnection;
+      runtime.connection = connection;
       runtime.connected = true;
       onStatus();
       logger.info('Connected to Home Assistant');
-      runtime.unsubscribeEntities = subscribeEntities(runtime.connection, onSnapshot);
-      runtime.connection.addEventListener('disconnected', () => {
+      unsubscribeEntities = subscribeEntities(connection, onSnapshot);
+      runtime.unsubscribeEntities = unsubscribeEntities;
+      connection.addEventListener('disconnected', () => {
         logger.warn('Home Assistant connection lost');
         teardownConnection();
         scheduleReconnect();
@@ -101,12 +118,12 @@ function createTransport(deps) {
   }
 
   function isConnected() {
-    return Boolean(runtime.connection && runtime.connected);
+    return Boolean(connection && runtime.connection === connection && runtime.connected);
   }
 
   async function callHomeAssistantService(domain, service, serviceData = {}) {
-    if (!enabled) throw new Error('Home Assistant not configured');
-    if (!runtime.connection) throw new Error('Home Assistant not connected');
+    if (!active || !enabled) throw new Error('Home Assistant not configured');
+    if (!connection || runtime.connection !== connection) throw new Error('Home Assistant not connected');
     if (!domain || !service) throw new Error('domain and service required');
     logger.info('Home Assistant outbound service call', {
       domain: String(domain),
@@ -114,11 +131,24 @@ function createTransport(deps) {
       serviceData: serviceData && typeof serviceData === 'object' ? { ...serviceData } : serviceData,
       caller: getCallerFrame(),
     });
-    await callService(runtime.connection, String(domain), String(service), serviceData || {});
+    await callService(connection, String(domain), String(service), serviceData || {});
+  }
+
+  function disconnect() {
+    // Configuration reloads deliberately retire the complete transport. Clear
+    // its pending retry before closing so the old credentials cannot race the
+    // newly created transport and reclaim the shared connection.
+    active = false;
+    if (runtime.reconnectTimer) {
+      clearTimeout(runtime.reconnectTimer);
+      runtime.reconnectTimer = null;
+    }
+    teardownConnection();
   }
 
   return {
     connect,
+    disconnect,
     isConnected,
     callHomeAssistantService,
   };

server/src/services/httpServer/index.js

@@ -5,6 +5,7 @@ const { httpServer } = require('../../globals/http');
 const config = require('../../globals/config');
 const logger = require('../../globals/logger').child('httpServer');
 const { startMediaMtx } = require('../mediaMtxService');
+const backupRestoreService = require('../backupRestoreService');
 
 httpServer.listen(config.port, () => {
   logger.info(`Server listening on :${config.port}`);
@@ -14,4 +15,24 @@ httpServer.listen(config.port, () => {
     first publisher attempts to authenticate.
   */
   startMediaMtx();
+  /*
+    Give child processes and startup integrations a short stabilization window
+    after restored databases migrate and HTTP begins listening. If the process
+    exits during that window, earliest startup sees the awaiting-health marker
+    and restores the prior data instead of accepting a broken replacement.
+  */
+  setTimeout(() => backupRestoreService.markStartupSuccessful(), 5000);
 });
+
+function stopAcceptingConnections() {
+  /*
+    Child-process services already own their SIGTERM cleanup. The HTTP service
+    only stops accepting new work; MediaMTX's bounded signal handler remains
+    responsible for ending the Node process even if an existing socket keeps
+    the close callback waiting.
+  */
+  if (httpServer.listening) httpServer.close();
+}
+
+process.once('SIGINT', stopAcceptingConnections);
+process.once('SIGTERM', stopAcceptingConnections);

server/src/services/identityService/index.js

@@ -118,6 +118,15 @@ function getDb() {
   return db;
 }
 
+function backupDatabase(destinationPath) {
+  /*
+    Keep identity writes live while SQLite copies a transactionally consistent
+    view into backup staging. Exposing the operation instead of the connection
+    preserves this service as the sole owner of identity.sqlite.
+  */
+  return getDb().backup(destinationPath);
+}
+
 function ensureSchema(conn) {
   conn.exec(`
     create table if not exists users (
@@ -1087,6 +1096,7 @@ function createJsonStore({ path: filePath, normalizeStoreShape, cloneStore, logg
 module.exports = {
   identityEvents,
   getDb,
+  backupDatabase,
   sanitizeNickname,
   normalizeCookieUserId,
   isValidCookieUserId,

server/src/services/interInstanceService/configuration.js

@@ -14,7 +14,6 @@ module.exports = {
     pollIntervalMs: 30000,
     requestTimeoutMs: 5000,
     profile: {
-      publicUrl: 'https://rover.example.com',
       name: 'Example Rover Server',
       description: 'A short public description of this rover server.',
       color: '#38bdf8',
@@ -33,10 +32,9 @@ module.exports = {
     pollIntervalMs: integer({ description: 'Milliseconds between peer-directory refreshes.', minimum: 1000, maximum: 86400000 }),
     requestTimeoutMs: integer({ description: 'Maximum milliseconds allowed for each directory or peer information request before it is aborted.', minimum: 250, maximum: 120000 }),
     profile: strictObject({
-      publicUrl: string({ description: 'Public base URL peers and users use to reach this server; it also identifies and filters this instance from directory results.', examples: ['https://rover.example.com'], maxLength: 2048 }),
       name: string({ description: 'Public instance name advertised to peer servers.', minLength: 1, maxLength: 120 }),
       description: string({ description: 'Short public summary advertised with this instance.', examples: ['A short public description of this rover server.'], maxLength: 500 }),
       color: string({ description: 'Six-digit hexadecimal accent color advertised for this instance.', pattern: '^#[0-9a-fA-F]{6}$' }),
-    }, { description: 'Public identity this server publishes through the inter-instance information endpoint.', required: ['publicUrl', 'name', 'description', 'color'] }),
+    }, { description: 'Public identity this server publishes through the inter-instance information endpoint; its address comes from the top-level public URL.', required: ['name', 'description', 'color'] }),
   }, { title: 'Inter-instance directory', description: 'Controls discovery and public information exchange between independent MultiRover servers.', required: ['enabled', 'directoryUrls', 'pollIntervalMs', 'requestTimeoutMs', 'profile'] }),
 };

server/src/services/interInstanceService/index.js

@@ -6,7 +6,7 @@ const { v4: uuidv4 } = require('uuid');
 const { app } = require('../../globals/http');
 const io = require('../../globals/io');
 const logger = require('../../globals/logger').child('interInstanceService');
-const { loadConfig, getFeatureFlags } = require('../../configuration');
+const { loadConfig, getFeatureFlags, registerConfigurationHandler } = require('../../configuration');
 const { getConfiguredSocials } = require('../sessionService/configuration');
 const { getMode, MODES } = require('../modeManager');
 const roverManager = require('../roverManager');
@@ -20,13 +20,13 @@ const DEFAULT_POLL_INTERVAL_MS = 30000;
 const DEFAULT_REQUEST_TIMEOUT_MS = 5000;
 const INFO_PATH = '/api/inter-instance/info';
 const INSTANCE_ID = uuidv4();
-const config = loadConfig();
-const interInstanceConfig = config.interInstance || {};
-const profileConfig = interInstanceConfig.profile || {};
+let interInstanceConfig = loadConfig().interInstance || {};
 const interInstanceEvents = new EventEmitter();
 const remoteInstances = new Map();
 
-let polling = false;
+let pollGeneration = 0;
+let pollingGeneration = null;
+let pollTimer = null;
 function asTrimmedString(value) {
   return typeof value === 'string' ? value.trim() : '';
 }
@@ -59,7 +59,7 @@ function pollIntervalMs() {
 }
 
 function ownPublicUrl() {
-  return normalizeBaseUrl(profileConfig.publicUrl);
+  return normalizeBaseUrl(loadConfig().publicUrl);
 }
 
 function ownInstanceId() {
@@ -79,6 +79,7 @@ function buildPublicUrl(pathname) {
 
 function publicProfile() {
   const publicUrl = ownPublicUrl();
+  const profileConfig = interInstanceConfig.profile || {};
   return {
     id: ownInstanceId(),
     name: asTrimmedString(profileConfig.name) || publicUrl || 'Rover server',
@@ -189,7 +190,15 @@ function filterPublicUsers(users = [], publicIds) {
 function buildLocalInfo() {
   const mode = getMode();
   const lockdown = isLockdownMode();
-  const features = getFeatureFlags();
+  /*
+    Build every configuration-derived part of one public response from the
+    same immutable revision. Besides preventing a revision change from mixing
+    feature flags with newer social links, this supplies the explicit snapshot
+    required by getConfiguredSocials instead of relying on the removed legacy
+    global configuration object.
+  */
+  const config = loadConfig();
+  const features = getFeatureFlags(config);
   const publicRoster = getPublicRoster();
   const publicIds = publicRoverIdSet(publicRoster);
   const roster = publicRoster.map((rover) => (lockdown ? rover : addRoverSnapshotLinks(rover)));
@@ -429,25 +438,40 @@ async function pollRemoteInstance(entry) {
   }
 }
 
-async function pollNow() {
-  if (!isEnabled() || polling) return;
-  polling = true;
+async function pollNow(expectedGeneration = pollGeneration) {
+  if (!isEnabled() || expectedGeneration !== pollGeneration || pollingGeneration === expectedGeneration) return;
+  pollingGeneration = expectedGeneration;
   try {
     const entries = await fetchDirectoryEntries();
     const nextEntries = await Promise.all(entries.map((entry) => pollRemoteInstance(entry)));
+    // Ignore responses from the previous directory/profile after a live edit;
+    // otherwise a slow retired request could repopulate peers after disable or
+    // overwrite results produced by the newly configured directory.
+    if (!isEnabled() || expectedGeneration !== pollGeneration) return;
     replaceRemoteInstances(nextEntries);
     interInstanceEvents.emit('change');
   } catch (err) {
     logger.warn('Inter-instance poll failed', { error: err.message });
   } finally {
-    polling = false;
+    if (pollingGeneration === expectedGeneration) pollingGeneration = null;
   }
 }
 
 function startPolling() {
-  if (!isEnabled()) return;
-  pollNow();
-  setInterval(pollNow, pollIntervalMs());
+  pollGeneration += 1;
+  const expectedGeneration = pollGeneration;
+  if (pollTimer) {
+    clearInterval(pollTimer);
+    pollTimer = null;
+  }
+  if (!isEnabled()) {
+    remoteInstances.clear();
+    interInstanceEvents.emit('change');
+    return;
+  }
+  pollNow(expectedGeneration);
+  pollTimer = setInterval(() => pollNow(expectedGeneration), pollIntervalMs());
+  pollTimer.unref?.();
 }
 
 function getState() {
@@ -462,6 +486,23 @@ function getState() {
 
 startPolling();
 
+registerConfigurationHandler('interInstance', (nextConfig = {}) => {
+  // Replacing this single reference updates request timeouts, identity fields,
+  // directory URLs, and peer lists together. Rebuilding the interval applies
+  // the new cadence immediately and clears stale peers when disabled.
+  interInstanceConfig = nextConfig;
+  startPolling();
+});
+
+registerConfigurationHandler('publicUrl', () => {
+  /*
+    The canonical URL participates in self-filtering as well as the published
+    profile. Start a fresh generation immediately so results from an in-flight
+    poll using the former identity cannot be committed afterward.
+  */
+  startPolling();
+});
+
 module.exports = {
   getState,
   interInstanceEvents,

server/src/services/interInstanceService/index.test.js

@@ -0,0 +1,76 @@
+// Inter-Instance Public Payload Tests
+// Purpose: Verifies that configuration-backed public metadata can be assembled for peer servers.
+// Scope: Runs the service in an isolated child process so its socket gateways, timers, and configuration singleton never touch another test's runtime.
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+
+test('builds the inter-instance payload when social links are enabled', () => {
+  const dataRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'multirover-inter-instance-'));
+  const serverRoot = path.resolve(__dirname, '../../..');
+
+  try {
+    /*
+      Enabling Social links is essential to this regression: disabled links
+      short-circuit before the configuration argument is read and therefore
+      cannot expose a stale or missing configuration reference. The child
+      process loads the real service graph and calls the same payload builder
+      used by GET /api/inter-instance/info.
+    */
+    const script = `
+      const configuration = require('./src/configuration');
+      const database = configuration.getConfigurationDatabase();
+      const current = database.getClientConfiguration();
+      const next = structuredClone(current.config);
+      next.socials.enabled = true;
+      next.socials.links = [{
+        id: 'community',
+        label: 'Community',
+        url: 'https://community.example.test',
+        icon: 'FaUsers',
+        color: '#38bdf8'
+      }];
+      database.updateConfiguration({
+        value: next,
+        expectedRevision: current.revision,
+        actor: 'inter-instance-test'
+      });
+      configuration.applyCommittedConfiguration().then(() => {
+        const { buildLocalInfo } = require('./src/services/interInstanceService');
+        const payload = buildLocalInfo();
+        // Production services may write startup logs to stdout. A unique
+        // marker separates the assertion payload from that expected noise.
+        process.stdout.write('\\n__INTER_INSTANCE_RESULT__' + JSON.stringify(payload.socials));
+        database.close();
+        // Requiring the production service intentionally registers persistent
+        // Socket.IO gateways. The disposable child has completed its one real
+        // payload assertion, so it must not wait for those server-owned handles.
+        process.exit(0);
+      }).catch((error) => {
+        console.error(error);
+        process.exit(1);
+      });
+    `;
+    const output = execFileSync(process.execPath, ['-e', script], {
+      cwd: serverRoot,
+      env: { ...process.env, SERVER_DATA_DIR: dataRoot },
+      encoding: 'utf8',
+    });
+
+    const resultMarker = '__INTER_INSTANCE_RESULT__';
+    const resultOffset = output.lastIndexOf(resultMarker);
+    assert.notEqual(resultOffset, -1, 'child process did not emit its inter-instance result');
+    assert.deepEqual(JSON.parse(output.slice(resultOffset + resultMarker.length)), [{
+      id: 'community',
+      label: 'Community',
+      url: 'https://community.example.test',
+      icon: 'FaUsers',
+      color: '#38bdf8',
+    }]);
+  } finally {
+    fs.rmSync(dataRoot, { recursive: true, force: true });
+  }
+});

server/src/services/kinectService/configuration.js

@@ -8,7 +8,7 @@ module.exports = {
   feature: true,
   defaultValue: { enabled: false, captureCooldownMs: 10000 },
   schema: strictObject({
-    enabled: boolean({ description: 'Starts the Kinect worker and exposes authorized frame capture after restart.' }),
+    enabled: boolean({ description: 'Immediately starts the Kinect worker and exposes authorized frame capture.' }),
     captureCooldownMs: integer({ description: 'Minimum milliseconds between accepted Kinect frame-capture requests across all clients.', minimum: 0, maximum: 3600000 }),
   }, {
     title: 'Kinect',

server/src/services/kinectService/index.js

@@ -1,7 +1,7 @@
 // Kinect Service
 // Purpose: Composes Kinect hardware capture and browser socket delivery.
 // Scope: Exposes session-readable state while keeping startup side effects in this service folder.
-const { loadConfig } = require('../../configuration');
+const { loadConfig, registerConfigurationHandler } = require('../../configuration');
 const hardware = require('./hardware');
 const { registerKinectSocketGateway, kinectEvents } = require('./socketGateway');
 
@@ -11,6 +11,10 @@ const gateway = registerKinectSocketGateway({
   hardware,
 });
 
+registerConfigurationHandler('kinect', (kinectConfig) => {
+  gateway.reconfigure({ kinect: kinectConfig || {} });
+});
+
 module.exports = {
   getState: gateway.getState,
   kinectEvents,

server/src/services/kinectService/socketGateway.js

@@ -33,7 +33,7 @@ function normalizeKinectConfig(config = {}) {
 }
 
 function registerKinectSocketGateway({ config, hardware }) {
-  const settings = normalizeKinectConfig(config);
+  let settings = normalizeKinectConfig(config);
   let captureCooldownUntil = 0;
   let busy = false;
   let lastAction = null;
@@ -206,8 +206,31 @@ function registerKinectSocketGateway({ config, hardware }) {
     }
   }
 
+  function reconfigure(nextConfig) {
+    const previousEnabled = settings.enabled;
+    settings = normalizeKinectConfig(nextConfig);
+    lastError = null;
+
+    // The native worker is the Kinect service's complete hardware runtime.
+    // Restarting only when the enabled state changes avoids interrupting an
+    // unrelated cooldown edit while still making enable/disable immediate.
+    if (previousEnabled && !settings.enabled) {
+      hardware.stopWorker();
+      busy = false;
+    } else if (!previousEnabled && settings.enabled) {
+      try {
+        hardware.startWorker();
+      } catch (err) {
+        lastError = err.message || 'kinect worker failed to start';
+        logger.warn('Kinect worker startup failed after configuration change', { err: lastError });
+      }
+    }
+    emitStatusChange();
+  }
+
   return {
     getState: buildStatus,
+    reconfigure,
   };
 }
 

server/src/services/liftService/configuration.js

@@ -16,7 +16,7 @@ module.exports = {
     commandCooldownMs: 3000,
   },
   schema: strictObject({
-    enabled: boolean({ description: 'Enables lift status and commands through the two configured Home Assistant switches after restart.' }),
+    enabled: boolean({ description: 'Immediately enables lift status and commands through the two configured Home Assistant switches.' }),
     upSwitch: string({ description: 'Home Assistant switch entity that powers upward lift movement.', examples: ['switch.lift_up'], maxLength: 255 }),
     downSwitch: string({ description: 'Home Assistant switch entity that powers downward lift movement.', examples: ['switch.lift_down'], maxLength: 255 }),
     interlockMs: integer({ description: 'Milliseconds to wait after turning off the opposing direction before energizing the requested direction. Runtime always enforces at least 250 ms.', minimum: 0, maximum: 600000 }),

server/src/services/liftService/index.js

@@ -4,27 +4,28 @@
 const EventEmitter = require('events');
 const io = require('../../globals/io');
 const logger = require('../../globals/logger').child('liftService');
-const { loadConfig } = require('../../configuration');
+const { loadConfig, registerConfigurationHandler } = require('../../configuration');
 const { getMode, MODES } = require('../modeManager');
 const { isAdmin, isLockdownAdmin } = require('../roleService');
-const {
-  homeAssistantEvents,
-  getRawEntitySnapshot,
-  callHomeAssistantService,
-  isConnected: isHomeAssistantConnected,
-  enabled: homeAssistantEnabled,
-} = require('../homeAssistantService');
+const homeAssistantService = require('../homeAssistantService');
+const { homeAssistantEvents, getRawEntitySnapshot, callHomeAssistantService } = homeAssistantService;
 
 const events = new EventEmitter();
-const config = loadConfig();
-const haConfig = config.homeAssistant || {};
-const liftConfig = haConfig.lift || {};
-const featureEnabled = Boolean(liftConfig.enabled);
+let featureEnabled;
+let upSwitchId;
+let downSwitchId;
+let interlockMs;
+let commandCooldownMs;
 
-const upSwitchId = String(liftConfig.upSwitch || '').trim();
-const downSwitchId = String(liftConfig.downSwitch || '').trim();
-const interlockMs = Math.max(250, Number(liftConfig.interlockMs) || 9000);
-const commandCooldownMs = Math.max(interlockMs, Number(liftConfig.commandCooldownMs) || 25000);
+function applyLiftConfig(liftConfig = {}) {
+  featureEnabled = Boolean(liftConfig.enabled);
+  upSwitchId = String(liftConfig.upSwitch || '').trim();
+  downSwitchId = String(liftConfig.downSwitch || '').trim();
+  interlockMs = Math.max(250, Number(liftConfig.interlockMs) || 9000);
+  commandCooldownMs = Math.max(interlockMs, Number(liftConfig.commandCooldownMs) || 25000);
+}
+
+applyLiftConfig(loadConfig().homeAssistant?.lift || {});
 
 const state = {
   busy: false,
@@ -70,7 +71,7 @@ function isConfigured() {
 
 function getState() {
   const configured = isConfigured();
-  const connected = isHomeAssistantConnected();
+  const connected = homeAssistantService.isConnected();
   return {
     enabled: featureEnabled,
     configured,
@@ -105,8 +106,8 @@ function emitUpdate() {
 function assertReady() {
   if (!featureEnabled) throw new Error('Lift is disabled');
   if (!isConfigured()) throw new Error('Lift not configured');
-  if (!homeAssistantEnabled) throw new Error('Home Assistant not configured');
-  if (!isHomeAssistantConnected()) throw new Error('Home Assistant not connected');
+  if (!homeAssistantService.enabled) throw new Error('Home Assistant not configured');
+  if (!homeAssistantService.isConnected()) throw new Error('Home Assistant not connected');
 }
 
 async function applyPosition(target) {
@@ -175,16 +176,10 @@ async function moveDown(actor = 'unknown') {
   return requestPosition('down', actor);
 }
 
-if (featureEnabled) {
-  /*
-    Lift state depends on Home Assistant switch snapshots. Subscribe only when
-    the lift exists so disabled installs do not maintain hardware-specific UI
-    sync paths.
-  */
-  homeAssistantEvents.on('snapshot', emitUpdate);
-  homeAssistantEvents.on('status', emitUpdate);
+homeAssistantEvents.on('snapshot', emitUpdate);
+homeAssistantEvents.on('status', emitUpdate);
 
-  io.on('connection', (socket) => {
+io.on('connection', (socket) => {
     function assertFeatureAccess() {
       const mode = getMode();
       // Lift is a public activity feature in open and turns modes. Restricted
@@ -215,11 +210,19 @@ if (featureEnabled) {
         cb({ error: err.message });
       }
     });
-  });
-} else {
+});
+
+if (!featureEnabled) {
   logger.info('Lift disabled by config');
 }
 
+registerConfigurationHandler('homeAssistant', (haConfig = {}) => {
+  // Lift is nested under the Home Assistant section, so it participates in the
+  // same section reload and immediately sees the replacement HA transport.
+  applyLiftConfig(haConfig.lift || {});
+  emitUpdate();
+});
+
 emitUpdate();
 
 module.exports = {

server/src/services/llmCommentaryService/index.js

@@ -5,7 +5,7 @@ const fsp = require('fs/promises');
 const { Ollama } = require('ollama');
 const io = require('../../globals/io');
 const logger = require('../../globals/logger').child('llmCommentary');
-const { loadConfig } = require('../../configuration');
+const { loadConfig, registerConfigurationHandler } = require('../../configuration');
 const { getRole, roleEvents } = require('../roleService');
 const { getMode, MODES, modeEvents } = require('../modeManager');
 const roverManager = require('../roverManager');
@@ -34,13 +34,12 @@ const { createSnapshotEngine } = require('./snapshotEngine');
 const { registerHooks } = require('./hooks');
 const { createRunner } = require('./runner');
 
-const config = loadConfig();
-const commentaryConfig = config.llmCommentary || {};
-const enabled = Boolean(commentaryConfig.enabled);
-const ollamaUrl = String(commentaryConfig.ollamaServer || '').trim();
-const model = String(commentaryConfig.model || '').trim();
-const ollamaClient = ollamaUrl ? new Ollama({ host: ollamaUrl }) : null;
-const frequencyMs = normalizeFrequencyMs(Number(commentaryConfig.frequency));
+let enabled;
+let ollamaUrl;
+let model;
+let ollamaClient;
+let frequencyMs;
+let runner;
 
 const runtime = {
   timer: null,
@@ -234,73 +233,67 @@ const snapshotEngine = createSnapshotEngine({
   getSkipStreak: () => runtime.skipStreak,
 });
 
-const runner = createRunner({
-  logger,
-  enabled,
-  model,
-  ollamaUrl,
-  frequencyMs,
-  jitterMs: JITTER_MS,
-  postCooldownMs: POST_COOLDOWN_MS,
-  maxBotMessages: MAX_BOT_MESSAGES,
-  runtime,
-  snapshotEngine,
-  readSystemPrompt,
-  buildModelMessages,
-  generateCommentary,
-  normalizeDuplicateKey,
-  getRecentMessages,
-  sendSystemMessage,
-  buildFailureInfo,
-  updatePhase,
-  startRunRecord,
-  patchCurrentRun,
-  finalizeRunRecord,
-  updateStatus,
-});
-
-const canRunFromConfig = enabled && model && ollamaUrl;
-
-if (canRunFromConfig) {
-  registerHooks({
-    io,
-    roleEvents,
-    roverManager,
-    emitStatusToSocket,
-    isAdminSocket,
-    clearRuntimeHistory: runner.clearRuntimeHistory,
-    getAdminState: () => buildAdminState(status, runtime.runHistory),
-    onDriverActivity: runner.wakeForDriverActivity,
-    onSensorEvent: snapshotEngine.onSensorEvent,
-    onRoverRemoved: snapshotEngine.removeRover,
+function applyCommentaryConfig(commentaryConfig = {}) {
+  runner?.stop('configuration changed');
+  enabled = Boolean(commentaryConfig.enabled);
+  ollamaUrl = String(commentaryConfig.ollamaServer || '').trim();
+  model = String(commentaryConfig.model || '').trim();
+  ollamaClient = ollamaUrl ? new Ollama({ host: ollamaUrl }) : null;
+  frequencyMs = normalizeFrequencyMs(Number(commentaryConfig.frequency));
+  status = { ...status, enabled, model, ollamaUrl, frequencyMs };
+  runner = createRunner({
+    logger,
+    enabled,
+    model,
+    ollamaUrl,
+    frequencyMs,
+    jitterMs: JITTER_MS,
+    postCooldownMs: POST_COOLDOWN_MS,
+    maxBotMessages: MAX_BOT_MESSAGES,
+    runtime,
+    snapshotEngine,
+    readSystemPrompt,
+    buildModelMessages,
+    generateCommentary,
+    normalizeDuplicateKey,
+    getRecentMessages,
+    sendSystemMessage,
+    buildFailureInfo,
+    updatePhase,
+    startRunRecord,
+    patchCurrentRun,
+    finalizeRunRecord,
+    updateStatus,
   });
-
-  const mode = getMode();
-  if (mode === MODES.LOCKDOWN) {
+  if (getMode() === MODES.LOCKDOWN) {
     runner.stop('paused during lockdown');
-    logger.info('LLM commentary paused due to lockdown mode');
   } else {
     runner.start();
   }
-
-  modeEvents.on('change', (nextMode) => {
-    if (nextMode === MODES.LOCKDOWN) {
-      runner.stop('paused during lockdown');
-      logger.info('LLM commentary paused due to lockdown mode');
-      return;
-    }
-    runner.start();
-  });
-} else {
-  const disabledReason = !enabled
-    ? 'llmCommentary.enabled is false'
-    : 'model or ollama server missing';
-  updatePhase('disabled', {
-    running: false,
-    inFlight: false,
-    currentRunId: null,
-    lastOutcome: 'disabled',
-    lastReason: disabledReason,
-  });
-  logger.info('LLM commentary service not started', { reason: disabledReason });
 }
+
+applyCommentaryConfig(loadConfig().llmCommentary || {});
+
+// Runtime hooks stay attached once and route actions through the newest runner.
+registerHooks({
+  io,
+  roleEvents,
+  roverManager,
+  emitStatusToSocket,
+  isAdminSocket,
+  clearRuntimeHistory: (...args) => runner.clearRuntimeHistory(...args),
+  getAdminState: () => buildAdminState(status, runtime.runHistory),
+  onDriverActivity: (...args) => runner.wakeForDriverActivity(...args),
+  onSensorEvent: snapshotEngine.onSensorEvent,
+  onRoverRemoved: snapshotEngine.removeRover,
+});
+
+modeEvents.on('change', (nextMode) => {
+  if (nextMode === MODES.LOCKDOWN) {
+    runner.stop('paused during lockdown');
+    return;
+  }
+  runner.start();
+});
+
+registerConfigurationHandler('llmCommentary', applyCommentaryConfig);

server/src/services/llmCommentaryService/runner.js

@@ -26,12 +26,14 @@ function createRunner(deps) {
     finalizeRunRecord,
     updateStatus,
   } = deps;
+  let active = false;
 
   function defaultTickDelayMs() {
     return frequencyMs + Math.floor(Math.random() * (jitterMs + 1));
   }
 
   function scheduleNextTick(runTick, delayMs = defaultTickDelayMs()) {
+    if (!active) return;
     const safeDelay = Math.max(0, Number.isFinite(delayMs) ? Math.floor(delayMs) : defaultTickDelayMs());
     const nextRunAt = Date.now() + safeDelay;
     updateStatus({ nextRunAt });
@@ -39,6 +41,7 @@ function createRunner(deps) {
   }
 
   function wakeForDriverActivity(runTick) {
+    if (!active) return;
     if (runtime.inFlight) return;
     if (runtime.timer) {
       clearTimeout(runtime.timer);
@@ -48,6 +51,7 @@ function createRunner(deps) {
   }
 
   function stop(reason = 'stopped') {
+    active = false;
     if (runtime.timer) {
       clearTimeout(runtime.timer);
       runtime.timer = null;
@@ -335,6 +339,8 @@ function createRunner(deps) {
       });
       return;
     }
+    if (active) return;
+    active = true;
     logger.info('LLM commentary enabled', { model, ollamaUrl, frequencyMs });
     updatePhase('idle', {
       running: true,

server/src/services/mediaMtxService/config.js

@@ -20,19 +20,17 @@ function normalizeAdditionalHosts(rawHosts) {
 
 function buildMediaMtxConfig({ config, serverPort, snapshotWriterPath }) {
   const media = config?.media || {};
-  let additionalHosts = normalizeAdditionalHosts(media.additionalHosts);
-  if (!additionalHosts.length && media.whepBaseUrl) {
-    try {
-      /*
-        Existing installations predate media.additionalHosts. Using the already-configured
-        WHEP hostname as a one-host migration default keeps them reachable on first restart;
-        administrators can still list every public and LAN candidate explicitly afterward.
-      */
-      additionalHosts = [new URL(media.whepBaseUrl).hostname].filter(Boolean);
-    } catch {
-      throw new Error('media.whepBaseUrl must be a valid URL when media.additionalHosts is empty');
-    }
+  const configuredHosts = normalizeAdditionalHosts(media.additionalHosts);
+  let publicHostname = '';
+  try {
+    publicHostname = new URL(config?.publicUrl).hostname;
+  } catch {
+    // The assembled configuration schema normally prevents this. Keeping the
+    // builder tolerant makes its pure tests and startup error path explicit.
   }
+  // The canonical public hostname is always advertised once. Operators only
+  // maintain genuinely additional LAN names, aliases, or fixed IP addresses.
+  const additionalHosts = [...new Set([publicHostname, ...configuredHosts].filter(Boolean))];
   const authPort = Number(serverPort) || 8080;
 
   return {
@@ -56,6 +54,9 @@ function buildMediaMtxConfig({ config, serverPort, snapshotWriterPath }) {
     hls: false,
 
     webrtc: true,
+    // WHEP and WHIP signaling is public only through the Node /video proxy.
+    // ICE transport on 8189 remains directly reachable by browsers.
+    webrtcAddress: '127.0.0.1:8889',
     webrtcLocalUDPAddress: ':8189',
     webrtcLocalTCPAddress: ':8189',
     webrtcAdditionalHosts: additionalHosts,

server/src/services/mediaMtxService/config.test.js

@@ -8,8 +8,8 @@ const { buildMediaMtxConfig, normalizeAdditionalHosts } = require('./config');
 test('generates RTSP over TCP without deployment-specific hardcodes', () => {
   const generated = buildMediaMtxConfig({
     config: {
+      publicUrl: 'https://public.example.com',
       media: {
-        whepBaseUrl: 'http://media.internal:8889/video',
         additionalHosts: ['public.example.com', '10.20.30.40'],
       },
     },
@@ -23,12 +23,13 @@ test('generates RTSP over TCP without deployment-specific hardcodes', () => {
   assert.equal(Object.hasOwn(generated, 'rtpAddress'), false);
   assert.equal(Object.hasOwn(generated, 'rtcpAddress'), false);
   assert.deepEqual(generated.webrtcAdditionalHosts, ['public.example.com', '10.20.30.40']);
+  assert.equal(generated.webrtcAddress, '127.0.0.1:8889');
   assert.equal(generated.authHTTPAddress, 'http://127.0.0.1:8123/mediamtx/auth');
 });
 
-test('uses the configured WHEP hostname while an older config has no additionalHosts', () => {
+test('derives the primary ICE hostname from the canonical public URL', () => {
   const generated = buildMediaMtxConfig({
-    config: { media: { whepBaseUrl: 'https://second-server.example/video' } },
+    config: { publicUrl: 'https://second-server.example', media: { additionalHosts: [] } },
     serverPort: 8080,
     snapshotWriterPath: '/usr/local/bin/rover-snapshot-writer.sh',
   });

server/src/services/mediaMtxService/configuration.js

@@ -1,22 +1,18 @@
 // Media Transport Configuration
-// Purpose: Defines browser WHEP addressing and additional MediaMTX ICE hosts.
+// Purpose: Defines additional MediaMTX ICE hosts not already derived from the server's public URL.
 // Scope: Contains configuration metadata only and never starts MediaMTX.
-const { strictObject, string, stringArray } = require('../../configuration/schemaHelpers');
+const { strictObject, stringArray } = require('../../configuration/schemaHelpers');
 
 module.exports = {
   key: 'media',
   defaultValue: {
-    // Signaling remains server-local because the internal `/video` proxy owns
-    // browser access; only ICE transport addresses come from the legacy sample.
-    whepBaseUrl: 'http://127.0.0.1:8889/video',
-    additionalHosts: ['rover.example.com', 'media-server.local'],
+    additionalHosts: [],
   },
   schema: strictObject({
-    whepBaseUrl: string({ title: 'WHEP base URL', description: 'Base HTTP URL used to build browser WHEP playback and WHIP audio-publishing endpoints.', format: 'uri', maxLength: 2048 }),
     additionalHosts: stringArray({
       title: 'Additional ICE hosts',
       item: { description: 'Hostname or IP address MediaMTX advertises as a WebRTC ICE candidate.', examples: ['rover.example.com', 'media-server.local'], minLength: 1, maxLength: 255 },
-      array: { description: 'Additional public or LAN hostnames and addresses browsers may use to reach MediaMTX WebRTC transport.', uniqueItems: true },
+      array: { description: 'Extra public or LAN hostnames and addresses browsers may use in addition to the hostname derived from the top-level public URL.', uniqueItems: true },
     }),
-  }, { title: 'Media', description: 'Controls browser signaling addresses and WebRTC network candidates generated for the managed MediaMTX process.', required: ['whepBaseUrl', 'additionalHosts'] }),
+  }, { title: 'Media', description: 'Adds optional WebRTC network candidates to the public hostname and local interfaces generated automatically for MediaMTX.', required: ['additionalHosts'] }),
 };

server/src/services/mediaMtxService/index.js

@@ -1,21 +1,43 @@
 // MediaMTX Service
 // Purpose: Composes server configuration, runtime paths, and child-process supervision.
 // Scope: Starts MediaMTX only after the HTTP auth endpoint is listening and stops it with the server.
-const { loadConfig } = require('../../configuration');
+const { loadConfig, registerConfigurationHandler } = require('../../configuration');
 const globalConfig = require('../../globals/config');
 const logger = require('../../globals/logger').child('mediamtx');
 const { createMediaMtxSupervisor } = require('./supervisor');
 
-const supervisor = createMediaMtxSupervisor({
-  config: loadConfig(),
-  serverPort: globalConfig.port,
-  logger,
-});
+let supervisor = createSupervisor();
+let started = false;
+
+function createSupervisor() {
+  return createMediaMtxSupervisor({
+    config: loadConfig(),
+    serverPort: globalConfig.port,
+    logger,
+  });
+}
 
 function startMediaMtx() {
+  started = true;
   return supervisor.start();
 }
 
+function stopSupervisor() {
+  return new Promise((resolve) => supervisor.stop(resolve));
+}
+
+async function reloadMediaMtx() {
+  // MediaMTX consumes a generated document rather than the Node configuration
+  // object directly. Replace its child process when either explicit media
+  // hosts or the canonical public hostname changes.
+  await stopSupervisor();
+  supervisor = createSupervisor();
+  if (started) supervisor.start();
+}
+
+registerConfigurationHandler('media', reloadMediaMtx);
+registerConfigurationHandler('publicUrl', reloadMediaMtx);
+
 /*
   Other services already use process signal hooks for their own workers. This hook performs
   only synchronous signal delivery; systemd's default control-group cleanup remains the final

server/src/services/mediaMtxService/proxy.js

@@ -0,0 +1,69 @@
+// MediaMTX HTTP Proxy
+// Purpose: Exposes WHEP and WHIP signaling beneath the server-owned /video path while MediaMTX remains loopback-only.
+// Scope: Proxies signaling HTTP only; WebRTC media continues to travel directly through MediaMTX's ICE listener.
+const { createProxyMiddleware } = require('http-proxy-middleware');
+
+const PUBLIC_MEDIA_PREFIX = '/video';
+const INTERNAL_WEBRTC_ORIGIN = 'http://127.0.0.1:8889';
+const SIGNALING_TIMEOUT_MS = 60 * 60 * 1000;
+
+function rewriteSessionLocation(location, internalOrigin = INTERNAL_WEBRTC_ORIGIN) {
+  const value = String(location || '');
+  if (!value) return value;
+
+  /*
+    MediaMTX normally returns a root-relative WHEP/WHIP session URL. Browsers
+    subsequently PATCH and DELETE that exact Location, so restore the public
+    mount prefix that was removed before proxying the initial request.
+  */
+  if (value.startsWith('/') && !value.startsWith(`${PUBLIC_MEDIA_PREFIX}/`)) {
+    return `${PUBLIC_MEDIA_PREFIX}${value}`;
+  }
+
+  try {
+    const parsed = new URL(value);
+    if (parsed.origin === new URL(internalOrigin).origin) {
+      return `${PUBLIC_MEDIA_PREFIX}${parsed.pathname}${parsed.search}${parsed.hash}`;
+    }
+  } catch {
+    // A path relative to the WHEP/WHIP endpoint already resolves beneath
+    // /video in the browser and must not be converted into a root path.
+  }
+  return value;
+}
+
+function createMediaMtxProxy({ target = INTERNAL_WEBRTC_ORIGIN, logger = console } = {}) {
+  return createProxyMiddleware({
+    target,
+    changeOrigin: true,
+    proxyTimeout: SIGNALING_TIMEOUT_MS,
+    timeout: SIGNALING_TIMEOUT_MS,
+    logger,
+    on: {
+      proxyRes(proxyResponse) {
+        const location = proxyResponse.headers.location;
+        if (location) proxyResponse.headers.location = rewriteSessionLocation(location, target);
+      },
+      error(error, request, response) {
+        logger.warn?.('MediaMTX signaling proxy failed', {
+          method: request.method,
+          path: request.originalUrl || request.url,
+          error: error.message,
+        });
+        if (response.headersSent) {
+          response.destroy(error);
+          return;
+        }
+        response.writeHead(502, { 'Content-Type': 'text/plain; charset=utf-8', 'Cache-Control': 'no-store' });
+        response.end('Media signaling is temporarily unavailable.');
+      },
+    },
+  });
+}
+
+module.exports = {
+  INTERNAL_WEBRTC_ORIGIN,
+  PUBLIC_MEDIA_PREFIX,
+  createMediaMtxProxy,
+  rewriteSessionLocation,
+};

server/src/services/mediaMtxService/proxy.test.js

@@ -0,0 +1,90 @@
+// MediaMTX HTTP Proxy Tests
+// Purpose: Verifies streaming WHEP/WHIP method, body, header, path, and session-location behavior.
+// Scope: Uses ephemeral loopback HTTP servers and always closes them; it never starts MediaMTX or the application server.
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const http = require('http');
+const express = require('express');
+const { PUBLIC_MEDIA_PREFIX, createMediaMtxProxy, rewriteSessionLocation } = require('./proxy');
+
+function listen(server) {
+  return new Promise((resolve, reject) => {
+    server.once('error', reject);
+    server.listen(0, '127.0.0.1', () => resolve(server.address().port));
+  });
+}
+
+function close(server) {
+  return new Promise((resolve, reject) => server.close((error) => (error ? reject(error) : resolve())));
+}
+
+test('streams WHEP session requests and keeps follow-up locations beneath /video', async () => {
+  const received = [];
+  const mediaMtx = http.createServer((request, response) => {
+    const chunks = [];
+    request.on('data', (chunk) => chunks.push(chunk));
+    request.on('end', () => {
+      received.push({
+        method: request.method,
+        path: request.url,
+        authorization: request.headers.authorization,
+        contentType: request.headers['content-type'],
+        body: Buffer.concat(chunks).toString('utf8'),
+      });
+      response.writeHead(201, {
+        'Content-Type': 'application/sdp',
+        Location: '/rover-one/whep/session-id',
+      });
+      response.end('answer');
+    });
+  });
+  const mediaPort = await listen(mediaMtx);
+
+  const app = express();
+  const silentLogger = { info() {}, warn() {}, error() {} };
+  app.use(PUBLIC_MEDIA_PREFIX, createMediaMtxProxy({
+    target: `http://127.0.0.1:${mediaPort}`,
+    logger: silentLogger,
+  }));
+  // If the proxy accidentally falls through, this parser would consume the
+  // request and make the integration failure explicit instead of timing out.
+  app.use(express.json());
+  const nodeServer = http.createServer(app);
+  const nodePort = await listen(nodeServer);
+
+  try {
+    const requests = [
+      { method: 'POST', path: '/video/rover-one/whep', type: 'application/sdp', body: 'v=0\r\no=offer' },
+      { method: 'PATCH', path: '/video/rover-one/whep/session-id', type: 'application/trickle-ice-sdpfrag', body: 'a=candidate' },
+      { method: 'DELETE', path: '/video/rover-one/whep/session-id', type: 'application/trickle-ice-sdpfrag', body: '' },
+    ];
+    for (const request of requests) {
+      const response = await fetch(`http://127.0.0.1:${nodePort}${request.path}`, {
+        method: request.method,
+        headers: { Authorization: 'Bearer session-token', 'Content-Type': request.type },
+        body: request.method === 'DELETE' ? undefined : request.body,
+      });
+      assert.equal(response.status, 201);
+      assert.equal(response.headers.get('location'), '/video/rover-one/whep/session-id');
+      assert.equal(await response.text(), 'answer');
+    }
+
+    assert.deepEqual(received, requests.map((request) => ({
+      method: request.method,
+      path: request.path.slice('/video'.length),
+      authorization: 'Bearer session-token',
+      contentType: request.type,
+      body: request.body,
+    })));
+  } finally {
+    await close(nodeServer);
+    await close(mediaMtx);
+  }
+});
+
+test('rewrites only root-relative or internal absolute MediaMTX locations', () => {
+  assert.equal(rewriteSessionLocation('/camera/whep/id'), '/video/camera/whep/id');
+  assert.equal(rewriteSessionLocation('http://127.0.0.1:8889/camera/whep/id?one=two'), '/video/camera/whep/id?one=two');
+  assert.equal(rewriteSessionLocation('whep/id'), 'whep/id');
+  assert.equal(rewriteSessionLocation('https://example.com/camera/whep/id'), 'https://example.com/camera/whep/id');
+});

server/src/services/mediaMtxService/supervisor.js

@@ -39,6 +39,9 @@ function createMediaMtxSupervisor(deps) {
 
   function start() {
     if (child) return child;
+    // `stop()` marks the old lifecycle as intentional. Reset that marker when
+    // the same supervisor is started again so later crashes remain fatal.
+    stopping = false;
 
     const generatedConfig = buildMediaMtxConfig({ config, serverPort, snapshotWriterPath });
     /*

server/src/services/mediaMtxService/supervisor.test.js

@@ -37,7 +37,7 @@ test('passes the resolved data root to MediaMTX runOnReady hooks', () => {
 
   try {
     const supervisor = createMediaMtxSupervisor({
-      config: { media: { additionalHosts: ['media.example.test'] } },
+      config: { publicUrl: 'https://public.example.test', media: { additionalHosts: ['media.example.test'] } },
       serverPort: 8080,
       logger,
       mediaMtxBin: '/test/bin/mediamtx',

server/src/services/neatoService/configuration.js

@@ -10,7 +10,7 @@ module.exports = {
   // ESPHome naming shape while `enabled: false` prevents accidental control.
   defaultValue: { enabled: false, device: 'neato_vacuum' },
   schema: strictObject({
-    enabled: boolean({ description: 'Exposes Neato status and commands through the configured Home Assistant ESPHome device after restart.' }),
+    enabled: boolean({ description: 'Immediately exposes Neato status and commands through the configured Home Assistant ESPHome device.' }),
     device: string({ description: 'ESPHome device name used to derive the Neato entity IDs in Home Assistant; punctuation is normalized to underscores.', examples: ['neato_vacuum'], maxLength: 255 }),
   }, {
     title: 'Neato',

server/src/services/neatoService/index.js

@@ -4,24 +4,16 @@
 const EventEmitter = require('events');
 const io = require('../../globals/io');
 const logger = require('../../globals/logger').child('neatoService');
-const { loadConfig } = require('../../configuration');
+const { loadConfig, registerConfigurationHandler } = require('../../configuration');
 const { isVerified } = require('../verificationService');
 const { getMode, MODES } = require('../modeManager');
 const { isAdmin, isLockdownAdmin } = require('../roleService');
 const { sendAlert } = require('../alertService');
-const {
-  homeAssistantEvents,
-  getRawEntitySnapshot,
-  callHomeAssistantService,
-  isConnected: isHomeAssistantConnected,
-  enabled: homeAssistantEnabled,
-} = require('../homeAssistantService');
+const homeAssistantService = require('../homeAssistantService');
+const { homeAssistantEvents, getRawEntitySnapshot, callHomeAssistantService } = homeAssistantService;
 
 const events = new EventEmitter();
-const config = loadConfig();
-const haConfig = config.homeAssistant || {};
-const neatoConfig = haConfig.neato || {};
-const featureEnabled = Boolean(neatoConfig.enabled);
+let featureEnabled;
 
 function normalizeDeviceName(value) {
   const raw = String(value || '').trim().toLowerCase();
@@ -29,7 +21,7 @@ function normalizeDeviceName(value) {
   return raw.replace(/[^a-z0-9_]+/g, '_').replace(/^_+|_+$/g, '');
 }
 
-const device = normalizeDeviceName(neatoConfig.device);
+let device;
 const RESUME_DELAY_MS = 3000;
 const ALERT_COLOR = '#a855f7';
 // BrainSlug exposes these exact select values for Gen 3 robots. Keeping the
@@ -42,7 +34,11 @@ function entityId(domain, suffix) {
   return `${domain}.${device}_${suffix}`;
 }
 
-const ENTITY_IDS = {
+let ENTITY_IDS;
+let ALERT_ENTITIES;
+
+function buildEntityIds() {
+  return {
   buttons: {
     start: entityId('button', 'house_clean'),
     resume: entityId('button', 'resume_cleaning'),
@@ -69,18 +65,26 @@ const ENTITY_IDS = {
   selects: {
     navigationMode: entityId('select', 'navigation_mode'),
   },
-};
+  };
+}
 
 // Alert Feed coverage is intentionally limited to the raw robot lifecycle and
 // issue fields requested for Neato. Battery and charger telemetry poll often and
 // would create noise without representing a useful robot status transition.
-const ALERT_ENTITIES = Object.freeze([
-  { title: 'Neato UI state', entityId: ENTITY_IDS.textSensors.uiState },
-  { title: 'Neato robot state', entityId: ENTITY_IDS.textSensors.robotState },
-  { title: 'Neato robot alert', entityId: ENTITY_IDS.textSensors.robotAlert },
-  { title: 'Neato robot error', entityId: ENTITY_IDS.textSensors.robotError },
-  { title: 'Neato external power', entityId: ENTITY_IDS.binarySensors.extPowerPresent },
-]);
+function applyNeatoConfig(neatoConfig = {}) {
+  featureEnabled = Boolean(neatoConfig.enabled);
+  device = normalizeDeviceName(neatoConfig.device);
+  ENTITY_IDS = buildEntityIds();
+  ALERT_ENTITIES = [
+    { title: 'Neato UI state', entityId: ENTITY_IDS.textSensors.uiState },
+    { title: 'Neato robot state', entityId: ENTITY_IDS.textSensors.robotState },
+    { title: 'Neato robot alert', entityId: ENTITY_IDS.textSensors.robotAlert },
+    { title: 'Neato robot error', entityId: ENTITY_IDS.textSensors.robotError },
+    { title: 'Neato external power', entityId: ENTITY_IDS.binarySensors.extPowerPresent },
+  ];
+}
+
+applyNeatoConfig(loadConfig().homeAssistant?.neato || {});
 
 // Each entity establishes its own baseline because ESPHome entities can become
 // available on different snapshots. A Map also distinguishes "not observed yet"
@@ -165,7 +169,9 @@ function requiredEntityIds() {
 
 function buildState() {
   const configured = Boolean(device);
-  const haConnected = isHomeAssistantConnected();
+  // Home Assistant may have replaced its transport since this service module
+  // loaded, so readiness must be resolved from the live service object.
+  const haConnected = homeAssistantService.isConnected();
   const requiredIds = requiredEntityIds();
   const entitiesAvailable = requiredIds.length > 0 && requiredIds.every((id) => isEntityAvailable(id));
   const connected = Boolean(haConnected && entitiesAvailable);
@@ -249,21 +255,14 @@ function emitUpdate() {
   }
 }
 
-if (featureEnabled) {
-  /*
-    Neato telemetry is derived from Home Assistant entities. Disabled installs
-    should keep the exported API inert instead of tracking HA snapshots for a
-    robot vacuum feature that does not exist on that server.
-  */
-  homeAssistantEvents.on('snapshot', () => {
+homeAssistantEvents.on('snapshot', () => {
+  if (featureEnabled) {
     emitUpdate();
     emitRawStateAlerts();
-  });
+  }
+});
 
-  homeAssistantEvents.on('status', () => {
-    emitUpdate();
-  });
-}
+homeAssistantEvents.on('status', emitUpdate);
 
 function assertConfiguredAndConnected() {
   if (!featureEnabled) {
@@ -272,10 +271,10 @@ function assertConfiguredAndConnected() {
   if (!device) {
     throw new Error('Neato not configured');
   }
-  if (!homeAssistantEnabled) {
+  if (!homeAssistantService.enabled) {
     throw new Error('Home Assistant not configured');
   }
-  if (!isHomeAssistantConnected()) {
+  if (!homeAssistantService.isConnected()) {
     throw new Error('Home Assistant not connected');
   }
 }
@@ -349,8 +348,7 @@ function hasVerifiedSockets() {
   return false;
 }
 
-if (featureEnabled) {
-  io.on('connection', (socket) => {
+io.on('connection', (socket) => {
   function assertFeatureAccess() {
     const mode = getMode();
     // Neato shares the same public-activity policy as lift: everyone may use
@@ -420,11 +418,18 @@ if (featureEnabled) {
       cb({ error: err.message });
     }
   });
-  });
-} else {
+});
+
+if (!featureEnabled) {
   logger.info('Neato disabled by config');
 }
 
+registerConfigurationHandler('homeAssistant', (haConfig = {}) => {
+  applyNeatoConfig(haConfig.neato || {});
+  alertBaselines.clear();
+  emitUpdate();
+});
+
 emitUpdate();
 
 module.exports = {

server/src/services/operatorCommandService/webTransport.js

@@ -11,7 +11,7 @@ function formatTimeInZone(date, timeZone) {
   }
 }
 
-function createWebTransportHandlers({ rovers, roverManager, config, siteUrl = '' }) {
+function createWebTransportHandlers({ rovers, roverManager, config, publicUrl = '' }) {
   return {
     async status(message, roverId) {
       const resolved = roverId ? resolveRoverSelector(roverId, rovers) : null;
@@ -59,7 +59,7 @@ function createWebTransportHandlers({ rovers, roverManager, config, siteUrl = ''
       if (!zones.some(([, zone]) => zone.toLowerCase() === String(serverTimezone).toLowerCase())) {
         lines.push(`Server Local — ${formatTimeInZone(now, serverTimezone)} **(server local timezone)**`);
       }
-      const siteLink = siteUrl ? `\n\n${siteUrl}` : '';
+      const siteLink = publicUrl ? `\n\n${publicUrl}` : '';
       return message.reply(`Time Status\n${lines.join('\n')}${siteLink}\n\nServer local timezone: ${serverTimezone}`);
     },
   };

server/src/services/overseerControlService/index.js

@@ -2,7 +2,7 @@ const fsp = require('fs/promises');
 const { Ollama } = require('ollama');
 const io = require('../../globals/io');
 const logger = require('../../globals/logger').child('overseerControl');
-const { loadConfig } = require('../../configuration');
+const { loadConfig, registerConfigurationHandler } = require('../../configuration');
 const { getRole, roleEvents } = require('../roleService');
 const { getMode, MODES, modeEvents } = require('../modeManager');
 const { verificationEvents } = require('../verificationService');
@@ -31,26 +31,24 @@ const { toStateUpdate, buildToolState, buildConversation, buildModelMessages } =
 const { buildOllamaTools, executeToolAction } = require('./tools');
 const { loadMemory, saveMemory, createDefaultMemory, summarizeMemory } = require('./memoryStore');
 
-const config = loadConfig();
-const overseerConfig = config.overseerControl || {};
 const RUN_MODE_AUTONOMOUS = 'autonomous';
 const RUN_MODE_DIRECT_ADDRESS = 'directAddress';
 const RUN_MODES = new Set([RUN_MODE_AUTONOMOUS, RUN_MODE_DIRECT_ADDRESS]);
-const enabled = Boolean(overseerConfig.enabled);
-const observeOnly = overseerConfig.observeOnly !== false;
-const name = String(overseerConfig.name || DEFAULT_NAME).trim() || DEFAULT_NAME;
-const configuredRunMode = String(overseerConfig.mode || RUN_MODE_AUTONOMOUS).trim();
-const runMode = RUN_MODES.has(configuredRunMode) ? configuredRunMode : RUN_MODE_AUTONOMOUS;
-const autonomousMode = runMode === RUN_MODE_AUTONOMOUS;
-const directAddressMode = runMode === RUN_MODE_DIRECT_ADDRESS;
-const model = String(overseerConfig.model || '').trim();
-const ollamaUrl = String(overseerConfig.ollamaServer || '').trim();
-const gateIntervalMs = normalizeMs(Number(overseerConfig.gateIntervalMs), DEFAULT_GATE_INTERVAL_MS);
-const postToolsOnlyMessages = Boolean(overseerConfig.postToolsOnlyMessages);
-const tiebreakerEnable = Boolean(overseerConfig.tiebreakerEnable);
-const runWhileNoPeopleOnline = Boolean(overseerConfig.runWhileNoPeopleOnline);
-const profileImageUrl = String(overseerConfig.profileImageUrl || '').trim() || null;
-const ollamaClient = ollamaUrl ? new Ollama({ host: ollamaUrl }) : null;
+let enabled;
+let observeOnly;
+let name;
+let runMode;
+let autonomousMode;
+let directAddressMode;
+let model;
+let ollamaUrl;
+let gateIntervalMs;
+let postToolsOnlyMessages;
+let tiebreakerEnable;
+let runWhileNoPeopleOnline;
+let profileImageUrl;
+let ollamaClient;
+let normalizedConfiguredName;
 
 function normalizeNameMentionText(value) {
   return String(value || '')
@@ -63,7 +61,26 @@ function normalizeNameMentionText(value) {
     .replace(/\s+/g, ' ');
 }
 
-const normalizedConfiguredName = normalizeNameMentionText(name);
+function applyOverseerConfig(overseerConfig = {}) {
+  enabled = Boolean(overseerConfig.enabled);
+  observeOnly = overseerConfig.observeOnly !== false;
+  name = String(overseerConfig.name || DEFAULT_NAME).trim() || DEFAULT_NAME;
+  const configuredRunMode = String(overseerConfig.mode || RUN_MODE_AUTONOMOUS).trim();
+  runMode = RUN_MODES.has(configuredRunMode) ? configuredRunMode : RUN_MODE_AUTONOMOUS;
+  autonomousMode = runMode === RUN_MODE_AUTONOMOUS;
+  directAddressMode = runMode === RUN_MODE_DIRECT_ADDRESS;
+  model = String(overseerConfig.model || '').trim();
+  ollamaUrl = String(overseerConfig.ollamaServer || '').trim();
+  gateIntervalMs = normalizeMs(Number(overseerConfig.gateIntervalMs), DEFAULT_GATE_INTERVAL_MS);
+  postToolsOnlyMessages = Boolean(overseerConfig.postToolsOnlyMessages);
+  tiebreakerEnable = Boolean(overseerConfig.tiebreakerEnable);
+  runWhileNoPeopleOnline = Boolean(overseerConfig.runWhileNoPeopleOnline);
+  profileImageUrl = String(overseerConfig.profileImageUrl || '').trim() || null;
+  ollamaClient = ollamaUrl ? new Ollama({ host: ollamaUrl }) : null;
+  normalizedConfiguredName = normalizeNameMentionText(name);
+}
+
+applyOverseerConfig(loadConfig().overseerControl || {});
 
 const runtime = {
   timer: null,
@@ -797,6 +814,27 @@ modeEvents.on('change', (mode) => {
   evaluateSchedulerGate(observeOnly ? 'observe-only mode' : null);
 });
 
+registerConfigurationHandler('overseerControl', (overseerConfig = {}) => {
+  // All scheduler and model parameters are one runtime unit. Cancel the old
+  // cadence, replace them atomically, and let the normal vote/mode gate decide
+  // whether the newly configured scheduler should run.
+  stopScheduler('configuration changed');
+  applyOverseerConfig(overseerConfig);
+  updateStatus({
+    enabled,
+    runMode,
+    observeOnly,
+    name,
+    model,
+    ollamaUrl,
+    gateIntervalMs,
+    postToolsOnlyMessages,
+    tiebreakerEnable,
+    runWhileNoPeopleOnline,
+  });
+  evaluateSchedulerGate('configuration changed');
+});
+
 if (!enabled) {
   logger.info('overseerControl disabled');
   updateStatus({ running: false, lastReason: 'overseerControl.enabled is false' });

server/src/services/ptzCameraService/configuration.js

@@ -21,7 +21,7 @@ module.exports = {
     replayEnabled: false,
   },
   schema: strictObject({
-    enabled: boolean({ description: 'Connects to the configured ONVIF camera and exposes its controls after restart.' }),
+    enabled: boolean({ description: 'Immediately connects to the configured ONVIF camera and exposes its controls.' }),
     name: string({ description: 'Human-readable camera name shown in the control interface.', minLength: 1, maxLength: 120 }),
     color: string({ description: 'Six-digit hexadecimal accent color used to identify this camera in the UI.', pattern: '^#[0-9a-fA-F]{6}$' }),
     host: string({ description: 'Hostname or IP address of the ONVIF camera.', examples: ['192.168.0.8'], maxLength: 255 }),

server/src/services/ptzCameraService/index.js

@@ -9,7 +9,7 @@ const { Cam } = require('onvif');
 
 const io = require('../../globals/io');
 const logger = require('../../globals/logger').child('ptzCamera');
-const { loadConfig } = require('../../configuration');
+const { loadConfig, registerConfigurationHandler } = require('../../configuration');
 const { resolveRoverSnapshotDir } = require('../../helpers/dataPaths');
 const {
   shouldUseSnapshotsForNonTurnVideo,
@@ -51,9 +51,8 @@ const PUBLISHER_STDERR_SYNC_MS = 10000;
 const PUBLISHER_RTSP_TIMEOUT_US = 10000000;
 
 const events = new EventEmitter();
-const config = loadConfig();
-const cameraConfig = config.ptzCamera || {};
-const enabled = Boolean(cameraConfig.enabled);
+let cameraConfig = loadConfig().ptzCamera || {};
+let enabled = Boolean(cameraConfig.enabled);
 
 const state = {
   initialized: false,
@@ -114,7 +113,7 @@ let lastSnapshotState = null;
 const snapshotSubscribers = new Map();
 const socketSnapshotSubscriptions = new Map();
 const snapshotLastSentBySocket = new Map();
-const audioPlayback = createPtzAudioPlayback({
+let audioPlayback = createPtzAudioPlayback({
   logger,
   cameraConfig,
   enabled,
@@ -1831,6 +1830,44 @@ if (enabled) {
   initialize();
 }
 
+function stopCameraRuntime() {
+  // Disable restart-producing callbacks before terminating the publisher. The
+  // old ffmpeg exit event can then observe `enabled === false` and will not
+  // resurrect a process built from the previous camera configuration.
+  enabled = false;
+  revokeOperator('configuration-change');
+  state.queue = [];
+  stopPublisher();
+  audioPlayback.stopActivePlayback('configuration-change');
+  if (snapshotTimer) {
+    clearInterval(snapshotTimer);
+    snapshotTimer = null;
+  }
+  if (spotlightVerifyTimer) {
+    clearTimeout(spotlightVerifyTimer);
+    spotlightVerifyTimer = null;
+  }
+  clearMotionWatchdog();
+  clearPanTiltRenewal();
+  clearZoomRepeat();
+  onvifCam = null;
+  state.initialized = false;
+  state.initializing = false;
+  state.rtspUri = null;
+  state.profileToken = DEFAULT_PROFILE_TOKEN;
+}
+
+registerConfigurationHandler('ptzCamera', (nextCameraConfig = {}) => {
+  stopCameraRuntime();
+  cameraConfig = nextCameraConfig;
+  enabled = Boolean(cameraConfig.enabled);
+  state.profileToken = String(cameraConfig.profileToken || DEFAULT_PROFILE_TOKEN);
+  state.error = null;
+  audioPlayback = createPtzAudioPlayback({ logger, cameraConfig, enabled, getSocketLabel });
+  emitChange('configuration-change');
+  if (enabled) initialize();
+});
+
 module.exports = {
   PTZ_CAMERA_ID,
   PTZ_STREAM_PATH,

server/src/services/roomCameraService/catalog.js

@@ -3,10 +3,8 @@
 // Scope: Owns camera identity/url normalization and read-only accessors for room camera metadata.
 const EventEmitter = require('events');
 const logger = require('../../globals/logger').child('roomCameraService');
-const { loadConfig } = require('../../configuration');
 
 const events = new EventEmitter();
-const config = loadConfig();
 const cameraMap = new Map();
 
 function normalizeCamera(camera) {
@@ -38,11 +36,11 @@ function getRoomCamera(id) {
   return cameraMap.get(String(id)) || null;
 }
 
-function loadFromConfig() {
+function loadFromConfig(roomCameraConfig = {}) {
   cameraMap.clear();
   // Schema validation guarantees the configured list shape. Keeping its
   // fallback local makes the camera catalog independent of feature projection.
-  const list = Array.isArray(config.roomCameras?.cameras) ? config.roomCameras.cameras : [];
+  const list = Array.isArray(roomCameraConfig.cameras) ? roomCameraConfig.cameras : [];
   list.forEach((camera) => {
     const normalized = normalizeCamera(camera);
     if (normalized) cameraMap.set(normalized.id, normalized);

server/src/services/roomCameraService/configuration.js

@@ -28,7 +28,7 @@ module.exports = {
     ],
   },
   schema: strictObject({
-    enabled: boolean({ description: 'Publishes the configured room-camera catalog and enables camera snapshots and streams after restart.' }),
+    enabled: boolean({ description: 'Immediately publishes the configured room-camera catalog and enables camera snapshots and streams.' }),
     cameras: {
       type: 'array',
       description: 'Room cameras available to the web UI and replay system.',

server/src/services/roomCameraService/index.js

@@ -5,34 +5,28 @@ const { loadFromConfig, getRoomCameras, getRoomCamera, roomCameraEvents } = requ
 const { createSnapshotEngine } = require('./snapshotEngine');
 const { registerRoomCameraSocketGateway } = require('./socketGateway');
 const replay = require('../replayEngineV2/roomCameraReplayBuilder');
-const { loadConfig } = require('../../configuration');
+const { loadConfig, registerConfigurationHandler } = require('../../configuration');
 
-const enabled = Boolean(loadConfig().roomCameras?.enabled);
+let enabled = false;
 
 const snapshotEngine = createSnapshotEngine({ getRoomCameras, roomCameraEvents });
-if (enabled) {
-  /*
-    Room cameras are optional local hardware/network devices. The service module
-    can still be imported by replay, health, and session code, but disabled
-    installs must not start polling LAN cameras in the background.
-  */
-  loadFromConfig();
-  snapshotEngine.startAll();
+function applyRoomCameraConfig(roomCameraConfig = {}) {
+  enabled = Boolean(roomCameraConfig.enabled);
+  // Loading an empty catalog on disable causes the snapshot engine's existing
+  // update listener to close every stream and timer without unregistering the
+  // stable browser gateway.
+  loadFromConfig(enabled ? roomCameraConfig : { cameras: [] });
 }
 
-if (enabled) {
-  /*
-    Camera frame sockets are part of the room-camera feature surface. Keeping
-    them behind the same gate prevents disabled features from being callable by
-    hand even though server/index.js still imports this module.
-  */
-  registerRoomCameraSocketGateway({
-    getRoomCamera,
-    getRoomCameras,
-    getRoomCameraState: snapshotEngine.getRoomCameraState,
-    roomCameraStreamEvents: snapshotEngine.roomCameraStreamEvents,
-  });
-}
+registerRoomCameraSocketGateway({
+  getRoomCamera,
+  getRoomCameras,
+  getRoomCameraState: snapshotEngine.getRoomCameraState,
+  roomCameraStreamEvents: snapshotEngine.roomCameraStreamEvents,
+});
+
+applyRoomCameraConfig(loadConfig().roomCameras || {});
+registerConfigurationHandler('roomCameras', applyRoomCameraConfig);
 
 function buildRoomCameraReplayVideo(options = {}) {
   return replay.buildRoomCameraReplayVideo(options, { getRoomCamera, getRoomCameras });

server/src/services/roomCameraService/snapshotEngine.js

@@ -74,7 +74,17 @@ function handleStreamError(camera, err) {
 }
 
 function createSnapshotEngine({ getRoomCameras, roomCameraEvents }) {
+  function isCurrentCamera(camera) {
+    return getRoomCameras().some((current) => (
+      current.id === camera.id && current.url === camera.url && current.streamUrl === camera.streamUrl
+    ));
+  }
+
   function startStream(camera) {
+    // Stream close/error events can arrive after a configuration reload. Verify
+    // identity and URL against the current catalog before allowing an old
+    // reconnect timer to recreate a retired camera connection.
+    if (!isCurrentCamera(camera)) return;
     const streamUrl = getStreamUrl(camera);
     if (!streamUrl || streamState.get(camera.id)?.req) return;
     const url = new URL(streamUrl);

server/src/services/roverManager/state.js

@@ -7,6 +7,12 @@ const rovers = new Map();
 const socketToRovers = new Map();
 const spectatorSockets = new Set();
 const managerEvents = new EventEmitter();
+/*
+  Service reload support requires optional consumers such as commentary to keep
+  one stable rover listener even while disabled. Preserve a finite ceiling so
+  accidental reload-time duplication still becomes visible.
+*/
+managerEvents.setMaxListeners(20);
 const backoffTimers = new Map();
 const dockGuardStates = new Map();
 const dockProtectionStrikeStates = new Map();

server/src/services/serverControlService/index.js

@@ -1,55 +1,63 @@
 // server Control Service
-// Purpose: Defines the server Control Service module and the helpers/state used by this service unit.
-// Scope: Keeps runtime behavior unchanged while isolating responsibilities into a clear module boundary.
-const { spawn } = require('child_process');
+// Purpose: Lets a lockdown administrator restart the Node application without rebooting or controlling the host.
+// Scope: Authorizes and announces one restart request; existing SIGTERM hooks own service and child-process cleanup.
 const io = require('../../globals/io');
 const logger = require('../../globals/logger').child('serverControlService');
-const { isAdmin } = require('../roleService');
-const { sendAlert } = require('../alertService');
+const { getConfigurationDatabase } = require('../../configuration');
+const { requireRecentPassword } = require('../adminConfigurationService');
 
-const ALERT_COLOR = '#ff5722';
-let rebootPending = false;
+const database = getConfigurationDatabase();
+let restartPending = false;
 
-function scheduleSystemReboot() {
-  if (rebootPending) {
-    throw new Error('Server reboot already pending');
-  }
-  rebootPending = true;
+function actorFor(socket) {
+  return socket?.data?.user?.username || socket.id;
+}
 
+function scheduleApplicationRestart() {
+  if (restartPending) throw new Error('Application restart already pending.');
+  restartPending = true;
+
+  /*
+    Socket acknowledgements are asynchronous network writes. This short delay
+    lets the response and restarting notification leave before SIGTERM invokes
+    the cleanup hooks already owned by the server's long-running services.
+  */
   setTimeout(() => {
-    logger.warn('Issuing system reboot command');
     try {
-      const child = spawn('systemctl', ['reboot'], {
-        detached: true,
-        stdio: 'ignore',
-      });
-      child.unref();
-    } catch (err) {
-      rebootPending = false;
-      logger.error('Server reboot command failed', err.message);
+      process.kill(process.pid, 'SIGTERM');
+    } catch (error) {
+      // If signaling fails, this process is still usable and must allow the
+      // administrator to try again instead of remaining permanently pending.
+      restartPending = false;
+      logger.error('Application restart signal failed', error.message);
     }
-  }, 400);
+  }, 250);
+}
+
+function requestApplicationRestart({ actor, reason = 'administrator-requested' }) {
+  if (restartPending) throw new Error('Application restart already pending.');
+  database.recordAuditEvent(actor, 'application.restart-requested', { reason });
+  scheduleApplicationRestart();
+  logger.warn('Application restart requested', { actor, reason });
+  // Restore and ordinary admin restarts share this one browser contract, so
+  // clients can explain the disconnect without knowing which control invoked it.
+  io.emit('server:restarting', { reason });
 }
 
 io.on('connection', (socket) => {
-  socket.on('server:reboot', (_, cb = () => {}) => {
-    if (!isAdmin(socket)) {
-      cb({ error: 'Not authorized' });
-      return;
-    }
+  socket.on('server:restartApplication', (_payload = {}, cb = () => {}) => {
     try {
-      scheduleSystemReboot();
-      const who = socket?.data?.user?.username || socket.id;
-      logger.warn('Server reboot requested', { by: who });
-      sendAlert({
-        color: ALERT_COLOR,
-        title: 'Server Reboot',
-        message: `Reboot requested by ${who}`,
-      });
+      requireRecentPassword(socket);
+      const actor = actorFor(socket);
+      requestApplicationRestart({ actor });
       cb({ success: true });
-    } catch (err) {
-      cb({ error: err.message });
+    } catch (error) {
+      cb({ error: error.message, code: error.code || null });
     }
   });
 });
 
+module.exports = {
+  isApplicationRestartPending: () => restartPending,
+  requestApplicationRestart,
+};