feat: enhance URL validation and email address parsing; refactor related components

- Increment schema version from 11 to 12.
- Modify ProxyResolver to use ICCID for device proxy binding resolution.
- Update tests to reflect changes in proxy binding logic using ICCID.
- Enhance DeviceBindingsDialog to manage eSIM profile bindings instead of device bindings.
- Update UI components and translations to reflect the new profile binding terminology.
- Implement pagination for automatic task runs in AutomaticTasksPage.
- Create a new Pagination component for better navigation in lists.

.env.example

@@ -0,0 +1,6 @@
+# Copy this file to .env and fill in real values before `docker compose up -d`.
+# .env is gitignored; .env.example is tracked as a template.
+
+# Admin password for the web UI. REQUIRED — the server refuses to start safely
+# without it once exposed. Pick a strong password.
+VOCAT_ADMIN_PASSWORD=change-me-to-a-strong-password

.gitignore

@@ -15,6 +15,9 @@
 vc.jar
 *.cookies
 *.session
+.env
+.env.*
+!.env.example
 
 # ---- Frontend build products ----
 web/dist/

Dockerfile

@@ -45,6 +45,9 @@ RUN mkdir -p /opt/vocat/bin /opt/vocat/data && \
 
 COPY --from=go-builder /out/vocat /opt/vocat/bin/vocat
 
+# Symlink into /usr/local/bin so `docker exec <ctr> vocat ...` finds it via $PATH.
+RUN ln -s /opt/vocat/bin/vocat /usr/local/bin/vocat
+
 USER vocat
 VOLUME ["/opt/vocat/data"]
 EXPOSE 7575

README.md

@@ -305,6 +305,14 @@ cd web && npm run build
 - [Linux.do](https://linux.do) — An inspiring tech community
 - [iniwex5](https://github.com/iniwex5) - Style and Functionality Guidelines
 
+## Buy me a coffee
+
+| Network | Address |
+| ------- | ------- |
+| USDT-TRON (TRC20) | `TQQAbboBoU8h5xX4YCA1rqWJU2WjK3seSg` |
+| USDT-BSC (BEP20) | `0xdbfcd4a462550d6ff06d09cbd89026c6b145d9c4` |
+| USDT-Polygon | `0xdbfcd4a462550d6ff06d09cbd89026c6b145d9c4` |
+
 ## License
 
 See [LICENSE](LICENSE).

cmd/vocat/develop.go

@@ -6,11 +6,11 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
-	"os"
 	"strings"
 	"time"
 
 	"vocat/internal/config"
+	"vocat/internal/developer"
 	"vocat/internal/store"
 )
 
@@ -18,7 +18,7 @@ import (
 // plugin/extension system. When absent the developer mode defaults to off, so
 // a fresh install exposes no plugin surface until an operator explicitly turns
 // it on with `vocat develop on` and restarts the service.
-const developerEnabledSettingKey = "developer.enabled"
+const developerEnabledSettingKey = developer.EnabledSettingKey
 
 // runDevelop handles the hidden `vocat develop on|off` subcommand. It is
 // intentionally excluded from printUsage and the interactive menu: the plugin
@@ -65,6 +65,11 @@ func runDevelop(args []string, logger *slog.Logger) error {
 	}); err != nil {
 		return fmt.Errorf("persist developer flag: %w", err)
 	}
+	if !enabled {
+		if err := developer.ResetExperimental(ctx, database); err != nil {
+			return fmt.Errorf("reset developer settings: %w", err)
+		}
+	}
 
 	if enabled {
 		fmt.Printf("开发者模式已开启。重启 vocat 服务后插件功能生效。\n数据库：%s\n", cfg.DatabasePath)
@@ -91,18 +96,5 @@ func parseDevelopArg(arg string) (bool, bool) {
 // or an unparseable value resolves to false — the system defaults closed, so
 // any read failure keeps plugins off rather than exposing them by accident.
 func isDeveloperEnabled(ctx context.Context, database *store.Store) bool {
-	setting, err := database.AppSetting(ctx, developerEnabledSettingKey)
-	if err != nil {
-		if !errors.Is(err, store.ErrNotFound) {
-			fmt.Fprintf(os.Stderr, "vocat: read developer flag failed; plugin system stays off: %v\n", err)
-		}
-		return false
-	}
-	var document struct {
-		Enabled bool `json:"enabled"`
-	}
-	if err := json.Unmarshal(setting.Value, &document); err != nil {
-		return false
-	}
-	return document.Enabled
+	return developer.Enabled(ctx, database)
 }

cmd/vocat/main.go

@@ -2,15 +2,18 @@ package main
 
 import (
 	"context"
+	"crypto/tls"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"log/slog"
+	"net"
 	"net/http"
 	"os"
 	"os/signal"
 	"path/filepath"
 	"strings"
+	"sync"
 	"syscall"
 	"time"
 
@@ -18,8 +21,11 @@ import (
 
 	"vocat/internal/auth"
 	"vocat/internal/config"
+	"vocat/internal/developer"
 	"vocat/internal/device"
+	"vocat/internal/exportproxy"
 	"vocat/internal/extensions"
+	"vocat/internal/httpsmode"
 	"vocat/internal/loghub"
 	"vocat/internal/server"
 	"vocat/internal/store"
@@ -119,16 +125,41 @@ func run(logger *slog.Logger, logs *loghub.Hub) error {
 		return err
 	}
 	defer database.Close()
+	developerEnabled := isDeveloperEnabled(startupContext, database)
+	pluginRoot := filepath.Join(filepath.Dir(cfg.DatabasePath), "plugins")
+	legacyExportProxyConfig := filepath.Join(pluginRoot, exportproxy.ReservedID, "data", "configs.json")
+	if !developerEnabled {
+		if err := developer.ResetExperimental(startupContext, database); err != nil {
+			return fmt.Errorf("reset disabled developer settings: %w", err)
+		}
+		if err := exportproxy.RemoveLegacyConfig(legacyExportProxyConfig); err != nil {
+			return fmt.Errorf("remove legacy export proxy configuration: %w", err)
+		}
+	}
+	httpsManager, err := httpsmode.New(
+		startupContext,
+		database,
+		filepath.Join(filepath.Dir(cfg.DatabasePath), "tls"),
+		cfg.Address,
+	)
+	if err != nil {
+		return fmt.Errorf("configure self-signed HTTPS: %w", err)
+	}
 
 	// The plugin/extension system is gated behind a hidden developer-mode flag.
 	// When off (the default) the manager is never created and the server receives
 	// a nil Extensions handle, so every /extensions* and /plugin-assets/* route
 	// returns 503/404 and the SPA hides the plugin surface.
-	developerEnabled := isDeveloperEnabled(startupContext, database)
 	var extensionManager *extensions.Manager
+	var exportProxyManager *exportproxy.Manager
 	if developerEnabled {
+		exportProxyManager, err = exportproxy.New(startupContext, database, logger, legacyExportProxyConfig)
+		if err != nil {
+			return fmt.Errorf("create built-in export proxy: %w", err)
+		}
+		defer exportProxyManager.Close()
 		extensionManager, err = extensions.NewManager(
-			filepath.Join(filepath.Dir(cfg.DatabasePath), "plugins"),
+			pluginRoot,
 			logger,
 		)
 		if err != nil {
@@ -163,6 +194,8 @@ func run(logger *slog.Logger, logs *loghub.Hub) error {
 	if err := provisionDiscoveredDevices(startupContext, database, deviceManager); err != nil {
 		logger.Warn("automatic first-run device provisioning failed", "error", err)
 	}
+	configureDeviceBackends(startupContext, logger, database, deviceManager)
+	restoreDefaultCellularRadios(startupContext, logger, database, deviceManager)
 	defer func() {
 		stopContext, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 		defer cancel()
@@ -173,7 +206,14 @@ func run(logger *slog.Logger, logs *loghub.Hub) error {
 	pollContext, cancelPolling := context.WithCancel(context.Background())
 	defer cancelPolling()
 	go pollDeviceSnapshots(pollContext, logger, database, deviceManager)
+	go restoreConfiguredCellularData(pollContext, logger, database, deviceManager)
+	go collectCellularTraffic(pollContext, logger, database)
 	go persistLogsToStore(pollContext, logger, logs, database)
+	if !developerEnabled {
+		go disableAllDeveloperCellularData(pollContext, logger, database, deviceManager)
+	} else {
+		go watchDeveloperDisable(pollContext, logger, database, deviceManager, exportProxyManager, legacyExportProxyConfig)
+	}
 
 	vowifiManager, err := configureVoWiFiRuntime(
 		startupContext,
@@ -184,6 +224,7 @@ func run(logger *slog.Logger, logs *loghub.Hub) error {
 	if err != nil {
 		return fmt.Errorf("configure VoWiFi runtime: %w", err)
 	}
+	go reconcileCardPolicies(pollContext, logger, database, deviceManager, vowifiManager)
 	defer func() {
 		stopContext, cancel := context.WithTimeout(context.Background(), 15*time.Second)
 		defer cancel()
@@ -203,9 +244,11 @@ func run(logger *slog.Logger, logs *loghub.Hub) error {
 		SecureCookies:       cfg.SecureCookies,
 		MaxRequestBodyBytes: cfg.MaxRequestBodyBytes,
 		Extensions:          extensionManager,
+		ExportProxy:         exportProxyManager,
 		DeveloperEnabled:    developerEnabled,
 		UpdateRepository:    strings.TrimSpace(os.Getenv("VOCAT_REPO")),
 		UpdateToken:         strings.TrimSpace(os.Getenv("GITHUB_TOKEN")),
+		HTTPS:               httpsManager,
 	})
 	if err != nil {
 		return err
@@ -214,16 +257,37 @@ func run(logger *slog.Logger, logs *loghub.Hub) error {
 	go handler.StartSMSSyncLoop(pollContext, 15*time.Second)
 	handler.StartTelegramBot(pollContext)
 	handler.StartSMSNotificationDispatchers(pollContext)
+	handler.StartAutomaticTasks(pollContext)
 
-	httpServer := &http.Server{
-		Addr:              cfg.Address,
-		Handler:           handler,
-		ReadHeaderTimeout: 5 * time.Second,
-		ReadTimeout:       15 * time.Second,
-		WriteTimeout:      30 * time.Second,
-		IdleTimeout:       90 * time.Second,
-		MaxHeaderBytes:    1 << 20,
+	serverConfig := func(handler http.Handler) *http.Server {
+		return &http.Server{
+			Addr:              cfg.Address,
+			Handler:           handler,
+			ReadHeaderTimeout: 5 * time.Second,
+			ReadTimeout:       15 * time.Second,
+			WriteTimeout:      30 * time.Second,
+			IdleTimeout:       90 * time.Second,
+			MaxHeaderBytes:    1 << 20,
+		}
 	}
+	plainHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if httpsManager.Enabled() {
+			host := strings.TrimSpace(r.Host)
+			if host == "" {
+				host = cfg.Address
+			}
+			http.Redirect(w, r, "https://"+host+r.URL.RequestURI(), http.StatusPermanentRedirect)
+			return
+		}
+		handler.ServeHTTP(w, r)
+	})
+	plainServer := serverConfig(plainHandler)
+	tlsServer := serverConfig(handler)
+	baseListener, err := net.Listen("tcp", cfg.Address)
+	if err != nil {
+		return fmt.Errorf("listen on %s: %w", cfg.Address, err)
+	}
+	protocolMux := httpsmode.NewMultiplexer(baseListener, httpsManager)
 
 	signalContext, stopSignals := signal.NotifyContext(
 		context.Background(),
@@ -232,10 +296,17 @@ func run(logger *slog.Logger, logs *loghub.Hub) error {
 	)
 	defer stopSignals()
 
-	serverError := make(chan error, 1)
+	serverError := make(chan error, 2)
 	go func() {
-		logger.Info("HTTP server listening", "address", cfg.Address)
-		err := httpServer.ListenAndServe()
+		logger.Info("HTTP server listening", "address", cfg.Address, "self_signed_https", httpsManager.Enabled())
+		err := plainServer.Serve(protocolMux.Plain())
+		if errors.Is(err, http.ErrServerClosed) {
+			err = nil
+		}
+		serverError <- err
+	}()
+	go func() {
+		err := tlsServer.Serve(tls.NewListener(protocolMux.TLS(), httpsManager.TLSConfig()))
 		if errors.Is(err, http.ErrServerClosed) {
 			err = nil
 		}
@@ -244,6 +315,7 @@ func run(logger *slog.Logger, logs *loghub.Hub) error {
 
 	select {
 	case err := <-serverError:
+		_ = protocolMux.Close()
 		return err
 	case <-signalContext.Done():
 		logger.Info("shutdown signal received")
@@ -258,11 +330,187 @@ func run(logger *slog.Logger, logs *loghub.Hub) error {
 		cfg.ShutdownTimeout,
 	)
 	defer cancelShutdown()
-	if err := httpServer.Shutdown(shutdownContext); err != nil {
-		_ = httpServer.Close()
-		return fmt.Errorf("graceful HTTP shutdown: %w", err)
+	shutdownErrors := make(chan error, 2)
+	go func() { shutdownErrors <- plainServer.Shutdown(shutdownContext) }()
+	go func() { shutdownErrors <- tlsServer.Shutdown(shutdownContext) }()
+	time.Sleep(10 * time.Millisecond)
+	_ = protocolMux.Close()
+	for range 2 {
+		if err := <-shutdownErrors; err != nil {
+			_ = plainServer.Close()
+			_ = tlsServer.Close()
+			return fmt.Errorf("graceful HTTP shutdown: %w", err)
+		}
+	}
+	return nil
+}
+
+func configureDeviceBackends(
+	ctx context.Context,
+	logger *slog.Logger,
+	database *store.Store,
+	manager *device.Manager,
+) {
+	configs, err := database.ListDevices(ctx)
+	if err != nil {
+		logger.Warn("configure device backends: list devices", "error", err)
+		return
+	}
+	mapper := integration.ATMapper{Store: database, Devices: manager}
+	for _, config := range configs {
+		entry, mapErr := mapper.Get(config.ID)
+		if mapErr != nil {
+			continue
+		}
+		if err := manager.SetBackend(entry.ID, config.DeviceBackend); err != nil {
+			logger.Warn("configure device backend", "device_id", config.ID, "backend", config.DeviceBackend, "error", err)
+		}
+	}
+}
+
+// restoreDefaultCellularRadios applies an explicitly saved cellular policy
+// after restart. Missing policies remain RF-off and are claimed by the safe
+// default policy; there is no automatic cellular fallback.
+func restoreDefaultCellularRadios(
+	ctx context.Context,
+	logger *slog.Logger,
+	database *store.Store,
+	manager *device.Manager,
+) {
+	configs, err := database.ListDevices(ctx)
+	if err != nil {
+		logger.Warn("startup cellular recovery: list devices", "error", err)
+		return
+	}
+	mapper := integration.ATMapper{Store: database, Devices: manager}
+	for _, config := range configs {
+		if config.VoWiFiEnabled {
+			continue
+		}
+		entry, err := mapper.Get(config.ID)
+		if err != nil || entry.Snapshot == nil || !entry.Snapshot.FlightMode {
+			continue
+		}
+		iccid := strings.TrimSpace(entry.Snapshot.ICCID)
+		if iccid == "" {
+			continue
+		}
+		if iccid != "" {
+			policy, policyErr := database.CardPolicy(ctx, iccid)
+			switch {
+			case policyErr == nil && policy.AirplaneEnabled:
+				continue
+			case errors.Is(policyErr, store.ErrNotFound):
+				continue
+			case policyErr != nil && !errors.Is(policyErr, store.ErrNotFound):
+				logger.Warn("startup cellular recovery: read card policy", "device_id", config.ID, "error", policyErr)
+				continue
+			}
+		}
+		restoreContext, cancel := context.WithTimeout(ctx, 10*time.Second)
+		_, err = manager.SetFlight(restoreContext, entry.ID, false)
+		cancel()
+		if err != nil {
+			logger.Warn("startup cellular recovery failed", "device_id", config.ID, "error", err)
+			continue
+		}
+		logger.Info("restored cellular radio after disabled VoWiFi", "device_id", config.ID, "iccid", iccid)
+	}
+}
+
+func restoreConfiguredCellularData(
+	ctx context.Context,
+	logger *slog.Logger,
+	database *store.Store,
+	manager *device.Manager,
+) {
+	configs, err := database.ListDevices(ctx)
+	if err != nil {
+		logger.Warn("startup cellular data recovery: list devices", "error", err)
+		return
+	}
+	mapper := integration.ATMapper{Store: database, Devices: manager}
+	for _, config := range configs {
+		if !config.NetworkEnabled || config.VoWiFiEnabled {
+			continue
+		}
+		entry, err := mapper.Get(config.ID)
+		if err != nil {
+			continue
+		}
+		dataContext, cancel := context.WithTimeout(ctx, 60*time.Second)
+		_, err = manager.SetNetwork(dataContext, entry.ID, device.NetworkRequest{
+			Enabled: true, APN: config.APN, IPVersion: "IPV4V6", Backend: config.DeviceBackend,
+		})
+		cancel()
+		if err != nil {
+			logger.Warn("startup cellular data recovery failed", "device_id", config.ID, "error", err)
+			continue
+		}
+		logger.Info("restored protected cellular data route", "device_id", config.ID, "interface", config.Interface)
+	}
+}
+
+func disableAllDeveloperCellularData(
+	ctx context.Context,
+	logger *slog.Logger,
+	database *store.Store,
+	manager *device.Manager,
+) {
+	configs, err := database.ListDevices(ctx)
+	if err != nil {
+		logger.Warn("developer cleanup: list devices", "error", err)
+		return
+	}
+	mapper := integration.ATMapper{Store: database, Devices: manager}
+	for _, config := range configs {
+		entry, err := mapper.Get(config.ID)
+		if err != nil {
+			continue
+		}
+		disableContext, cancel := context.WithTimeout(ctx, 30*time.Second)
+		_, err = manager.SetNetwork(disableContext, entry.ID, device.NetworkRequest{Enabled: false, Backend: config.DeviceBackend})
+		cancel()
+		if err != nil && ctx.Err() == nil {
+			logger.Warn("developer cleanup: stop cellular data", "device_id", config.ID, "error", err)
+		}
+	}
+}
+
+func watchDeveloperDisable(
+	ctx context.Context,
+	logger *slog.Logger,
+	database *store.Store,
+	manager *device.Manager,
+	exportProxy *exportproxy.Manager,
+	legacyConfigPath string,
+) {
+	ticker := time.NewTicker(2 * time.Second)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			if developer.Enabled(ctx, database) {
+				continue
+			}
+			if exportProxy != nil {
+				if err := exportProxy.DeleteAllAndDisable(ctx); err != nil && ctx.Err() == nil {
+					logger.Warn("developer cleanup: delete export proxies", "error", err)
+				}
+			}
+			if err := exportproxy.RemoveLegacyConfig(legacyConfigPath); err != nil {
+				logger.Warn("developer cleanup: remove legacy export proxy configuration", "error", err)
+			}
+			if err := developer.ResetExperimental(ctx, database); err != nil && ctx.Err() == nil {
+				logger.Warn("developer cleanup: reset settings", "error", err)
+			}
+			disableAllDeveloperCellularData(ctx, logger, database, manager)
+			logger.Info("developer mode disabled; roaming data and export proxies were removed")
+			return
+		}
 	}
-	return <-serverError
 }
 
 func configureVoWiFiRuntime(
@@ -279,6 +527,13 @@ func configureVoWiFiRuntime(
 		// The test deployment is deliberately non-cellular. VoWiFi teardown
 		// may restore CFUN, but it must never reactivate a PDP context.
 		RestoreCellularData: false,
+		// VoWiFi is always fail-closed with respect to cellular RF. Its teardown
+		// leaves CFUN=4; only the explicit airplane-mode-off endpoint restores
+		// CFUN=1.
+		PureAirplanePolicy: func(deviceID string) bool {
+			deviceConfig, configErr := database.Device(context.Background(), deviceID)
+			return configErr == nil && deviceConfig.VoWiFiEnabled
+		},
 	})
 	if err != nil {
 		return nil, err
@@ -310,6 +565,15 @@ func configureVoWiFiRuntime(
 			return nil, fmt.Errorf("register device %q VoWiFi runtime: %w", deviceConfig.ID, err)
 		}
 		if deviceConfig.VoWiFiEnabled {
+			if entry, mapErr := mapper.Get(deviceConfig.ID); mapErr == nil {
+				flightContext, cancelFlight := context.WithTimeout(ctx, 10*time.Second)
+				_, flightErr := deviceManager.SetFlight(flightContext, entry.ID, true)
+				cancelFlight()
+				if flightErr != nil {
+					_ = manager.Close(context.Background())
+					return nil, fmt.Errorf("protect device %q before VoWiFi startup: %w", deviceConfig.ID, flightErr)
+				}
+			}
 			if _, err := manager.RequestEnabled(deviceConfig.ID, true); err != nil {
 				_ = manager.Close(context.Background())
 				return nil, fmt.Errorf("start device %q VoWiFi policy: %w", deviceConfig.ID, err)
@@ -355,8 +619,18 @@ func newVoWiFiOrchestrator(
 			if message.Concat != nil && message.Concat.Total > 0 {
 				partsTotal = message.Concat.Total
 			}
+			messageID := message.MessageID
+			if message.Concat != nil && message.Concat.Total > 1 {
+				// A segment of a carrier-split long SMS over IMS. Address the whole
+				// message with a stable id so SaveSMSMessage folds every segment
+				// into one progressively merged row instead of one row per segment.
+				messageID = store.StableConcatMessageID(
+					"ims", deviceConfig.ModemIMEI, message.DeviceID, message.From,
+					message.Concat.Reference, message.Concat.Total,
+				)
+			}
 			_, saveErr := database.SaveSMSMessage(ctx, store.SMSMessage{
-				MessageID:  message.MessageID,
+				MessageID:  messageID,
 				DeviceID:   message.DeviceID,
 				ModemIMEI:  deviceConfig.ModemIMEI,
 				IMSI:       message.IMSI,
@@ -466,7 +740,7 @@ func provisionDiscoveredDevices(
 			ESIMTransport:  backend,
 			NetworkEnabled: false,
 			SMSEnabled:     true,
-			VoWiFiEnabled:  false,
+			VoWiFiEnabled:  true,
 		}); err != nil {
 			return err
 		}
@@ -526,20 +800,42 @@ func pollDeviceSnapshots(
 			logger.Debug("periodic modem discovery failed", "error", err)
 			return
 		}
-		for _, entry := range manager.List() {
+		// Hotplug can replace the physical discovery ID. Rebind each configured
+		// device's selected QMI/AT control plane before collecting its snapshot.
+		configureDeviceBackends(ctx, logger, database, manager)
+		entries := manager.List()
+		// Each physical modem owns its own operation lock. Refresh them in
+		// parallel so a slow or wedged EC20 on one hub port cannot delay signal
+		// and identity updates for every other modem by 30 seconds at a time.
+		var refreshGroup sync.WaitGroup
+		refreshSlots := make(chan struct{}, 4)
+		for _, entry := range entries {
 			if !entry.Discovered {
 				continue
 			}
-			refreshContext, cancelRefresh := context.WithTimeout(ctx, 30*time.Second)
-			snapshot, err := manager.Refresh(refreshContext, entry.ID)
-			cancelRefresh()
-			if err != nil && ctx.Err() == nil {
-				logger.Warn("modem snapshot refresh failed", "device_id", entry.ID, "error", err)
-			}
-			if err == nil && ctx.Err() == nil {
-				enforceCardRegion(ctx, logger, database, manager, entry.ID, &snapshot)
-			}
+			entry := entry
+			refreshGroup.Add(1)
+			go func() {
+				defer refreshGroup.Done()
+				select {
+				case refreshSlots <- struct{}{}:
+					defer func() { <-refreshSlots }()
+				case <-ctx.Done():
+					return
+				}
+				refreshContext, cancelRefresh := context.WithTimeout(ctx, 30*time.Second)
+				snapshot, refreshErr := manager.Refresh(refreshContext, entry.ID)
+				cancelRefresh()
+				if refreshErr != nil && ctx.Err() == nil {
+					logger.Warn("modem snapshot refresh failed", "device_id", entry.ID, "error", refreshErr)
+				}
+				if refreshErr == nil && ctx.Err() == nil {
+					enforceCardRegion(ctx, logger, database, manager, entry.ID, &snapshot)
+					enforceDefaultSafeCardPolicy(ctx, logger, database, manager, entry.ID, &snapshot)
+				}
+			}()
 		}
+		refreshGroup.Wait()
 	}
 	refresh()
 	ticker := time.NewTicker(30 * time.Second)
@@ -554,6 +850,158 @@ func pollDeviceSnapshots(
 	}
 }
 
+// enforceDefaultSafeCardPolicy handles a newly inserted physical SIM or a
+// profile that has never had a policy. RF is turned off before the default is
+// persisted; the VoWiFi runtime reconciler then starts service asynchronously.
+func enforceDefaultSafeCardPolicy(
+	ctx context.Context,
+	logger *slog.Logger,
+	database *store.Store,
+	manager *device.Manager,
+	physicalID string,
+	snapshot *device.Snapshot,
+) {
+	if snapshot == nil || !snapshot.SIMReady || strings.TrimSpace(snapshot.ICCID) == "" ||
+		device.RegionBlockReason(snapshot.IMSI) != "" {
+		return
+	}
+	iccid := strings.TrimSpace(snapshot.ICCID)
+	if _, err := database.CardPolicy(ctx, iccid); err == nil && !snapshot.SIMChanged {
+		return
+	} else if !errors.Is(err, store.ErrNotFound) {
+		logger.Warn("default card policy: read policy", "iccid", iccid, "error", err)
+		return
+	}
+	flightContext, cancel := context.WithTimeout(ctx, 10*time.Second)
+	_, err := manager.SetFlight(flightContext, physicalID, true)
+	cancel()
+	if err != nil {
+		logger.Warn("default card policy: failed to establish airplane mode", "device_id", physicalID, "iccid", iccid, "error", err)
+		return
+	}
+	if err := database.UpsertCardPolicy(ctx, store.CardPolicy{
+		ICCID: iccid, VoWiFiEnabled: true, AirplaneEnabled: true,
+		IPVersion: "IPV4V6", Source: "default",
+	}); err != nil {
+		logger.Warn("default card policy: persist policy", "iccid", iccid, "error", err)
+		return
+	}
+	mapper := integration.ATMapper{Store: database, Devices: manager}
+	configs, err := database.ListDevices(ctx)
+	if err != nil {
+		return
+	}
+	for _, config := range configs {
+		entry, mapErr := mapper.Get(config.ID)
+		if mapErr != nil || entry.ID != physicalID {
+			continue
+		}
+		config.NetworkEnabled = false
+		config.VoWiFiEnabled = true
+		if err := database.UpsertDevice(ctx, config); err != nil {
+			logger.Warn("default card policy: update device policy", "device_id", config.ID, "error", err)
+		}
+		break
+	}
+	logger.Info("new SIM protected by default VoWiFi/airplane policy", "device_id", physicalID, "iccid", iccid)
+}
+
+func reconcileCardPolicies(
+	ctx context.Context,
+	logger *slog.Logger,
+	database *store.Store,
+	manager *device.Manager,
+	vowifiManager *vowifiruntime.Manager,
+) {
+	reconcile := func() {
+		policies, policyListErr := database.ListCardPolicies(ctx)
+		if policyListErr == nil {
+			for _, policy := range policies {
+				if !policy.VoWiFiEnabled || (policy.AirplaneEnabled && !policy.NetworkEnabled) {
+					continue
+				}
+				policy.AirplaneEnabled = true
+				policy.NetworkEnabled = false
+				if err := database.UpsertCardPolicy(ctx, policy); err != nil {
+					logger.Warn("reconcile card policy: normalize stored RF-safe VoWiFi policy", "iccid", policy.ICCID, "error", err)
+				}
+			}
+		}
+		configs, err := database.ListDevices(ctx)
+		if err != nil {
+			return
+		}
+		mapper := integration.ATMapper{Store: database, Devices: manager}
+		for _, config := range configs {
+			entry, mapErr := mapper.Get(config.ID)
+			if mapErr != nil || entry.Snapshot == nil {
+				continue
+			}
+			iccid := strings.TrimSpace(entry.Snapshot.ICCID)
+			if iccid == "" {
+				continue
+			}
+			policy, policyErr := database.CardPolicy(ctx, iccid)
+			if policyErr != nil {
+				continue
+			}
+			if policy.VoWiFiEnabled && (!policy.AirplaneEnabled || policy.NetworkEnabled) {
+				policy.AirplaneEnabled = true
+				policy.NetworkEnabled = false
+				if err := database.UpsertCardPolicy(ctx, policy); err != nil {
+					logger.Warn("reconcile card policy: normalize RF-safe VoWiFi policy", "device_id", config.ID, "iccid", iccid, "error", err)
+					continue
+				}
+			}
+			if config.VoWiFiEnabled != policy.VoWiFiEnabled || (policy.VoWiFiEnabled && config.NetworkEnabled) {
+				config.VoWiFiEnabled = policy.VoWiFiEnabled
+				if policy.VoWiFiEnabled {
+					config.NetworkEnabled = false
+				}
+				if err := database.UpsertDevice(ctx, config); err != nil {
+					logger.Warn("reconcile card policy: update device", "device_id", config.ID, "error", err)
+					continue
+				}
+			}
+			state, stateErr := vowifiManager.State(config.ID)
+			if policy.VoWiFiEnabled {
+				if !entry.Snapshot.FlightMode {
+					flightContext, cancel := context.WithTimeout(ctx, 10*time.Second)
+					_, _ = manager.SetFlight(flightContext, entry.ID, true)
+					cancel()
+				}
+				switch {
+				case stateErr != nil || !state.Enabled:
+					_, _ = vowifiManager.RequestEnabled(config.ID, true)
+				case state.ICCID != "" && !strings.EqualFold(strings.TrimSpace(state.ICCID), iccid):
+					_, _ = vowifiManager.RequestReconnect(config.ID)
+				}
+				continue
+			}
+			if stateErr == nil && state.Enabled {
+				_, _ = vowifiManager.RequestEnabled(config.ID, false)
+				continue
+			}
+			if policy.AirplaneEnabled != entry.Snapshot.FlightMode {
+				flightContext, cancel := context.WithTimeout(ctx, 10*time.Second)
+				_, _ = manager.SetFlight(flightContext, entry.ID, policy.AirplaneEnabled)
+				cancel()
+			}
+		}
+	}
+	reconcile()
+	ticker := time.NewTicker(5 * time.Second)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			reconcile()
+		}
+	}
+}
+
 // cardPolicySourceRegionBlock marks a card policy that was written automatically
 // because the inserted SIM belongs to a region the product does not serve. It
 // doubles as the persistent record that the radio was forced off by us, so the
@@ -620,10 +1068,10 @@ func enforceCardRegion(
 	liftCardRegionBlock(ctx, logger, database, manager, id, snapshot)
 }
 
-// liftCardRegionBlock reverses an automatic region block once the current SIM
-// is positively confirmed to be allowed. It restores the radio only when an
-// outstanding auto-forced block exists, so it never overrides a flight mode the
-// user enabled deliberately.
+// liftCardRegionBlock removes the regional marker once an allowed SIM is
+// confirmed. It deliberately does not restore RF: the replacement SIM is
+// picked up by enforceDefaultSafeCardPolicy and remains in airplane/VoWiFi
+// mode until an explicit user action.
 func liftCardRegionBlock(
 	ctx context.Context,
 	logger *slog.Logger,
@@ -648,18 +1096,6 @@ func liftCardRegionBlock(
 	if len(outstanding) == 0 {
 		return
 	}
-	if snapshot.FlightMode {
-		flightContext, cancelFlight := context.WithTimeout(ctx, 30*time.Second)
-		_, err := manager.SetFlight(flightContext, id, false)
-		cancelFlight()
-		if err != nil && ctx.Err() == nil {
-			logger.Warn(
-				"region block: failed to restore radio",
-				"device_id", id, "error", err,
-			)
-			return
-		}
-	}
 	for _, policy := range outstanding {
 		if err := database.DeleteCardPolicy(ctx, policy.ICCID); err != nil && ctx.Err() == nil {
 			logger.Warn(
@@ -669,7 +1105,7 @@ func liftCardRegionBlock(
 		}
 	}
 	logger.Info(
-		"region block lifted; SIM is allowed",
+		"region marker removed; allowed SIM remains RF protected",
 		"device_id", id, "iccid", snapshot.ICCID, "imsi", snapshot.IMSI,
 	)
 }

cmd/vocat/main_test.go

@@ -152,11 +152,7 @@ func TestEnforceCardRegionSkipsRadioWhenAlreadyOff(t *testing.T) {
 }
 
 func TestEnforceCardRegionLiftsBlockForAllowedSIM(t *testing.T) {
-	client := &fakeModemClient{steps: []fakeStep{
-		{command: "AT+CFUN?", lines: []string{"+CFUN: 4"}},
-		{command: "AT+CFUN=1"},
-		{command: "AT+CFUN?", lines: []string{"+CFUN: 1"}},
-	}}
+	client := &fakeModemClient{}
 	manager := newRegionTestManager(t, client)
 	database := newRegionTestStore(t)
 

cmd/vocat/traffic.go

@@ -0,0 +1,123 @@
+package main
+
+import (
+	"context"
+	"log/slog"
+	"math"
+	"strings"
+	"time"
+
+	"vocat/internal/store"
+)
+
+const cellularTrafficSampleInterval = 30 * time.Second
+
+type interfaceTrafficSample struct {
+	interfaceName string
+	rxBytes       uint64
+	txBytes       uint64
+}
+
+func collectCellularTraffic(ctx context.Context, logger *slog.Logger, database *store.Store) {
+	previous := make(map[string]interfaceTrafficSample)
+	var lastPrune time.Time
+	collect := func() {
+		now := time.Now()
+		if lastPrune.IsZero() || now.Sub(lastPrune) >= 24*time.Hour {
+			lastPrune = now
+			if _, err := database.DeleteTrafficBefore(ctx, now.Add(-35*24*time.Hour)); err != nil && ctx.Err() == nil {
+				logger.Warn("prune old cellular traffic", "error", err)
+			}
+		}
+
+		configs, err := database.ListDevices(ctx)
+		if err != nil {
+			if ctx.Err() == nil {
+				logger.Warn("list devices for cellular traffic collection", "error", err)
+			}
+			return
+		}
+
+		active := make(map[string]struct{}, len(configs))
+		for _, config := range configs {
+			interfaceName := strings.TrimSpace(config.Interface)
+			if !config.NetworkEnabled || interfaceName == "" {
+				delete(previous, config.ID)
+				continue
+			}
+			active[config.ID] = struct{}{}
+
+			rxBytes, txBytes, err := readInterfaceTrafficCounters(interfaceName)
+			if err != nil {
+				// Interfaces can briefly disappear while QMI reconnects. The next
+				// successful read establishes a fresh baseline, so no reconnect
+				// traffic is accidentally counted twice.
+				delete(previous, config.ID)
+				continue
+			}
+			rxDelta, txDelta, ok := trafficCounterDelta(previous[config.ID], interfaceName, rxBytes, txBytes)
+			previous[config.ID] = interfaceTrafficSample{
+				interfaceName: interfaceName,
+				rxBytes:       rxBytes,
+				txBytes:       txBytes,
+			}
+			if !ok || (rxDelta == 0 && txDelta == 0) {
+				continue
+			}
+
+			for bucket, periodStart := range trafficBucketPeriods(time.Now()) {
+				if err := database.AddTrafficBucket(ctx, store.TrafficBucket{
+					DeviceID:    config.ID,
+					Bucket:      bucket,
+					PeriodStart: periodStart,
+					RXBytes:     rxDelta,
+					TXBytes:     txDelta,
+				}); err != nil && ctx.Err() == nil {
+					logger.Warn("record cellular traffic", "device", config.ID, "bucket", bucket, "error", err)
+				}
+			}
+		}
+
+		for deviceID := range previous {
+			if _, ok := active[deviceID]; !ok {
+				delete(previous, deviceID)
+			}
+		}
+	}
+
+	collect()
+	ticker := time.NewTicker(cellularTrafficSampleInterval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			collect()
+		}
+	}
+}
+
+func trafficCounterDelta(previous interfaceTrafficSample, interfaceName string, rxBytes, txBytes uint64) (int64, int64, bool) {
+	if previous.interfaceName == "" || previous.interfaceName != interfaceName || rxBytes < previous.rxBytes || txBytes < previous.txBytes {
+		return 0, 0, false
+	}
+	rxDelta := rxBytes - previous.rxBytes
+	txDelta := txBytes - previous.txBytes
+	if rxDelta > math.MaxInt64 || txDelta > math.MaxInt64 {
+		return 0, 0, false
+	}
+	return int64(rxDelta), int64(txDelta), true
+}
+
+func trafficBucketPeriods(now time.Time) map[string]time.Time {
+	local := now.In(time.Local)
+	year, month, day := local.Date()
+	dayStart := time.Date(year, month, day, 0, 0, 0, 0, time.Local).UTC()
+	return map[string]time.Time{
+		"hour":  now.UTC().Truncate(time.Minute),
+		"day":   now.UTC().Truncate(time.Hour),
+		"week":  dayStart,
+		"month": dayStart,
+	}
+}

cmd/vocat/traffic_linux.go

@@ -0,0 +1,39 @@
+//go:build linux
+
+package main
+
+import (
+	"fmt"
+	"net"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+)
+
+func readInterfaceTrafficCounters(interfaceName string) (uint64, uint64, error) {
+	iface, err := net.InterfaceByName(interfaceName)
+	if err != nil {
+		return 0, 0, err
+	}
+	read := func(counter string) (uint64, error) {
+		value, err := os.ReadFile(filepath.Join("/sys/class/net", iface.Name, "statistics", counter))
+		if err != nil {
+			return 0, err
+		}
+		parsed, err := strconv.ParseUint(strings.TrimSpace(string(value)), 10, 64)
+		if err != nil {
+			return 0, fmt.Errorf("parse %s %s counter: %w", iface.Name, counter, err)
+		}
+		return parsed, nil
+	}
+	rxBytes, err := read("rx_bytes")
+	if err != nil {
+		return 0, 0, err
+	}
+	txBytes, err := read("tx_bytes")
+	if err != nil {
+		return 0, 0, err
+	}
+	return rxBytes, txBytes, nil
+}

cmd/vocat/traffic_other.go

@@ -0,0 +1,9 @@
+//go:build !linux
+
+package main
+
+import "errors"
+
+func readInterfaceTrafficCounters(string) (uint64, uint64, error) {
+	return 0, 0, errors.New("interface traffic counters are only available on Linux")
+}

cmd/vocat/traffic_test.go

@@ -0,0 +1,38 @@
+package main
+
+import (
+	"testing"
+	"time"
+)
+
+func TestTrafficCounterDelta(t *testing.T) {
+	previous := interfaceTrafficSample{interfaceName: "wwan0", rxBytes: 100, txBytes: 50}
+	rx, tx, ok := trafficCounterDelta(previous, "wwan0", 175, 90)
+	if !ok || rx != 75 || tx != 40 {
+		t.Fatalf("delta = (%d, %d, %v), want (75, 40, true)", rx, tx, ok)
+	}
+	if _, _, ok := trafficCounterDelta(previous, "wwan1", 175, 90); ok {
+		t.Fatal("interface change must establish a new baseline")
+	}
+	if _, _, ok := trafficCounterDelta(previous, "wwan0", 90, 40); ok {
+		t.Fatal("counter reset must establish a new baseline")
+	}
+}
+
+func TestTrafficBucketPeriods(t *testing.T) {
+	now := time.Date(2026, 8, 10, 12, 34, 56, 0, time.Local)
+	periods := trafficBucketPeriods(now)
+	if got := periods["hour"]; !got.Equal(now.UTC().Truncate(time.Minute)) {
+		t.Fatalf("hour period = %s", got)
+	}
+	if got := periods["day"]; !got.Equal(now.UTC().Truncate(time.Hour)) {
+		t.Fatalf("day period = %s", got)
+	}
+	localDay := periods["week"].In(time.Local)
+	if localDay.Hour() != 0 || localDay.Minute() != 0 || localDay.Day() != 10 {
+		t.Fatalf("week period = %s, want local day start", periods["week"])
+	}
+	if !periods["month"].Equal(periods["week"]) {
+		t.Fatal("week and month should share daily periods")
+	}
+}

deploy/vocat.service

@@ -29,7 +29,7 @@ ProtectKernelModules=true
 ProtectKernelTunables=true
 ProtectControlGroups=true
 ReadWritePaths=/opt/vocat/data
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK AF_PACKET
 RestrictRealtime=true
 LockPersonality=true
 MemoryDenyWriteExecute=true

docker-compose.yml

@@ -0,0 +1,60 @@
+# VoCat Docker Compose deployment.
+#
+# First-time setup:
+#   cp .env.example .env        # then edit VOCAT_ADMIN_PASSWORD
+#   docker compose pull         # fetch the prebuilt GHCR image
+#   docker compose up -d        # start
+#
+# Build locally from this repo instead of using the GHCR image:
+#   docker compose up -d --build
+#
+# In-container binary self-update is intentionally disabled (VOCAT_CONTAINER=docker
+# makes the server return 409 on the apply endpoint). Update by pulling a new
+# image and recreating the container:
+#   docker compose pull && docker compose up -d
+
+services:
+  vocat:
+    # Use the prebuilt multi-arch image from GHCR. Override with
+    # --build to compile from the local Dockerfile instead.
+    image: ghcr.io/mengmengcode/vocat:latest
+    pull_policy: missing
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: vocat
+    restart: unless-stopped
+
+    # Host network mode: the export-proxy plugin uses SO_BINDTODEVICE to pin
+    # outbound proxy traffic to the modem interface (wwan0) so roaming data
+    # egresses only the module — never the host's default route. That syscall
+    # needs the host network namespace visible inside the container, which
+    # network_mode: host provides directly. Port publishing is therefore
+    # meaningless (the container shares the host stack and vocat binds
+    # 0.0.0.0:7575 itself); proxy ports opened by the plugin are likewise
+    # reachable on the host IP without explicit mapping.
+    network_mode: host
+
+    # VoWiFi / eSIM / IMS paths need raw sockets (IPsec, netlink). The systemd
+    # unit grants CAP_NET_ADMIN + CAP_NET_RAW; mirror that here.
+    cap_add:
+      - NET_ADMIN
+      - NET_RAW
+
+    environment:
+      # Marks the process as containerized: the web UI then advertises
+      # "pull new image" instead of attempting an in-place binary update.
+      VOCAT_CONTAINER: docker
+      # VOCAT_ADDR / VOCAT_DATABASE_PATH are set in the Dockerfile; override
+      # only if you want non-default values. Sensitive values come from .env.
+      VOCAT_ADMIN_PASSWORD: ${VOCAT_ADMIN_PASSWORD:?set VOCAT_ADMIN_PASSWORD in .env}
+
+    volumes:
+      # SQLite database + persistent state. Named volume (not a bind mount)
+      # because the container runs as uid 1000 (vocat) while a bind-mounted
+      # host dir would be root-owned and unwritable. Docker gives the named
+      # volume the image's uid 1000 ownership automatically.
+      - vocat-data:/opt/vocat/data
+
+volumes:
+  vocat-data:

go.mod

@@ -3,6 +3,7 @@ module vocat
 go 1.25.0
 
 require (
+	github.com/coder/websocket v1.8.15
 	go.bug.st/serial v1.6.4
 	golang.org/x/crypto v0.41.0
 	golang.org/x/sys v0.47.0

go.sum

@@ -1,3 +1,5 @@
+github.com/coder/websocket v1.8.15 h1:6B2JPeOGlpff2Uz6vOEH1Vzpi0iUz20A+lPVhPHtNUA=
+github.com/coder/websocket v1.8.15/go.mod h1:NX3SzP+inril6yawo5CQXx8+fk145lPDC6pumgx0mVg=
 github.com/creack/goselect v0.1.2 h1:2DNy14+JPjRBgPzAd1thbQp4BSIihxcBf0IXhQXDRa0=
 github.com/creack/goselect v0.1.2/go.mod h1:a/NhLweNvqIYMuxcMOuWY516Cimucms3DglDzQP3hKY=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=

internal/developer/settings.go

@@ -0,0 +1,140 @@
+package developer
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+
+	"vocat/internal/exportproxy"
+	"vocat/internal/httpsmode"
+	"vocat/internal/store"
+)
+
+func Enabled(ctx context.Context, database *store.Store) bool {
+	setting, err := database.AppSetting(ctx, EnabledSettingKey)
+	if err != nil {
+		return false
+	}
+	var document struct {
+		Enabled bool `json:"enabled"`
+	}
+	return json.Unmarshal(setting.Value, &document) == nil && document.Enabled
+}
+
+const (
+	EnabledSettingKey     = "developer.enabled"
+	DeviceLimitSettingKey = "developer.device_limit"
+	SMSHourlyLimitKey     = "developer.sms_hourly_limit"
+	DefaultDeviceLimit    = 5
+	MaxDeviceLimit        = 128
+	DefaultSMSHourlyLimit = 10
+	MaxSMSHourlyLimit     = 1000
+)
+
+func DeviceLimit(ctx context.Context, database *store.Store, enabled bool) int {
+	if !enabled {
+		return DefaultDeviceLimit
+	}
+	setting, err := database.AppSetting(ctx, DeviceLimitSettingKey)
+	if err != nil {
+		return DefaultDeviceLimit
+	}
+	var document struct {
+		Limit int `json:"limit"`
+	}
+	if json.Unmarshal(setting.Value, &document) != nil || document.Limit < 1 || document.Limit > MaxDeviceLimit {
+		return DefaultDeviceLimit
+	}
+	return document.Limit
+}
+
+func SetDeviceLimit(ctx context.Context, database *store.Store, limit int) error {
+	if limit < 1 || limit > MaxDeviceLimit {
+		return fmt.Errorf("device limit must be between 1 and %d", MaxDeviceLimit)
+	}
+	value, err := json.Marshal(map[string]int{"limit": limit})
+	if err != nil {
+		return err
+	}
+	return database.UpsertAppSetting(ctx, store.AppSetting{Key: DeviceLimitSettingKey, Value: value})
+}
+
+// SMSHourlyLimit is enforced regardless of developer mode. Developer mode
+// only controls whether administrators can see and modify this value.
+func SMSHourlyLimit(ctx context.Context, database *store.Store) int {
+	setting, err := database.AppSetting(ctx, SMSHourlyLimitKey)
+	if err != nil {
+		return DefaultSMSHourlyLimit
+	}
+	var document struct {
+		Limit int `json:"limit"`
+	}
+	if json.Unmarshal(setting.Value, &document) != nil || document.Limit < 1 || document.Limit > MaxSMSHourlyLimit {
+		return DefaultSMSHourlyLimit
+	}
+	return document.Limit
+}
+
+func SetSMSHourlyLimit(ctx context.Context, database *store.Store, limit int) error {
+	if limit < 1 || limit > MaxSMSHourlyLimit {
+		return fmt.Errorf("SMS hourly limit must be between 1 and %d", MaxSMSHourlyLimit)
+	}
+	value, err := json.Marshal(map[string]int{"limit": limit})
+	if err != nil {
+		return err
+	}
+	return database.UpsertAppSetting(ctx, store.AppSetting{Key: SMSHourlyLimitKey, Value: value})
+}
+
+// ResetExperimental restores every mutable developer-only setting. It is
+// called both by `vocat develop off` and at startup whenever developer mode is
+// disabled, so stale database values cannot silently remain active.
+func ResetExperimental(ctx context.Context, database *store.Store) error {
+	httpsValue, err := json.Marshal(map[string]bool{"enabled": false})
+	if err != nil {
+		return err
+	}
+	var resetErrors []error
+	if err := database.UpsertAppSetting(ctx, store.AppSetting{Key: httpsmode.SettingKey, Value: httpsValue}); err != nil {
+		resetErrors = append(resetErrors, fmt.Errorf("reset self-signed HTTPS: %w", err))
+	}
+	if err := SetDeviceLimit(ctx, database, DefaultDeviceLimit); err != nil {
+		resetErrors = append(resetErrors, fmt.Errorf("reset device limit: %w", err))
+	}
+	if err := SetSMSHourlyLimit(ctx, database, DefaultSMSHourlyLimit); err != nil {
+		resetErrors = append(resetErrors, fmt.Errorf("reset SMS hourly limit: %w", err))
+	}
+	if err := database.DeleteAppSetting(ctx, exportproxy.SettingKey); err != nil && !errors.Is(err, store.ErrNotFound) {
+		resetErrors = append(resetErrors, fmt.Errorf("delete export proxy configurations: %w", err))
+	}
+	devices, err := database.ListDevices(ctx)
+	if err != nil {
+		resetErrors = append(resetErrors, fmt.Errorf("list devices while disabling roaming data: %w", err))
+	} else {
+		for _, device := range devices {
+			if !device.NetworkEnabled {
+				continue
+			}
+			device.NetworkEnabled = false
+			if err := database.UpsertDevice(ctx, device); err != nil {
+				resetErrors = append(resetErrors, fmt.Errorf("disable roaming data for device %s: %w", device.ID, err))
+			}
+		}
+	}
+	policies, err := database.ListCardPolicies(ctx)
+	if err != nil {
+		resetErrors = append(resetErrors, fmt.Errorf("list card policies while disabling roaming data: %w", err))
+	} else {
+		for _, policy := range policies {
+			if !policy.NetworkEnabled {
+				continue
+			}
+			policy.NetworkEnabled = false
+			if err := database.UpsertCardPolicy(ctx, policy); err != nil {
+				resetErrors = append(resetErrors, fmt.Errorf("disable roaming policy for card %s: %w", policy.ICCID, err))
+			}
+		}
+	}
+	return errors.Join(resetErrors...)
+}

internal/developer/settings_test.go

@@ -0,0 +1,101 @@
+package developer
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"path/filepath"
+	"testing"
+
+	"vocat/internal/exportproxy"
+	"vocat/internal/httpsmode"
+	"vocat/internal/store"
+)
+
+func TestResetExperimentalRestoresDefaults(t *testing.T) {
+	ctx := context.Background()
+	database, err := store.Open(ctx, filepath.Join(t.TempDir(), "vocat.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer database.Close()
+	if err := SetDeviceLimit(ctx, database, 24); err != nil {
+		t.Fatal(err)
+	}
+	if err := SetSMSHourlyLimit(ctx, database, 42); err != nil {
+		t.Fatal(err)
+	}
+	enabled, _ := json.Marshal(map[string]bool{"enabled": true})
+	if err := database.UpsertAppSetting(ctx, store.AppSetting{Key: httpsmode.SettingKey, Value: enabled}); err != nil {
+		t.Fatal(err)
+	}
+	if err := database.UpsertDevice(ctx, store.Device{ID: "modem-1", Name: "modem-1", NetworkEnabled: true}); err != nil {
+		t.Fatal(err)
+	}
+	if err := database.UpsertCardPolicy(ctx, store.CardPolicy{ICCID: "8901000000000000001", NetworkEnabled: true, IPVersion: "IPV4V6"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := database.UpsertAppSetting(ctx, store.AppSetting{Key: exportproxy.SettingKey, Value: json.RawMessage(`[]`)}); err != nil {
+		t.Fatal(err)
+	}
+	if err := ResetExperimental(ctx, database); err != nil {
+		t.Fatal(err)
+	}
+	if limit := DeviceLimit(ctx, database, true); limit != DefaultDeviceLimit {
+		t.Fatalf("device limit = %d, want %d", limit, DefaultDeviceLimit)
+	}
+	if limit := SMSHourlyLimit(ctx, database); limit != DefaultSMSHourlyLimit {
+		t.Fatalf("SMS hourly limit = %d, want %d", limit, DefaultSMSHourlyLimit)
+	}
+	setting, err := database.AppSetting(ctx, httpsmode.SettingKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var document struct {
+		Enabled bool `json:"enabled"`
+	}
+	if err := json.Unmarshal(setting.Value, &document); err != nil || document.Enabled {
+		t.Fatalf("HTTPS setting = %s, error = %v", setting.Value, err)
+	}
+	device, err := database.Device(ctx, "modem-1")
+	if err != nil || device.NetworkEnabled {
+		t.Fatalf("device roaming data was not disabled: %+v, %v", device, err)
+	}
+	policy, err := database.CardPolicy(ctx, "8901000000000000001")
+	if err != nil || policy.NetworkEnabled {
+		t.Fatalf("card roaming policy was not disabled: %+v, %v", policy, err)
+	}
+	if _, err := database.AppSetting(ctx, exportproxy.SettingKey); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("export proxy configurations were not deleted: %v", err)
+	}
+}
+
+func TestSetDeviceLimitValidatesRange(t *testing.T) {
+	ctx := context.Background()
+	database, err := store.Open(ctx, filepath.Join(t.TempDir(), "vocat.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer database.Close()
+	if SetDeviceLimit(ctx, database, 0) == nil || SetDeviceLimit(ctx, database, MaxDeviceLimit+1) == nil {
+		t.Fatal("out-of-range device limit was accepted")
+	}
+}
+
+func TestSetSMSHourlyLimitValidatesRange(t *testing.T) {
+	ctx := context.Background()
+	database, err := store.Open(ctx, filepath.Join(t.TempDir(), "vocat.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer database.Close()
+	if SetSMSHourlyLimit(ctx, database, 0) == nil || SetSMSHourlyLimit(ctx, database, MaxSMSHourlyLimit+1) == nil {
+		t.Fatal("out-of-range SMS hourly limit was accepted")
+	}
+	if err := SetSMSHourlyLimit(ctx, database, 25); err != nil {
+		t.Fatal(err)
+	}
+	if got := SMSHourlyLimit(ctx, database); got != 25 {
+		t.Fatalf("SMS hourly limit = %d, want 25", got)
+	}
+}

internal/device/carrier_db.go

@@ -0,0 +1,66 @@
+package device
+
+import (
+	_ "embed"
+	"encoding/json"
+	"strings"
+)
+
+// The offline table is generated by scripts/update-carriers.py from Android's
+// versioned carrier ID database, with the previous global table retained as a
+// fallback for PLMNs that Android does not yet catalogue.
+//
+//go:embed mccmnc.json
+var carrierDatabaseJSON []byte
+
+type carrierDatabase struct {
+	Carriers map[string][]string `json:"c"`
+}
+
+var globalCarrierDatabase = func() carrierDatabase {
+	var database carrierDatabase
+	if err := json.Unmarshal(carrierDatabaseJSON, &database); err != nil {
+		panic("device: invalid embedded MCC/MNC database: " + err.Error())
+	}
+	return database
+}()
+
+// CarrierForPLMN returns the offline carrier display name and ISO alpha-2
+// country/territory code for a numeric five- or six-digit PLMN.
+func CarrierForPLMN(plmn string) (name, countryCode string, ok bool) {
+	plmn = strings.TrimSpace(plmn)
+	if !decimalDigits(plmn, 5, 6) {
+		return "", "", false
+	}
+	entry, ok := globalCarrierDatabase.Carriers[plmn]
+	if !ok || len(entry) == 0 || strings.TrimSpace(entry[0]) == "" {
+		return "", "", false
+	}
+	name = strings.TrimSpace(entry[0])
+	if len(entry) > 1 {
+		countryCode = strings.ToUpper(strings.TrimSpace(entry[1]))
+	}
+	return name, countryCode, true
+}
+
+// CarrierForIMSI resolves the home PLMN carried by an IMSI. MNCs may contain
+// either two or three digits, so prefer an exact six-digit database match and
+// then fall back to the five-digit form. This avoids treating the first three
+// subscriber digits as a three-digit MNC for networks such as 234-33.
+func CarrierForIMSI(imsi string) (plmn, name, countryCode string, ok bool) {
+	imsi = strings.TrimSpace(imsi)
+	if !decimalDigits(imsi, 5, 20) {
+		return "", "", "", false
+	}
+	for _, length := range []int{6, 5} {
+		if len(imsi) < length {
+			continue
+		}
+		candidate := imsi[:length]
+		carrier, country, found := CarrierForPLMN(candidate)
+		if found {
+			return candidate, carrier, country, true
+		}
+	}
+	return "", "", "", false
+}

internal/device/data.go

@@ -23,7 +23,7 @@ func (manager *Manager) SetNetwork(
 		return NetworkResult{}, err
 	}
 	apn := strings.TrimSpace(request.APN)
-	if request.Enabled && !apnPattern.MatchString(apn) {
+	if request.Enabled && apn != "" && !apnPattern.MatchString(apn) {
 		return NetworkResult{}, ErrInvalidNetworkAPN
 	}
 	ipVersion := normalizeIPVersion(request.IPVersion)
@@ -43,7 +43,21 @@ func (manager *Manager) SetNetwork(
 		}
 	}
 	candidate := manager.candidateFor(state)
-	if candidate.QMIControl != "" && candidate.NetworkInterface != "" {
+	backend := strings.ToLower(strings.TrimSpace(request.Backend))
+	if backend == "" {
+		if candidate.QMIControl != "" && candidate.NetworkInterface != "" {
+			backend = "qmi"
+		} else {
+			backend = "at"
+		}
+	}
+	if backend != "at" && backend != "qmi" {
+		return NetworkResult{}, fmt.Errorf("unsupported cellular data backend %q", request.Backend)
+	}
+	if backend == "qmi" {
+		if candidate.QMIControl == "" || candidate.NetworkInterface == "" {
+			return NetworkResult{}, fmt.Errorf("%w: QMI control device and network interface are required", ErrDataBackendUnavailable)
+		}
 		return setQMINetwork(ctx, candidate, request.Enabled, apn, ipVersion)
 	}
 
@@ -225,7 +239,7 @@ func (manager *Manager) SetOperatorSelection(
 	accessTechnologyValue *int,
 ) (OperatorSelection, error) {
 	result := OperatorSelection{Mode: 0}
-	command := "AT+COPS=0"
+	command := ""
 	if !automatic {
 		plmn = strings.TrimSpace(plmn)
 		if len(plmn) < 5 || len(plmn) > 6 || strings.IndexFunc(plmn, func(r rune) bool { return r < '0' || r > '9' }) >= 0 {
@@ -265,28 +279,187 @@ func (manager *Manager) SetOperatorSelection(
 	// the lock is not aborted while registration is still in progress.
 	lockCtx, cancel := manager.withTimeout(ctx, manager.scanTimeout)
 	defer cancel()
-	if _, err := client.Execute(lockCtx, command); err != nil {
-		manager.setResult(id, state, nil, errors.New("operator selection command failed"))
+	if automatic {
+		result, err = restoreAutomaticOperatorSelection(lockCtx, client)
+		manager.setResult(id, state, nil, err)
+		return result, err
+	}
+	response, err := client.Execute(lockCtx, command)
+	if err != nil || !response.OK() {
+		if err == nil {
+			err = &modem.CommandError{Command: response.Command, Final: response.Final, Lines: response.Lines}
+		}
+		rollbackOperatorSelection(manager, client)
+		wrapped := fmt.Errorf("manual operator selection failed and automatic selection was restored: %w", err)
+		manager.setResult(id, state, nil, wrapped)
+		return OperatorSelection{}, wrapped
+	}
+	actual, err := queryOperatorSelection(lockCtx, client)
+	if err != nil {
+		rollbackOperatorSelection(manager, client)
+		manager.setResult(id, state, nil, err)
+		return OperatorSelection{}, fmt.Errorf("verify manual operator selection: %w", err)
+	}
+	if actual.Mode != 1 || actual.Operator != plmn {
+		rollbackOperatorSelection(manager, client)
+		err := fmt.Errorf("network %s did not accept registration; automatic selection was restored (modem reported mode=%d operator=%q)", plmn, actual.Mode, actual.Operator)
+		manager.setResult(id, state, nil, err)
 		return OperatorSelection{}, err
 	}
-	if !automatic {
-		response, err := client.Execute(lockCtx, "AT+COPS?")
-		if err != nil {
-			manager.setResult(id, state, nil, err)
-			return OperatorSelection{}, fmt.Errorf("verify manual operator selection: %w", err)
-		}
-		actual, err := parseOperatorSelection(response)
-		if err != nil {
-			manager.setResult(id, state, nil, err)
-			return OperatorSelection{}, err
-		}
-		if actual.Mode != 1 || actual.Operator != plmn {
-			err := fmt.Errorf("network %s did not accept registration; modem reports mode=%d operator=%q", plmn, actual.Mode, actual.Operator)
-			manager.setResult(id, state, nil, err)
-			return OperatorSelection{}, err
-		}
-		result = actual
-	}
+	result = actual
 	manager.setResult(id, state, nil, nil)
 	return result, nil
 }
+
+func queryOperatorSelection(ctx context.Context, client modem.Client) (OperatorSelection, error) {
+	response, err := client.Execute(ctx, "AT+COPS?")
+	if err != nil {
+		return OperatorSelection{}, err
+	}
+	if !response.OK() {
+		return OperatorSelection{}, &modem.CommandError{Command: response.Command, Final: response.Final, Lines: response.Lines}
+	}
+	return parseOperatorSelection(response)
+}
+
+// restoreAutomaticOperatorSelection clears both a manual PLMN latch and an
+// old RAT-only scan restriction. The latter is important on EC20 modules:
+// COPS=0 alone can remain effectively LTE-only after an earlier lock, unlike a
+// phone's normal automatic GSM/WCDMA/LTE acquisition policy.
+func restoreAutomaticOperatorSelection(ctx context.Context, client modem.Client) (OperatorSelection, error) {
+	// Older firmware may not implement nwscanmode; COPS auto is still useful in
+	// that case, so this compatibility reset is best effort.
+	_, _ = client.Execute(ctx, `AT+QCFG="nwscanmode",0,1`)
+	_, _ = client.Execute(ctx, "AT+COPS=2")
+	response, err := client.Execute(ctx, "AT+COPS=0")
+	if err != nil {
+		return OperatorSelection{}, err
+	}
+	if !response.OK() {
+		return OperatorSelection{}, &modem.CommandError{Command: response.Command, Final: response.Final, Lines: response.Lines}
+	}
+	actual, err := queryOperatorSelection(ctx, client)
+	if err != nil {
+		return OperatorSelection{}, fmt.Errorf("verify automatic operator selection: %w", err)
+	}
+	if actual.Mode != 0 {
+		return OperatorSelection{}, fmt.Errorf("modem did not enter automatic operator selection (mode=%d operator=%q)", actual.Mode, actual.Operator)
+	}
+	return actual, nil
+}
+
+func rollbackOperatorSelection(manager *Manager, client modem.Client) {
+	rollbackCtx, cancel := context.WithTimeout(context.Background(), manager.longTimeout)
+	defer cancel()
+	_, _ = restoreAutomaticOperatorSelection(rollbackCtx, client)
+}
+
+// ReRegisterOperator detaches from the network and reapplies the modem's
+// current automatic/manual selection. This is intentionally different from a
+// passive refresh: it forces a new registration attempt without changing the
+// user's lock policy.
+func (manager *Manager) ReRegisterOperator(ctx context.Context, id string) (OperatorSelection, error) {
+	state, err := manager.lookup(id)
+	if err != nil {
+		return OperatorSelection{}, err
+	}
+	state.opMu.Lock()
+	defer state.opMu.Unlock()
+	if err := manager.validateActive(id, state); err != nil {
+		return OperatorSelection{}, err
+	}
+	client, err := manager.clientLocked(ctx, state, manager.candidateFor(state))
+	if err != nil {
+		manager.setResult(id, state, nil, err)
+		return OperatorSelection{}, err
+	}
+	longCtx, cancel := manager.withTimeout(ctx, manager.scanTimeout)
+	defer cancel()
+
+	current, err := queryOperatorSelection(longCtx, client)
+	if err != nil {
+		manager.setResult(id, state, nil, err)
+		return OperatorSelection{}, err
+	}
+	manual := current.Mode == 1 || current.Mode == 4
+	if manual && !decimalPLMN(current.Operator) {
+		response, formatErr := client.Execute(longCtx, "AT+COPS=3,2")
+		if formatErr != nil || !response.OK() {
+			if formatErr == nil {
+				formatErr = &modem.CommandError{Command: response.Command, Final: response.Final, Lines: response.Lines}
+			}
+			manager.setResult(id, state, nil, formatErr)
+			return OperatorSelection{}, formatErr
+		}
+		current, err = queryOperatorSelection(longCtx, client)
+		if err != nil {
+			manager.setResult(id, state, nil, err)
+			return OperatorSelection{}, err
+		}
+		manual = current.Mode == 1 || current.Mode == 4
+	}
+
+	if !manual {
+		result, restoreErr := restoreAutomaticOperatorSelection(longCtx, client)
+		manager.setResult(id, state, nil, restoreErr)
+		return result, restoreErr
+	}
+	desired := ""
+	if manual {
+		if !decimalPLMN(current.Operator) {
+			return OperatorSelection{}, errors.New("current manual operator is not available as a numeric PLMN")
+		}
+		desired = fmt.Sprintf(`AT+COPS=1,2,"%s"`, current.Operator)
+		if code, ok := accessTechnologyCode(current.AccessTechnology); ok {
+			desired += fmt.Sprintf(",%d", code)
+		}
+	}
+	for _, command := range []string{"AT+COPS=2", desired} {
+		response, executeErr := client.Execute(longCtx, command)
+		if executeErr != nil {
+			manager.setResult(id, state, nil, executeErr)
+			return OperatorSelection{}, executeErr
+		}
+		if !response.OK() {
+			executeErr = &modem.CommandError{Command: response.Command, Final: response.Final, Lines: response.Lines}
+			manager.setResult(id, state, nil, executeErr)
+			return OperatorSelection{}, executeErr
+		}
+	}
+	result, err := queryOperatorSelection(longCtx, client)
+	manager.setResult(id, state, nil, err)
+	if err != nil {
+		return OperatorSelection{}, err
+	}
+	return result, nil
+}
+
+func decimalPLMN(value string) bool {
+	value = strings.TrimSpace(value)
+	return (len(value) == 5 || len(value) == 6) && strings.IndexFunc(value, func(r rune) bool {
+		return r < '0' || r > '9'
+	}) < 0
+}
+
+func accessTechnologyCode(name string) (int, bool) {
+	switch strings.ToUpper(strings.TrimSpace(name)) {
+	case "GSM":
+		return 0, true
+	case "UTRAN":
+		return 2, true
+	case "EDGE":
+		return 3, true
+	case "HSDPA":
+		return 4, true
+	case "HSUPA":
+		return 5, true
+	case "HSPA":
+		return 6, true
+	case "LTE":
+		return 7, true
+	case "NR5G":
+		return 9, true
+	default:
+		return 0, false
+	}
+}

internal/device/data_linux.go

@@ -4,9 +4,13 @@ package device
 
 import (
 	"context"
+	"errors"
 	"fmt"
+	"hash/fnv"
+	"net"
 	"os"
 	"os/exec"
+	"strconv"
 	"strings"
 	"time"
 
@@ -31,7 +35,11 @@ func setQMINetwork(
 	profilePath := profile.Name()
 	defer os.Remove(profilePath)
 	ipType := map[string]string{"IP": "4", "IPV6": "6", "IPV4V6": "4"}[ipVersion]
-	if _, err := fmt.Fprintf(profile, "APN=%s\nIP_TYPE=%s\nPROXY=yes\n", apn, ipType); err != nil {
+	profileText := fmt.Sprintf("IP_TYPE=%s\nPROXY=yes\n", ipType)
+	if apn != "" {
+		profileText = "APN=" + apn + "\n" + profileText
+	}
+	if _, err := fmt.Fprint(profile, profileText); err != nil {
 		_ = profile.Close()
 		return NetworkResult{}, fmt.Errorf("write temporary QMI profile: %w", err)
 	}
@@ -54,36 +62,42 @@ func setQMINetwork(
 		lowerDetail := strings.ToLower(detail)
 		idempotentStop := !enabled && (strings.Contains(lowerDetail, "already stopped") ||
 			strings.Contains(lowerDetail, "not started") || strings.Contains(lowerDetail, "no network"))
-		if !idempotentStop {
+		idempotentStart := enabled && (strings.Contains(lowerDetail, "already started") ||
+			strings.Contains(lowerDetail, "already connected"))
+		if !idempotentStop && !idempotentStart {
 			return NetworkResult{}, fmt.Errorf("qmi-network %s failed: %w: %s", action, err, detail)
 		}
 	}
-	if ipCommand, lookErr := exec.LookPath("ip"); lookErr == nil {
-		linkAction := "down"
-		if enabled {
-			linkAction = "up"
-		}
-		linkOutput, linkErr := exec.CommandContext(ctx, ipCommand, "link", "set", "dev", candidate.NetworkInterface, linkAction).CombinedOutput()
-		if linkErr != nil {
-			return NetworkResult{}, fmt.Errorf("set %s %s: %w: %s", candidate.NetworkInterface, linkAction, linkErr, strings.TrimSpace(string(linkOutput)))
-		}
+	ipCommand, lookErr := exec.LookPath("ip")
+	if lookErr != nil {
+		return NetworkResult{}, fmt.Errorf("%w: install iproute2 to control %s", ErrDataBackendUnavailable, candidate.NetworkInterface)
+	}
+	linkAction := "down"
+	if enabled {
+		linkAction = "up"
+	}
+	linkOutput, linkErr := exec.CommandContext(ctx, ipCommand, "link", "set", "dev", candidate.NetworkInterface, linkAction).CombinedOutput()
+	if linkErr != nil {
+		return NetworkResult{}, fmt.Errorf("set %s %s: %w: %s", candidate.NetworkInterface, linkAction, linkErr, strings.TrimSpace(string(linkOutput)))
 	}
 	if enabled {
-		if busybox, lookErr := exec.LookPath("busybox"); lookErr == nil {
-			dhcpOutput, dhcpErr := exec.CommandContext(ctx, busybox, "udhcpc", "-q", "-n", "-t", "5", "-T", "3", "-i", candidate.NetworkInterface).CombinedOutput()
-			if dhcpErr != nil {
-				rollbackCtx, cancelRollback := context.WithTimeout(context.Background(), managerCommandCleanupTimeout)
-				defer cancelRollback()
-				_, _ = exec.CommandContext(rollbackCtx, qmiNetwork, "--profile="+profilePath, candidate.QMIControl, "stop").CombinedOutput()
-				if ipCommand, lookErr := exec.LookPath("ip"); lookErr == nil {
-					_, _ = exec.CommandContext(rollbackCtx, ipCommand, "link", "set", "dev", candidate.NetworkInterface, "down").CombinedOutput()
-				}
-				return NetworkResult{}, fmt.Errorf("QMI session started but DHCP failed: %w: %s", dhcpErr, strings.TrimSpace(string(dhcpOutput)))
-			}
-			if value := strings.TrimSpace(string(dhcpOutput)); value != "" {
-				detail = strings.TrimSpace(detail + "\n" + value)
-			}
+		busybox, busyboxErr := exec.LookPath("busybox")
+		if busyboxErr != nil {
+			return NetworkResult{}, fmt.Errorf("%w: busybox udhcpc is required for %s", ErrDataBackendUnavailable, candidate.NetworkInterface)
 		}
+		dhcpDetail, dhcpErr := configureExportProxyDHCP(ctx, busybox, ipCommand, candidate.NetworkInterface)
+		if dhcpErr != nil {
+			rollbackCtx, cancelRollback := context.WithTimeout(context.Background(), managerCommandCleanupTimeout)
+			defer cancelRollback()
+			clearExportProxyRoute(rollbackCtx, candidate.NetworkInterface)
+			_, _ = exec.CommandContext(rollbackCtx, qmiNetwork, "--profile="+profilePath, candidate.QMIControl, "stop").CombinedOutput()
+			_, _ = exec.CommandContext(rollbackCtx, ipCommand, "link", "set", "dev", candidate.NetworkInterface, "down").CombinedOutput()
+			return NetworkResult{}, fmt.Errorf("QMI session started but protected DHCP failed: %w", dhcpErr)
+		}
+		detail = strings.TrimSpace(detail + "\n" + dhcpDetail)
+	} else {
+		clearExportProxyRoute(ctx, candidate.NetworkInterface)
+		_, _ = exec.CommandContext(ctx, ipCommand, "-4", "addr", "flush", "dev", candidate.NetworkInterface, "scope", "global").CombinedOutput()
 	}
 	return NetworkResult{
 		Enabled:       enabled,
@@ -96,4 +110,173 @@ func setQMINetwork(
 	}, nil
 }
 
+// exportProxyRouteIdentity must stay in sync with the Export Proxy plugin's
+// Linux socket mark. Unmarked host traffic never sees the cellular default
+// route; only plugin sockets carrying this mark are policy-routed to it.
+func exportProxyRouteIdentity(networkInterface string) (mark uint32, table, priority int) {
+	hash := fnv.New32a()
+	_, _ = hash.Write([]byte(networkInterface))
+	value := hash.Sum32()
+	mark = 0x56000000 | (value & 0x00ffffff)
+	table = 20000 + int(value%10000)
+	priority = 20000 + int(value%10000)
+	return
+}
+
+func configureExportProxyDHCP(ctx context.Context, busybox, ipCommand, networkInterface string) (string, error) {
+	lease, err := os.CreateTemp("", "vocat-dhcp-lease-*.env")
+	if err != nil {
+		return "", err
+	}
+	leasePath := lease.Name()
+	_ = lease.Close()
+	_ = os.Remove(leasePath)
+	defer os.Remove(leasePath)
+	script, err := os.CreateTemp("", "vocat-udhcpc-*.sh")
+	if err != nil {
+		return "", err
+	}
+	scriptPath := script.Name()
+	defer os.Remove(scriptPath)
+	scriptText := fmt.Sprintf(`#!/bin/sh
+case "$1" in
+  bound|renew)
+    (umask 077; printf 'ip=%%s\nsubnet=%%s\nrouter=%%s\ndns=%%s\n' "$ip" "$subnet" "$router" "$dns" > %q)
+    ;;
+esac
+exit 0
+`, leasePath)
+	if _, err := script.WriteString(scriptText); err != nil {
+		_ = script.Close()
+		return "", err
+	}
+	if err := script.Chmod(0o700); err != nil {
+		_ = script.Close()
+		return "", err
+	}
+	if err := script.Close(); err != nil {
+		return "", err
+	}
+	output, err := exec.CommandContext(ctx, busybox, "udhcpc", "-q", "-n", "-t", "5", "-T", "3", "-i", networkInterface, "-s", scriptPath).CombinedOutput()
+	if err != nil {
+		if strings.Contains(strings.ToLower(string(output)), "address family not supported") {
+			return "", fmt.Errorf("udhcpc cannot open its link-layer socket: allow AF_PACKET in the vocat systemd service RestrictAddressFamilies setting: %w", err)
+		}
+		return "", fmt.Errorf("udhcpc: %w: %s", err, strings.TrimSpace(string(output)))
+	}
+	raw, err := os.ReadFile(leasePath)
+	if err != nil {
+		return "", fmt.Errorf("read DHCP lease: %w", err)
+	}
+	values := make(map[string]string)
+	for _, line := range strings.Split(string(raw), "\n") {
+		key, value, found := strings.Cut(line, "=")
+		if found {
+			values[strings.TrimSpace(key)] = strings.TrimSpace(value)
+		}
+	}
+	address := net.ParseIP(values["ip"]).To4()
+	maskIP := net.ParseIP(values["subnet"]).To4()
+	if address == nil || maskIP == nil {
+		return "", errors.New("DHCP returned no valid IPv4 address/subnet")
+	}
+	mask := net.IPMask(maskIP)
+	ones, bits := mask.Size()
+	if bits != 32 || ones < 0 {
+		return "", errors.New("DHCP returned an invalid IPv4 subnet")
+	}
+	network := address.Mask(mask)
+	routers := strings.Fields(values["router"])
+	if len(routers) > 0 && net.ParseIP(routers[0]).To4() == nil {
+		return "", errors.New("DHCP returned an invalid IPv4 gateway")
+	}
+	if result, addrErr := exec.CommandContext(ctx, ipCommand, "-4", "addr", "replace", fmt.Sprintf("%s/%d", address.String(), ones), "dev", networkInterface).CombinedOutput(); addrErr != nil {
+		return "", fmt.Errorf("configure cellular address: %w: %s", addrErr, strings.TrimSpace(string(result)))
+	}
+	mark, table, priority := exportProxyRouteIdentity(networkInterface)
+	clearExportProxyRoute(ctx, networkInterface)
+	connectedCIDR := fmt.Sprintf("%s/%d", network.String(), ones)
+	if result, routeErr := exec.CommandContext(ctx, ipCommand, "-4", "route", "replace", "table", strconv.Itoa(table), connectedCIDR, "dev", networkInterface, "scope", "link", "src", address.String()).CombinedOutput(); routeErr != nil {
+		clearExportProxyRoute(ctx, networkInterface)
+		return "", fmt.Errorf("install protected connected route: %w: %s", routeErr, strings.TrimSpace(string(result)))
+	}
+	defaultArgs := []string{"-4", "route", "replace", "table", strconv.Itoa(table), "default"}
+	if len(routers) > 0 {
+		defaultArgs = append(defaultArgs, "via", routers[0])
+	}
+	defaultArgs = append(defaultArgs, "dev", networkInterface, "onlink")
+	if result, routeErr := exec.CommandContext(ctx, ipCommand, defaultArgs...).CombinedOutput(); routeErr != nil {
+		clearExportProxyRoute(ctx, networkInterface)
+		return "", fmt.Errorf("install protected default route: %w: %s", routeErr, strings.TrimSpace(string(result)))
+	}
+	markText := fmt.Sprintf("0x%x", mark)
+	result, err := exec.CommandContext(ctx, ipCommand, "rule", "add", "priority", strconv.Itoa(priority), "fwmark", markText, "lookup", strconv.Itoa(table)).CombinedOutput()
+	if err != nil {
+		clearExportProxyRoute(ctx, networkInterface)
+		return "", fmt.Errorf("install protected routing rule: %w: %s", err, strings.TrimSpace(string(result)))
+	}
+	if err := writeExportProxyDNS(networkInterface, strings.Fields(values["dns"])); err != nil {
+		clearExportProxyRoute(ctx, networkInterface)
+		return "", fmt.Errorf("publish protected DNS configuration: %w", err)
+	}
+	return fmt.Sprintf("protected DHCP lease %s/%d", address.String(), ones), nil
+}
+
+func exportProxyDNSPath(networkInterface string) string {
+	safeName := strings.Map(func(character rune) rune {
+		if character >= 'a' && character <= 'z' || character >= 'A' && character <= 'Z' ||
+			character >= '0' && character <= '9' || character == '-' || character == '_' || character == '.' {
+			return character
+		}
+		return '_'
+	}, networkInterface)
+	return "/run/vocat/cellular-" + safeName + ".dns"
+}
+
+func writeExportProxyDNS(networkInterface string, servers []string) error {
+	valid := make([]string, 0, len(servers))
+	for _, server := range servers {
+		if address := net.ParseIP(server); address != nil {
+			valid = append(valid, address.String())
+		}
+	}
+	if len(valid) == 0 {
+		// This is used only by marked Export Proxy sockets. It never changes the
+		// host resolver and is merely a fallback for carriers omitting DHCP DNS.
+		valid = []string{"1.1.1.1", "8.8.8.8"}
+	}
+	if err := os.MkdirAll("/run/vocat", 0o755); err != nil {
+		return err
+	}
+	temporary, err := os.CreateTemp("/run/vocat", ".cellular-dns-*")
+	if err != nil {
+		return err
+	}
+	temporaryPath := temporary.Name()
+	defer os.Remove(temporaryPath)
+	if _, err := temporary.WriteString(strings.Join(valid, "\n") + "\n"); err != nil {
+		_ = temporary.Close()
+		return err
+	}
+	if err := temporary.Chmod(0o644); err != nil {
+		_ = temporary.Close()
+		return err
+	}
+	if err := temporary.Close(); err != nil {
+		return err
+	}
+	return os.Rename(temporaryPath, exportProxyDNSPath(networkInterface))
+}
+
+func clearExportProxyRoute(ctx context.Context, networkInterface string) {
+	_ = os.Remove(exportProxyDNSPath(networkInterface))
+	ipCommand, err := exec.LookPath("ip")
+	if err != nil {
+		return
+	}
+	mark, table, priority := exportProxyRouteIdentity(networkInterface)
+	_, _ = exec.CommandContext(ctx, ipCommand, "rule", "del", "priority", strconv.Itoa(priority), "fwmark", fmt.Sprintf("0x%x", mark), "lookup", strconv.Itoa(table)).CombinedOutput()
+	_, _ = exec.CommandContext(ctx, ipCommand, "-4", "route", "flush", "table", strconv.Itoa(table)).CombinedOutput()
+}
+
 const managerCommandCleanupTimeout = 15 * time.Second

internal/device/data_test.go

@@ -74,7 +74,10 @@ func TestOperatorSelectionManualAndAutomatic(t *testing.T) {
 	client := &transcriptClient{steps: []clientStep{
 		{command: `AT+COPS=1,2,"46000",7`, response: okResponse()},
 		{command: "AT+COPS?", response: okResponse(`+COPS: 1,2,"46000",7`)},
+		{command: `AT+QCFG="nwscanmode",0,1`, response: okResponse()},
+		{command: "AT+COPS=2", response: okResponse()},
 		{command: "AT+COPS=0", response: okResponse()},
+		{command: "AT+COPS?", response: okResponse(`+COPS: 0,2,"46001",7`)},
 	}}
 	manager, id := newStartedTestManager(t, client)
 	act := 7
@@ -89,7 +92,7 @@ func TestOperatorSelectionManualAndAutomatic(t *testing.T) {
 	if err != nil {
 		t.Fatalf("automatic selection: %v", err)
 	}
-	if selection.Mode != 0 || selection.Operator != "" {
+	if selection.Mode != 0 || selection.Operator != "46001" {
 		t.Fatalf("automatic selection = %#v", selection)
 	}
 	client.assertDone(t)
@@ -99,6 +102,10 @@ func TestOperatorSelectionRejectsAutomaticFallbackAsSuccess(t *testing.T) {
 	client := &transcriptClient{steps: []clientStep{
 		{command: `AT+COPS=1,2,"46000",7`, response: okResponse()},
 		{command: "AT+COPS?", response: okResponse("+COPS: 0")},
+		{command: `AT+QCFG="nwscanmode",0,1`, response: okResponse()},
+		{command: "AT+COPS=2", response: okResponse()},
+		{command: "AT+COPS=0", response: okResponse()},
+		{command: "AT+COPS?", response: okResponse(`+COPS: 0,2,"46001",7`)},
 	}}
 	manager, id := newStartedTestManager(t, client)
 	act := 7
@@ -107,3 +114,77 @@ func TestOperatorSelectionRejectsAutomaticFallbackAsSuccess(t *testing.T) {
 	}
 	client.assertDone(t)
 }
+
+func TestOperatorSelectionCommandFailureRestoresAutomaticMode(t *testing.T) {
+	selectionErr := errors.New("+CME ERROR: 30")
+	client := &transcriptClient{steps: []clientStep{
+		{command: `AT+COPS=1,2,"46000",7`, err: selectionErr},
+		{command: `AT+QCFG="nwscanmode",0,1`, response: okResponse()},
+		{command: "AT+COPS=2", response: okResponse()},
+		{command: "AT+COPS=0", response: okResponse()},
+		{command: "AT+COPS?", response: okResponse(`+COPS: 0,2,"46001",7`)},
+	}}
+	manager, id := newStartedTestManager(t, client)
+	act := 7
+	_, err := manager.SetOperatorSelection(context.Background(), id, false, "46000", &act)
+	if !errors.Is(err, selectionErr) {
+		t.Fatalf("error = %v, want wrapped selection error", err)
+	}
+	client.assertDone(t)
+}
+
+func TestReRegisterOperatorReappliesAutomaticMode(t *testing.T) {
+	client := &transcriptClient{steps: []clientStep{
+		{command: "AT+COPS?", response: okResponse(`+COPS: 0,2,"46001",7`)},
+		{command: `AT+QCFG="nwscanmode",0,1`, response: okResponse()},
+		{command: "AT+COPS=2", response: okResponse()},
+		{command: "AT+COPS=0", response: okResponse()},
+		{command: "AT+COPS?", response: okResponse(`+COPS: 0,2,"46001",7`)},
+	}}
+	manager, id := newStartedTestManager(t, client)
+	selection, err := manager.ReRegisterOperator(context.Background(), id)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if selection.Mode != 0 || selection.Operator != "46001" {
+		t.Fatalf("selection = %#v", selection)
+	}
+	client.assertDone(t)
+}
+
+func TestReRegisterOperatorPreservesManualLock(t *testing.T) {
+	client := &transcriptClient{steps: []clientStep{
+		{command: "AT+COPS?", response: okResponse(`+COPS: 1,2,"46003",7`)},
+		{command: "AT+COPS=2", response: okResponse()},
+		{command: `AT+COPS=1,2,"46003",7`, response: okResponse()},
+		{command: "AT+COPS?", response: okResponse(`+COPS: 1,2,"46003",7`)},
+	}}
+	manager, id := newStartedTestManager(t, client)
+	selection, err := manager.ReRegisterOperator(context.Background(), id)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if selection.Mode != 1 || selection.Operator != "46003" || selection.AccessTechnology != "LTE" {
+		t.Fatalf("selection = %#v", selection)
+	}
+	client.assertDone(t)
+}
+
+func TestReRegisterOperatorRecoversDeregisteredModeWithAutomaticSelection(t *testing.T) {
+	client := &transcriptClient{steps: []clientStep{
+		{command: "AT+COPS?", response: okResponse(`+COPS: 2`)},
+		{command: `AT+QCFG="nwscanmode",0,1`, response: okResponse()},
+		{command: "AT+COPS=2", response: okResponse()},
+		{command: "AT+COPS=0", response: okResponse()},
+		{command: "AT+COPS?", response: okResponse(`+COPS: 0,2,"46001",7`)},
+	}}
+	manager, id := newStartedTestManager(t, client)
+	selection, err := manager.ReRegisterOperator(context.Background(), id)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if selection.Mode != 0 || selection.Operator != "46001" {
+		t.Fatalf("selection = %#v", selection)
+	}
+	client.assertDone(t)
+}

internal/device/es9p.go

@@ -3,14 +3,17 @@ package device
 import (
 	"bytes"
 	"context"
-	"crypto/tls"
 	"encoding/base64"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
 	"strings"
 	"time"
+
+	"vocat/internal/netguard"
 )
 
 // es9pClient speaks SGP.22 ES9+ — JSON over HTTPS — to one SM-DP+. It is the
@@ -24,25 +27,31 @@ import (
 // header.functionExecutionStatus (with statusCodeData.message holding the
 // human-readable failure, e.g. "The matchingID is not found").
 type es9pClient struct {
-	smdp string
-	http *http.Client
+	smdp     string
+	endpoint *url.URL
+	http     *http.Client
 }
 
-func newES9PClient(smdp string) *es9pClient {
-	// The eUICC — not the host — is the root of trust for RSP: during
-	// AuthenticateServer the card verifies the SM-DP+'s CERT.DPauth.SIG against
-	// its embedded CI root, so a rogue/TLS-MitM server cannot forge a signature
-	// the card will accept. The host TLS layer is transport only, and a minimal
-	// embedded box may ship no CA bundle (this is exactly what broke on the test
-	// machine), so we don't anchor host TLS to system roots. InsecureSkipVerify
-	// is safe here specifically because the card does the authoritative check.
-	transport := &http.Transport{
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //nolint:gosec // eUICC is the RSP trust anchor
+func newES9PClient(ctx context.Context, smdp string) (*es9pClient, error) {
+	smdp = strings.TrimSpace(smdp)
+	if smdp == "" || strings.Contains(smdp, "://") {
+		return nil, errors.New("esim: SM-DP+ address must be a hostname with an optional port")
+	}
+	candidate, err := url.Parse("https://" + smdp)
+	if err != nil || candidate.Hostname() == "" || candidate.User != nil ||
+		(candidate.Path != "" && candidate.Path != "/") || candidate.RawQuery != "" || candidate.Fragment != "" {
+		return nil, errors.New("esim: SM-DP+ address must be a hostname with an optional port")
+	}
+	candidate.Path = ""
+	validated, err := netguard.ValidatePublicURL(ctx, candidate.String(), true)
+	if err != nil {
+		return nil, fmt.Errorf("esim: unsafe SM-DP+ address: %w", err)
 	}
 	return &es9pClient{
-		smdp: strings.TrimSpace(smdp),
-		http: &http.Client{Timeout: 90 * time.Second, Transport: transport},
-	}
+		smdp:     validated.Host,
+		endpoint: validated,
+		http:     netguard.NewPublicHTTPClient(90*time.Second, true),
+	}, nil
 }
 
 // es9pError is a failed ES9+ functionExecutionStatus. Message is the SM-DP+'s
@@ -80,12 +89,13 @@ type es9pStatusCodeData struct {
 // is decided the way lpac decides it: a non-success execution status, or a
 // missing required output field, yields an es9pError carrying the SM-DP+ message.
 func (c *es9pClient) call(ctx context.Context, function string, request map[string]string, requiredOut ...string) (map[string]json.RawMessage, error) {
-	url := "https://" + c.smdp + "/gsma/rsp2/es9plus/" + function
+	endpoint := *c.endpoint
+	endpoint.Path = "/gsma/rsp2/es9plus/" + function
 	body, err := json.Marshal(request)
 	if err != nil {
 		return nil, err
 	}
-	httpReq, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(body))
+	httpReq, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint.String(), bytes.NewReader(body))
 	if err != nil {
 		return nil, err
 	}

internal/device/es9p_test.go

@@ -7,6 +7,7 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"strings"
 	"testing"
 )
@@ -16,9 +17,15 @@ func newTestES9P(t *testing.T, handler http.HandlerFunc) *es9pClient {
 	t.Helper()
 	server := httptest.NewTLSServer(handler)
 	t.Cleanup(server.Close)
-	client := newES9PClient(strings.TrimPrefix(server.URL, "https://"))
-	client.http = server.Client()
-	return client
+	endpoint, err := url.Parse(server.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return &es9pClient{
+		smdp:     strings.TrimPrefix(server.URL, "https://"),
+		endpoint: endpoint,
+		http:     server.Client(),
+	}
 }
 
 func successEnvelope(fields map[string]any) map[string]any {
@@ -33,6 +40,20 @@ func successEnvelope(fields map[string]any) map[string]any {
 
 func b64(value []byte) string { return base64.StdEncoding.EncodeToString(value) }
 
+func TestNewES9PClientRejectsUnsafeAddress(t *testing.T) {
+	for _, address := range []string{
+		"https://rsp.example.com",
+		"127.0.0.1",
+		"169.254.169.254",
+		"rsp.example.com/unexpected/path",
+		"user:[email protected]",
+	} {
+		if _, err := newES9PClient(context.Background(), address); err == nil {
+			t.Errorf("newES9PClient(%q) accepted an unsafe address", address)
+		}
+	}
+}
+
 func TestInitiateAuthenticationSuccess(t *testing.T) {
 	signed1 := []byte{0x30, 0x03, 0x80, 0x01, 0x09}
 	client := newTestES9P(t, func(w http.ResponseWriter, r *http.Request) {

internal/device/esim.go

@@ -26,6 +26,12 @@ import (
 // isdRAID is the standard ISD-R AID that hosts the LPA functions (ES10).
 const isdRAID = "A0000005591010FFFFFFFF8900000100"
 
+// xesimISDRAID is the alternate ISD-R application exposed by XeSIM cards.
+// It implements the same ES10 interface, but is not selectable through the
+// standard ...0100 AID. Selecting it is a read-only capability probe; profile
+// state is never changed during discovery.
+const xesimISDRAID = "A0000005591010FFFFFFFF8900000177"
+
 // eSTK multi-SE products expose each eUICC storage through its own vendor
 // ISD-R AID. The standard GSMA AID aliases one of them, so probing only that
 // AID silently hides the second storage.
@@ -296,20 +302,32 @@ func (manager *Manager) openEuiccOnceAID(ctx context.Context, id, aidHex string)
 	return channel, nil
 }
 
-// discoverEuiccAIDs detects eSTK multi-SE cards without changing any profile
-// state. The vendor product applet is selected only as a read-only capability
-// probe; when present, both vendor ISD-R AIDs are tried. Per OpenEUICC's eSTK
-// integration, the generic GSMA AID is not appended after an eSTK SE opens,
-// because it aliases one of the same storages.
+// discoverEuiccAIDs detects eSTK multi-SE and alternate-ISD-R cards without
+// changing any profile state. The vendor product applet and candidate ISD-R
+// applications are selected only as read-only capability probes. Per
+// OpenEUICC's eSTK integration, generic AIDs are not appended after an eSTK SE
+// opens, because the standard AID aliases one of the same storages.
 func (manager *Manager) discoverEuiccAIDs(ctx context.Context, id string) []string {
 	product, err := manager.openEuiccAID(ctx, id, estkProductAID)
-	if err != nil {
-		return []string{isdRAID}
+	if err == nil {
+		product.close(context.Background())
+
+		var found []string
+		for _, aid := range []string{estkSE0AID, estkSE1AID} {
+			channel, err := manager.openEuiccAID(ctx, id, aid)
+			if err != nil {
+				continue
+			}
+			channel.close(context.Background())
+			found = append(found, aid)
+		}
+		if len(found) > 0 {
+			return found
+		}
 	}
-	product.close(context.Background())
 
 	var found []string
-	for _, aid := range []string{estkSE0AID, estkSE1AID} {
+	for _, aid := range []string{isdRAID, xesimISDRAID} {
 		channel, err := manager.openEuiccAID(ctx, id, aid)
 		if err != nil {
 			continue
@@ -317,10 +335,12 @@ func (manager *Manager) discoverEuiccAIDs(ctx context.Context, id string) []stri
 		channel.close(context.Background())
 		found = append(found, aid)
 	}
-	if len(found) == 0 {
-		return []string{isdRAID}
+	if len(found) > 0 {
+		return found
 	}
-	return found
+	// Preserve the old error path for a physical SIM with no eUICC. The caller
+	// retries the standard AID once and returns ErrNoEUICC to the HTTP layer.
+	return []string{isdRAID}
 }
 
 func isTransientEuiccCME(err error) bool {
@@ -531,18 +551,27 @@ func (manager *Manager) ESIMListProfiles(ctx context.Context, id string) (EsimIn
 		}
 		return EsimInfo{}, errESIMRecovering
 	}
-	channel, err := manager.openEuicc(ctx, id)
-	if err != nil {
-		return EsimInfo{}, err
+	var lastErr error
+	for _, aid := range manager.discoverEuiccAIDs(ctx, id) {
+		channel, err := manager.openEuiccAID(ctx, id, aid)
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		payload, err := channel.es10(ctx, []byte{0xBF, 0x2D, 0x00}) // GetProfilesInfo
+		channel.close(context.Background())
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		info := EsimInfo{AID: aid, Profiles: parseProfilesInfo(payload)}
+		manager.cacheESIMInfo(id, info)
+		return info, nil
 	}
-	defer channel.close(context.Background())
-	payload, err := channel.es10(ctx, []byte{0xBF, 0x2D, 0x00}) // GetProfilesInfo
-	if err != nil {
-		return EsimInfo{}, err
+	if lastErr != nil {
+		return EsimInfo{}, lastErr
 	}
-	info := EsimInfo{Profiles: parseProfilesInfo(payload)}
-	manager.cacheESIMInfo(id, info)
-	return info, nil
+	return EsimInfo{}, ErrNoEUICC
 }
 
 // ESIMSwitchProfile enables one profile by ICCID via ES10c EnableProfile.
@@ -774,7 +803,14 @@ func (manager *Manager) refreshAfterProfileSwitch(id string) {
 	time.Sleep(settle)
 	for attempt := 0; attempt < attempts; attempt++ {
 		ctx, cancel := context.WithTimeout(context.Background(), manager.commandTimeout*4)
-		_, err := manager.Refresh(ctx, id)
+		_, _ = manager.Discover(ctx)
+		_, flightErr := manager.SetFlight(ctx, id, true)
+		var err error
+		if flightErr == nil {
+			_, err = manager.Refresh(ctx, id)
+		} else {
+			err = flightErr
+		}
 		cancel()
 		if err == nil {
 			return

internal/device/esim_download.go

@@ -74,7 +74,10 @@ func (manager *Manager) ESIMDownloadProfile(ctx context.Context, id string, para
 		return nil, err
 	}
 
-	client := newES9PClient(smdp)
+	client, err := newES9PClient(ctx, smdp)
+	if err != nil {
+		return nil, err
+	}
 
 	report("auth_client", "正在向 SM-DP+ 进行客户端身份认证...", 30)
 	init, err := client.initiateAuthentication(ctx, challenge, info1)
@@ -217,17 +220,26 @@ type EsimChipInfo struct {
 func (manager *Manager) ESIMChipInfo(ctx context.Context, id string) (*EsimChipInfo, error) {
 	manager.esimMu.Lock()
 	defer manager.esimMu.Unlock()
-	channel, err := manager.openEuicc(ctx, id)
-	if err != nil {
-		return nil, err
-	}
-	defer channel.close(context.Background())
 
-	info, err := readEsimChipInfo(ctx, channel, isdRAID)
-	if err != nil {
-		return nil, err
+	var lastErr error
+	for _, aid := range manager.discoverEuiccAIDs(ctx, id) {
+		channel, err := manager.openEuiccAID(ctx, id, aid)
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		info, err := readEsimChipInfo(ctx, channel, aid)
+		channel.close(context.Background())
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		return &info, nil
 	}
-	return &info, nil
+	if lastErr != nil {
+		return nil, lastErr
+	}
+	return nil, ErrNoEUICC
 }
 
 func readEsimChipInfo(ctx context.Context, channel *euiccChannel, aidHex string) (EsimChipInfo, error) {

internal/device/esim_test.go

@@ -244,6 +244,45 @@ func TestTransientEuiccCMEClassification(t *testing.T) {
 	}
 }
 
+func TestDiscoverEuiccAIDsFindsXeSIMAlternateISDR(t *testing.T) {
+	manageChannel := clientStep{
+		command:  `AT+CSIM=10,"0070000001"`,
+		response: okResponse(`+CSIM: 6,"019000"`),
+	}
+	closeChannel := clientStep{
+		command:  `AT+CSIM=10,"0070800100"`,
+		response: okResponse(`+CSIM: 4,"9000"`),
+	}
+	selectStep := func(aid, response string) clientStep {
+		return clientStep{
+			command:  fmt.Sprintf(`AT+CSIM=42,"01A4040010%s"`, aid),
+			response: okResponse(fmt.Sprintf(`+CSIM: 4,"%s"`, response)),
+		}
+	}
+
+	client := &transcriptClient{steps: []clientStep{
+		// No eSTK product applet on this card.
+		manageChannel,
+		selectStep(estkProductAID, "6A82"),
+		closeChannel,
+		// XeSIM does not expose the standard GSMA ...0100 application.
+		manageChannel,
+		selectStep(isdRAID, "6A82"),
+		closeChannel,
+		// Its dedicated ...0177 ISD-R is selectable.
+		manageChannel,
+		selectStep(xesimISDRAID, "9000"),
+		closeChannel,
+	}}
+	manager, id := newStartedTestManager(t, client)
+
+	aids := manager.discoverEuiccAIDs(context.Background(), id)
+	if len(aids) != 1 || aids[0] != xesimISDRAID {
+		t.Fatalf("discovered AIDs = %#v, want XeSIM %s", aids, xesimISDRAID)
+	}
+	client.assertDone(t)
+}
+
 func TestEUICCChannelStuckWrapsTransientCME(t *testing.T) {
 	cause := &modem.CommandError{
 		Command: `AT+CSIM=10,"0070000001"`,

internal/device/manager.go

@@ -50,6 +50,8 @@ type ussdSession struct {
 type managedDevice struct {
 	opMu              sync.Mutex
 	candidate         modem.Candidate
+	backend           string
+	lastICCID         string
 	client            modem.Client
 	snapshot          *Snapshot
 	lastError         string
@@ -358,16 +360,44 @@ func (manager *Manager) Refresh(ctx context.Context, id string) (Snapshot, error
 		return Snapshot{}, err
 	}
 	candidate := manager.candidateFor(state)
+	backend := manager.backendFor(state)
 	client, err := manager.clientLocked(ctx, state, candidate)
 	if err != nil {
 		manager.setResult(id, state, nil, err)
 		return Snapshot{}, err
 	}
-	snapshot, err := manager.readSnapshot(ctx, id, candidate, client)
+	previousICCID := state.lastICCID
+	snapshot, err := manager.readSnapshot(ctx, id, candidate, backend, previousICCID, client)
+	if err == nil && strings.TrimSpace(snapshot.ICCID) != "" {
+		state.lastICCID = strings.TrimSpace(snapshot.ICCID)
+	}
 	manager.setResult(id, state, &snapshot, err)
 	return snapshot, err
 }
 
+// SetBackend selects which control plane supplies registration and data state.
+// AT remains available in either mode for UICC, RF, SMS, voice and diagnostics.
+func (manager *Manager) SetBackend(id, backend string) error {
+	backend = strings.ToLower(strings.TrimSpace(backend))
+	if backend != "at" && backend != "qmi" {
+		return fmt.Errorf("unsupported device backend %q", backend)
+	}
+	manager.mu.Lock()
+	defer manager.mu.Unlock()
+	state := manager.devices[id]
+	if state == nil || !state.discovered {
+		return ErrNotFound
+	}
+	state.backend = backend
+	return nil
+}
+
+func (manager *Manager) backendFor(state *managedDevice) string {
+	manager.mu.RLock()
+	defer manager.mu.RUnlock()
+	return state.backend
+}
+
 func (manager *Manager) ExecuteAT(
 	ctx context.Context,
 	id string,

internal/device/manager_test.go

@@ -19,6 +19,14 @@ func TestManagerRefreshBuildsEC20Snapshot(t *testing.T) {
 			),
 		},
 		{command: "AT+CPIN?", response: okResponse("+CPIN: READY")},
+		{
+			command:  "AT+CCID",
+			response: modem.Response{Final: "+CME ERROR: 100"},
+			err:      errors.New("CCID unsupported"),
+		},
+		{command: "AT+QCCID", response: okResponse("+QCCID: 8986001234567890123F")},
+		{command: "AT+CIMI", response: okResponse("460001234567890")},
+		{command: "AT+CRSM=176,28486,0,0,17", response: okResponse(`+CRSM: 144,0,"00434D4343FFFFFFFFFFFFFFFFFFFFFFFF"`)},
 		{command: "AT+CSQ", response: okResponse("+CSQ: 20,99")},
 		{
 			command: `AT+QENG="servingcell"`,
@@ -27,14 +35,8 @@ func TestManagerRefreshBuildsEC20Snapshot(t *testing.T) {
 			),
 		},
 		{command: "AT+COPS?", response: okResponse(`+COPS: 0,0,"China Mobile",7`)},
+		{command: "AT+CEREG?", response: okResponse(`+CEREG: 0,5`)},
 		{command: "AT+CGSN", response: okResponse("867123456789012")},
-		{
-			command:  "AT+CCID",
-			response: modem.Response{Final: "+CME ERROR: 100"},
-			err:      errors.New("CCID unsupported"),
-		},
-		{command: "AT+QCCID", response: okResponse("+QCCID: 8986001234567890123F")},
-		{command: "AT+CIMI", response: okResponse("460001234567890")},
 		{command: "AT+CFUN?", response: okResponse("+CFUN: 1")},
 		{command: "AT+CNUM", response: okResponse(`+CNUM: "","+8613800138000",145`)},
 	}}
@@ -66,12 +68,14 @@ func TestManagerRefreshBuildsEC20Snapshot(t *testing.T) {
 		t.Fatalf("signal metrics = %#v", snapshot)
 	}
 	if snapshot.AccessTech != "LTE" || snapshot.Band != "B3" ||
-		snapshot.Channel != "1650" || snapshot.OperatorName != "China Mobile" {
+		snapshot.Channel != "1650" || snapshot.OperatorName != "China Unicom" ||
+		snapshot.OperatorCode != "46001" ||
+		snapshot.RegistrationStatus != 5 || snapshot.RegistrationSource != "CEREG" {
 		t.Fatalf("network = %#v", snapshot)
 	}
 	if snapshot.IMEI != "867123456789012" ||
 		snapshot.ICCID != "8986001234567890123" ||
-		snapshot.IMSI != "460001234567890" {
+		snapshot.IMSI != "460001234567890" || snapshot.SPN != "CMCC" {
 		t.Fatalf("subscriber identifiers = %#v", snapshot)
 	}
 	if !snapshot.ModeKnown || snapshot.OperatingMode != 1 ||
@@ -93,6 +97,18 @@ func TestManagerRefreshBuildsEC20Snapshot(t *testing.T) {
 	client.assertDone(t)
 }
 
+func TestParseSPNASCIIAndUCS2(t *testing.T) {
+	if got := parseSPN(okResponse(`+CRSM: 144,0,"004C6562617261FFFFFFFFFFFFFFFFFFFF"`)); got != "Lebara" {
+		t.Fatalf("ASCII SPN = %q", got)
+	}
+	if got := parseSPN(okResponse(`+CRSM: 144,0,"0080004C00650062006100720061FFFF"`)); got != "Lebara" {
+		t.Fatalf("UCS2 SPN = %q", got)
+	}
+	if got := parseSPN(okResponse(`+CRSM: 106,130,""`)); got != "" {
+		t.Fatalf("failed CRSM SPN = %q", got)
+	}
+}
+
 func TestParseICCIDIdentifierStripsTwoFillerNibbles(t *testing.T) {
 	response := modem.Response{Lines: []string{"+CCID: 894921007608519523FF"}}
 	if got := parseICCIDIdentifier(response, []string{"+CCID:", "+QCCID:"}, 18, 22); got != "894921007608519523" {
@@ -119,6 +135,57 @@ func TestManagerRequiresStartAndKnownDevice(t *testing.T) {
 	}
 }
 
+func TestManagerBackendSelectionIsExplicit(t *testing.T) {
+	manager, id := newStartedTestManager(t, &transcriptClient{})
+	if err := manager.SetBackend(id, "qmi"); err != nil {
+		t.Fatal(err)
+	}
+	state, err := manager.lookup(id)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := manager.backendFor(state); got != "qmi" {
+		t.Fatalf("backend = %q, want qmi", got)
+	}
+	if err := manager.SetBackend(id, "mbim"); err == nil {
+		t.Fatal("unsupported backend was accepted")
+	}
+}
+
+func TestManagerForcesRFOffBeforeInspectingChangedSIMNetwork(t *testing.T) {
+	client := &transcriptClient{steps: []clientStep{
+		{command: "ATI", response: okResponse("Quectel", "EC20", "Revision: test")},
+		{command: "AT+CPIN?", response: okResponse("+CPIN: READY")},
+		{command: "AT+CCID", response: okResponse("+CCID: 8900000000000000002")},
+		// This must precede CIMI, signal, serving-cell and operator queries.
+		{command: "AT+CFUN=4", response: okResponse()},
+		{command: "AT+CIMI", response: okResponse("234150000000002")},
+		{command: "AT+CRSM=176,28486,0,0,17", response: okResponse(`+CRSM: 144,0,"004C6562617261FFFFFFFFFFFFFFFFFFFF"`)},
+		{command: "AT+CSQ", response: okResponse("+CSQ: 99,99")},
+		{command: `AT+QENG="servingcell"`, response: okResponse(`+QENG: "servingcell","SEARCH"`)},
+		{command: "AT+COPS?", response: okResponse("+COPS: 0")},
+		{command: "AT+CEREG?", response: okResponse("+CEREG: 0,0")},
+		{command: "AT+CGSN", response: okResponse("867123456789012")},
+		{command: "AT+CFUN?", response: okResponse("+CFUN: 4")},
+		{command: "AT+CNUM", response: okResponse(`+CNUM: "","+447700900002",145`)},
+	}}
+	manager, id := newStartedTestManager(t, client)
+	state, err := manager.lookup(id)
+	if err != nil {
+		t.Fatal(err)
+	}
+	state.lastICCID = "8900000000000000001"
+
+	snapshot, err := manager.Refresh(context.Background(), id)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !snapshot.SIMChanged || !snapshot.FlightMode || snapshot.OperatingMode != 4 {
+		t.Fatalf("changed SIM snapshot = %#v", snapshot)
+	}
+	client.assertDone(t)
+}
+
 func TestExecuteSensitiveATDoesNotPersistCommandOrModemError(t *testing.T) {
 	const secretCommand = `AT+CSIM=78,"00880081221000112233445566778899AABBCCDDEEFF1000112233445566778899AABBCCDDEEFF00"`
 	client := &transcriptClient{steps: []clientStep{{

internal/device/registration_linux.go

@@ -0,0 +1,36 @@
+//go:build linux
+
+package device
+
+import (
+	"context"
+	"os/exec"
+	"strings"
+	"time"
+
+	"vocat/internal/modem"
+)
+
+func readPlatformRegistration(ctx context.Context, candidate modem.Candidate) (platformRegistration, bool) {
+	control := strings.TrimSpace(candidate.QMIControl)
+	if control == "" {
+		return platformRegistration{}, false
+	}
+	qmicli, err := exec.LookPath("qmicli")
+	if err != nil {
+		return platformRegistration{}, false
+	}
+	queryContext, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+	output, err := exec.CommandContext(
+		queryContext,
+		qmicli,
+		"-d", control,
+		"--device-open-proxy",
+		"--nas-get-serving-system",
+	).CombinedOutput()
+	if err != nil {
+		return platformRegistration{}, false
+	}
+	return parseQMIRegistration(string(output))
+}

internal/device/registration_other.go

@@ -0,0 +1,13 @@
+//go:build !linux
+
+package device
+
+import (
+	"context"
+
+	"vocat/internal/modem"
+)
+
+func readPlatformRegistration(context.Context, modem.Candidate) (platformRegistration, bool) {
+	return platformRegistration{}, false
+}

internal/device/registration_qmi.go

@@ -0,0 +1,80 @@
+package device
+
+import (
+	"regexp"
+	"strings"
+)
+
+type platformRegistration struct {
+	Status     int
+	PLMN       string
+	Name       string
+	PSAttached bool
+}
+
+var qmiQuotedFieldPattern = regexp.MustCompile(`(?i)^\s*([^:]+):\s*'([^']*)'\s*$`)
+
+func parseQMIRegistration(output string) (platformRegistration, bool) {
+	result := platformRegistration{}
+	registrationState := ""
+	roaming := false
+	mcc := ""
+	mnc := ""
+	pcsDigit := false
+	for _, rawLine := range strings.Split(output, "\n") {
+		match := qmiQuotedFieldPattern.FindStringSubmatch(strings.TrimSpace(rawLine))
+		if len(match) != 3 {
+			continue
+		}
+		key := strings.ToLower(strings.TrimSpace(match[1]))
+		value := strings.TrimSpace(match[2])
+		switch key {
+		case "registration state":
+			registrationState = strings.ToLower(value)
+		case "roaming status":
+			roaming = strings.EqualFold(value, "on")
+		case "ps":
+			result.PSAttached = strings.EqualFold(value, "attached")
+		case "mcc":
+			if mcc == "" {
+				mcc = value
+			}
+		case "mnc":
+			if mnc == "" {
+				mnc = value
+			}
+		case "description":
+			if result.Name == "" {
+				result.Name = value
+			}
+		case "mnc with pcs digit":
+			pcsDigit = strings.EqualFold(value, "yes")
+		}
+	}
+	switch registrationState {
+	case "registered":
+		result.Status = 1
+		if roaming {
+			result.Status = 5
+		}
+	case "not-registered-searching", "searching":
+		result.Status = 2
+	case "registration-denied", "denied":
+		result.Status = 3
+	case "not-registered":
+		result.Status = 0
+	default:
+		return platformRegistration{}, false
+	}
+	if decimalDigits(mcc, 3, 3) && decimalDigits(mnc, 1, 3) {
+		width := 2
+		if pcsDigit {
+			width = 3
+		}
+		for len(mnc) < width {
+			mnc = "0" + mnc
+		}
+		result.PLMN = mcc + mnc
+	}
+	return result, true
+}

internal/device/registration_qmi_test.go

@@ -0,0 +1,31 @@
+package device
+
+import "testing"
+
+func TestParseQMIRegistrationRegisteredRoaming(t *testing.T) {
+	output := `
+Registration state: 'registered'
+CS: 'attached'
+PS: 'attached'
+Roaming status: 'on'
+Current PLMN:
+    MCC: '460'
+    MNC: '1'
+    Description: 'UNICOM'
+Full operator code info:
+    MCC: '460'
+    MNC: '1'
+    MNC with PCS digit: 'no'
+`
+	result, found := parseQMIRegistration(output)
+	if !found || result.Status != 5 || !result.PSAttached || result.PLMN != "46001" || result.Name != "UNICOM" {
+		t.Fatalf("registration = %#v, found=%v", result, found)
+	}
+}
+
+func TestParseQMIRegistrationSearching(t *testing.T) {
+	result, found := parseQMIRegistration("Registration state: 'not-registered-searching'\nPS: 'detached'")
+	if !found || result.Status != 2 || result.PSAttached {
+		t.Fatalf("registration = %#v, found=%v", result, found)
+	}
+}

internal/device/registration_test.go

@@ -0,0 +1,24 @@
+package device
+
+import (
+	"testing"
+
+	"vocat/internal/modem"
+)
+
+func TestParseRegistrationStatus(t *testing.T) {
+	tests := []struct {
+		line string
+		want int
+	}{
+		{line: "+CEREG: 0,5", want: 5},
+		{line: "+CGREG: 2,1,\"FFFE\",\"06698D06\",7", want: 1},
+		{line: "+CREG: 2", want: 2},
+	}
+	for _, test := range tests {
+		got, ok := parseRegistrationStatus(modem.Response{Lines: []string{test.line}})
+		if !ok || got != test.want {
+			t.Fatalf("parseRegistrationStatus(%q) = %d, %v", test.line, got, ok)
+		}
+	}
+}

internal/device/scan.go

@@ -14,6 +14,7 @@ type ScannedOperator struct {
 	Name    string `json:"name"`
 	Short   string `json:"shortName,omitempty"`
 	Numeric string `json:"numeric"`
+	Country string `json:"countryCode,omitempty"`
 	Act     string `json:"act,omitempty"`
 }
 
@@ -75,11 +76,19 @@ func parseOperatorScan(response modem.Response) []ScannedOperator {
 			if len(fields) < 4 {
 				continue
 			}
+			name, country, _ := CarrierForPLMN(fields[3])
+			if name == "" {
+				name = strings.TrimSpace(fields[1])
+			}
+			if name == "" {
+				name = strings.TrimSpace(fields[3])
+			}
 			operator := ScannedOperator{
 				Status:  operatorScanStatus(fields[0]),
-				Name:    fields[1],
+				Name:    name,
 				Short:   fields[2],
 				Numeric: fields[3],
+				Country: country,
 			}
 			if len(fields) >= 5 {
 				operator.Act = accessTechnology(fields[4])
@@ -90,6 +99,20 @@ func parseOperatorScan(response modem.Response) []ScannedOperator {
 	return operators
 }
 
+// carrierNameForPLMN resolves the numeric serving PLMN through the bundled
+// global carrier database. Some EC20 firmware returns an empty, localized, or
+// stale long name even though the MCC/MNC is correct. The numeric identity is
+// the authoritative value used for network selection.
+func carrierNameForPLMN(plmn, fallback string) string {
+	if name, _, ok := CarrierForPLMN(plmn); ok {
+		return name
+	}
+	if fallback = strings.TrimSpace(fallback); fallback != "" {
+		return fallback
+	}
+	return strings.TrimSpace(plmn)
+}
+
 // extractScanTuples returns the contents of each top-level parenthesised group,
 // ignoring parentheses inside quoted strings.
 func extractScanTuples(payload string) []string {

internal/device/scan_test.go

@@ -0,0 +1,75 @@
+package device
+
+import (
+	"testing"
+
+	"vocat/internal/modem"
+)
+
+func TestParseOperatorScanNormalizesMainlandCarrierNamesByPLMN(t *testing.T) {
+	response := modem.Response{Lines: []string{
+		`+COPS: (1,"CMCC","CMCC","46000",7),(1,"wrong modem name","CU","46001",7),(1,"","CT","46011",7),(1,"CBN","CBN","46015",7)`,
+	}}
+	operators := parseOperatorScan(response)
+	if len(operators) != 4 {
+		t.Fatalf("operators = %#v", operators)
+	}
+	want := []string{"China Mobile", "China Unicom", "China Telecom", "China Broadnet"}
+	for index := range want {
+		if operators[index].Name != want[index] {
+			t.Fatalf("operator %d name = %q, want %q", index, operators[index].Name, want[index])
+		}
+	}
+}
+
+func TestCarrierNameForPLMNUsesGlobalDatabase(t *testing.T) {
+	if got := carrierNameForPLMN("23415", "stale modem name"); got != "Vodafone" {
+		t.Fatalf("carrier name = %q", got)
+	}
+	if got := carrierNameForPLMN("26202", ""); got != "Vodafone" {
+		t.Fatalf("German carrier name = %q", got)
+	}
+	if got := carrierNameForPLMN("310260", ""); got != "T-Mobile - US" {
+		t.Fatalf("US carrier name = %q", got)
+	}
+	if got := carrierNameForPLMN("99999", "Test Network"); got != "Test Network" {
+		t.Fatalf("unknown carrier fallback = %q", got)
+	}
+}
+
+func TestCarrierForPLMNReturnsCountryCode(t *testing.T) {
+	tests := map[string]string{
+		"23415":  "GB",
+		"23487":  "GB",
+		"26202":  "DE",
+		"310260": "US",
+		"22201":  "IT",
+		"72405":  "BR",
+		"46015":  "CN",
+	}
+	for plmn, wantCountry := range tests {
+		name, country, ok := CarrierForPLMN(plmn)
+		if !ok || name == "" || country != wantCountry {
+			t.Errorf("CarrierForPLMN(%q) = (%q, %q, %v), want a name and country %q", plmn, name, country, ok, wantCountry)
+		}
+	}
+}
+
+func TestCarrierForIMSIHandlesTwoAndThreeDigitMNCs(t *testing.T) {
+	tests := []struct {
+		imsi        string
+		wantPLMN    string
+		wantCountry string
+	}{
+		{imsi: "234336570710174", wantPLMN: "23433", wantCountry: "GB"},
+		{imsi: "234159609054263", wantPLMN: "23415", wantCountry: "GB"},
+		{imsi: "234870123456789", wantPLMN: "23487", wantCountry: "GB"},
+		{imsi: "310260123456789", wantPLMN: "310260", wantCountry: "US"},
+	}
+	for _, item := range tests {
+		plmn, name, country, ok := CarrierForIMSI(item.imsi)
+		if !ok || plmn != item.wantPLMN || name == "" || country != item.wantCountry {
+			t.Errorf("CarrierForIMSI(%q) = (%q, %q, %q, %v), want PLMN %q and country %q", item.imsi, plmn, name, country, ok, item.wantPLMN, item.wantCountry)
+		}
+	}
+}

internal/device/snapshot.go

@@ -3,12 +3,14 @@ package device
 import (
 	"context"
 	"encoding/csv"
+	"encoding/hex"
 	"fmt"
 	"io"
 	"strconv"
 	"strings"
 	"time"
 	"unicode"
+	"unicode/utf16"
 
 	"vocat/internal/modem"
 )
@@ -17,6 +19,8 @@ func (manager *Manager) readSnapshot(
 	ctx context.Context,
 	id string,
 	candidate modem.Candidate,
+	backend string,
+	previousICCID string,
 	client modem.Client,
 ) (Snapshot, error) {
 	snapshot := Snapshot{
@@ -47,11 +51,43 @@ func (manager *Manager) readSnapshot(
 	if response, ok := optional("AT+CPIN?"); ok {
 		snapshot.SIMStatus, snapshot.SIMReady = parseCPIN(response)
 	}
+	ccid, ccidErr := manager.command(ctx, client, "AT+CCID")
+	if ccidErr != nil {
+		ccid, ccidErr = manager.command(ctx, client, "AT+QCCID")
+	}
+	if ccidErr != nil {
+		snapshot.Warnings = append(snapshot.Warnings, "read ICCID: "+ccidErr.Error())
+	} else {
+		snapshot.ICCID = parseICCIDIdentifier(ccid, []string{"+CCID:", "+QCCID:"}, 18, 22)
+	}
+	previousICCID = strings.TrimSpace(previousICCID)
+	if previousICCID != "" && snapshot.ICCID != "" && !strings.EqualFold(previousICCID, snapshot.ICCID) {
+		// A different physical SIM must never inherit the previous card's
+		// permission to use cellular RF. Disable RF before reading serving-cell
+		// or operator state; policy reconciliation will then start VoWiFi.
+		if _, err := manager.command(ctx, client, "AT+CFUN=4"); err != nil {
+			return snapshot, fmt.Errorf("protect changed SIM with RF off: %w", err)
+		}
+		snapshot.SIMChanged = true
+	}
+	if response, ok := optional("AT+CIMI"); ok {
+		snapshot.IMSI = parseIdentifier(response, []string{"+CIMI:"}, 10, 18)
+	}
+	// EF_SPN is the SIM-issued brand (for example "Lebara"), which is distinct
+	// from the IMSI sponsor/core PLMN. A Lebara UK subscription may therefore
+	// legitimately carry a Vodafone NL IMSI while still presenting Lebara as
+	// its customer-facing operator. Failure is intentionally silent because
+	// EF_SPN is optional and some physical SIMs deny CRSM access to it.
+	if response, spnErr := manager.command(ctx, client, "AT+CRSM=176,28486,0,0,17"); spnErr == nil {
+		snapshot.SPN = parseSPN(response)
+	}
 	if response, ok := optional("AT+CSQ"); ok {
 		snapshot.SignalRaw, snapshot.SignalPercent, snapshot.RSSIDBm = parseCSQ(response)
 	}
+	servingPLMN := ""
 	if response, ok := optional(`AT+QENG="servingcell"`); ok {
 		metrics := parseQENG(response)
+		servingPLMN = metrics.PLMN
 		snapshot.AccessTech = metrics.AccessTech
 		snapshot.Band = metrics.Band
 		snapshot.Channel = metrics.Channel
@@ -64,12 +100,45 @@ func (manager *Manager) readSnapshot(
 	}
 	if response, ok := optional("AT+COPS?"); ok {
 		operator := parseCOPS(response)
-		snapshot.OperatorName = operator.Name
-		snapshot.OperatorCode = operator.Code
+		if operator.Code != "" {
+			snapshot.OperatorCode = operator.Code
+		} else {
+			snapshot.OperatorCode = servingPLMN
+		}
+		snapshot.OperatorName = carrierNameForPLMN(snapshot.OperatorCode, operator.Name)
 		if snapshot.AccessTech == "" {
 			snapshot.AccessTech = operator.AccessTech
 		}
 	}
+	for _, command := range []string{"AT+CEREG?", "AT+CGREG?", "AT+CREG?"} {
+		response, registrationErr := manager.command(ctx, client, command)
+		if registrationErr != nil {
+			continue
+		}
+		if status, found := parseRegistrationStatus(response); found {
+			snapshot.RegistrationStatus = status
+			snapshot.RegistrationSource = strings.TrimSuffix(strings.TrimPrefix(command, "AT+"), "?")
+			break
+		}
+	}
+	if strings.EqualFold(backend, "qmi") {
+		registration, found := readPlatformRegistration(ctx, candidate)
+		if found {
+			snapshot.RegistrationStatus = registration.Status
+			snapshot.RegistrationSource = "QMI NAS"
+			snapshot.PSAttached = registration.PSAttached
+			if registration.PLMN != "" {
+				snapshot.OperatorCode = registration.PLMN
+				snapshot.OperatorName = carrierNameForPLMN(registration.PLMN, registration.Name)
+			}
+		}
+	}
+	if snapshot.RegistrationSource == "" && (snapshot.OperatorName != "" || snapshot.OperatorCode != "") {
+		// Older firmware can omit registration queries while COPS still proves
+		// that an operator is selected.
+		snapshot.RegistrationStatus = 1
+		snapshot.RegistrationSource = "COPS"
+	}
 	if response, ok := optional("AT+CGSN"); ok {
 		snapshot.IMEI = parseIdentifier(
 			response,
@@ -79,18 +148,6 @@ func (manager *Manager) readSnapshot(
 		)
 	}
 
-	ccid, ccidErr := manager.command(ctx, client, "AT+CCID")
-	if ccidErr != nil {
-		ccid, ccidErr = manager.command(ctx, client, "AT+QCCID")
-	}
-	if ccidErr != nil {
-		snapshot.Warnings = append(snapshot.Warnings, "read ICCID: "+ccidErr.Error())
-	} else {
-		snapshot.ICCID = parseICCIDIdentifier(ccid, []string{"+CCID:", "+QCCID:"}, 18, 22)
-	}
-	if response, ok := optional("AT+CIMI"); ok {
-		snapshot.IMSI = parseIdentifier(response, []string{"+CIMI:"}, 10, 18)
-	}
 	if response, ok := optional("AT+CFUN?"); ok {
 		if mode, found := parseCFUN(response); found {
 			snapshot.OperatingMode = mode
@@ -107,6 +164,72 @@ func (manager *Manager) readSnapshot(
 	return snapshot, nil
 }
 
+func parseSPN(response modem.Response) string {
+	value := valueAfterPrefix(response, "+CRSM:")
+	fields := csvValues(value)
+	if len(fields) < 3 {
+		return ""
+	}
+	sw1, sw1Err := strconv.Atoi(strings.TrimSpace(fields[0]))
+	sw2, sw2Err := strconv.Atoi(strings.TrimSpace(fields[1]))
+	if sw1Err != nil || sw2Err != nil || (sw1 != 0x90 && sw1 != 0x91 && sw1 != 0x9f) || sw2 < 0 || sw2 > 255 {
+		return ""
+	}
+	raw, err := hex.DecodeString(strings.Trim(strings.TrimSpace(fields[2]), `"`))
+	if err != nil || len(raw) < 2 {
+		return ""
+	}
+	alpha := raw[1:] // byte 0 is the display-condition bit field.
+	for len(alpha) > 0 && (alpha[len(alpha)-1] == 0xff || alpha[len(alpha)-1] == 0x00) {
+		alpha = alpha[:len(alpha)-1]
+	}
+	if len(alpha) == 0 {
+		return ""
+	}
+	if alpha[0] == 0x80 {
+		ucs2 := alpha[1:]
+		if len(ucs2)%2 != 0 {
+			ucs2 = ucs2[:len(ucs2)-1]
+		}
+		units := make([]uint16, 0, len(ucs2)/2)
+		for index := 0; index+1 < len(ucs2); index += 2 {
+			unit := uint16(ucs2[index])<<8 | uint16(ucs2[index+1])
+			if unit != 0xffff && unit != 0 {
+				units = append(units, unit)
+			}
+		}
+		return strings.TrimSpace(string(utf16.Decode(units)))
+	}
+	// EF_SPN uses the unpacked GSM default alphabet. Its printable Latin subset
+	// is byte-compatible with UTF-8/ASCII and covers operator brands in practice.
+	printable := make([]byte, 0, len(alpha))
+	for _, value := range alpha {
+		if value >= 0x20 && value <= 0x7e {
+			printable = append(printable, value)
+		}
+	}
+	return strings.TrimSpace(string(printable))
+}
+
+func parseRegistrationStatus(response modem.Response) (int, bool) {
+	for _, prefix := range []string{"+CEREG:", "+CGREG:", "+CREG:"} {
+		values := csvValues(valueAfterPrefix(response, prefix))
+		if len(values) == 0 {
+			continue
+		}
+		index := 0
+		// Query responses are <n>,<stat>; unsolicited responses are <stat>.
+		if len(values) >= 2 {
+			index = 1
+		}
+		status, err := strconv.Atoi(strings.TrimSpace(values[index]))
+		if err == nil && status >= 0 && status <= 10 {
+			return status, true
+		}
+	}
+	return 0, false
+}
+
 func parseATI(lines []string) (manufacturer, model, firmware string) {
 	for _, line := range lines {
 		line = strings.TrimSpace(line)
@@ -159,6 +282,7 @@ func parseCSQ(response modem.Response) (raw, percent, dbm *int) {
 }
 
 type qengMetrics struct {
+	PLMN       string
 	AccessTech string
 	Band       string
 	Channel    string
@@ -179,6 +303,9 @@ func parseQENG(response modem.Response) qengMetrics {
 		}
 		result := qengMetrics{AccessTech: strings.ToUpper(values[2])}
 		if strings.EqualFold(values[2], "LTE") && len(values) >= 17 {
+			if decimalDigits(values[4], 3, 3) && decimalDigits(values[5], 2, 3) {
+				result.PLMN = values[4] + values[5]
+			}
 			result.Channel = values[8]
 			if values[9] != "" {
 				result.Band = "B" + values[9]
@@ -193,6 +320,13 @@ func parseQENG(response modem.Response) qengMetrics {
 	return qengMetrics{}
 }
 
+func decimalDigits(value string, minimum, maximum int) bool {
+	value = strings.TrimSpace(value)
+	return len(value) >= minimum && len(value) <= maximum && strings.IndexFunc(value, func(character rune) bool {
+		return character < '0' || character > '9'
+	}) < 0
+}
+
 type operatorInfo struct {
 	Name       string
 	Code       string

internal/device/types.go

@@ -27,6 +27,7 @@ type NetworkRequest struct {
 	Enabled   bool   `json:"enabled"`
 	APN       string `json:"apn"`
 	IPVersion string `json:"ipVersion"`
+	Backend   string `json:"backend,omitempty"`
 }
 
 type NetworkResult struct {
@@ -73,35 +74,40 @@ const (
 )
 
 type Snapshot struct {
-	DeviceID      string      `json:"deviceId"`
-	Port          string      `json:"port"`
-	Responsive    bool        `json:"responsive"`
-	Manufacturer  string      `json:"manufacturer"`
-	Model         string      `json:"model"`
-	Firmware      string      `json:"firmware"`
-	SIMStatus     string      `json:"simStatus"`
-	SIMReady      bool        `json:"simReady"`
-	SignalRaw     *int        `json:"signalRaw,omitempty"`
-	SignalPercent *int        `json:"signalPercent,omitempty"`
-	RSSIDBm       *int        `json:"rssiDbm,omitempty"`
-	RSRP          *int        `json:"rsrp,omitempty"`
-	RSRQ          *int        `json:"rsrq,omitempty"`
-	SINR          *int        `json:"sinr,omitempty"`
-	AccessTech    string      `json:"accessTech"`
-	Band          string      `json:"band"`
-	Channel       string      `json:"channel"`
-	OperatorName  string      `json:"operatorName"`
-	OperatorCode  string      `json:"operatorCode"`
-	IMEI          string      `json:"imei"`
-	ICCID         string      `json:"iccid"`
-	IMSI          string      `json:"imsi"`
-	OperatingMode int         `json:"operatingMode"`
-	ModeKnown     bool        `json:"modeKnown"`
-	FlightMode    bool        `json:"flightMode"`
-	RadioOff      bool        `json:"radioOff"`
-	Phone         PhoneNumber `json:"phone"`
-	Warnings      []string    `json:"warnings,omitempty"`
-	UpdatedAt     time.Time   `json:"updatedAt"`
+	DeviceID           string      `json:"deviceId"`
+	Port               string      `json:"port"`
+	Responsive         bool        `json:"responsive"`
+	Manufacturer       string      `json:"manufacturer"`
+	Model              string      `json:"model"`
+	Firmware           string      `json:"firmware"`
+	SIMStatus          string      `json:"simStatus"`
+	SIMReady           bool        `json:"simReady"`
+	SIMChanged         bool        `json:"simChanged,omitempty"`
+	SignalRaw          *int        `json:"signalRaw,omitempty"`
+	SignalPercent      *int        `json:"signalPercent,omitempty"`
+	RSSIDBm            *int        `json:"rssiDbm,omitempty"`
+	RSRP               *int        `json:"rsrp,omitempty"`
+	RSRQ               *int        `json:"rsrq,omitempty"`
+	SINR               *int        `json:"sinr,omitempty"`
+	AccessTech         string      `json:"accessTech"`
+	Band               string      `json:"band"`
+	Channel            string      `json:"channel"`
+	OperatorName       string      `json:"operatorName"`
+	OperatorCode       string      `json:"operatorCode"`
+	RegistrationStatus int         `json:"registrationStatus"`
+	RegistrationSource string      `json:"registrationSource"`
+	PSAttached         bool        `json:"psAttached"`
+	IMEI               string      `json:"imei"`
+	ICCID              string      `json:"iccid"`
+	IMSI               string      `json:"imsi"`
+	SPN                string      `json:"spn,omitempty"`
+	OperatingMode      int         `json:"operatingMode"`
+	ModeKnown          bool        `json:"modeKnown"`
+	FlightMode         bool        `json:"flightMode"`
+	RadioOff           bool        `json:"radioOff"`
+	Phone              PhoneNumber `json:"phone"`
+	Warnings           []string    `json:"warnings,omitempty"`
+	UpdatedAt          time.Time   `json:"updatedAt"`
 }
 
 type USSDResult struct {

internal/exportproxy/bind_linux.go

@@ -0,0 +1,98 @@
+//go:build linux
+
+package exportproxy
+
+import (
+	"bufio"
+	"context"
+	"hash/fnv"
+	"net"
+	"os"
+	"strings"
+	"syscall"
+	"unicode"
+)
+
+func platformSupported() error { return nil }
+
+func boundDialer(networkInterface string) net.Dialer {
+	return net.Dialer{Control: func(_, _ string, raw syscall.RawConn) error {
+		var bindError error
+		err := raw.Control(func(fd uintptr) {
+			if err := syscall.SetsockoptInt(int(fd), syscall.SOL_SOCKET, syscall.SO_MARK, int(exportRouteMark(networkInterface))); err != nil {
+				bindError = err
+				return
+			}
+			bindError = syscall.SetsockoptString(int(fd), syscall.SOL_SOCKET, syscall.SO_BINDTODEVICE, networkInterface)
+		})
+		if err != nil {
+			return err
+		}
+		return bindError
+	}}
+}
+
+func exportRouteMark(networkInterface string) uint32 {
+	hash := fnv.New32a()
+	_, _ = hash.Write([]byte(networkInterface))
+	return 0x56000000 | (hash.Sum32() & 0x00ffffff)
+}
+
+func boundResolver(networkInterface string) *net.Resolver {
+	dialer := boundDialer(networkInterface)
+	return &net.Resolver{PreferGo: true, Dial: func(ctx context.Context, network, _ string) (net.Conn, error) {
+		var lastError error
+		for _, server := range exportRouteDNSServers(networkInterface) {
+			connection, err := dialer.DialContext(ctx, network, net.JoinHostPort(server, "53"))
+			if err == nil {
+				return connection, nil
+			}
+			lastError = err
+		}
+		return nil, lastError
+	}}
+}
+
+func exportRouteDNSServers(networkInterface string) []string {
+	if !validInterfaceName(networkInterface) {
+		return []string{"1.1.1.1", "8.8.8.8"}
+	}
+	root, err := os.OpenRoot("/run/vocat")
+	if err != nil {
+		return []string{"1.1.1.1", "8.8.8.8"}
+	}
+	defer root.Close()
+	file, err := root.Open("cellular-" + networkInterface + ".dns")
+	if err != nil {
+		return []string{"1.1.1.1", "8.8.8.8"}
+	}
+	defer file.Close()
+	servers := make([]string, 0, 2)
+	scanner := bufio.NewScanner(file)
+	for scanner.Scan() {
+		if value := strings.TrimSpace(scanner.Text()); net.ParseIP(value) != nil {
+			servers = append(servers, value)
+		}
+	}
+	if len(servers) == 0 {
+		return []string{"1.1.1.1", "8.8.8.8"}
+	}
+	return servers
+}
+
+// Linux IFNAMSIZ is 16 including the terminator. Restricting names here both
+// matches kernel interface names and prevents a stored device value from ever
+// becoming a filesystem path component.
+func validInterfaceName(value string) bool {
+	if value == "" || len(value) > 15 || value == "." || value == ".." {
+		return false
+	}
+	for _, character := range value {
+		if character > unicode.MaxASCII || !(character >= 'a' && character <= 'z' ||
+			character >= 'A' && character <= 'Z' || character >= '0' && character <= '9' ||
+			character == '-' || character == '_' || character == '.') {
+			return false
+		}
+	}
+	return true
+}

internal/exportproxy/bind_linux_test.go

@@ -0,0 +1,18 @@
+//go:build linux
+
+package exportproxy
+
+import "testing"
+
+func TestValidInterfaceName(t *testing.T) {
+	for _, value := range []string{"wwan0", "wwp0s20f0u5i4", "rmnet_data0", "usb.1"} {
+		if !validInterfaceName(value) {
+			t.Errorf("validInterfaceName(%q) = false", value)
+		}
+	}
+	for _, value := range []string{"", ".", "..", "../wwan0", `..\wwan0`, "wwan0/evil", "interface-name-too-long"} {
+		if validInterfaceName(value) {
+			t.Errorf("validInterfaceName(%q) = true", value)
+		}
+	}
+}

internal/exportproxy/bind_other.go

@@ -0,0 +1,12 @@
+//go:build !linux
+
+package exportproxy
+
+import (
+	"errors"
+	"net"
+)
+
+func platformSupported() error           { return errors.New("built-in export proxy is only available on Linux") }
+func boundDialer(string) net.Dialer      { return net.Dialer{} }
+func boundResolver(string) *net.Resolver { return net.DefaultResolver }

internal/exportproxy/ipinfo.go

@@ -0,0 +1,88 @@
+package exportproxy
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"strings"
+	"time"
+)
+
+const ipInfoURL = "https://ipinfo.io/json"
+
+type PublicIPInfo struct {
+	IP           string `json:"ip"`
+	CountryCode  string `json:"country_code"`
+	Region       string `json:"region"`
+	City         string `json:"city"`
+	Organization string `json:"organization,omitempty"`
+}
+
+// LookupPublicIP sends the lookup through the same marked, interface-bound
+// dialer and isolated DNS resolver as Export Proxy. It therefore reports the
+// modem's roaming exit rather than the host or browser's default connection.
+func LookupPublicIP(ctx context.Context, networkInterface string) (PublicIPInfo, error) {
+	networkInterface = strings.TrimSpace(networkInterface)
+	if networkInterface == "" {
+		return PublicIPInfo{}, errors.New("cellular network interface is required")
+	}
+	if err := platformSupported(); err != nil {
+		return PublicIPInfo{}, err
+	}
+	dialer := boundDialer(networkInterface)
+	resolver := boundResolver(networkInterface)
+	transport := &http.Transport{
+		DialContext: func(ctx context.Context, _, address string) (net.Conn, error) {
+			return dialTarget(ctx, address, &dialer, resolver)
+		},
+		DisableKeepAlives:     true,
+		ResponseHeaderTimeout: 12 * time.Second,
+	}
+	defer transport.CloseIdleConnections()
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, ipInfoURL, nil)
+	if err != nil {
+		return PublicIPInfo{}, err
+	}
+	request.Header.Set("Accept", "application/json")
+	request.Header.Set("User-Agent", "VoCat/1.0")
+	response, err := transport.RoundTrip(request)
+	if err != nil {
+		return PublicIPInfo{}, fmt.Errorf("query ipinfo.io through %s: %w", networkInterface, err)
+	}
+	defer response.Body.Close()
+	if response.StatusCode < 200 || response.StatusCode >= 300 {
+		_, _ = io.Copy(io.Discard, io.LimitReader(response.Body, 4<<10))
+		return PublicIPInfo{}, fmt.Errorf("ipinfo.io returned HTTP %d", response.StatusCode)
+	}
+	return decodePublicIPInfo(io.LimitReader(response.Body, 64<<10))
+}
+
+func decodePublicIPInfo(reader io.Reader) (PublicIPInfo, error) {
+	var response struct {
+		IP      string `json:"ip"`
+		Country string `json:"country"`
+		Region  string `json:"region"`
+		City    string `json:"city"`
+		Org     string `json:"org"`
+	}
+	if err := json.NewDecoder(reader).Decode(&response); err != nil {
+		return PublicIPInfo{}, fmt.Errorf("decode ipinfo.io response: %w", err)
+	}
+	response.IP = strings.TrimSpace(response.IP)
+	response.Country = strings.ToUpper(strings.TrimSpace(response.Country))
+	if net.ParseIP(response.IP) == nil {
+		return PublicIPInfo{}, errors.New("ipinfo.io response contained no valid IP address")
+	}
+	if len(response.Country) != 2 {
+		return PublicIPInfo{}, errors.New("ipinfo.io response contained no valid country code")
+	}
+	return PublicIPInfo{
+		IP: response.IP, CountryCode: response.Country,
+		Region: strings.TrimSpace(response.Region), City: strings.TrimSpace(response.City),
+		Organization: strings.TrimSpace(response.Org),
+	}, nil
+}

internal/exportproxy/ipinfo_test.go

@@ -0,0 +1,22 @@
+package exportproxy
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestDecodePublicIPInfo(t *testing.T) {
+	info, err := decodePublicIPInfo(strings.NewReader(`{"ip":"203.0.113.8","city":"London","region":"England","country":"gb","org":"AS64500 Test"}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if info.IP != "203.0.113.8" || info.CountryCode != "GB" || info.Region != "England" || info.City != "London" {
+		t.Fatalf("info = %+v", info)
+	}
+}
+
+func TestDecodePublicIPInfoRejectsInvalidResponse(t *testing.T) {
+	if _, err := decodePublicIPInfo(strings.NewReader(`{"ip":"not-an-ip","country":"GB"}`)); err == nil {
+		t.Fatal("invalid IP was accepted")
+	}
+}

internal/exportproxy/manager.go

@@ -0,0 +1,494 @@
+package exportproxy
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net"
+	"os"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"vocat/internal/store"
+)
+
+const (
+	SettingKey   = "developer.export_proxy.configs"
+	PasswordMask = "••••••••"
+	ReservedID   = "export-proxy"
+)
+
+var (
+	ErrNotFound = errors.New("export proxy configuration not found")
+	ErrDisabled = errors.New("export proxy is disabled")
+)
+
+type Config struct {
+	ID          string `json:"id"`
+	Name        string `json:"name"`
+	DeviceID    string `json:"device_id"`
+	Interface   string `json:"interface"`
+	Mode        string `json:"mode"`
+	ListenHost  string `json:"listen_host"`
+	ListenPort  int    `json:"listen_port"`
+	Enabled     bool   `json:"enabled"`
+	AuthEnabled bool   `json:"auth_enabled"`
+	Username    string `json:"username"`
+	Password    string `json:"password"`
+}
+
+type Status struct {
+	ID        string    `json:"id"`
+	Name      string    `json:"name"`
+	Mode      string    `json:"mode"`
+	Enabled   bool      `json:"enabled"`
+	Running   bool      `json:"running"`
+	Listen    string    `json:"listen"`
+	Error     string    `json:"error,omitempty"`
+	StartedAt time.Time `json:"started_at,omitempty"`
+}
+
+type Manager struct {
+	mu        sync.Mutex
+	store     *store.Store
+	logger    *slog.Logger
+	configs   []Config
+	listeners map[string]net.Listener
+	started   map[string]time.Time
+	lastError map[string]string
+	disabled  bool
+}
+
+func New(ctx context.Context, database *store.Store, logger *slog.Logger, legacyConfigPath string) (*Manager, error) {
+	if database == nil {
+		return nil, errors.New("export proxy store is required")
+	}
+	if logger == nil {
+		logger = slog.Default()
+	}
+	manager := &Manager{
+		store: database, logger: logger,
+		listeners: make(map[string]net.Listener),
+		started:   make(map[string]time.Time),
+		lastError: make(map[string]string),
+	}
+	migrated, err := manager.load(ctx, legacyConfigPath)
+	if err != nil {
+		return nil, err
+	}
+	if migrated {
+		if err := manager.saveLocked(ctx); err != nil {
+			return nil, fmt.Errorf("migrate legacy export proxy configurations: %w", err)
+		}
+		_ = RemoveLegacyConfig(legacyConfigPath)
+	}
+
+	for _, config := range manager.configs {
+		if config.Enabled {
+			if err := manager.start(ctx, config.ID); err != nil {
+				manager.logger.Warn("start built-in export proxy", "id", config.ID, "error", err)
+			}
+		}
+	}
+	return manager, nil
+}
+
+func RemoveLegacyConfig(path string) error {
+	path = strings.TrimSpace(path)
+	if path == "" {
+		return nil
+	}
+	err := os.Remove(path)
+	if errors.Is(err, os.ErrNotExist) {
+		return nil
+	}
+	return err
+}
+
+func (manager *Manager) load(ctx context.Context, legacyConfigPath string) (bool, error) {
+	setting, err := manager.store.AppSetting(ctx, SettingKey)
+	if err == nil {
+		if err := json.Unmarshal(setting.Value, &manager.configs); err != nil {
+			return false, fmt.Errorf("decode export proxy configurations: %w", err)
+		}
+		return false, nil
+	}
+	if !errors.Is(err, store.ErrNotFound) {
+		return false, err
+	}
+	legacy, err := os.ReadFile(strings.TrimSpace(legacyConfigPath))
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) || strings.TrimSpace(legacyConfigPath) == "" {
+			return false, nil
+		}
+		return false, err
+	}
+	if err := json.Unmarshal(legacy, &manager.configs); err != nil {
+		return false, fmt.Errorf("decode legacy export proxy configurations: %w", err)
+	}
+	return true, nil
+}
+
+func (manager *Manager) saveLocked(ctx context.Context) error {
+	raw, err := json.Marshal(manager.configs)
+	if err != nil {
+		return err
+	}
+	return manager.store.UpsertAppSetting(ctx, store.AppSetting{Key: SettingKey, Value: raw, Sensitive: true})
+}
+
+func (manager *Manager) Configs() ([]Config, error) {
+	manager.mu.Lock()
+	defer manager.mu.Unlock()
+	if manager.disabled {
+		return nil, ErrDisabled
+	}
+	result := make([]Config, len(manager.configs))
+	for index, config := range manager.configs {
+		result[index] = redact(config)
+	}
+	return result, nil
+}
+
+// EnabledConfigForDevice returns the first enabled configuration bound to the
+// given device, reporting whether one exists. It is used to block turning off a
+// device's roaming data while one of its export proxies is still running.
+func (manager *Manager) EnabledConfigForDevice(deviceID string) (Config, bool) {
+	manager.mu.Lock()
+	defer manager.mu.Unlock()
+	if manager.disabled {
+		return Config{}, false
+	}
+	for _, config := range manager.configs {
+		if config.DeviceID == deviceID && config.Enabled {
+			return redact(config), true
+		}
+	}
+	return Config{}, false
+}
+
+func (manager *Manager) Status() ([]Status, error) {
+	manager.mu.Lock()
+	defer manager.mu.Unlock()
+	if manager.disabled {
+		return nil, ErrDisabled
+	}
+	result := make([]Status, 0, len(manager.configs))
+	for _, config := range manager.configs {
+		status := Status{ID: config.ID, Name: config.Name, Mode: config.Mode, Enabled: config.Enabled, Error: manager.lastError[config.ID]}
+		if listener := manager.listeners[config.ID]; listener != nil {
+			status.Running = true
+			status.Listen = listener.Addr().String()
+			status.StartedAt = manager.started[config.ID]
+		}
+		result = append(result, status)
+	}
+	return result, nil
+}
+
+func (manager *Manager) Create(ctx context.Context, config Config) (Config, error) {
+	config.ID = generateID()
+	if err := manager.prepareConfig(ctx, &config); err != nil {
+		return Config{}, err
+	}
+	manager.mu.Lock()
+	if manager.disabled {
+		manager.mu.Unlock()
+		return Config{}, ErrDisabled
+	}
+	if err := manager.checkPortLocked(config, ""); err != nil {
+		manager.mu.Unlock()
+		return Config{}, err
+	}
+	manager.configs = append(manager.configs, config)
+	if err := manager.saveLocked(ctx); err != nil {
+		manager.configs = manager.configs[:len(manager.configs)-1]
+		manager.mu.Unlock()
+		return Config{}, err
+	}
+	manager.mu.Unlock()
+	if config.Enabled {
+		if err := manager.start(ctx, config.ID); err != nil {
+			_ = manager.Delete(context.Background(), config.ID)
+			return Config{}, err
+		}
+	}
+	return redact(config), nil
+}
+
+func (manager *Manager) Update(ctx context.Context, id string, incoming Config) (Config, error) {
+	incoming.ID = strings.TrimSpace(id)
+	manager.mu.Lock()
+	if manager.disabled {
+		manager.mu.Unlock()
+		return Config{}, ErrDisabled
+	}
+	existing, index := manager.configByIDLocked(incoming.ID)
+	manager.mu.Unlock()
+	if index < 0 {
+		return Config{}, ErrNotFound
+	}
+	if incoming.Password == "" || incoming.Password == PasswordMask {
+		incoming.Password = existing.Password
+	}
+	if err := manager.prepareConfig(ctx, &incoming); err != nil {
+		return Config{}, err
+	}
+
+	manager.mu.Lock()
+	if manager.disabled {
+		manager.mu.Unlock()
+		return Config{}, ErrDisabled
+	}
+	existing, index = manager.configByIDLocked(incoming.ID)
+	if index < 0 {
+		manager.mu.Unlock()
+		return Config{}, ErrNotFound
+	}
+	if err := manager.checkPortLocked(incoming, incoming.ID); err != nil {
+		manager.mu.Unlock()
+		return Config{}, err
+	}
+	wasRunning := manager.listeners[incoming.ID] != nil
+	runtimeChanged := existing.Mode != incoming.Mode || existing.Interface != incoming.Interface ||
+		existing.ListenHost != incoming.ListenHost || existing.ListenPort != incoming.ListenPort ||
+		existing.AuthEnabled != incoming.AuthEnabled || existing.Username != incoming.Username || existing.Password != incoming.Password
+	manager.configs[index] = incoming
+	if err := manager.saveLocked(ctx); err != nil {
+		manager.configs[index] = existing
+		manager.mu.Unlock()
+		return Config{}, err
+	}
+	manager.mu.Unlock()
+
+	switch {
+	case !incoming.Enabled:
+		manager.stop(incoming.ID)
+	case !wasRunning || runtimeChanged || !existing.Enabled:
+		if err := manager.start(ctx, incoming.ID); err != nil {
+			return redact(incoming), err
+		}
+	}
+	return redact(incoming), nil
+}
+
+func (manager *Manager) Delete(ctx context.Context, id string) error {
+	manager.mu.Lock()
+	defer manager.mu.Unlock()
+	if manager.disabled {
+		return ErrDisabled
+	}
+	_, index := manager.configByIDLocked(strings.TrimSpace(id))
+	if index < 0 {
+		return ErrNotFound
+	}
+	manager.stopLocked(id)
+	manager.configs = append(manager.configs[:index], manager.configs[index+1:]...)
+	return manager.saveLocked(ctx)
+}
+
+// DeleteAllAndDisable is irreversible for the active developer-mode session:
+// it closes every listener, removes every saved proxy, and rejects new work.
+func (manager *Manager) DeleteAllAndDisable(ctx context.Context) error {
+	manager.mu.Lock()
+	for id := range manager.listeners {
+		manager.stopLocked(id)
+	}
+	manager.configs = nil
+	manager.disabled = true
+	manager.mu.Unlock()
+	err := manager.store.DeleteAppSetting(ctx, SettingKey)
+	if errors.Is(err, store.ErrNotFound) {
+		return nil
+	}
+	return err
+}
+
+func (manager *Manager) Close() error {
+	manager.mu.Lock()
+	defer manager.mu.Unlock()
+	manager.disabled = true
+	for id := range manager.listeners {
+		manager.stopLocked(id)
+	}
+	return nil
+}
+
+func (manager *Manager) prepareConfig(ctx context.Context, config *Config) error {
+	config.Name = strings.TrimSpace(config.Name)
+	config.DeviceID = strings.TrimSpace(config.DeviceID)
+	config.Interface = strings.TrimSpace(config.Interface)
+	config.Mode = strings.ToLower(strings.TrimSpace(config.Mode))
+	config.ListenHost = strings.TrimSpace(config.ListenHost)
+	config.Username = strings.TrimSpace(config.Username)
+	if config.Name == "" {
+		config.Name = "proxy-" + config.ID[:4]
+	}
+	if config.DeviceID == "" {
+		return errors.New("device is required")
+	}
+	device, err := manager.store.Device(ctx, config.DeviceID)
+	if err != nil {
+		if errors.Is(err, store.ErrNotFound) {
+			return errors.New("configured device was not found")
+		}
+		return err
+	}
+	if strings.TrimSpace(device.Interface) == "" {
+		return errors.New("the selected device has no cellular interface")
+	}
+	if config.Interface != "" && config.Interface != device.Interface {
+		return errors.New("proxy interface does not match the selected device")
+	}
+	config.Interface = device.Interface
+	if config.Enabled && !device.NetworkEnabled {
+		return errors.New("enable roaming data on the selected device before starting its export proxy")
+	}
+	if config.Mode != "http" && config.Mode != "socks5" {
+		return errors.New("mode must be http or socks5")
+	}
+	if config.ListenHost == "" {
+		config.ListenHost = "0.0.0.0"
+	}
+	if net.ParseIP(config.ListenHost) == nil && config.ListenHost != "localhost" {
+		return errors.New("listen host must be an IP address")
+	}
+	if config.ListenPort < 0 || config.ListenPort > 65535 {
+		return errors.New("listen port must be between 0 and 65535")
+	}
+	if config.AuthEnabled {
+		if config.Username == "" {
+			return errors.New("username is required when authentication is enabled")
+		}
+		if len(config.Username) > 128 || len(config.Password) > 128 {
+			return errors.New("proxy credentials are too long")
+		}
+	}
+	return nil
+}
+
+func (manager *Manager) checkPortLocked(config Config, excludeID string) error {
+	if config.ListenPort == 0 {
+		return nil
+	}
+	for _, current := range manager.configs {
+		if current.ID != excludeID && current.ListenPort == config.ListenPort && current.ListenHost == config.ListenHost {
+			return fmt.Errorf("port %d is already used by another export proxy", config.ListenPort)
+		}
+	}
+	if existing, _ := manager.configByIDLocked(excludeID); excludeID != "" &&
+		existing.ListenHost == config.ListenHost && existing.ListenPort == config.ListenPort {
+		return nil
+	}
+	listener, err := net.Listen("tcp", net.JoinHostPort(config.ListenHost, strconv.Itoa(config.ListenPort)))
+	if err != nil {
+		return fmt.Errorf("port %d is already in use", config.ListenPort)
+	}
+	_ = listener.Close()
+	return nil
+}
+
+func (manager *Manager) start(ctx context.Context, id string) error {
+	manager.mu.Lock()
+	if manager.disabled {
+		manager.mu.Unlock()
+		return ErrDisabled
+	}
+	config, index := manager.configByIDLocked(id)
+	if index < 0 || !config.Enabled {
+		manager.mu.Unlock()
+		return ErrNotFound
+	}
+	if err := platformSupported(); err != nil {
+		manager.lastError[id] = err.Error()
+		manager.mu.Unlock()
+		return err
+	}
+	manager.stopLocked(id)
+	listener, err := net.Listen("tcp", net.JoinHostPort(config.ListenHost, strconv.Itoa(config.ListenPort)))
+	if err != nil {
+		manager.lastError[id] = err.Error()
+		manager.mu.Unlock()
+		return err
+	}
+	if config.ListenPort == 0 {
+		config.ListenPort = listener.Addr().(*net.TCPAddr).Port
+		manager.configs[index] = config
+		if err := manager.saveLocked(ctx); err != nil {
+			_ = listener.Close()
+			manager.mu.Unlock()
+			return err
+		}
+	}
+	delete(manager.lastError, id)
+	manager.listeners[id] = listener
+	manager.started[id] = time.Now().UTC()
+	manager.mu.Unlock()
+	go manager.serve(listener, config)
+	return nil
+}
+
+func (manager *Manager) stop(id string) {
+	manager.mu.Lock()
+	defer manager.mu.Unlock()
+	manager.stopLocked(id)
+}
+
+func (manager *Manager) stopLocked(id string) {
+	if listener := manager.listeners[id]; listener != nil {
+		_ = listener.Close()
+		delete(manager.listeners, id)
+	}
+	delete(manager.started, id)
+}
+
+func (manager *Manager) serve(listener net.Listener, config Config) {
+	dialer := boundDialer(config.Interface)
+	resolver := boundResolver(config.Interface)
+	for {
+		connection, err := listener.Accept()
+		if err != nil {
+			return
+		}
+		go func(client net.Conn) {
+			defer client.Close()
+			var err error
+			if config.Mode == "http" {
+				err = serveHTTP(client, config, &dialer, resolver)
+			} else {
+				err = serveSOCKS(client, config, &dialer, resolver)
+			}
+			if err != nil {
+				manager.logger.Debug("export proxy connection closed", "id", config.ID, "error", err)
+			}
+		}(connection)
+	}
+}
+
+func (manager *Manager) configByIDLocked(id string) (Config, int) {
+	for index, config := range manager.configs {
+		if config.ID == id {
+			return config, index
+		}
+	}
+	return Config{}, -1
+}
+
+func redact(config Config) Config {
+	if config.Password != "" {
+		config.Password = PasswordMask
+	}
+	return config
+}
+
+func generateID() string {
+	value := make([]byte, 4)
+	_, _ = rand.Read(value)
+	return hex.EncodeToString(value)
+}

internal/exportproxy/manager_test.go

@@ -0,0 +1,123 @@
+package exportproxy
+
+import (
+	"context"
+	"errors"
+	"io"
+	"log/slog"
+	"path/filepath"
+	"testing"
+
+	"vocat/internal/store"
+)
+
+func TestManagerPersistsAndDeletesDisabledConfig(t *testing.T) {
+	ctx := context.Background()
+	database, err := store.Open(ctx, filepath.Join(t.TempDir(), "vocat.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer database.Close()
+	if err := database.UpsertDevice(ctx, store.Device{ID: "modem-1", Name: "modem-1", Interface: "wwan0"}); err != nil {
+		t.Fatal(err)
+	}
+	manager, err := New(ctx, database, slog.New(slog.NewTextHandler(io.Discard, nil)), "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	created, err := manager.Create(ctx, Config{DeviceID: "modem-1", Mode: "socks5", ListenHost: "127.0.0.1", ListenPort: 1080})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if created.ID == "" || created.Interface != "wwan0" {
+		t.Fatalf("created = %+v", created)
+	}
+	configs, err := manager.Configs()
+	if err != nil || len(configs) != 1 {
+		t.Fatalf("configs = %+v, %v", configs, err)
+	}
+	if err := manager.DeleteAllAndDisable(ctx); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := manager.Configs(); !errors.Is(err, ErrDisabled) {
+		t.Fatalf("Configs after disable = %v", err)
+	}
+	if _, err := database.AppSetting(ctx, SettingKey); !errors.Is(err, store.ErrNotFound) {
+		t.Fatalf("setting remains: %v", err)
+	}
+}
+
+func TestManagerRequiresRoamingDataForEnabledProxy(t *testing.T) {
+	ctx := context.Background()
+	database, err := store.Open(ctx, filepath.Join(t.TempDir(), "vocat.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer database.Close()
+	if err := database.UpsertDevice(ctx, store.Device{ID: "modem-1", Name: "modem-1", Interface: "wwan0"}); err != nil {
+		t.Fatal(err)
+	}
+	manager, err := New(ctx, database, nil, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer manager.Close()
+	_, err = manager.Create(ctx, Config{DeviceID: "modem-1", Mode: "socks5", ListenHost: "127.0.0.1", ListenPort: 1080, Enabled: true})
+	if err == nil {
+		t.Fatal("enabled proxy was accepted while roaming data was disabled")
+	}
+}
+
+func TestManagerEnabledConfigForDevice(t *testing.T) {
+	ctx := context.Background()
+	database, err := store.Open(ctx, filepath.Join(t.TempDir(), "vocat.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer database.Close()
+	if err := database.UpsertDevice(ctx, store.Device{ID: "modem-1", Name: "modem-1", Interface: "wwan0", NetworkEnabled: true}); err != nil {
+		t.Fatal(err)
+	}
+	if err := database.UpsertDevice(ctx, store.Device{ID: "modem-2", Name: "modem-2", Interface: "wwan1", NetworkEnabled: true}); err != nil {
+		t.Fatal(err)
+	}
+	manager, err := New(ctx, database, nil, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer manager.Close()
+	if _, ok := manager.EnabledConfigForDevice("modem-1"); ok {
+		t.Fatal("reported an enabled config before any was created")
+	}
+	// A disabled config bound to modem-1 must not count.
+	if _, err := manager.Create(ctx, Config{DeviceID: "modem-1", Mode: "socks5", ListenHost: "127.0.0.1", ListenPort: 1080}); err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := manager.EnabledConfigForDevice("modem-1"); ok {
+		t.Fatal("disabled config counted as enabled")
+	}
+	// An enabled config bound to modem-2 counts only for modem-2. The listener start
+	// is Linux-only, so the config is created disabled and flipped on in memory to
+	// exercise the query without binding a port.
+	created, err := manager.Create(ctx, Config{DeviceID: "modem-2", Mode: "socks5", ListenHost: "127.0.0.1", ListenPort: 0, AuthEnabled: true, Username: "u", Password: "secret"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	manager.mu.Lock()
+	for index := range manager.configs {
+		if manager.configs[index].ID == created.ID {
+			manager.configs[index].Enabled = true
+		}
+	}
+	manager.mu.Unlock()
+	if _, ok := manager.EnabledConfigForDevice("modem-1"); ok {
+		t.Fatal("config bound to another device counted")
+	}
+	found, ok := manager.EnabledConfigForDevice("modem-2")
+	if !ok {
+		t.Fatal("enabled config not found for its device")
+	}
+	if found.Password != PasswordMask {
+		t.Fatalf("password not redacted: %+v", found)
+	}
+}

internal/exportproxy/proxy_http.go

@@ -0,0 +1,72 @@
+package exportproxy
+
+import (
+	"bufio"
+	"context"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"strings"
+)
+
+func serveHTTP(client net.Conn, config Config, dialer *net.Dialer, resolver *net.Resolver) error {
+	reader := bufio.NewReader(client)
+	request, err := http.ReadRequest(reader)
+	if err != nil {
+		return err
+	}
+	if config.AuthEnabled && !httpAuthorized(request, config) {
+		_, _ = client.Write([]byte("HTTP/1.1 407 Proxy Authentication Required\r\nProxy-Authenticate: Basic realm=\"vocat-export-proxy\"\r\n\r\n"))
+		return errors.New("HTTP proxy authentication required")
+	}
+	if request.Method == http.MethodConnect {
+		ctx, cancel := context.WithTimeout(context.Background(), proxyTimeout)
+		target, err := dialTarget(ctx, request.URL.Host, dialer, resolver)
+		cancel()
+		if err != nil {
+			_, _ = fmt.Fprint(client, "HTTP/1.1 502 Bad Gateway\r\n\r\n")
+			return err
+		}
+		defer target.Close()
+		if _, err := client.Write([]byte("HTTP/1.1 200 Connection Established\r\n\r\n")); err != nil {
+			return err
+		}
+		if buffered := reader.Buffered(); buffered > 0 {
+			if value, err := reader.Peek(buffered); err == nil {
+				_, _ = target.Write(value)
+				_, _ = reader.Discard(buffered)
+			}
+		}
+		pipe(client, target)
+		return nil
+	}
+
+	request.Header.Del("Proxy-Authorization")
+	request.Header.Del("Proxy-Connection")
+	request.RequestURI = ""
+	transport := &http.Transport{
+		DialContext: func(ctx context.Context, _, address string) (net.Conn, error) {
+			return dialTarget(ctx, address, dialer, resolver)
+		},
+		DisableKeepAlives: true,
+	}
+	response, err := transport.RoundTrip(request)
+	if err != nil {
+		_, _ = fmt.Fprint(client, "HTTP/1.1 502 Bad Gateway\r\n\r\n")
+		return err
+	}
+	defer response.Body.Close()
+	return response.Write(client)
+}
+
+func httpAuthorized(request *http.Request, config Config) bool {
+	header := strings.TrimSpace(strings.TrimPrefix(request.Header.Get("Proxy-Authorization"), "Basic "))
+	decoded, err := base64.StdEncoding.DecodeString(header)
+	if err != nil {
+		return false
+	}
+	parts := strings.SplitN(string(decoded), ":", 2)
+	return len(parts) == 2 && parts[0] == config.Username && parts[1] == config.Password
+}

internal/exportproxy/proxy_shared.go

@@ -0,0 +1,55 @@
+package exportproxy
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"time"
+)
+
+const proxyTimeout = 30 * time.Second
+
+func dialTarget(ctx context.Context, address string, dialer *net.Dialer, resolver *net.Resolver) (net.Conn, error) {
+	host, port, err := net.SplitHostPort(address)
+	if err != nil {
+		return nil, err
+	}
+	if ip := net.ParseIP(host); ip != nil {
+		return dialer.DialContext(ctx, "tcp", net.JoinHostPort(ip.String(), port))
+	}
+	ips, err := resolver.LookupIPAddr(ctx, host)
+	if err != nil {
+		return nil, err
+	}
+	var lastErr error
+	for _, ip := range ips {
+		connection, err := dialer.DialContext(ctx, "tcp", net.JoinHostPort(ip.IP.String(), port))
+		if err == nil {
+			return connection, nil
+		}
+		lastErr = err
+	}
+	if lastErr == nil {
+		lastErr = fmt.Errorf("%w: no addresses for %s", errors.ErrUnsupported, host)
+	}
+	return nil, lastErr
+}
+
+func pipe(left, right net.Conn) {
+	done := make(chan struct{}, 2)
+	go func() { _, _ = copyConnection(right, left); done <- struct{}{} }()
+	go func() { _, _ = copyConnection(left, right); done <- struct{}{} }()
+	<-done
+}
+
+func copyConnection(destination net.Conn, source net.Conn) (int64, error) {
+	written, err := io.CopyBuffer(destination, source, make([]byte, 32*1024))
+	if err == nil && written > 0 {
+		if connection, ok := destination.(interface{ CloseWrite() error }); ok {
+			_ = connection.CloseWrite()
+		}
+	}
+	return written, err
+}

internal/exportproxy/proxy_socks.go

@@ -0,0 +1,148 @@
+package exportproxy
+
+import (
+	"bufio"
+	"context"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"strconv"
+)
+
+func serveSOCKS(client net.Conn, config Config, dialer *net.Dialer, resolver *net.Resolver) error {
+	reader := bufio.NewReader(client)
+	version, err := reader.ReadByte()
+	if err != nil || version != 5 {
+		return errors.New("unsupported SOCKS version")
+	}
+	methodCount, err := reader.ReadByte()
+	if err != nil {
+		return err
+	}
+	methods := make([]byte, methodCount)
+	if _, err := io.ReadFull(reader, methods); err != nil {
+		return err
+	}
+	chosen := byte(0xff)
+	if config.AuthEnabled && hasMethod(methods, 2) {
+		chosen = 2
+	} else if !config.AuthEnabled && hasMethod(methods, 0) {
+		chosen = 0
+	}
+	if _, err := client.Write([]byte{5, chosen}); err != nil || chosen == 0xff {
+		return errors.New("no acceptable SOCKS authentication method")
+	}
+	if chosen == 2 {
+		if err := socksAuthenticate(reader, client, config); err != nil {
+			return err
+		}
+	}
+	header := make([]byte, 4)
+	if _, err := io.ReadFull(reader, header); err != nil {
+		return err
+	}
+	if header[0] != 5 || header[1] != 1 {
+		_ = writeSocksReply(client, 7)
+		return errors.New("only SOCKS5 CONNECT is supported")
+	}
+	host, port, err := readSocksAddress(reader, header[3])
+	if err != nil {
+		_ = writeSocksReply(client, 1)
+		return err
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), proxyTimeout)
+	target, err := dialTarget(ctx, net.JoinHostPort(host, strconv.Itoa(port)), dialer, resolver)
+	cancel()
+	if err != nil {
+		_ = writeSocksReply(client, 5)
+		return err
+	}
+	defer target.Close()
+	if err := writeSocksReply(client, 0); err != nil {
+		return err
+	}
+	if buffered := reader.Buffered(); buffered > 0 {
+		if value, err := reader.Peek(buffered); err == nil {
+			_, _ = target.Write(value)
+			_, _ = reader.Discard(buffered)
+		}
+	}
+	pipe(client, target)
+	return nil
+}
+
+func socksAuthenticate(reader *bufio.Reader, writer io.Writer, config Config) error {
+	header := make([]byte, 2)
+	if _, err := io.ReadFull(reader, header); err != nil || header[0] != 1 {
+		return errors.New("invalid SOCKS authentication request")
+	}
+	username := make([]byte, int(header[1]))
+	if _, err := io.ReadFull(reader, username); err != nil {
+		return err
+	}
+	length, err := reader.ReadByte()
+	if err != nil {
+		return err
+	}
+	password := make([]byte, int(length))
+	if _, err := io.ReadFull(reader, password); err != nil {
+		return err
+	}
+	if string(username) != config.Username || string(password) != config.Password {
+		_, _ = writer.Write([]byte{1, 1})
+		return errors.New("SOCKS authentication failed")
+	}
+	_, err = writer.Write([]byte{1, 0})
+	return err
+}
+
+func hasMethod(methods []byte, wanted byte) bool {
+	for _, method := range methods {
+		if method == wanted {
+			return true
+		}
+	}
+	return false
+}
+
+func readSocksAddress(reader *bufio.Reader, kind byte) (string, int, error) {
+	var host string
+	switch kind {
+	case 1:
+		value := make([]byte, 4)
+		if _, err := io.ReadFull(reader, value); err != nil {
+			return "", 0, err
+		}
+		host = net.IP(value).String()
+	case 3:
+		length, err := reader.ReadByte()
+		if err != nil {
+			return "", 0, err
+		}
+		value := make([]byte, int(length))
+		if _, err := io.ReadFull(reader, value); err != nil {
+			return "", 0, err
+		}
+		host = string(value)
+	case 4:
+		value := make([]byte, 16)
+		if _, err := io.ReadFull(reader, value); err != nil {
+			return "", 0, err
+		}
+		host = net.IP(value).String()
+	default:
+		return "", 0, fmt.Errorf("unsupported SOCKS address type %d", kind)
+	}
+	value := make([]byte, 2)
+	if _, err := io.ReadFull(reader, value); err != nil {
+		return "", 0, err
+	}
+	return host, int(binary.BigEndian.Uint16(value)), nil
+}
+
+func writeSocksReply(connection net.Conn, code byte) error {
+	_, err := connection.Write([]byte{5, code, 0, 1, 0, 0, 0, 0, 0, 0})
+	return err
+}

internal/extensions/manager.go

@@ -24,6 +24,9 @@ import (
 	"strings"
 	"sync"
 	"time"
+
+	"vocat/internal/exportproxy"
+	"vocat/internal/netguard"
 )
 
 const maxPackageBytes int64 = 64 << 20
@@ -71,7 +74,7 @@ func NewManager(root string, logger *slog.Logger) (*Manager, error) {
 	}
 	manager := &Manager{
 		root: root, logger: logger, plugins: make(map[string]*Plugin),
-		client: &http.Client{Timeout: 45 * time.Second},
+		client: netguard.NewPublicHTTPClient(45*time.Second, true),
 	}
 	if err := manager.scan(); err != nil {
 		return nil, err
@@ -94,6 +97,10 @@ func (manager *Manager) scan() error {
 			manager.logger.Warn("skip invalid plugin", "directory", dir, "error", err)
 			continue
 		}
+		if plugin.ID == exportproxy.ReservedID {
+			manager.logger.Info("skip legacy Export Proxy plugin; functionality is built in", "directory", dir)
+			continue
+		}
 		manager.plugins[plugin.ID] = plugin
 		if plugin.Enabled {
 			manager.startLocked(plugin)
@@ -149,9 +156,9 @@ func (manager *Manager) List() []Plugin {
 }
 
 func (manager *Manager) InstallURL(ctx context.Context, rawURL, expectedSHA string) (Plugin, error) {
-	parsed, err := url.Parse(strings.TrimSpace(rawURL))
-	if err != nil || (parsed.Scheme != "https" && parsed.Scheme != "http") || parsed.Host == "" {
-		return Plugin{}, errors.New("plugin URL must be an absolute HTTP or HTTPS URL")
+	parsed, err := netguard.ValidatePublicURL(ctx, rawURL, true)
+	if err != nil {
+		return Plugin{}, fmt.Errorf("plugin URL must be a public absolute HTTPS URL: %w", err)
 	}
 	request, err := http.NewRequestWithContext(ctx, http.MethodGet, parsed.String(), nil)
 	if err != nil {
@@ -201,6 +208,9 @@ func (manager *Manager) Install(reader io.Reader, expectedSHA string) (Plugin, e
 	if err != nil {
 		return Plugin{}, err
 	}
+	if manifest.ID == exportproxy.ReservedID {
+		return Plugin{}, errors.New("plugin ID export-proxy is reserved by the built-in Export Proxy feature")
+	}
 	staging, err := os.MkdirTemp(manager.root, ".install-"+manifest.ID+"-")
 	if err != nil {
 		return Plugin{}, err
@@ -344,12 +354,13 @@ func (manager *Manager) ServeAsset(w http.ResponseWriter, r *http.Request, id, n
 		http.NotFound(w, r)
 		return
 	}
-	filename := filepath.Join(plugin.dir, filepath.FromSlash(name))
-	if !strings.HasPrefix(filepath.Clean(filename), filepath.Clean(plugin.dir)+string(os.PathSeparator)) {
+	root, err := os.OpenRoot(plugin.dir)
+	if err != nil {
 		http.NotFound(w, r)
 		return
 	}
-	file, err := os.Open(filename)
+	defer root.Close()
+	file, err := root.Open(filepath.FromSlash(name))
 	if err != nil {
 		http.NotFound(w, r)
 		return
@@ -360,7 +371,7 @@ func (manager *Manager) ServeAsset(w http.ResponseWriter, r *http.Request, id, n
 		http.NotFound(w, r)
 		return
 	}
-	contentType := mime.TypeByExtension(filepath.Ext(filename))
+	contentType := mime.TypeByExtension(filepath.Ext(name))
 	if contentType != "" {
 		w.Header().Set("Content-Type", contentType)
 	}

internal/extensions/manager_test.go

@@ -3,12 +3,30 @@ package extensions
 import (
 	"archive/zip"
 	"bytes"
+	"context"
 	"io"
 	"log/slog"
 	"strings"
 	"testing"
 )
 
+func TestInstallURLRejectsNonHTTPSAndPrivateDestinations(t *testing.T) {
+	manager, err := NewManager(t.TempDir(), nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer manager.Close()
+	for _, raw := range []string{
+		"http://example.com/plugin.zip",
+		"https://127.0.0.1/plugin.zip",
+		"https://169.254.169.254/latest/meta-data/",
+	} {
+		if _, err := manager.InstallURL(context.Background(), raw, ""); err == nil {
+			t.Errorf("InstallURL(%q) accepted an unsafe destination", raw)
+		}
+	}
+}
+
 func TestInstallListDisableAndUninstall(t *testing.T) {
 	manager, err := NewManager(t.TempDir(), slog.New(slog.NewTextHandler(io.Discard, nil)))
 	if err != nil {

internal/httpsmode/listener.go

@@ -0,0 +1,106 @@
+package httpsmode
+
+import (
+	"bufio"
+	"errors"
+	"net"
+	"sync"
+	"time"
+)
+
+type bufferedConn struct {
+	net.Conn
+	reader *bufio.Reader
+}
+
+func (conn *bufferedConn) Read(buffer []byte) (int, error) { return conn.reader.Read(buffer) }
+
+type channelListener struct {
+	address net.Addr
+	conns   chan net.Conn
+	done    chan struct{}
+}
+
+func (listener *channelListener) Accept() (net.Conn, error) {
+	select {
+	case conn := <-listener.conns:
+		if conn == nil {
+			return nil, net.ErrClosed
+		}
+		return conn, nil
+	case <-listener.done:
+		return nil, net.ErrClosed
+	}
+}
+func (listener *channelListener) Close() error   { return nil }
+func (listener *channelListener) Addr() net.Addr { return listener.address }
+
+type Multiplexer struct {
+	base      net.Listener
+	manager   *Manager
+	plain     *channelListener
+	tls       *channelListener
+	done      chan struct{}
+	closeOnce sync.Once
+}
+
+func NewMultiplexer(base net.Listener, manager *Manager) *Multiplexer {
+	done := make(chan struct{})
+	mux := &Multiplexer{
+		base: base, manager: manager, done: done,
+		plain: &channelListener{address: base.Addr(), conns: make(chan net.Conn, 64), done: done},
+		tls:   &channelListener{address: base.Addr(), conns: make(chan net.Conn, 64), done: done},
+	}
+	go mux.accept()
+	return mux
+}
+
+func (mux *Multiplexer) Plain() net.Listener { return mux.plain }
+func (mux *Multiplexer) TLS() net.Listener   { return mux.tls }
+
+func (mux *Multiplexer) Close() error {
+	var err error
+	mux.closeOnce.Do(func() {
+		close(mux.done)
+		err = mux.base.Close()
+	})
+	return err
+}
+
+func (mux *Multiplexer) accept() {
+	for {
+		conn, err := mux.base.Accept()
+		if err != nil {
+			if !errors.Is(err, net.ErrClosed) {
+				_ = mux.Close()
+			}
+			return
+		}
+		go mux.classify(conn)
+	}
+}
+
+func (mux *Multiplexer) classify(conn net.Conn) {
+	reader := bufio.NewReaderSize(conn, 4096)
+	_ = conn.SetReadDeadline(time.Now().Add(10 * time.Second))
+	first, err := reader.Peek(1)
+	_ = conn.SetReadDeadline(time.Time{})
+	if err != nil {
+		_ = conn.Close()
+		return
+	}
+	wrapped := &bufferedConn{Conn: conn, reader: reader}
+	listener := mux.plain
+	if first[0] == 0x16 {
+		if !mux.manager.Enabled() {
+			_ = conn.Close()
+			return
+		}
+		listener = mux.tls
+	}
+	select {
+	case listener.conns <- wrapped:
+	case <-mux.done:
+		_ = conn.Close()
+	}
+}

internal/httpsmode/manager.go

@@ -0,0 +1,259 @@
+package httpsmode
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/hex"
+	"encoding/json"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"math/big"
+	"net"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"vocat/internal/store"
+)
+
+const SettingKey = "transport.self_signed_https"
+
+type State struct {
+	Enabled     bool      `json:"enabled"`
+	HTTPURL     string    `json:"http_url"`
+	HTTPSURL    string    `json:"https_url"`
+	Fingerprint string    `json:"fingerprint,omitempty"`
+	NotAfter    time.Time `json:"not_after,omitempty"`
+}
+
+type Manager struct {
+	store   *store.Store
+	dir     string
+	address string
+	enabled atomic.Bool
+	mu      sync.RWMutex
+	cert    *tls.Certificate
+}
+
+func New(ctx context.Context, database *store.Store, dir, address string) (*Manager, error) {
+	manager := &Manager{store: database, dir: dir, address: address}
+	setting, err := database.AppSetting(ctx, SettingKey)
+	if err == nil {
+		var document struct {
+			Enabled bool `json:"enabled"`
+		}
+		if json.Unmarshal(setting.Value, &document) == nil && document.Enabled {
+			if err := manager.ensureCertificate(); err != nil {
+				return nil, err
+			}
+			manager.enabled.Store(true)
+		}
+	} else if !errors.Is(err, store.ErrNotFound) {
+		return nil, err
+	}
+	return manager, nil
+}
+
+func (manager *Manager) Enabled() bool { return manager != nil && manager.enabled.Load() }
+
+func (manager *Manager) SetEnabled(ctx context.Context, enabled bool) (State, error) {
+	if enabled {
+		if err := manager.ensureCertificate(); err != nil {
+			return State{}, err
+		}
+	}
+	raw, err := json.Marshal(map[string]bool{"enabled": enabled})
+	if err != nil {
+		return State{}, err
+	}
+	if err := manager.store.UpsertAppSetting(ctx, store.AppSetting{Key: SettingKey, Value: raw}); err != nil {
+		return State{}, err
+	}
+	manager.enabled.Store(enabled)
+	return manager.State(""), nil
+}
+
+func (manager *Manager) State(host string) State {
+	host = strings.TrimSpace(host)
+	if host == "" {
+		host = manager.address
+	}
+	state := State{
+		Enabled:  manager.Enabled(),
+		HTTPURL:  "http://" + host,
+		HTTPSURL: "https://" + host,
+	}
+	manager.mu.RLock()
+	if manager.cert != nil && manager.cert.Leaf != nil {
+		digest := sha256.Sum256(manager.cert.Leaf.Raw)
+		encoded := strings.ToUpper(hex.EncodeToString(digest[:]))
+		parts := make([]string, 0, len(encoded)/2)
+		for len(encoded) >= 2 {
+			parts = append(parts, encoded[:2])
+			encoded = encoded[2:]
+		}
+		state.Fingerprint = strings.Join(parts, ":")
+		state.NotAfter = manager.cert.Leaf.NotAfter
+	}
+	manager.mu.RUnlock()
+	return state
+}
+
+func (manager *Manager) TLSConfig() *tls.Config {
+	return &tls.Config{
+		MinVersion: tls.VersionTLS12,
+		NextProtos: []string{"h2", "http/1.1"},
+		GetCertificate: func(*tls.ClientHelloInfo) (*tls.Certificate, error) {
+			manager.mu.RLock()
+			defer manager.mu.RUnlock()
+			if manager.cert == nil {
+				return nil, errors.New("self-signed certificate is unavailable")
+			}
+			return manager.cert, nil
+		},
+	}
+}
+
+func (manager *Manager) CertificatePEM() ([]byte, error) {
+	if err := manager.ensureCertificate(); err != nil {
+		return nil, err
+	}
+	return os.ReadFile(filepath.Join(manager.dir, "selfsigned.crt"))
+}
+
+func (manager *Manager) ensureCertificate() error {
+	manager.mu.Lock()
+	defer manager.mu.Unlock()
+	if manager.cert != nil && manager.cert.Leaf != nil && time.Until(manager.cert.Leaf.NotAfter) > 30*24*time.Hour {
+		return nil
+	}
+	if err := os.MkdirAll(manager.dir, 0o750); err != nil {
+		return fmt.Errorf("create TLS directory: %w", err)
+	}
+	certPath := filepath.Join(manager.dir, "selfsigned.crt")
+	keyPath := filepath.Join(manager.dir, "selfsigned.key")
+	if cert, err := loadCertificate(certPath, keyPath); err == nil && time.Until(cert.Leaf.NotAfter) > 30*24*time.Hour {
+		manager.cert = cert
+		return nil
+	}
+	certPEM, keyPEM, err := generateCertificate(manager.address)
+	if err != nil {
+		return err
+	}
+	if err := writePrivateFile(keyPath, keyPEM, 0o600); err != nil {
+		return err
+	}
+	if err := writePrivateFile(certPath, certPEM, 0o644); err != nil {
+		return err
+	}
+	cert, err := loadCertificate(certPath, keyPath)
+	if err != nil {
+		return err
+	}
+	manager.cert = cert
+	return nil
+}
+
+func loadCertificate(certPath, keyPath string) (*tls.Certificate, error) {
+	cert, err := tls.LoadX509KeyPair(certPath, keyPath)
+	if err != nil {
+		return nil, err
+	}
+	if len(cert.Certificate) == 0 {
+		return nil, errors.New("certificate chain is empty")
+	}
+	cert.Leaf, err = x509.ParseCertificate(cert.Certificate[0])
+	if err != nil {
+		return nil, err
+	}
+	return &cert, nil
+}
+
+func generateCertificate(address string) ([]byte, []byte, error) {
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return nil, nil, err
+	}
+	limit := new(big.Int).Lsh(big.NewInt(1), 128)
+	serial, err := rand.Int(rand.Reader, limit)
+	if err != nil {
+		return nil, nil, err
+	}
+	now := time.Now().UTC()
+	template := &x509.Certificate{
+		SerialNumber: serial,
+		Subject:      pkix.Name{CommonName: "VoCat self-signed local certificate", Organization: []string{"VoCat"}},
+		NotBefore:    now.Add(-5 * time.Minute), NotAfter: now.AddDate(5, 0, 0),
+		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		BasicConstraintsValid: true,
+		DNSNames:              []string{"localhost"},
+		IPAddresses:           []net.IP{net.IPv4(127, 0, 0, 1), net.IPv6loopback},
+	}
+	if hostname, hostnameErr := os.Hostname(); hostnameErr == nil && strings.TrimSpace(hostname) != "" {
+		template.DNSNames = append(template.DNSNames, strings.TrimSpace(hostname))
+	}
+	if host, _, splitErr := net.SplitHostPort(address); splitErr == nil {
+		if ip := net.ParseIP(host); ip != nil && !ip.IsUnspecified() {
+			template.IPAddresses = append(template.IPAddresses, ip)
+		} else if host != "" && host != "0.0.0.0" && host != "::" {
+			template.DNSNames = append(template.DNSNames, host)
+		}
+	}
+	if interfaces, interfaceErr := net.InterfaceAddrs(); interfaceErr == nil {
+		for _, item := range interfaces {
+			text := item.String()
+			if slash := strings.IndexByte(text, '/'); slash >= 0 {
+				text = text[:slash]
+			}
+			if ip := net.ParseIP(strings.TrimSpace(text)); ip != nil && !ip.IsUnspecified() {
+				template.IPAddresses = append(template.IPAddresses, ip)
+			}
+		}
+	}
+	der, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
+	if err != nil {
+		return nil, nil, err
+	}
+	keyDER, err := x509.MarshalPKCS8PrivateKey(key)
+	if err != nil {
+		return nil, nil, err
+	}
+	return pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}),
+		pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: keyDER}), nil
+}
+
+func writePrivateFile(path string, data []byte, mode os.FileMode) error {
+	temp, err := os.CreateTemp(filepath.Dir(path), ".tls-*")
+	if err != nil {
+		return err
+	}
+	tempName := temp.Name()
+	defer os.Remove(tempName)
+	if err := temp.Chmod(mode); err != nil {
+		_ = temp.Close()
+		return err
+	}
+	if _, err := temp.Write(data); err != nil {
+		_ = temp.Close()
+		return err
+	}
+	if err := temp.Sync(); err != nil {
+		_ = temp.Close()
+		return err
+	}
+	if err := temp.Close(); err != nil {
+		return err
+	}
+	return os.Rename(tempName, path)
+}

internal/httpsmode/manager_test.go

@@ -0,0 +1,99 @@
+package httpsmode
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+	"path/filepath"
+	"testing"
+
+	"vocat/internal/store"
+)
+
+func TestManagerPersistsToggleAndCertificate(t *testing.T) {
+	ctx := context.Background()
+	dir := t.TempDir()
+	database, err := store.Open(ctx, filepath.Join(dir, "vocat.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer database.Close()
+	manager, err := New(ctx, database, filepath.Join(dir, "tls"), "0.0.0.0:7575")
+	if err != nil {
+		t.Fatal(err)
+	}
+	state, err := manager.SetEnabled(ctx, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !state.Enabled || state.Fingerprint == "" || state.NotAfter.IsZero() {
+		t.Fatalf("enabled state = %#v", state)
+	}
+	certificate, err := manager.CertificatePEM()
+	if err != nil || len(certificate) == 0 {
+		t.Fatalf("certificate = %d bytes, %v", len(certificate), err)
+	}
+	reloaded, err := New(ctx, database, filepath.Join(dir, "tls"), "0.0.0.0:7575")
+	if err != nil || !reloaded.Enabled() {
+		t.Fatalf("reloaded manager enabled=%v error=%v", reloaded.Enabled(), err)
+	}
+	if _, err := reloaded.SetEnabled(ctx, false); err != nil || reloaded.Enabled() {
+		t.Fatalf("disable enabled=%v error=%v", reloaded.Enabled(), err)
+	}
+}
+
+func TestMultiplexerRoutesPlainAndTLS(t *testing.T) {
+	ctx := context.Background()
+	dir := t.TempDir()
+	database, err := store.Open(ctx, filepath.Join(dir, "vocat.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer database.Close()
+	manager, err := New(ctx, database, filepath.Join(dir, "tls"), "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := manager.SetEnabled(ctx, true); err != nil {
+		t.Fatal(err)
+	}
+	base, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	mux := NewMultiplexer(base, manager)
+	defer mux.Close()
+
+	plainClient, err := net.Dial("tcp", base.Addr().String())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer plainClient.Close()
+	if _, err := plainClient.Write([]byte("GET / HTTP/1.1\r\nHost: local\r\n\r\n")); err != nil {
+		t.Fatal(err)
+	}
+	plainServer, err := mux.Plain().Accept()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer plainServer.Close()
+
+	tlsResult := make(chan error, 1)
+	go func() {
+		serverConn, acceptErr := mux.TLS().Accept()
+		if acceptErr != nil {
+			tlsResult <- acceptErr
+			return
+		}
+		defer serverConn.Close()
+		tlsResult <- tls.Server(serverConn, manager.TLSConfig()).Handshake()
+	}()
+	tlsClient, err := tls.Dial("tcp", base.Addr().String(), &tls.Config{InsecureSkipVerify: true}) // test-only local certificate
+	if err != nil {
+		t.Fatal(err)
+	}
+	_ = tlsClient.Close()
+	if err := <-tlsResult; err != nil {
+		t.Fatal(err)
+	}
+}

internal/i18n/i18n.go

@@ -74,6 +74,7 @@ var zhToEn = map[string]string{
 	// ---- devices ----
 	"设备数量已达上限，最多只能添加 %d 台设备": "Device limit reached; at most %d devices can be added.",
 	"SIM 卡归属地为%s（MCC %s），本服务不向该地区卡片提供数据/短信/VoWiFi": "The SIM's home region is %s (MCC %s); this service does not provide data, SMS, or VoWiFi to cards from that region.",
+	"请先禁用该设备已绑定的导出代理，再关闭漫游数据": "Disable the export proxy bound to this device before turning off roaming data.",
 
 	// ---- settings / update ----
 	"未配置受信任的软件更新源；不会从未知地址下载或执行文件。": "No trusted update source is configured; no files will be downloaded or executed from unknown addresses.",

internal/modem/discovery.go

@@ -221,7 +221,13 @@ func readSerialAliases(root string) map[string]string {
 func candidateID(productID, serialNumber, usbName string) string {
 	serialNumber = strings.TrimSpace(serialNumber)
 	if serialNumber != "" && !strings.EqualFold(serialNumber, "android") {
-		return "quectel-" + sanitizeID(serialNumber)
+		// A surprising number of EC20/EC25 carrier boards expose the same
+		// factory/default USB serial number.  The device manager is keyed by this
+		// value, so using the serial alone silently collapsed two modems connected
+		// to the same hub into one entry.  Include the physical USB topology in the
+		// discovery key; configured devices remain stable through ATMapper's
+		// USB-path/IMEI matching even when Linux renumbers ttyUSB nodes.
+		return "quectel-" + sanitizeID(serialNumber+"-"+usbName)
 	}
 	return "quectel-" + sanitizeID(productID+"-"+usbName)
 }

internal/modem/discovery_test.go

@@ -171,6 +171,51 @@ func TestSysFSDiscoverySelectsATPortForSecondQMIUSBModem(t *testing.T) {
 	}
 }
 
+func TestSysFSDiscoveryDoesNotCollapseModemsWithSharedFactorySerial(t *testing.T) {
+	root := t.TempDir()
+	sysRoot := filepath.Join(root, "sys")
+	devRoot := filepath.Join(root, "dev")
+	usbRoot := filepath.Join(sysRoot, "bus", "usb", "devices")
+
+	for index, item := range []struct {
+		usbName string
+		ttyBase int
+	}{
+		{usbName: "1-5.1", ttyBase: 0},
+		{usbName: "1-5.2", ttyBase: 4},
+	} {
+		mustWrite(t, filepath.Join(usbRoot, item.usbName, "idVendor"), "2c7c\n")
+		mustWrite(t, filepath.Join(usbRoot, item.usbName, "idProduct"), "0125\n")
+		mustWrite(t, filepath.Join(usbRoot, item.usbName, "serial"), "0123456789ABCDEF\n")
+		for number := 0; number < 4; number++ {
+			interfaceName := item.usbName + ":1." + strconv.Itoa(number)
+			tty := fmt.Sprintf("ttyUSB%d", item.ttyBase+number)
+			mustWrite(t, filepath.Join(usbRoot, interfaceName, "bInterfaceNumber"), fmt.Sprintf("%02x\n", number))
+			mustMkdir(t, filepath.Join(usbRoot, interfaceName, tty, "tty", tty))
+		}
+		mustMkdir(t, filepath.Join(usbRoot, item.usbName+":1.4", "usbmisc", fmt.Sprintf("cdc-wdm%d", index)))
+	}
+
+	candidates, err := NewSysFSDiscoverer(sysRoot, devRoot).Discover(context.Background())
+	if err != nil {
+		t.Fatalf("Discover: %v", err)
+	}
+	if len(candidates) != 2 {
+		t.Fatalf("got %d candidates, want 2", len(candidates))
+	}
+	if candidates[0].ID == candidates[1].ID {
+		t.Fatalf("shared factory serial collapsed discovery IDs to %q", candidates[0].ID)
+	}
+	for _, candidate := range candidates {
+		if candidate.SerialNumber != "0123456789ABCDEF" {
+			t.Fatalf("serial = %q", candidate.SerialNumber)
+		}
+		if candidate.ATPort.Role != PortRoleAT {
+			t.Fatalf("AT port = %#v", candidate.ATPort)
+		}
+	}
+}
+
 func TestSysFSDiscoveryIgnoresNonQuectelUSB(t *testing.T) {
 	root := t.TempDir()
 	usbRoot := filepath.Join(root, "sys", "bus", "usb", "devices")

internal/netguard/public.go

@@ -0,0 +1,170 @@
+package netguard
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"net/netip"
+	"net/url"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// ValidatePublicURL accepts an absolute HTTP(S) URL only when every currently
+// resolved address is publicly routable. The transport returned by
+// NewPublicHTTPClient repeats the same check when it dials, which also prevents
+// DNS rebinding between validation and connection establishment.
+func ValidatePublicURL(ctx context.Context, raw string, requireHTTPS bool) (*url.URL, error) {
+	parsed, err := url.Parse(strings.TrimSpace(raw))
+	if err != nil || !parsed.IsAbs() || parsed.Hostname() == "" {
+		return nil, errors.New("destination must be an absolute HTTP URL")
+	}
+	if parsed.User != nil {
+		return nil, errors.New("destination URL cannot contain user information")
+	}
+	if parsed.Scheme != "http" && parsed.Scheme != "https" {
+		return nil, errors.New("destination URL must use HTTP or HTTPS")
+	}
+	if requireHTTPS && parsed.Scheme != "https" {
+		return nil, errors.New("destination URL must use HTTPS")
+	}
+	if port := parsed.Port(); port != "" {
+		value, err := strconv.Atoi(port)
+		if err != nil || value < 1 || value > 65535 {
+			return nil, errors.New("destination URL has an invalid port")
+		}
+	}
+	if _, err := resolvePublic(ctx, parsed.Hostname()); err != nil {
+		return nil, err
+	}
+	return parsed, nil
+}
+
+// NewPublicHTTPClient creates a client that never uses environment proxies,
+// rejects private/special-use destinations at dial time, and validates every
+// redirect before following it.
+func NewPublicHTTPClient(timeout time.Duration, requireHTTPS bool) *http.Client {
+	if timeout <= 0 {
+		timeout = 30 * time.Second
+	}
+	transport := &http.Transport{
+		Proxy:                 nil,
+		DialContext:           PublicDialer(timeout),
+		ForceAttemptHTTP2:     true,
+		TLSHandshakeTimeout:   timeout,
+		ResponseHeaderTimeout: timeout,
+		ExpectContinueTimeout: time.Second,
+		TLSClientConfig: &tls.Config{
+			MinVersion: tls.VersionTLS12,
+		},
+	}
+	return &http.Client{
+		Transport: transport,
+		Timeout:   timeout,
+		CheckRedirect: func(request *http.Request, via []*http.Request) error {
+			if len(via) >= 4 {
+				return errors.New("too many redirects")
+			}
+			_, err := ValidatePublicURL(request.Context(), request.URL.String(), requireHTTPS)
+			return err
+		},
+	}
+}
+
+// PublicDialer resolves the original hostname and connects directly to one of
+// its validated public addresses. It does not pass the hostname back through a
+// second resolver, so a DNS rebinding response cannot redirect the connection.
+func PublicDialer(timeout time.Duration) func(context.Context, string, string) (net.Conn, error) {
+	return func(ctx context.Context, network, address string) (net.Conn, error) {
+		host, port, err := net.SplitHostPort(address)
+		if err != nil {
+			return nil, fmt.Errorf("parse outbound address: %w", err)
+		}
+		addresses, err := resolvePublic(ctx, host)
+		if err != nil {
+			return nil, err
+		}
+		dialer := net.Dialer{Timeout: timeout}
+		var lastErr error
+		for _, address := range addresses {
+			connection, err := dialer.DialContext(ctx, network, net.JoinHostPort(address.String(), port))
+			if err == nil {
+				return connection, nil
+			}
+			lastErr = err
+		}
+		return nil, fmt.Errorf("connect to public destination: %w", lastErr)
+	}
+}
+
+func resolvePublic(ctx context.Context, host string) ([]netip.Addr, error) {
+	if literal, err := netip.ParseAddr(strings.Trim(host, "[]")); err == nil {
+		literal = literal.Unmap()
+		if !publicAddress(literal) {
+			return nil, errors.New("destination resolves to a private or special-use address")
+		}
+		return []netip.Addr{literal}, nil
+	}
+	addresses, err := net.DefaultResolver.LookupNetIP(ctx, "ip", host)
+	if err != nil {
+		return nil, fmt.Errorf("resolve destination: %w", err)
+	}
+	result := make([]netip.Addr, 0, len(addresses))
+	for _, address := range addresses {
+		address = address.Unmap()
+		if !publicAddress(address) {
+			return nil, errors.New("destination resolves to a private or special-use address")
+		}
+		result = append(result, address)
+	}
+	if len(result) == 0 {
+		return nil, errors.New("destination has no IP address")
+	}
+	return result, nil
+}
+
+var blockedNetworks = []netip.Prefix{
+	netip.MustParsePrefix("0.0.0.0/8"),
+	netip.MustParsePrefix("10.0.0.0/8"),
+	netip.MustParsePrefix("100.64.0.0/10"),
+	netip.MustParsePrefix("127.0.0.0/8"),
+	netip.MustParsePrefix("169.254.0.0/16"),
+	netip.MustParsePrefix("172.16.0.0/12"),
+	netip.MustParsePrefix("192.0.0.0/24"),
+	netip.MustParsePrefix("192.0.2.0/24"),
+	netip.MustParsePrefix("192.88.99.0/24"),
+	netip.MustParsePrefix("192.168.0.0/16"),
+	netip.MustParsePrefix("198.18.0.0/15"),
+	netip.MustParsePrefix("198.51.100.0/24"),
+	netip.MustParsePrefix("203.0.113.0/24"),
+	netip.MustParsePrefix("224.0.0.0/4"),
+	netip.MustParsePrefix("240.0.0.0/4"),
+	netip.MustParsePrefix("::/128"),
+	netip.MustParsePrefix("::1/128"),
+	netip.MustParsePrefix("64:ff9b:1::/48"),
+	netip.MustParsePrefix("100::/64"),
+	netip.MustParsePrefix("2001:db8::/32"),
+	netip.MustParsePrefix("fc00::/7"),
+	netip.MustParsePrefix("fe80::/10"),
+	netip.MustParsePrefix("ff00::/8"),
+	// Block both the well-known and local-use NAT64 prefixes. Otherwise a
+	// public-looking IPv6 literal could translate to a private IPv4 target.
+	netip.MustParsePrefix("64:ff9b::/96"),
+	netip.MustParsePrefix("2002::/16"),
+}
+
+func publicAddress(address netip.Addr) bool {
+	if !address.IsValid() || !address.IsGlobalUnicast() {
+		return false
+	}
+	for _, blocked := range blockedNetworks {
+		if blocked.Contains(address) {
+			return false
+		}
+	}
+	return true
+}

internal/netguard/public_test.go

@@ -0,0 +1,29 @@
+package netguard
+
+import (
+	"context"
+	"testing"
+)
+
+func TestValidatePublicURLRejectsUnsafeDestinations(t *testing.T) {
+	tests := []string{
+		"http://127.0.0.1/plugin.zip",
+		"https://[::1]/plugin.zip",
+		"https://169.254.169.254/latest/meta-data/",
+		"https://[64:ff9b::7f00:1]/",
+		"https://[2002:7f00:1::]/",
+		"file:///etc/passwd",
+		"https://user:[email protected]/plugin.zip",
+	}
+	for _, raw := range tests {
+		if _, err := ValidatePublicURL(context.Background(), raw, false); err == nil {
+			t.Errorf("ValidatePublicURL(%q) accepted an unsafe destination", raw)
+		}
+	}
+}
+
+func TestValidatePublicURLCanRequireHTTPS(t *testing.T) {
+	if _, err := ValidatePublicURL(context.Background(), "http://8.8.8.8/plugin.zip", true); err == nil {
+		t.Fatal("HTTP destination was accepted while HTTPS was required")
+	}
+}

internal/server/automatic_task_notifications.go

@@ -0,0 +1,306 @@
+package server
+
+import (
+	"bytes"
+	"context"
+	"crypto/hmac"
+	"crypto/sha256"
+	"crypto/tls"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"mime"
+	"net"
+	"net/http"
+	"net/mail"
+	"net/smtp"
+	"strconv"
+	"strings"
+	"time"
+
+	"vocat/internal/store"
+)
+
+type automaticTaskNotification struct {
+	Title string
+	Text  string
+	Time  time.Time
+	Task  store.AutomaticTask
+	Run   store.AutomaticTaskRun
+}
+
+func (s *Server) notifyAutomaticTask(ctx context.Context, task store.AutomaticTask, run store.AutomaticTaskRun) {
+	deviceLabel := task.DeviceID
+	if configured, err := s.store.Device(ctx, task.DeviceID); err == nil {
+		deviceLabel = firstNonEmpty(configured.Name, configured.ID)
+	}
+	status := "成功"
+	detail := firstNonEmpty(run.Output, "任务已完成")
+	if run.Status != "success" {
+		status = "失败"
+		detail = firstNonEmpty(run.Error, "未知错误")
+	}
+	taskType := map[string]string{"sms": "发送短信", "call": "拨打电话", "public_ip": "获取漫游公网 IP"}[task.TaskType]
+	environment := map[string]string{"vowifi": "VoWiFi", "cellular": "基站直连"}[task.Environment]
+	notification := automaticTaskNotification{
+		Title: "自动任务执行" + status,
+		Text: strings.Join([]string{
+			"自动任务执行" + status,
+			"任务  " + task.Name,
+			"设备  " + deviceLabel,
+			"类型  " + firstNonEmpty(taskType, task.TaskType),
+			"环境  " + firstNonEmpty(environment, task.Environment),
+			"时间  " + run.FinishedAt.Local().Format("2006-01-02 15:04:05"),
+			"结果  " + detail,
+		}, "\n"),
+		Time: run.FinishedAt, Task: task, Run: run,
+	}
+	for _, channel := range []string{"telegram", "bark", "email", "pushplus", "webhook"} {
+		setting, err := s.store.NotificationSetting(ctx, channel)
+		if errors.Is(err, store.ErrNotFound) || (err == nil && !setting.Enabled) {
+			continue
+		}
+		if err != nil {
+			s.logger.Warn("read automatic task notification setting", "channel", channel, "error", err)
+			continue
+		}
+		var config map[string]any
+		if err := json.Unmarshal(setting.Config, &config); err != nil {
+			s.logger.Warn("decode automatic task notification setting", "channel", channel, "error", err)
+			continue
+		}
+		if err := sendAutomaticTaskNotification(ctx, channel, config, notification); err != nil {
+			s.logger.Warn("send automatic task notification", "channel", channel, "task_id", task.ID, "error", err)
+		}
+	}
+}
+
+func sendAutomaticTaskNotification(ctx context.Context, channel string, config map[string]any, message automaticTaskNotification) error {
+	switch channel {
+	case "telegram":
+		return sendTelegramTextNotification(ctx, config, message.Text)
+	case "bark":
+		return sendBarkTextNotification(ctx, config, message.Title, message.Text)
+	case "email":
+		return sendEmailTextNotification(ctx, config, message.Title, message.Text)
+	case "pushplus":
+		return sendPushplusTextNotification(ctx, config, message.Title, message.Text)
+	case "webhook":
+		return sendAutomaticTaskWebhook(ctx, config, message)
+	default:
+		return fmt.Errorf("unsupported notification channel %q", channel)
+	}
+}
+
+func sendTelegramTextNotification(ctx context.Context, config map[string]any, text string) error {
+	token := configString(config, "bot_token")
+	parsed, err := validateTelegramAPIURL(ctx, configString(config, "base_url"), token, "sendMessage")
+	if err != nil {
+		return err
+	}
+	client, err := restrictedHTTPClient(ctx, 8*time.Second, configString(config, "proxy"))
+	if err != nil {
+		return err
+	}
+	payload, _ := json.Marshal(map[string]any{"chat_id": configString(config, "chat_id"), "text": text})
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, parsed.String(), bytes.NewReader(payload))
+	if err != nil {
+		return err
+	}
+	request.Header.Set("Content-Type", "application/json")
+	request.Header.Set("User-Agent", "vocat-automatic-task/1")
+	return performNotificationRequest(client, request, true)
+}
+
+func sendBarkTextNotification(ctx context.Context, config map[string]any, title, text string) error {
+	client, err := restrictedHTTPClient(ctx, 8*time.Second, "")
+	if err != nil {
+		return err
+	}
+	payload := map[string]any{"title": title, "body": text}
+	for _, field := range []string{"group", "icon", "level"} {
+		if value := configString(config, field); value != "" {
+			payload[field] = value
+		}
+	}
+	encoded, _ := json.Marshal(payload)
+	for _, destination := range configStrings(config, "urls") {
+		parsed, err := validateOutboundURL(ctx, destination, false)
+		if err != nil {
+			return err
+		}
+		request, err := http.NewRequestWithContext(ctx, http.MethodPost, parsed.String(), bytes.NewReader(encoded))
+		if err != nil {
+			return err
+		}
+		request.Header.Set("Content-Type", "application/json; charset=utf-8")
+		request.Header.Set("User-Agent", "vocat-automatic-task/1")
+		if err := performNotificationRequest(client, request, false); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func sendPushplusTextNotification(ctx context.Context, config map[string]any, title, text string) error {
+	destination, err := validateOutboundURL(ctx, "https://www.pushplus.plus/send", true)
+	if err != nil {
+		return err
+	}
+	payload := map[string]any{"token": configString(config, "token"), "title": title, "content": text, "template": "txt", "timestamp": time.Now().UnixMilli()}
+	if topic := configString(config, "topic"); topic != "" {
+		payload["topic"] = topic
+	}
+	if channel := configString(config, "channel"); channel != "" {
+		payload["channel"] = channel
+	}
+	encoded, _ := json.Marshal(payload)
+	client, err := restrictedHTTPClient(ctx, 8*time.Second, "")
+	if err != nil {
+		return err
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, destination.String(), bytes.NewReader(encoded))
+	if err != nil {
+		return err
+	}
+	request.Header.Set("Content-Type", "application/json; charset=utf-8")
+	request.Header.Set("User-Agent", "vocat-automatic-task/1")
+	response, err := client.Do(request)
+	if err != nil {
+		return err
+	}
+	defer response.Body.Close()
+	body, _ := io.ReadAll(io.LimitReader(response.Body, 64<<10))
+	var result struct {
+		Code int    `json:"code"`
+		Msg  string `json:"msg"`
+	}
+	if response.StatusCode < 200 || response.StatusCode >= 300 || json.Unmarshal(body, &result) != nil || result.Code != 200 {
+		return fmt.Errorf("%w: Pushplus HTTP %d code %d %s", errProviderRejected, response.StatusCode, result.Code, result.Msg)
+	}
+	return nil
+}
+
+func sendAutomaticTaskWebhook(ctx context.Context, config map[string]any, message automaticTaskNotification) error {
+	payload, _ := json.Marshal(map[string]any{
+		"event": "automatic_task.completed", "message": message.Text,
+		"timestamp": message.Time.UTC().Format(time.RFC3339), "task_id": message.Task.ID,
+		"task_name": message.Task.Name, "device_id": message.Task.DeviceID,
+		"task_type": message.Task.TaskType, "environment": message.Task.Environment,
+		"status": message.Run.Status, "attempts": message.Run.Attempts,
+		"output": message.Run.Output, "error": message.Run.Error,
+	})
+	client, err := restrictedHTTPClient(ctx, durationMilliseconds(configInt(config, "timeout_ms"), 5*time.Second), "")
+	if err != nil {
+		return err
+	}
+	for _, destination := range configStrings(config, "urls") {
+		parsed, err := validateOutboundURL(ctx, destination, false)
+		if err != nil {
+			return err
+		}
+		request, err := http.NewRequestWithContext(ctx, http.MethodPost, parsed.String(), bytes.NewReader(payload))
+		if err != nil {
+			return err
+		}
+		for name, value := range configStringMap(config, "headers") {
+			request.Header.Set(name, value)
+		}
+		request.Header.Set("Content-Type", "application/json")
+		request.Header.Set("User-Agent", "vocat-automatic-task/1")
+		if secret := configString(config, "secret"); secret != "" {
+			signature := hmac.New(sha256.New, []byte(secret))
+			_, _ = signature.Write(payload)
+			request.Header.Set("X-vocat-Signature", "sha256="+hex.EncodeToString(signature.Sum(nil)))
+		}
+		if err := performNotificationRequest(client, request, false); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func sendEmailTextNotification(ctx context.Context, config map[string]any, subject, text string) error {
+	host := strings.TrimSpace(configString(config, "smtp_host"))
+	port := configInt(config, "smtp_port")
+	if port == 0 {
+		port = 587
+	}
+	timeout := 8 * time.Second
+	connection, err := dialRestricted(ctx, "tcp", net.JoinHostPort(host, strconv.Itoa(port)), timeout)
+	if err != nil {
+		return err
+	}
+	defer connection.Close()
+	if err := connection.SetDeadline(time.Now().Add(timeout)); err != nil {
+		return err
+	}
+	tlsConfig := &tls.Config{MinVersion: tls.VersionTLS12, ServerName: host}
+	useSSL, _ := config["use_ssl"].(bool)
+	implicitTLS := port == 465 || useSSL
+	if implicitTLS {
+		secure := tls.Client(connection, tlsConfig)
+		if err := secure.HandshakeContext(ctx); err != nil {
+			return err
+		}
+		connection = secure
+	}
+	client, err := smtp.NewClient(connection, host)
+	if err != nil {
+		return err
+	}
+	defer client.Close()
+	if !implicitTLS {
+		if available, _ := client.Extension("STARTTLS"); !available {
+			return errors.New("SMTP server does not offer STARTTLS")
+		}
+		if err := client.StartTLS(tlsConfig); err != nil {
+			return err
+		}
+	}
+	username, password := configString(config, "username"), configString(config, "password")
+	if username != "" {
+		if err := client.Auth(smtp.PlainAuth("", username, password, host)); err != nil {
+			return err
+		}
+	}
+	from, err := parseMailAddress(configString(config, "from_address"))
+	if err != nil {
+		return err
+	}
+	var recipients []*mail.Address
+	for _, item := range configStrings(config, "to_addresses") {
+		address, err := parseMailAddress(item)
+		if err != nil {
+			return err
+		}
+		recipients = append(recipients, address)
+	}
+	if err := client.Mail(from.Address); err != nil {
+		return err
+	}
+	for _, recipient := range recipients {
+		if err := client.Rcpt(recipient.Address); err != nil {
+			return err
+		}
+	}
+	writer, err := client.Data()
+	if err != nil {
+		return err
+	}
+	email := strings.Join([]string{
+		"Date: " + time.Now().UTC().Format(time.RFC1123Z), "From: " + formatMailAddress(from),
+		"To: " + joinMailAddresses(recipients), "Subject: " + mime.QEncoding.Encode("UTF-8", subject),
+		"MIME-Version: 1.0", "Content-Type: text/plain; charset=UTF-8", "Content-Transfer-Encoding: 8bit", "", text, "",
+	}, "\r\n")
+	if _, err := io.WriteString(writer, email); err != nil {
+		_ = writer.Close()
+		return err
+	}
+	if err := writer.Close(); err != nil {
+		return err
+	}
+	return client.Quit()
+}

internal/server/automatic_tasks.go

@@ -0,0 +1,665 @@
+package server
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"vocat/internal/device"
+	"vocat/internal/exportproxy"
+	"vocat/internal/store"
+)
+
+const (
+	automaticTaskPollInterval = 5 * time.Second
+	automaticTaskMaxRuntime   = 8 * time.Minute
+)
+
+type automaticTaskPayload struct {
+	Phone           string `json:"phone,omitempty"`
+	Message         string `json:"message,omitempty"`
+	DurationSeconds int    `json:"duration_seconds,omitempty"`
+}
+
+type automaticTaskExecutionError struct {
+	err       error
+	retryable bool
+}
+
+func (value automaticTaskExecutionError) Error() string { return value.err.Error() }
+func (value automaticTaskExecutionError) Unwrap() error { return value.err }
+
+type automaticTaskScheduler struct {
+	server *Server
+	ctx    context.Context
+	mu     sync.Mutex
+	queues map[string]chan store.AutomaticTaskRun
+}
+
+func (s *Server) StartAutomaticTasks(ctx context.Context) {
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	scheduler := &automaticTaskScheduler{server: s, ctx: ctx, queues: make(map[string]chan store.AutomaticTaskRun)}
+	s.automaticTasks = scheduler
+	go scheduler.run()
+}
+
+func (scheduler *automaticTaskScheduler) run() {
+	ticker := time.NewTicker(automaticTaskPollInterval)
+	defer ticker.Stop()
+	scheduler.claim()
+	for {
+		select {
+		case <-scheduler.ctx.Done():
+			return
+		case <-ticker.C:
+			scheduler.claim()
+		}
+	}
+}
+
+func (scheduler *automaticTaskScheduler) claim() {
+	runs, err := scheduler.server.store.ClaimDueAutomaticTasks(scheduler.ctx, time.Now().UTC(), 50)
+	if err != nil {
+		scheduler.server.logger.Warn("claim automatic tasks", "error", err)
+		return
+	}
+	for _, run := range runs {
+		scheduler.enqueue(run)
+	}
+}
+
+func (scheduler *automaticTaskScheduler) enqueue(run store.AutomaticTaskRun) {
+	deviceID := strings.TrimSpace(run.DeviceID)
+	scheduler.mu.Lock()
+	queue := scheduler.queues[deviceID]
+	if queue == nil {
+		queue = make(chan store.AutomaticTaskRun, 100)
+		scheduler.queues[deviceID] = queue
+		go scheduler.worker(deviceID, queue)
+	}
+	scheduler.mu.Unlock()
+	select {
+	case queue <- run:
+	case <-scheduler.ctx.Done():
+	}
+}
+
+func (scheduler *automaticTaskScheduler) worker(deviceID string, queue <-chan store.AutomaticTaskRun) {
+	for {
+		select {
+		case <-scheduler.ctx.Done():
+			return
+		case run := <-queue:
+			scheduler.execute(run)
+		}
+	}
+}
+
+func (scheduler *automaticTaskScheduler) execute(run store.AutomaticTaskRun) {
+	task, err := scheduler.server.store.AutomaticTask(scheduler.ctx, run.TaskID)
+	if err != nil {
+		run.Status, run.Error, run.FinishedAt = "failed", err.Error(), time.Now().UTC()
+		_ = scheduler.server.store.UpdateAutomaticTaskRun(context.Background(), run)
+		return
+	}
+	run.Status, run.StartedAt = "running", time.Now().UTC()
+	_ = scheduler.server.store.UpdateAutomaticTaskRun(context.Background(), run)
+	var output string
+	for attempt := 1; attempt <= task.RetryCount+1; attempt++ {
+		run.Attempts = attempt
+		_ = scheduler.server.store.UpdateAutomaticTaskRun(context.Background(), run)
+		operationContext, cancel := context.WithTimeout(scheduler.ctx, automaticTaskMaxRuntime)
+		output, err = scheduler.server.executeAutomaticTask(operationContext, task)
+		cancel()
+		if err == nil {
+			break
+		}
+		var executionError automaticTaskExecutionError
+		if errors.As(err, &executionError) && !executionError.retryable {
+			break
+		}
+		if attempt <= task.RetryCount {
+			scheduler.server.logger.Warn("automatic task attempt failed", "task_id", task.ID, "device_id", task.DeviceID, "attempt", attempt, "error", err)
+			select {
+			case <-scheduler.ctx.Done():
+				break
+			case <-time.After(time.Duration(attempt*5) * time.Second):
+			}
+		}
+	}
+	run.FinishedAt = time.Now().UTC()
+	if err == nil {
+		run.Status, run.Output, run.Error = "success", output, ""
+	} else {
+		run.Status, run.Error = "failed", err.Error()
+	}
+	if updateErr := scheduler.server.store.UpdateAutomaticTaskRun(context.Background(), run); updateErr != nil {
+		scheduler.server.logger.Warn("finish automatic task run", "run_id", run.ID, "error", updateErr)
+	}
+	if task.Notify {
+		go scheduler.server.notifyAutomaticTask(context.Background(), task, run)
+	}
+}
+
+func (s *Server) executeAutomaticTask(ctx context.Context, task store.AutomaticTask) (string, error) {
+	config, entry, physicalID, err := s.ensureAutomaticTaskProfile(ctx, task)
+	if err != nil {
+		return "", err
+	}
+	networkWasEnabled := config.NetworkEnabled
+	if err := s.prepareAutomaticTaskEnvironment(ctx, &config, entry, physicalID, task); err != nil {
+		return "", err
+	}
+	var payload automaticTaskPayload
+	if err := json.Unmarshal(task.Payload, &payload); err != nil {
+		return "", fmt.Errorf("decode task payload: %w", err)
+	}
+	switch task.TaskType {
+	case "sms":
+		return s.executeAutomaticSMS(ctx, task, payload)
+	case "call":
+		return s.executeAutomaticCall(ctx, task, payload)
+	case "public_ip":
+		return s.executeAutomaticPublicIP(ctx, config, physicalID, task.ProfileICCID, networkWasEnabled)
+	default:
+		return "", fmt.Errorf("unsupported automatic task type %q", task.TaskType)
+	}
+}
+
+func (s *Server) ensureAutomaticTaskProfile(ctx context.Context, task store.AutomaticTask) (store.Device, device.Device, string, error) {
+	config, err := s.store.Device(ctx, task.DeviceID)
+	if err != nil {
+		return store.Device{}, device.Device{}, "", fmt.Errorf("read device: %w", err)
+	}
+	entry, physicalID, present := s.physicalForConfig(config)
+	if !present || entry.Snapshot == nil {
+		return store.Device{}, device.Device{}, "", errors.New("configured device is offline")
+	}
+	if strings.EqualFold(strings.TrimSpace(entry.Snapshot.ICCID), strings.TrimSpace(task.ProfileICCID)) {
+		return config, entry, physicalID, nil
+	}
+	if _, err := s.devices.SetFlight(ctx, physicalID, true); err != nil {
+		return store.Device{}, device.Device{}, "", fmt.Errorf("enter airplane mode before profile switch: %w", err)
+	}
+	if err := s.devices.ESIMSwitchProfile(ctx, physicalID, task.ProfileICCID, task.ProfileAID); err != nil {
+		return store.Device{}, device.Device{}, "", fmt.Errorf("switch eSIM profile: %w", err)
+	}
+	entry, physicalID, present = s.physicalForConfig(config)
+	if !present {
+		return store.Device{}, device.Device{}, "", errors.New("device did not recover after profile switch")
+	}
+	snapshot, err := s.devices.Refresh(ctx, physicalID)
+	if err != nil {
+		return store.Device{}, device.Device{}, "", fmt.Errorf("verify switched profile: %w", err)
+	}
+	if !strings.EqualFold(strings.TrimSpace(snapshot.ICCID), strings.TrimSpace(task.ProfileICCID)) {
+		return store.Device{}, device.Device{}, "", fmt.Errorf("profile verification failed: current ICCID is %s", firstNonEmpty(snapshot.ICCID, "unavailable"))
+	}
+	entry.Snapshot = &snapshot
+	return config, entry, physicalID, nil
+}
+
+func (s *Server) prepareAutomaticTaskEnvironment(ctx context.Context, config *store.Device, entry device.Device, physicalID string, task store.AutomaticTask) error {
+	iccid := strings.TrimSpace(task.ProfileICCID)
+	if task.Environment == "vowifi" {
+		if task.TaskType == "public_ip" {
+			return errors.New("public IP tasks cannot run over VoWiFi")
+		}
+		if _, err := s.devices.SetFlight(ctx, physicalID, true); err != nil {
+			return fmt.Errorf("enable airplane mode for VoWiFi: %w", err)
+		}
+		config.VoWiFiEnabled, config.NetworkEnabled = true, false
+		if err := s.store.UpsertDevice(ctx, *config); err != nil {
+			return err
+		}
+		if err := s.store.UpsertCardPolicy(ctx, store.CardPolicy{ICCID: iccid, VoWiFiEnabled: true, AirplaneEnabled: true, IPVersion: "IPV4V6", Source: "automatic_task"}); err != nil {
+			return err
+		}
+		if s.vowifi == nil {
+			return errors.New("VoWiFi runtime is unavailable")
+		}
+		state, stateErr := s.vowifi.State(config.ID)
+		stateMatchesCard := state.ICCID == "" || strings.EqualFold(strings.TrimSpace(state.ICCID), iccid)
+		if stateErr == nil && stateMatchesCard && state.IMSReady && (task.TaskType != "sms" || state.SMSReady) {
+			return nil
+		}
+		if stateErr == nil && state.Enabled {
+			_, stateErr = s.vowifi.RequestReconnect(config.ID)
+		} else {
+			_, stateErr = s.vowifi.RequestEnabled(config.ID, true)
+		}
+		if stateErr != nil {
+			return fmt.Errorf("start VoWiFi: %w", stateErr)
+		}
+		return s.waitAutomaticVoWiFi(ctx, config.ID, iccid, task.TaskType == "sms")
+	}
+	if s.vowifi != nil {
+		if state, stateErr := s.vowifi.State(config.ID); stateErr == nil && (state.Enabled || state.Active) {
+			if _, stateErr = s.vowifi.RequestEnabled(config.ID, false); stateErr != nil {
+				return fmt.Errorf("stop VoWiFi: %w", stateErr)
+			}
+			if err := s.waitAutomaticVoWiFiStopped(ctx, config.ID); err != nil {
+				return err
+			}
+		}
+	}
+	config.VoWiFiEnabled = false
+	config.NetworkEnabled = task.TaskType == "public_ip"
+	if err := s.store.UpsertDevice(ctx, *config); err != nil {
+		return err
+	}
+	if err := s.store.UpsertCardPolicy(ctx, store.CardPolicy{ICCID: iccid, NetworkEnabled: config.NetworkEnabled, VoWiFiEnabled: false, AirplaneEnabled: false, APN: config.APN, IPVersion: "IPV4V6", Source: "automatic_task"}); err != nil {
+		return err
+	}
+	if task.TaskType != "public_ip" {
+		if _, err := s.devices.SetNetwork(ctx, physicalID, device.NetworkRequest{Enabled: false, APN: config.APN, IPVersion: "IPV4V6", Backend: config.DeviceBackend}); err != nil {
+			s.logger.Warn("automatic task could not stop unused cellular data", "device_id", config.ID, "error", err)
+		}
+	}
+	if _, err := s.devices.SetFlight(ctx, physicalID, false); err != nil {
+		return fmt.Errorf("enable cellular radio: %w", err)
+	}
+	if _, err := s.devices.SetOperatorSelection(ctx, physicalID, true, "", nil); err != nil {
+		return fmt.Errorf("enable automatic network selection: %w", err)
+	}
+	if _, err := s.devices.ReRegisterOperator(ctx, physicalID); err != nil {
+		return fmt.Errorf("re-register cellular network: %w", err)
+	}
+	if err := s.waitAutomaticCellular(ctx, physicalID, task.TaskType == "public_ip"); err != nil {
+		return err
+	}
+	if task.TaskType == "public_ip" {
+		if !s.developerActive(ctx) {
+			return errors.New("roaming public IP tasks require developer mode")
+		}
+		if _, err := s.devices.SetNetwork(ctx, physicalID, device.NetworkRequest{Enabled: true, APN: config.APN, IPVersion: "IPV4V6", Backend: config.DeviceBackend}); err != nil {
+			s.rollbackAutomaticNetwork(config.ID, physicalID, iccid, *config)
+			return fmt.Errorf("start roaming data: %w", err)
+		}
+	}
+	return nil
+}
+
+func (s *Server) waitAutomaticVoWiFi(ctx context.Context, deviceID, iccid string, requireSMS bool) error {
+	ticker := time.NewTicker(2 * time.Second)
+	defer ticker.Stop()
+	for {
+		state, err := s.vowifi.State(deviceID)
+		if err == nil && state.IMSReady && (!requireSMS || state.SMSReady) && (state.ICCID == "" || strings.EqualFold(state.ICCID, iccid)) {
+			return nil
+		}
+		if err == nil && state.LastError != "" && !state.Active && !state.Enabled {
+			return errors.New(state.LastError)
+		}
+		select {
+		case <-ctx.Done():
+			if err == nil && state.LastError != "" {
+				return fmt.Errorf("wait for VoWiFi readiness: %s", state.LastError)
+			}
+			return fmt.Errorf("wait for VoWiFi readiness: %w", ctx.Err())
+		case <-ticker.C:
+		}
+	}
+}
+
+func (s *Server) waitAutomaticVoWiFiStopped(ctx context.Context, deviceID string) error {
+	ticker := time.NewTicker(time.Second)
+	defer ticker.Stop()
+	for {
+		state, err := s.vowifi.State(deviceID)
+		if err != nil || (!state.Active && !state.Enabled) {
+			return nil
+		}
+		select {
+		case <-ctx.Done():
+			return fmt.Errorf("wait for VoWiFi shutdown: %w", ctx.Err())
+		case <-ticker.C:
+		}
+	}
+}
+
+func (s *Server) waitAutomaticCellular(ctx context.Context, physicalID string, requirePacketAttach bool) error {
+	ticker := time.NewTicker(3 * time.Second)
+	defer ticker.Stop()
+	stableSamples := 0
+	for {
+		snapshot, err := s.devices.Refresh(ctx, physicalID)
+		registered := err == nil && (snapshot.RegistrationStatus == 1 || snapshot.RegistrationStatus == 5)
+		if registered && (!requirePacketAttach || snapshot.PSAttached) {
+			stableSamples++
+			if stableSamples >= 2 {
+				return nil
+			}
+		} else {
+			stableSamples = 0
+		}
+		if err == nil && snapshot.RegistrationStatus == 3 {
+			return errors.New("cellular network registration was denied")
+		}
+		select {
+		case <-ctx.Done():
+			return fmt.Errorf("wait for cellular registration: %w", ctx.Err())
+		case <-ticker.C:
+		}
+	}
+}
+
+func (s *Server) executeAutomaticSMS(ctx context.Context, task store.AutomaticTask, payload automaticTaskPayload) (string, error) {
+	body, _ := json.Marshal(map[string]any{"device_id": task.DeviceID, "phone": payload.Phone, "message": payload.Message})
+	recorder := httptest.NewRecorder()
+	request := httptest.NewRequestWithContext(ctx, http.MethodPost, "/api/sms/send", bytes.NewReader(body))
+	request.Header.Set("Content-Type", "application/json")
+	s.handleSMSSend(recorder, request)
+	if recorder.Code < 200 || recorder.Code >= 300 {
+		failure := fmt.Errorf("send SMS failed (HTTP %d): %s", recorder.Code, compactAutomaticResponse(recorder.Body.Bytes()))
+		// Once any part reached the modem/IMS transaction, retrying the whole
+		// message could deliver a duplicate. Preparation failures remain safe to
+		// retry according to the configured count.
+		return "", automaticTaskExecutionError{err: failure, retryable: automaticSMSRetrySafe(recorder.Body.Bytes())}
+	}
+	return "短信已提交到 " + payload.Phone, nil
+}
+
+func automaticSMSRetrySafe(body []byte) bool {
+	var payload struct {
+		Data struct {
+			PartsAttempted int   `json:"parts_attempted"`
+			PartsAccepted  int   `json:"parts_accepted"`
+			RetrySafe      *bool `json:"retry_safe"`
+		} `json:"data"`
+	}
+	if json.Unmarshal(body, &payload) != nil {
+		return false
+	}
+	if payload.Data.RetrySafe != nil {
+		return *payload.Data.RetrySafe
+	}
+	return payload.Data.PartsAttempted == 0 && payload.Data.PartsAccepted == 0
+}
+
+func (s *Server) executeAutomaticCall(ctx context.Context, task store.AutomaticTask, payload automaticTaskPayload) (string, error) {
+	config, err := s.store.Device(ctx, task.DeviceID)
+	if err != nil {
+		return "", err
+	}
+	_, physicalID, present := s.physicalForConfig(config)
+	if !present {
+		return "", errors.New("configured device is offline")
+	}
+	body, _ := json.Marshal(map[string]any{"number": payload.Phone, "duration_seconds": payload.DurationSeconds})
+	recorder := httptest.NewRecorder()
+	request := httptest.NewRequestWithContext(ctx, http.MethodPost, "/api/devices/calls/dial", bytes.NewReader(body))
+	request.Header.Set("Content-Type", "application/json")
+	s.handleCallAction(recorder, request, config, physicalID, "dial")
+	if recorder.Code < 200 || recorder.Code >= 300 {
+		return "", fmt.Errorf("dial failed (HTTP %d): %s", recorder.Code, compactAutomaticResponse(recorder.Body.Bytes()))
+	}
+	return fmt.Sprintf("已拨打 %s，将在 %d 秒后自动挂断", payload.Phone, payload.DurationSeconds), nil
+}
+
+func (s *Server) executeAutomaticPublicIP(ctx context.Context, config store.Device, physicalID, iccid string, networkWasEnabled bool) (string, error) {
+	if !networkWasEnabled {
+		defer s.rollbackAutomaticNetwork(config.ID, physicalID, iccid, config)
+	}
+	if strings.TrimSpace(config.Interface) == "" {
+		return "", errors.New("device has no cellular network interface")
+	}
+	info, err := exportproxy.LookupPublicIP(ctx, config.Interface)
+	if err != nil {
+		return "", fmt.Errorf("detect roaming public IP: %w", err)
+	}
+	s.savePublicIP(config.ID, iccid, info)
+	return strings.TrimSpace(fmt.Sprintf("公网 IP %s · %s %s", info.IP, info.CountryCode, info.Region)), nil
+}
+
+func (s *Server) rollbackAutomaticNetwork(deviceID, physicalID, iccid string, config store.Device) {
+	cleanupContext, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	if _, err := s.devices.SetNetwork(cleanupContext, physicalID, device.NetworkRequest{Enabled: false, APN: config.APN, IPVersion: "IPV4V6", Backend: config.DeviceBackend}); err != nil {
+		s.logger.Warn("stop one-shot automatic roaming data", "device_id", deviceID, "error", err)
+	}
+	config.NetworkEnabled = false
+	if err := s.store.UpsertDevice(cleanupContext, config); err != nil {
+		s.logger.Warn("restore automatic roaming data setting", "device_id", deviceID, "error", err)
+	}
+	if err := s.store.UpsertCardPolicy(cleanupContext, store.CardPolicy{ICCID: iccid, NetworkEnabled: false, VoWiFiEnabled: false, AirplaneEnabled: false, APN: config.APN, IPVersion: "IPV4V6", Source: "automatic_task"}); err != nil {
+		s.logger.Warn("restore automatic roaming card policy", "device_id", deviceID, "error", err)
+	}
+}
+
+func compactAutomaticResponse(body []byte) string {
+	var payload map[string]any
+	if json.Unmarshal(body, &payload) == nil {
+		if apiErr, ok := payload["error"].(map[string]any); ok {
+			return firstNonEmpty(fmt.Sprint(apiErr["message"]), fmt.Sprint(apiErr["code"]), "request failed")
+		}
+	}
+	return strings.TrimSpace(string(body))
+}
+
+func (s *Server) routeAutomaticTasksAPI(w http.ResponseWriter, r *http.Request, cleanPath string) bool {
+	segments := splitAPIPath(cleanPath)
+	if len(segments) == 0 || segments[0] != "automatic-tasks" {
+		return false
+	}
+	if len(segments) == 1 {
+		s.handleAutomaticTasks(w, r)
+		return true
+	}
+	if len(segments) == 2 && segments[1] == "runs" {
+		s.handleAutomaticTaskRuns(w, r)
+		return true
+	}
+	id, err := strconv.ParseInt(segments[1], 10, 64)
+	if err != nil || id <= 0 {
+		writeError(w, http.StatusBadRequest, "invalid_task_id", "automatic task ID is invalid")
+		return true
+	}
+	if len(segments) == 2 {
+		s.handleAutomaticTask(w, r, id)
+		return true
+	}
+	if len(segments) == 3 && segments[2] == "run" {
+		s.handleAutomaticTaskRunNow(w, r, id)
+		return true
+	}
+	writeError(w, http.StatusNotFound, "not_found", "automatic task endpoint not found")
+	return true
+}
+
+func (s *Server) handleAutomaticTasks(w http.ResponseWriter, r *http.Request) {
+	switch r.Method {
+	case http.MethodGet:
+		tasks, err := s.store.ListAutomaticTasks(r.Context())
+		if err != nil {
+			s.writeStoreError(w, err)
+			return
+		}
+		writeJSON(w, http.StatusOK, map[string]any{"data": map[string]any{"tasks": tasks}})
+	case http.MethodPost:
+		task, err := s.decodeAutomaticTask(r, 0)
+		if err != nil {
+			writeError(w, http.StatusBadRequest, "invalid_automatic_task", err.Error())
+			return
+		}
+		saved, err := s.store.SaveAutomaticTask(r.Context(), task)
+		if err != nil {
+			s.writeStoreError(w, err)
+			return
+		}
+		writeJSON(w, http.StatusCreated, map[string]any{"data": saved})
+	default:
+		w.Header().Set("Allow", "GET, POST")
+		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "method not allowed")
+	}
+}
+
+func (s *Server) handleAutomaticTask(w http.ResponseWriter, r *http.Request, id int64) {
+	switch r.Method {
+	case http.MethodPut:
+		task, err := s.decodeAutomaticTask(r, id)
+		if err != nil {
+			writeError(w, http.StatusBadRequest, "invalid_automatic_task", err.Error())
+			return
+		}
+		saved, err := s.store.SaveAutomaticTask(r.Context(), task)
+		if err != nil {
+			s.writeStoreError(w, err)
+			return
+		}
+		writeJSON(w, http.StatusOK, map[string]any{"data": saved})
+	case http.MethodDelete:
+		if err := s.store.DeleteAutomaticTask(r.Context(), id); err != nil {
+			s.writeStoreError(w, err)
+			return
+		}
+		writeJSON(w, http.StatusOK, map[string]any{"data": map[string]any{"deleted": true}})
+	default:
+		w.Header().Set("Allow", "PUT, DELETE")
+		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "method not allowed")
+	}
+}
+
+func (s *Server) handleAutomaticTaskRuns(w http.ResponseWriter, r *http.Request) {
+	if !requireMethod(w, r, http.MethodGet) {
+		return
+	}
+	query := r.URL.Query()
+	limit, _ := strconv.Atoi(query.Get("limit"))
+	offset, _ := strconv.Atoi(query.Get("offset"))
+	runs, total, err := s.store.ListAutomaticTaskRunsPaginated(r.Context(), limit, offset)
+	if err != nil {
+		s.writeStoreError(w, err)
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"data": map[string]any{"runs": runs, "total": total}})
+}
+
+func (s *Server) handleAutomaticTaskRunNow(w http.ResponseWriter, r *http.Request, id int64) {
+	if !requireMethod(w, r, http.MethodPost) {
+		return
+	}
+	if s.automaticTasks == nil {
+		writeError(w, http.StatusServiceUnavailable, "scheduler_unavailable", "automatic task scheduler is unavailable")
+		return
+	}
+	task, err := s.store.AutomaticTask(r.Context(), id)
+	if err != nil {
+		s.writeStoreError(w, err)
+		return
+	}
+	run, err := s.store.QueueAutomaticTaskNow(r.Context(), task)
+	if err != nil {
+		s.writeStoreError(w, err)
+		return
+	}
+	s.automaticTasks.enqueue(run)
+	writeJSON(w, http.StatusAccepted, map[string]any{"data": run})
+}
+
+func (s *Server) decodeAutomaticTask(r *http.Request, id int64) (store.AutomaticTask, error) {
+	var request struct {
+		Name         string               `json:"name"`
+		Enabled      bool                 `json:"enabled"`
+		DeviceID     string               `json:"device_id"`
+		ProfileICCID string               `json:"profile_iccid"`
+		ProfileAID   string               `json:"profile_aid"`
+		TaskType     string               `json:"task_type"`
+		Environment  string               `json:"environment"`
+		IntervalDays int                  `json:"interval_days"`
+		StartDate    string               `json:"start_date"`
+		RunTime      string               `json:"run_time"`
+		Timezone     string               `json:"timezone"`
+		RetryCount   int                  `json:"retry_count"`
+		Notify       bool                 `json:"notify"`
+		Payload      automaticTaskPayload `json:"payload"`
+	}
+	if err := s.decodeJSON(nilResponseWriter{}, r, &request); err != nil {
+		return store.AutomaticTask{}, err
+	}
+	request.Name, request.DeviceID = strings.TrimSpace(request.Name), strings.TrimSpace(request.DeviceID)
+	request.ProfileICCID, request.ProfileAID = strings.TrimSpace(request.ProfileICCID), strings.TrimSpace(request.ProfileAID)
+	request.TaskType, request.Environment = strings.ToLower(strings.TrimSpace(request.TaskType)), strings.ToLower(strings.TrimSpace(request.Environment))
+	if request.Name == "" || request.DeviceID == "" || request.ProfileICCID == "" {
+		return store.AutomaticTask{}, errors.New("name, device, and eSIM profile are required")
+	}
+	if _, err := s.store.Device(r.Context(), request.DeviceID); err != nil {
+		return store.AutomaticTask{}, errors.New("selected device does not exist")
+	}
+	if request.Environment != "vowifi" && request.Environment != "cellular" {
+		return store.AutomaticTask{}, errors.New("environment must be vowifi or cellular")
+	}
+	if request.TaskType != "sms" && request.TaskType != "call" && request.TaskType != "public_ip" {
+		return store.AutomaticTask{}, errors.New("unsupported task type")
+	}
+	if request.TaskType == "public_ip" && request.Environment != "cellular" {
+		return store.AutomaticTask{}, errors.New("public IP tasks must use cellular direct mode")
+	}
+	if request.IntervalDays < 1 || request.IntervalDays > 365 || request.RetryCount < 0 || request.RetryCount > 10 {
+		return store.AutomaticTask{}, errors.New("interval_days must be 1-365 and retry_count must be 0-10")
+	}
+	if request.TaskType == "sms" {
+		if !validDialNumber(request.Payload.Phone) || strings.TrimSpace(request.Payload.Message) == "" {
+			return store.AutomaticTask{}, errors.New("SMS phone and message are required")
+		}
+		if blocked, reason := blockedSMSDestination(request.Payload.Phone); blocked {
+			return store.AutomaticTask{}, errors.New(reason)
+		}
+	}
+	if request.TaskType == "call" && (!validDialNumber(request.Payload.Phone) || request.Payload.DurationSeconds < 1 || request.Payload.DurationSeconds > 600) {
+		return store.AutomaticTask{}, errors.New("call phone is required and automatic hang-up must be 1-600 seconds")
+	}
+	request.Timezone = strings.TrimSpace(request.Timezone)
+	if request.Timezone == "" {
+		request.Timezone = time.Local.String()
+	}
+	location, err := time.LoadLocation(request.Timezone)
+	if err != nil {
+		return store.AutomaticTask{}, errors.New("timezone must be a valid IANA time zone")
+	}
+	nextRun, err := nextAutomaticRun(request.StartDate, request.RunTime, request.IntervalDays, time.Now().In(location))
+	if err != nil {
+		return store.AutomaticTask{}, err
+	}
+	payload, _ := json.Marshal(request.Payload)
+	task := store.AutomaticTask{ID: id, Name: request.Name, Enabled: request.Enabled, DeviceID: request.DeviceID,
+		ProfileICCID: request.ProfileICCID, ProfileAID: request.ProfileAID, TaskType: request.TaskType,
+		Environment: request.Environment, IntervalDays: request.IntervalDays, StartDate: request.StartDate,
+		RunTime: request.RunTime, Timezone: request.Timezone, Payload: payload, RetryCount: request.RetryCount, Notify: request.Notify, NextRunAt: nextRun.UTC()}
+	if id != 0 {
+		if previous, previousErr := s.store.AutomaticTask(r.Context(), id); previousErr == nil {
+			task.CreatedAt, task.LastRunAt, task.LastStatus, task.LastError = previous.CreatedAt, previous.LastRunAt, previous.LastStatus, previous.LastError
+		}
+	}
+	return task, nil
+}
+
+func nextAutomaticRun(date, clock string, intervalDays int, now time.Time) (time.Time, error) {
+	location := now.Location()
+	start, err := time.ParseInLocation("2006-01-02 15:04", strings.TrimSpace(date)+" "+strings.TrimSpace(clock), location)
+	if err != nil {
+		return time.Time{}, errors.New("start_date and run_time must use YYYY-MM-DD and HH:MM")
+	}
+	for start.Before(now) {
+		start = start.AddDate(0, 0, intervalDays)
+	}
+	return start, nil
+}
+
+// nilResponseWriter is used only because decodeJSON's size/error contract is
+// shared with HTTP handlers; decode errors are returned to the real handler.
+type nilResponseWriter struct{}
+
+func (nilResponseWriter) Header() http.Header        { return make(http.Header) }
+func (nilResponseWriter) Write([]byte) (int, error)  { return 0, nil }
+func (nilResponseWriter) WriteHeader(statusCode int) {}

internal/server/automatic_tasks_test.go

@@ -0,0 +1,30 @@
+package server
+
+import (
+	"testing"
+	"time"
+)
+
+func TestNextAutomaticRunUsesIntervalAndLocalClock(t *testing.T) {
+	location := time.FixedZone("test", 8*60*60)
+	now := time.Date(2026, 8, 10, 12, 0, 0, 0, location)
+	next, err := nextAutomaticRun("2026-08-01", "09:30", 3, now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := time.Date(2026, 8, 13, 9, 30, 0, 0, location)
+	if !next.Equal(want) {
+		t.Fatalf("next run = %v, want %v", next, want)
+	}
+}
+
+func TestAutomaticSMSRetrySafetyPreventsDuplicateSubmission(t *testing.T) {
+	unsafe := []byte(`{"data":{"parts_attempted":1,"parts_accepted":1,"retry_safe":false}}`)
+	if automaticSMSRetrySafe(unsafe) {
+		t.Fatal("partially submitted SMS was considered safe to retry")
+	}
+	safe := []byte(`{"data":{"parts_attempted":0,"parts_accepted":0}}`)
+	if !automaticSMSRetrySafe(safe) {
+		t.Fatal("unattempted SMS was not considered safe to retry")
+	}
+}

internal/server/call_api.go

@@ -76,8 +76,8 @@ func (s *Server) handleCallAction(w http.ResponseWriter, r *http.Request, config
 			return true
 		}
 		duration = time.Duration(request.DurationSeconds) * time.Second
-		if duration < time.Second || duration > maxCallDuration {
-			writeError(w, http.StatusBadRequest, "invalid_duration", "duration_seconds must be between 1 and 600")
+		if duration < 0 || duration > maxCallDuration {
+			writeError(w, http.StatusBadRequest, "invalid_duration", "duration_seconds must be 0 (no automatic hang-up) or between 1 and 600")
 			return true
 		}
 		command = "ATD" + number + ";"
@@ -137,7 +137,9 @@ func (s *Server) handleCallAction(w http.ResponseWriter, r *http.Request, config
 			if call, ok := result.(vowifi.Call); ok {
 				callID = call.ID
 			}
-			go s.hangupVoWiFiAfter(config.ID, callID, duration)
+			if duration > 0 {
+				go s.hangupVoWiFiAfter(config.ID, callID, duration)
+			}
 		}
 		s.recordAudit(r.Context(), "admin", "call."+action, "device", config.ID, "success", transport)
 		writeJSON(w, http.StatusAccepted, map[string]any{"data": map[string]any{
@@ -158,7 +160,9 @@ func (s *Server) handleCallAction(w http.ResponseWriter, r *http.Request, config
 		return true
 	}
 	if action == "dial" {
-		go s.hangupAfter(config.ID, physicalID, duration)
+		if duration > 0 {
+			go s.hangupAfter(config.ID, physicalID, duration)
+		}
 	}
 	s.recordAudit(r.Context(), "admin", "call."+action, "device", config.ID, "success", transport)
 	writeJSON(w, http.StatusAccepted, map[string]any{
@@ -179,7 +183,7 @@ func resolveVoWiFiCallID(controller VoWiFiCallController, deviceID, id, required
 		return "", err
 	}
 	for _, call := range calls {
-		if requiredState == "" || call.State == requiredState {
+		if call.State != "ended" && call.State != "failed" && (requiredState == "" || call.State == requiredState) {
 			return call.ID, nil
 		}
 	}
@@ -203,7 +207,11 @@ func (s *Server) hangupVoWiFiAfter(deviceID, callID string, duration time.Durati
 
 func (s *Server) callTransport(deviceID string) string {
 	if s.vowifi != nil {
-		if state, err := s.vowifi.State(deviceID); err == nil && state.Enabled {
+		// Enabled is only the desired card policy. Calls can use IMS only after
+		// registration has actually completed; otherwise keep using the modem's
+		// circuit-switched call path instead of routing into an unavailable IMS
+		// session.
+		if state, err := s.vowifi.State(deviceID); err == nil && state.IMSReady {
 			return "vowifi"
 		}
 	}

internal/server/call_api_test.go

@@ -1,9 +1,11 @@
 package server
 
 import (
+	"context"
 	"testing"
 
 	"vocat/internal/modem"
+	"vocat/internal/vowifi"
 )
 
 func TestParseCLCC(t *testing.T) {
@@ -28,3 +30,44 @@ func TestValidDialNumber(t *testing.T) {
 		}
 	}
 }
+
+func TestCallTransportRequiresIMSReady(t *testing.T) {
+	controller := &fakeVoWiFiController{state: vowifi.State{Enabled: true}}
+	server := &Server{vowifi: controller}
+	if got := server.callTransport("ec20"); got != "cellular" {
+		t.Fatalf("callTransport before IMS registration = %q, want cellular", got)
+	}
+	controller.state.IMSReady = true
+	if got := server.callTransport("ec20"); got != "vowifi" {
+		t.Fatalf("callTransport with IMS ready = %q, want vowifi", got)
+	}
+}
+
+func TestResolveVoWiFiCallIDIgnoresTerminalCalls(t *testing.T) {
+	controller := &fakeCallController{calls: []vowifi.Call{
+		{ID: "failed", State: "failed"},
+		{ID: "active", State: "active"},
+	}}
+	got, err := resolveVoWiFiCallID(controller, "ec20", "", "")
+	if err != nil || got != "active" {
+		t.Fatalf("resolveVoWiFiCallID() = %q, %v; want active", got, err)
+	}
+}
+
+type fakeCallController struct {
+	calls []vowifi.Call
+}
+
+func (controller *fakeCallController) Calls(string) ([]vowifi.Call, error) {
+	return controller.calls, nil
+}
+
+func (*fakeCallController) DialCall(context.Context, string, string) (vowifi.Call, error) {
+	return vowifi.Call{}, nil
+}
+
+func (*fakeCallController) AnswerCall(context.Context, string, string) (vowifi.Call, error) {
+	return vowifi.Call{}, nil
+}
+
+func (*fakeCallController) HangupCall(context.Context, string, string) error { return nil }

internal/server/call_media_api.go

@@ -0,0 +1,99 @@
+package server
+
+import (
+	"context"
+	"encoding/binary"
+	"errors"
+	"io"
+	"net/http"
+	"strings"
+
+	"github.com/coder/websocket"
+
+	"vocat/internal/store"
+)
+
+const maxCallMediaMessage = 16 << 10
+
+// handleCallMedia upgrades an authenticated same-origin request to a binary
+// PCM bridge. Each WebSocket message contains little-endian signed 16-bit,
+// 8 kHz, mono samples. RTP and codec details remain inside the IMS provider.
+func (s *Server) handleCallMedia(w http.ResponseWriter, r *http.Request, config store.Device) bool {
+	if !requireMethod(w, r, http.MethodGet) {
+		return true
+	}
+	if s.callTransport(config.ID) != "vowifi" {
+		writeError(w, http.StatusNotImplemented, "call_media_unavailable", "browser audio is only available for an active VoWiFi IMS call")
+		return true
+	}
+	callID := strings.TrimSpace(r.URL.Query().Get("call_id"))
+	if callID == "" || len(callID) > 256 {
+		writeError(w, http.StatusBadRequest, "invalid_call_id", "call_id is required")
+		return true
+	}
+	controller, ok := s.vowifi.(VoWiFiCallMediaController)
+	if !ok {
+		writeError(w, http.StatusNotImplemented, "call_media_unavailable", "the active IMS session does not expose RTP media")
+		return true
+	}
+	media, err := controller.CallMedia(r.Context(), config.ID, callID)
+	if err != nil {
+		writeError(w, http.StatusConflict, "call_media_unavailable", err.Error())
+		return true
+	}
+	connection, err := websocket.Accept(w, r, &websocket.AcceptOptions{
+		CompressionMode: websocket.CompressionDisabled,
+	})
+	if err != nil {
+		return true
+	}
+	connection.SetReadLimit(maxCallMediaMessage)
+	ctx, cancel := context.WithCancel(r.Context())
+	defer cancel()
+	defer connection.Close(websocket.StatusNormalClosure, "call media closed")
+
+	downlink := make(chan error, 1)
+	go func() {
+		defer cancel()
+		for {
+			samples, readErr := media.ReadPCM(ctx)
+			if readErr != nil {
+				downlink <- readErr
+				return
+			}
+			payload := make([]byte, len(samples)*2)
+			for index, sample := range samples {
+				binary.LittleEndian.PutUint16(payload[index*2:], uint16(sample))
+			}
+			if writeErr := connection.Write(ctx, websocket.MessageBinary, payload); writeErr != nil {
+				downlink <- writeErr
+				return
+			}
+		}
+	}()
+
+	for {
+		select {
+		case err := <-downlink:
+			if !errors.Is(err, context.Canceled) && !errors.Is(err, io.EOF) {
+				s.logger.Debug("call media downlink closed", "device_id", config.ID, "call_id", callID, "error", err)
+			}
+			return true
+		default:
+		}
+		messageType, payload, readErr := connection.Read(ctx)
+		if readErr != nil {
+			return true
+		}
+		if messageType != websocket.MessageBinary || len(payload) == 0 || len(payload)%2 != 0 {
+			continue
+		}
+		samples := make([]int16, len(payload)/2)
+		for index := range samples {
+			samples[index] = int16(binary.LittleEndian.Uint16(payload[index*2:]))
+		}
+		if err := media.WritePCM(samples); err != nil {
+			return true
+		}
+	}
+}

internal/server/developer_settings.go

@@ -0,0 +1,68 @@
+package server
+
+import (
+	"net/http"
+
+	"vocat/internal/developer"
+)
+
+func (s *Server) handleDeveloperSettings(w http.ResponseWriter, r *http.Request) {
+	if !s.developerActive(r.Context()) {
+		writeError(w, http.StatusNotFound, "not_found", "resource not found")
+		return
+	}
+	switch r.Method {
+	case http.MethodGet:
+		s.writeDeveloperSettings(w, r)
+	case http.MethodPut:
+		var request struct {
+			DeviceLimit    *int `json:"device_limit"`
+			SMSHourlyLimit *int `json:"sms_hourly_limit"`
+		}
+		if err := s.decodeJSON(w, r, &request); err != nil {
+			writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
+			return
+		}
+		if request.DeviceLimit == nil && request.SMSHourlyLimit == nil {
+			writeError(w, http.StatusBadRequest, "invalid_request", "at least one developer setting is required")
+			return
+		}
+		if request.DeviceLimit != nil && (*request.DeviceLimit < 1 || *request.DeviceLimit > developer.MaxDeviceLimit) {
+			writeError(w, http.StatusBadRequest, "invalid_device_limit", "device limit is outside the supported range")
+			return
+		}
+		if request.SMSHourlyLimit != nil && (*request.SMSHourlyLimit < 1 || *request.SMSHourlyLimit > developer.MaxSMSHourlyLimit) {
+			writeError(w, http.StatusBadRequest, "invalid_sms_hourly_limit", "SMS hourly limit is outside the supported range")
+			return
+		}
+		if request.DeviceLimit != nil {
+			if err := developer.SetDeviceLimit(r.Context(), s.store, *request.DeviceLimit); err != nil {
+				writeError(w, http.StatusBadRequest, "invalid_device_limit", err.Error())
+				return
+			}
+			s.recordAudit(r.Context(), "admin", "settings.developer.device_limit", "settings", "developer", "success", "device limit updated")
+		}
+		if request.SMSHourlyLimit != nil {
+			if err := developer.SetSMSHourlyLimit(r.Context(), s.store, *request.SMSHourlyLimit); err != nil {
+				writeError(w, http.StatusBadRequest, "invalid_sms_hourly_limit", err.Error())
+				return
+			}
+			s.recordAudit(r.Context(), "admin", "settings.developer.sms_hourly_limit", "settings", "developer", "success", "global SMS hourly limit updated")
+		}
+		s.writeDeveloperSettings(w, r)
+	default:
+		w.Header().Set("Allow", "GET, PUT")
+		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "method not allowed")
+	}
+}
+
+func (s *Server) writeDeveloperSettings(w http.ResponseWriter, r *http.Request) {
+	writeJSON(w, http.StatusOK, map[string]any{"data": map[string]any{
+		"device_limit":             developer.DeviceLimit(r.Context(), s.store, true),
+		"default_device_limit":     developer.DefaultDeviceLimit,
+		"max_device_limit":         developer.MaxDeviceLimit,
+		"sms_hourly_limit":         developer.SMSHourlyLimit(r.Context(), s.store),
+		"default_sms_hourly_limit": developer.DefaultSMSHourlyLimit,
+		"max_sms_hourly_limit":     developer.MaxSMSHourlyLimit,
+	}})
+}

internal/server/developer_settings_test.go

@@ -0,0 +1,52 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"vocat/internal/developer"
+	"vocat/internal/store"
+)
+
+func TestDeveloperOnlySettingsAreHiddenWhenModeIsOff(t *testing.T) {
+	server := &Server{developerEnabled: false}
+	for _, handler := range []func(http.ResponseWriter, *http.Request){
+		server.handleDeveloperSettings,
+		server.handleHTTPSSettings,
+		server.handleHTTPSCertificate,
+	} {
+		response := httptest.NewRecorder()
+		handler(response, httptest.NewRequest(http.MethodGet, "/api/settings/developer", nil))
+		if response.Code != http.StatusNotFound {
+			t.Fatalf("developer-only endpoint status = %d, want 404", response.Code)
+		}
+	}
+}
+
+func TestDeveloperSettingsUpdatesGlobalSMSLimit(t *testing.T) {
+	ctx := context.Background()
+	database, err := store.Open(ctx, ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	enabled, _ := json.Marshal(map[string]bool{"enabled": true})
+	if err := database.UpsertAppSetting(ctx, store.AppSetting{Key: developer.EnabledSettingKey, Value: enabled}); err != nil {
+		t.Fatal(err)
+	}
+	server := &Server{store: database, developerEnabled: true, logger: regionTestLogger(), maxRequestBodyBytes: 4096}
+	request := httptest.NewRequest(http.MethodPut, "/api/settings/developer", strings.NewReader(`{"sms_hourly_limit":25}`))
+	request.Header.Set("Content-Type", "application/json")
+	response := httptest.NewRecorder()
+	server.handleDeveloperSettings(response, request)
+	if response.Code != http.StatusOK {
+		t.Fatalf("status = %d, body=%s", response.Code, response.Body.String())
+	}
+	if got := developer.SMSHourlyLimit(ctx, database); got != 25 {
+		t.Fatalf("SMS hourly limit = %d, want 25", got)
+	}
+}

internal/server/device_api.go

@@ -11,6 +11,7 @@ import (
 	"strings"
 	"time"
 
+	"vocat/internal/developer"
 	"vocat/internal/device"
 	"vocat/internal/i18n"
 	"vocat/internal/modem"
@@ -38,6 +39,7 @@ type DeviceController interface {
 	SetUSBNetModeByPort(context.Context, string, int) (device.USBNetMode, error)
 	OperatorSelection(context.Context, string) (device.OperatorSelection, error)
 	SetOperatorSelection(context.Context, string, bool, string, *int) (device.OperatorSelection, error)
+	ReRegisterOperator(context.Context, string) (device.OperatorSelection, error)
 	ScanOperators(context.Context, string) (device.OperatorScanResult, error)
 	SendSMS(context.Context, string, string, string) (device.SMSSendResult, error)
 	ListSMS(context.Context, string) ([]device.SMSMessage, error)
@@ -56,6 +58,7 @@ type DeviceController interface {
 type deviceConfigPayload struct {
 	ID                 string `json:"id"`
 	Name               string `json:"name"`
+	DeviceType         string `json:"device_type"`
 	Interface          string `json:"interface"`
 	ControlDevice      string `json:"control_device"`
 	ATPort             string `json:"at_port"`
@@ -86,6 +89,7 @@ func (payload deviceConfigPayload) toStoreDevice() store.Device {
 	return store.Device{
 		ID:                 strings.TrimSpace(payload.ID),
 		Name:               name,
+		DeviceType:         store.NormalizeDeviceType(payload.DeviceType),
 		Interface:          strings.TrimSpace(payload.Interface),
 		ControlDevice:      strings.TrimSpace(payload.ControlDevice),
 		ATPort:             strings.TrimSpace(payload.ATPort),
@@ -170,15 +174,13 @@ func splitAPIPath(value string) []string {
 	return result
 }
 
-// maxDeviceLimit 是设备数量的软上限：达到上限后禁止再添加新设备。
-const maxDeviceLimit = 5
-
 func (s *Server) handleDevices(w http.ResponseWriter, r *http.Request) bool {
+	deviceLimit := developer.DeviceLimit(r.Context(), s.store, s.developerEnabled)
 	switch r.Method {
 	case http.MethodGet:
 		writeJSON(w, http.StatusOK, map[string]any{
 			"data": map[string]any{
-				"device_limit": maxDeviceLimit,
+				"device_limit": deviceLimit,
 				"devices":      s.deviceSummaries(),
 			},
 		})
@@ -203,6 +205,10 @@ func (s *Server) handleDevices(w http.ResponseWriter, r *http.Request) bool {
 			writeError(w, http.StatusBadRequest, "invalid_device_id", "device ID must use 1-64 letters, digits, dots, underscores, or hyphens")
 			return true
 		}
+		if strings.TrimSpace(payload.DeviceType) == "" || store.NormalizeDeviceType(payload.DeviceType) == "" {
+			writeError(w, http.StatusBadRequest, "invalid_device_type", "select a supported device type")
+			return true
+		}
 		if _, err := s.store.Device(r.Context(), payload.ID); err == nil {
 			writeError(w, http.StatusConflict, "device_exists", "a device with this ID already exists")
 			return true
@@ -215,8 +221,8 @@ func (s *Server) handleDevices(w http.ResponseWriter, r *http.Request) bool {
 			s.writeStoreError(w, err)
 			return true
 		}
-		if len(configured) >= maxDeviceLimit {
-			writeError(w, http.StatusConflict, "device_limit_reached", i18n.Tf("设备数量已达上限，最多只能添加 %d 台设备", maxDeviceLimit))
+		if len(configured) >= deviceLimit {
+			writeError(w, http.StatusConflict, "device_limit_reached", i18n.Tf("设备数量已达上限，最多只能添加 %d 台设备", deviceLimit))
 			return true
 		}
 		devices, err := s.devices.Discover(r.Context())
@@ -230,11 +236,46 @@ func (s *Server) handleDevices(w http.ResponseWriter, r *http.Request) bool {
 			return true
 		}
 		config := payload.toStoreDevice()
+		// Newly added hardware starts fail-closed: RF is disabled immediately and
+		// VoWiFi becomes the desired service. Cellular registration is only
+		// restored by the user's later airplane-mode-off action.
+		config.VoWiFiEnabled = true
+		config.NetworkEnabled = false
+		if !s.developerActive(r.Context()) {
+			config.NetworkEnabled = false
+		}
 		fillConfigFromPhysical(&config, *selected)
+		if selector, ok := s.devices.(interface{ SetBackend(string, string) error }); ok {
+			if err := selector.SetBackend(selected.ID, config.DeviceBackend); err != nil {
+				s.writeDeviceError(w, err)
+				return true
+			}
+		}
+		if _, err := s.devices.SetFlight(r.Context(), selected.ID, true); err != nil {
+			s.writeDeviceError(w, err)
+			return true
+		}
 		if err := s.store.UpsertDevice(r.Context(), config); err != nil {
 			s.writeStoreError(w, err)
 			return true
 		}
+		if selected.Snapshot != nil {
+			iccid := strings.TrimSpace(selected.Snapshot.ICCID)
+			if iccid != "" {
+				if err := s.store.UpsertCardPolicy(r.Context(), store.CardPolicy{
+					ICCID: iccid, VoWiFiEnabled: true, AirplaneEnabled: true,
+					IPVersion: "IPV4V6", Source: "default",
+				}); err != nil {
+					s.writeStoreError(w, err)
+					return true
+				}
+			}
+		}
+		if s.vowifi != nil {
+			if _, err := s.vowifi.RequestEnabled(config.ID, true); err != nil {
+				s.logger.Warn("new device saved in safe airplane mode but VoWiFi start was not queued", "device_id", config.ID, "error", err)
+			}
+		}
 		writeJSON(w, http.StatusCreated, map[string]any{
 			"data": map[string]any{
 				"status":          "created",
@@ -402,11 +443,25 @@ func (s *Server) handleDevicePath(
 				return true
 			}
 			next := payload.toStoreDevice()
+			if !s.developerActive(r.Context()) {
+				next.NetworkEnabled = false
+			}
 			next.ID = id
 			next.CreatedAt = config.CreatedAt
+			// VoWiFi/airplane transitions are transactional device actions. A
+			// general config save must not silently bypass their RF-safe ordering.
+			next.VoWiFiEnabled = config.VoWiFiEnabled
 			if next.Name == id && strings.TrimSpace(payload.Name) == "" {
 				next.Name = config.Name
 			}
+			if _, physicalID, present := s.physicalForConfig(next); present {
+				if selector, ok := s.devices.(interface{ SetBackend(string, string) error }); ok {
+					if err := selector.SetBackend(physicalID, next.DeviceBackend); err != nil {
+						s.writeDeviceError(w, err)
+						return true
+					}
+				}
+			}
 			if err := s.store.UpsertDevice(r.Context(), next); err != nil {
 				s.writeStoreError(w, err)
 				return true
@@ -423,7 +478,7 @@ func (s *Server) handleDevicePath(
 
 	entry, physicalID, physicalPresent := s.physicalForConfig(config)
 	if len(tail) > 0 && tail[0] == "esim" {
-		return s.handleESIM(w, r, tail[1:], physicalID, physicalPresent)
+		return s.handleESIM(w, r, tail[1:], physicalID, physicalPresent, config.ID)
 	}
 	switch strings.Join(tail, "/") {
 	case "overview":
@@ -485,12 +540,27 @@ func (s *Server) handleDevicePath(
 			s.writeDeviceError(w, err)
 			return true
 		}
+		s.clearPublicIP(config.ID)
 		writeJSON(w, http.StatusAccepted, map[string]any{"data": map[string]any{"status": "rebooting"}})
 	case "flight-mode":
 		if !s.requirePhysicalDevice(w, physicalPresent) {
 			return true
 		}
-		return s.handleFlightMode(w, r, physicalID)
+		return s.handleFlightMode(w, r, config, physicalID)
+	case "network":
+		if !s.requirePhysicalDevice(w, physicalPresent) {
+			return true
+		}
+		return s.handleCellularData(w, r, config, physicalID)
+	case "network/public-ip":
+		if !s.requirePhysicalDevice(w, physicalPresent) {
+			return true
+		}
+		iccid := ""
+		if entry.Snapshot != nil {
+			iccid = entry.Snapshot.ICCID
+		}
+		return s.handleCellularPublicIP(w, r, config, iccid)
 	case "usbnet-mode":
 		if !s.requirePhysicalDevice(w, physicalPresent) {
 			return true
@@ -501,6 +571,11 @@ func (s *Server) handleDevicePath(
 			return true
 		}
 		return s.handleOperatorSelection(w, r, physicalID)
+	case "operator_selection/reregister":
+		if !s.requirePhysicalDevice(w, physicalPresent) {
+			return true
+		}
+		return s.handleOperatorReRegister(w, r, physicalID)
 	case "operator_selection/scan":
 		if !s.requirePhysicalDevice(w, physicalPresent) {
 			return true
@@ -527,6 +602,11 @@ func (s *Server) handleDevicePath(
 			return true
 		}
 		return s.handleCallAction(w, r, config, physicalID, tail[1])
+	case "calls/media":
+		if !s.requirePhysicalDevice(w, physicalPresent) {
+			return true
+		}
+		return s.handleCallMedia(w, r, config)
 	default:
 		return false
 	}
@@ -667,6 +747,21 @@ func (s *Server) handleOperatorSelection(w http.ResponseWriter, r *http.Request,
 	return true
 }
 
+func (s *Server) handleOperatorReRegister(w http.ResponseWriter, r *http.Request, physicalID string) bool {
+	if !requireMethod(w, r, http.MethodPost) {
+		return true
+	}
+	controller := http.NewResponseController(w)
+	_ = controller.SetWriteDeadline(time.Time{})
+	result, err := s.devices.ReRegisterOperator(r.Context(), physicalID)
+	if err != nil {
+		s.writeDeviceError(w, err)
+		return true
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"data": operatorSelectionWire(result)})
+	return true
+}
+
 func (s *Server) handleVoWiFiEnabled(
 	w http.ResponseWriter,
 	r *http.Request,
@@ -691,6 +786,10 @@ func (s *Server) handleVoWiFiEnabled(
 		writeError(w, http.StatusServiceUnavailable, "physical_device_missing", "the configured modem is not present on this Linux host")
 		return true
 	}
+	if request.Enabled && config.NetworkEnabled {
+		writeError(w, http.StatusConflict, "cellular_data_active", "disable roaming data before enabling VoWiFi")
+		return true
+	}
 	if request.Enabled {
 		entry, _, _ := s.physicalForConfig(config)
 		imsi := snapshotString(entry.Snapshot, func(snapshot *device.Snapshot) string { return snapshot.IMSI })
@@ -700,9 +799,59 @@ func (s *Server) handleVoWiFiEnabled(
 		}
 	}
 
+	// Establish RF-off synchronously before changing the asynchronous VoWiFi
+	// lifecycle. This removes the attach window both when entering VoWiFi and
+	// when leaving it: teardown starts from CFUN=4 and is required to remain
+	// there until the user explicitly disables airplane mode.
 	previous := config.VoWiFiEnabled
+	liveICCID := ""
+	entry, physicalID, present := s.physicalForConfig(config)
+	if present {
+		if _, err := s.devices.SetFlight(r.Context(), physicalID, true); err != nil {
+			s.writeDeviceError(w, err)
+			return true
+		}
+	}
+	if entry.Snapshot != nil {
+		iccid := strings.TrimSpace(entry.Snapshot.ICCID)
+		if iccid != "" {
+			liveICCID = iccid
+			policy, policyErr := s.store.CardPolicy(r.Context(), iccid)
+			if errors.Is(policyErr, store.ErrNotFound) {
+				policy = store.CardPolicy{ICCID: iccid, IPVersion: "IPV4V6"}
+				policyErr = nil
+			}
+			if policyErr != nil {
+				s.writeStoreError(w, policyErr)
+				return true
+			}
+			policy.VoWiFiEnabled = request.Enabled
+			policy.AirplaneEnabled = true
+			policy.NetworkEnabled = false
+			policy.Source = "manual"
+			if err := s.store.UpsertCardPolicy(r.Context(), policy); err != nil {
+				s.writeStoreError(w, err)
+				return true
+			}
+		}
+	}
+
+	rollbackCardPolicy := func() {
+		if liveICCID == "" {
+			return
+		}
+		policy, policyErr := s.store.CardPolicy(context.Background(), liveICCID)
+		if policyErr != nil {
+			return
+		}
+		policy.VoWiFiEnabled = previous
+		policy.AirplaneEnabled = true
+		policy.NetworkEnabled = false
+		_ = s.store.UpsertCardPolicy(context.Background(), policy)
+	}
 	config.VoWiFiEnabled = request.Enabled
 	if err := s.store.UpsertDevice(r.Context(), config); err != nil {
+		rollbackCardPolicy()
 		s.writeStoreError(w, err)
 		return true
 	}
@@ -724,6 +873,7 @@ func (s *Server) handleVoWiFiEnabled(
 			return true
 		}
 		config.VoWiFiEnabled = previous
+		rollbackCardPolicy()
 		if restoreErr := s.store.UpsertDevice(r.Context(), config); restoreErr != nil {
 			s.logger.Error(
 				"restore VoWiFi policy after rejected runtime operation",
@@ -927,7 +1077,7 @@ func (s *Server) handleUSSD(w http.ResponseWriter, r *http.Request, id string) b
 	return true
 }
 
-func (s *Server) handleFlightMode(w http.ResponseWriter, r *http.Request, id string) bool {
+func (s *Server) handleFlightMode(w http.ResponseWriter, r *http.Request, config store.Device, physicalID string) bool {
 	if !requireMethod(w, r, http.MethodPatch) {
 		return true
 	}
@@ -938,15 +1088,120 @@ func (s *Server) handleFlightMode(w http.ResponseWriter, r *http.Request, id str
 		writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
 		return true
 	}
-	result, err := s.devices.SetFlight(r.Context(), id, request.Enabled)
+	if config.VoWiFiEnabled {
+		writeError(w, http.StatusConflict, "vowifi_owns_airplane_mode", "airplane mode is locked on while VoWiFi is enabled")
+		return true
+	}
+	result, err := s.devices.SetFlight(r.Context(), physicalID, request.Enabled)
 	if err != nil {
 		s.writeDeviceError(w, err)
 		return true
 	}
+	// Unlike VoWiFi, CFUN airplane state is not represented in the device row.
+	// Persist it against the live ICCID so a restart can distinguish an
+	// intentional airplane policy from an interrupted VoWiFi teardown.
+	if entry, getErr := s.devices.Get(physicalID); getErr == nil && entry.Snapshot != nil {
+		iccid := strings.TrimSpace(entry.Snapshot.ICCID)
+		if iccid != "" {
+			policy, policyErr := s.store.CardPolicy(r.Context(), iccid)
+			if errors.Is(policyErr, store.ErrNotFound) {
+				policy = store.CardPolicy{ICCID: iccid, IPVersion: "IPV4V6"}
+				policyErr = nil
+			}
+			if policyErr != nil {
+				s.writeStoreError(w, policyErr)
+				return true
+			}
+			policy.AirplaneEnabled = request.Enabled
+			if request.Enabled {
+				policy.VoWiFiEnabled = false
+			}
+			policy.Source = "manual"
+			if err := s.store.UpsertCardPolicy(r.Context(), policy); err != nil {
+				s.writeStoreError(w, err)
+				return true
+			}
+		}
+	}
 	writeJSON(w, http.StatusOK, map[string]any{"data": result})
 	return true
 }
 
+func (s *Server) handleCellularData(
+	w http.ResponseWriter,
+	r *http.Request,
+	config store.Device,
+	physicalID string,
+) bool {
+	if !s.developerActive(r.Context()) {
+		writeError(w, http.StatusForbidden, "developer_mode_required", "roaming data is available only in developer mode")
+		return true
+	}
+	switch r.Method {
+	case http.MethodGet:
+		writeJSON(w, http.StatusOK, map[string]any{"data": map[string]any{
+			"enabled":           config.NetworkEnabled,
+			"interface":         config.Interface,
+			"apn":               config.APN,
+			"export_proxy_only": true,
+		}})
+	case http.MethodPatch, http.MethodPut:
+		var request struct {
+			Enabled bool   `json:"enabled"`
+			APN     string `json:"apn"`
+		}
+		if err := s.decodeJSON(w, r, &request); err != nil {
+			writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
+			return true
+		}
+		if request.Enabled && config.VoWiFiEnabled {
+			writeError(w, http.StatusConflict, "vowifi_owns_radio", "disable VoWiFi before enabling cellular roaming data")
+			return true
+		}
+		if !request.Enabled && s.exportProxy != nil {
+			if _, active := s.exportProxy.EnabledConfigForDevice(config.ID); active {
+				writeError(w, http.StatusConflict, "export_proxy_active", i18n.T("请先禁用该设备已绑定的导出代理，再关闭漫游数据"))
+				return true
+			}
+		}
+		apn := strings.TrimSpace(request.APN)
+		if apn == "" {
+			apn = strings.TrimSpace(config.APN)
+		}
+		controller := http.NewResponseController(w)
+		_ = controller.SetWriteDeadline(time.Time{})
+		result, err := s.devices.SetNetwork(r.Context(), physicalID, device.NetworkRequest{
+			Enabled: request.Enabled, APN: apn, IPVersion: "IPV4V6", Backend: config.DeviceBackend,
+		})
+		if err != nil {
+			s.writeDeviceError(w, err)
+			return true
+		}
+		previous := config.NetworkEnabled
+		config.NetworkEnabled = request.Enabled
+		if apn != "" {
+			config.APN = apn
+		}
+		if err := s.store.UpsertDevice(r.Context(), config); err != nil {
+			rollbackContext, cancel := context.WithTimeout(context.Background(), 20*time.Second)
+			_, _ = s.devices.SetNetwork(rollbackContext, physicalID, device.NetworkRequest{
+				Enabled: previous, APN: config.APN, IPVersion: "IPV4V6", Backend: config.DeviceBackend,
+			})
+			cancel()
+			s.writeStoreError(w, err)
+			return true
+		}
+		writeJSON(w, http.StatusOK, map[string]any{"data": map[string]any{
+			"enabled": result.Enabled, "interface": result.Interface,
+			"backend": result.Backend, "export_proxy_only": true,
+		}})
+	default:
+		w.Header().Set("Allow", "GET, PATCH, PUT")
+		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "method not allowed")
+	}
+	return true
+}
+
 func (s *Server) requirePhysicalDevice(w http.ResponseWriter, present bool) bool {
 	if s.devices == nil {
 		writeError(w, http.StatusServiceUnavailable, "device_manager_unavailable", "device manager is unavailable")
@@ -1031,6 +1286,7 @@ func (s *Server) dashboardDevices() []map[string]any {
 		result = append(result, map[string]any{
 			"id":                entry["id"],
 			"name":              entry["name"],
+			"device_type":       entry["device_type"],
 			"interface":         entry["interface"],
 			"proxy_port":        entry["proxy_port"],
 			"public_ip":         entry["public_ip"],
@@ -1041,7 +1297,7 @@ func (s *Server) dashboardDevices() []map[string]any {
 			"network_duplex":    modemStatus["network_duplex"],
 			"vowifi_active":     vowifiActive,
 			"vowifi_runtime":    runtime,
-			"network_connected": false,
+			"network_connected": entry["network_connected"],
 			"model":             modemStatus["model"],
 		})
 	}
@@ -1098,24 +1354,68 @@ func (s *Server) configuredDeviceSummary(
 	}
 	result["id"] = config.ID
 	result["name"] = config.Name
+	result["device_type"] = store.NormalizeDeviceType(config.DeviceType)
 	result["interface"] = config.Interface
 	result["proxy_port"] = config.ProxyPort
 	result["esim_transport"] = config.ESIMTransport
 	result["sms_enabled"] = config.SMSEnabled
-	result["network_enabled"] = false
+	result["network_enabled"] = config.NetworkEnabled
+	result["developer_enabled"] = s.developerActive(context.Background())
+	result["network_connected"] = config.NetworkEnabled
+	result["data_connected"] = config.NetworkEnabled
 	result["vowifi_enabled"] = config.VoWiFiEnabled
-	if runtime, err := s.store.VoWiFiRuntime(context.Background(), config.ID); err == nil {
-		runtimeResponse := storedVoWiFiRuntime(runtime)
-		result["vowifi_runtime"] = runtimeResponse
-		result["vowifi_active"] = runtime.TunnelReady
-		if runtime.LocalPhone != "" {
-			// The SIM panel reads the top-level local_phone; keep modem.phone_number
-			// in sync for the summary/overview consumers that read it there.
-			result["local_phone"] = runtime.LocalPhone
-			result["phone_number_source"] = runtime.PhoneNumberSource
-			if modemStatus, ok := result["modem"].(map[string]any); ok {
-				modemStatus["phone_number"] = runtime.LocalPhone
-				modemStatus["phone_number_source"] = runtime.PhoneNumberSource
+	var runtimeResponse map[string]any
+	runtimeMatchesCard := true
+	if s.vowifi != nil {
+		if runtime, err := s.vowifi.State(config.ID); err == nil {
+			runtimeMatchesCard = voWiFiRuntimeMatchesSnapshot(runtime.ICCID, entry)
+			if runtimeMatchesCard {
+				runtimeResponse = liveVoWiFiRuntime(runtime)
+			} else {
+				runtimeResponse = idleVoWiFiRuntime(config.ID, snapshotForEntry(entry))
+			}
+		}
+	}
+	if runtimeResponse == nil {
+		if runtime, err := s.store.VoWiFiRuntime(context.Background(), config.ID); err == nil {
+			currentICCID := ""
+			var currentSnapshot *device.Snapshot
+			if entry != nil {
+				currentSnapshot = entry.Snapshot
+				if entry.Snapshot != nil {
+					currentICCID = strings.TrimSpace(entry.Snapshot.ICCID)
+				}
+			}
+			runtimeMatchesCard = currentICCID == "" || runtime.ICCID == "" ||
+				strings.EqualFold(currentICCID, strings.TrimSpace(runtime.ICCID))
+			if runtimeMatchesCard {
+				runtimeResponse = storedVoWiFiRuntime(runtime)
+			} else {
+				// The saved IMS session belongs to a different eSIM profile. Never
+				// project its registration or number onto the currently selected SIM.
+				runtimeResponse = idleVoWiFiRuntime(config.ID, currentSnapshot)
+			}
+		}
+	}
+	if runtimeResponse == nil {
+		runtimeResponse = idleVoWiFiRuntime(config.ID, snapshotForEntry(entry))
+	}
+	result["vowifi_runtime"] = runtimeResponse
+	runtimeEnabled, _ := runtimeResponse["enabled"].(bool)
+	runtimeTunnelReady, _ := runtimeResponse["tunnel_ready"].(bool)
+	result["vowifi_active"] = config.VoWiFiEnabled && runtimeMatchesCard && runtimeEnabled && runtimeTunnelReady
+	// Numbers are SIM-owned data. Resolve the association by the live ICCID
+	// instead of reusing the last VoWiFi runtime attached to this device ID.
+	if entry != nil && entry.Snapshot != nil {
+		currentICCID := strings.TrimSpace(entry.Snapshot.ICCID)
+		if currentICCID != "" {
+			if association, err := s.store.PhoneAssociation(context.Background(), currentICCID); err == nil {
+				result["local_phone"] = association.Number
+				result["phone_number_source"] = association.Source
+				if modemStatus, ok := result["modem"].(map[string]any); ok {
+					modemStatus["phone_number"] = association.Number
+					modemStatus["phone_number_source"] = association.Source
+				}
 			}
 		}
 	}
@@ -1127,6 +1427,7 @@ func (s *Server) configuredDeviceOverview(
 	entry device.Device,
 	present bool,
 ) map[string]any {
+	developerActive := s.developerActive(context.Background())
 	var physical *device.Device
 	if present {
 		physical = &entry
@@ -1141,12 +1442,34 @@ func (s *Server) configuredDeviceOverview(
 	result["control_device"] = config.ControlDevice
 	result["esim_transport"] = config.ESIMTransport
 	result["sms_enabled"] = config.SMSEnabled
-	result["network_enabled"] = false
+	result["network_enabled"] = developerActive && config.NetworkEnabled
 	result["vowifi_enabled"] = config.VoWiFiEnabled
 	result["radio_live_ok"] = present && entry.Snapshot != nil && entry.Snapshot.Responsive
-	result["traffic"] = map[string]string{}
-	result["traffic_raw"] = map[string]int64{}
-	result["traffic_meta"] = map[string]any{}
+
+	// Live network state: on-demand sample of the cellular interface counters,
+	// kept warm by the 2s overview SSE cadence. Only meaningful when the modem
+	// data path is enabled and an interface is configured.
+	if developerActive && config.NetworkEnabled && strings.TrimSpace(config.Interface) != "" {
+		live := s.netTraffic.sample(config.ID, config.Interface, time.Now())
+		result["private_ip"] = live.ipv4
+		result["traffic"] = map[string]string{
+			"rx":      formatLiveBytes(float64(live.minuteRx)),
+			"tx":      formatLiveBytes(float64(live.minuteTx)),
+			"rate":    formatLiveBytes(live.rxRate) + "/s",
+			"rate_tx": formatLiveBytes(live.txRate) + "/s",
+		}
+		result["traffic_raw"] = map[string]int64{
+			"rx":      live.minuteRx,
+			"tx":      live.minuteTx,
+			"rate":    int64(live.rxRate),
+			"rate_tx": int64(live.txRate),
+		}
+		result["traffic_meta"] = map[string]any{"status": live.status}
+	} else {
+		result["traffic"] = map[string]string{}
+		result["traffic_raw"] = map[string]int64{}
+		result["traffic_meta"] = map[string]any{}
+	}
 	return result
 }
 
@@ -1167,7 +1490,7 @@ func (s *Server) configuredDeviceStatus(
 	result := map[string]any{
 		"healthy":               summary["healthy"],
 		"public_ip":             summary["public_ip"],
-		"network_connected":     false,
+		"network_connected":     config.NetworkEnabled,
 		"modem":                 summary["modem"],
 		"vowifi":                summary["vowifi_runtime"],
 		"sim_service_table":     map[string]any{},
@@ -1183,9 +1506,14 @@ func (s *Server) configuredDeviceStatus(
 }
 
 func storedVoWiFiRuntime(runtime store.VoWiFiRuntime) map[string]any {
+	extra, _ := rawJSONObject(runtime.Extra).(map[string]any)
+	enabled, _ := extra["enabled"].(bool)
+	active, _ := extra["active"].(bool)
 	return map[string]any{
 		"device_id":           runtime.DeviceID,
 		"phase":               runtime.Phase,
+		"enabled":             enabled,
+		"active":              active,
 		"dataplane_mode":      runtime.DataplaneMode,
 		"iccid":               runtime.ICCID,
 		"imsi":                runtime.IMSI,
@@ -1209,6 +1537,63 @@ func storedVoWiFiRuntime(runtime store.VoWiFiRuntime) map[string]any {
 	}
 }
 
+func liveVoWiFiRuntime(runtime vowifi.State) map[string]any {
+	return map[string]any{
+		"device_id":           runtime.DeviceID,
+		"phase":               string(runtime.Phase),
+		"enabled":             runtime.Enabled,
+		"active":              runtime.Active,
+		"dataplane_mode":      runtime.DataplaneMode,
+		"iccid":               runtime.ICCID,
+		"imsi":                runtime.IMSI,
+		"sim_ready":           runtime.SIMReady,
+		"access_ready":        runtime.AccessReady,
+		"tunnel_ready":        runtime.TunnelReady,
+		"ims_ready":           runtime.IMSReady,
+		"sms_ready":           runtime.SMSReady,
+		"reg_status":          map[bool]int{true: 1, false: 0}[runtime.IMSReady],
+		"reg_status_text":     map[bool]string{true: "registered", false: "not registered"}[runtime.IMSReady],
+		"network_mode":        "Wi-Fi",
+		"local_phone":         runtime.PhoneNumber,
+		"phone_number_source": runtime.PhoneNumberSource,
+		"last_error_class":    runtime.LastErrorClass,
+		"last_error":          runtime.LastError,
+		"last_reason":         runtime.LastReason,
+		"updated_at":          runtime.UpdatedAt,
+		"tunnel": map[string]any{
+			"established":    runtime.TunnelReady,
+			"name":           runtime.TunnelName,
+			"dataplane_mode": runtime.DataplaneMode,
+			"epdg":           runtime.EPDG,
+			"proxy_mode":     runtime.ProxyMode,
+			"proxy_id":       runtime.ProxyID,
+			"security_audit": runtime.Security,
+		},
+		"imscore": map[string]any{
+			"registered":         runtime.IMSReady,
+			"registration_state": runtime.IMSRegistration,
+			"associated_number":  runtime.PhoneNumber,
+			"number_source":      runtime.PhoneNumberSource,
+		},
+		"smsip": map[string]any{"ready": runtime.SMSReady},
+	}
+}
+
+func snapshotForEntry(entry *device.Device) *device.Snapshot {
+	if entry == nil {
+		return nil
+	}
+	return entry.Snapshot
+}
+
+func voWiFiRuntimeMatchesSnapshot(runtimeICCID string, entry *device.Device) bool {
+	current := strings.TrimSpace(snapshotString(snapshotForEntry(entry), func(snapshot *device.Snapshot) string {
+		return snapshot.ICCID
+	}))
+	runtimeICCID = strings.TrimSpace(runtimeICCID)
+	return current == "" || runtimeICCID == "" || strings.EqualFold(current, runtimeICCID)
+}
+
 func rawJSONObject(value json.RawMessage) any {
 	var result any
 	if len(value) != 0 && json.Unmarshal(value, &result) == nil {
@@ -1250,7 +1635,7 @@ func deviceSummary(entry device.Device) map[string]any {
 		"physical_present":         entry.Discovered,
 		"worker_running":           entry.Discovered,
 		"data_connected":           false,
-		"radio_registered":         snapshot != nil && snapshot.OperatorName != "",
+		"radio_registered":         snapshot != nil && (snapshot.RegistrationStatus == 1 || snapshot.RegistrationStatus == 5),
 		"lifecycle_phase":          lifecyclePhase(entry),
 		"lifecycle_reason":         entry.LastError,
 		"public_ip":                "",
@@ -1307,6 +1692,7 @@ func storedDeviceConfig(config store.Device) map[string]any {
 	return map[string]any{
 		"id":                   config.ID,
 		"name":                 config.Name,
+		"device_type":          store.NormalizeDeviceType(config.DeviceType),
 		"interface":            config.Interface,
 		"control_device":       config.ControlDevice,
 		"at_port":              config.ATPort,
@@ -1324,7 +1710,7 @@ func storedDeviceConfig(config store.Device) map[string]any {
 		"qmi_use_proxy":        config.QMIUseProxy,
 		"qmi_proxy_path":       config.QMIProxyPath,
 		"qmi_proxy_executable": config.QMIProxyExecutable,
-		"network_enabled":      false,
+		"network_enabled":      config.NetworkEnabled,
 		"sms_enabled":          config.SMSEnabled,
 		"vowifi_enabled":       config.VoWiFiEnabled,
 	}
@@ -1358,61 +1744,66 @@ func fillConfigFromPhysical(config *store.Device, entry device.Device) {
 func modemSummary(snapshot *device.Snapshot, phone string, phoneSource string) map[string]any {
 	if snapshot == nil {
 		return map[string]any{
-			"operator":            "",
-			"native_mcc":          "",
-			"native_mnc":          "",
-			"card_mcc":            "",
-			"card_mnc":            "",
-			"card_country":        "",
-			"service_blocked":     false,
-			"blocked_reason":      "",
-			"network_mode":        "",
-			"radio_band":          "",
-			"radio_channel":       0,
-			"signal_dbm":          0,
-			"signal_sinr":         0,
-			"imei":                "",
-			"iccid":               "",
-			"reg_status":          0,
-			"reg_status_text":     "not refreshed",
-			"sim_inserted":        false,
-			"phone_number":        phone,
-			"phone_number_source": phoneSource,
-			"model":               "",
+			"operator":              "",
+			"native_mcc":            "",
+			"native_mnc":            "",
+			"native_spn":            "",
+			"operator_country_code": "",
+			"card_mcc":              "",
+			"card_mnc":              "",
+			"card_country":          "",
+			"service_blocked":       false,
+			"blocked_reason":        "",
+			"network_mode":          "",
+			"radio_band":            "",
+			"radio_channel":         0,
+			"signal_dbm":            0,
+			"signal_sinr":           0,
+			"imei":                  "",
+			"iccid":                 "",
+			"reg_status":            0,
+			"reg_status_text":       "not refreshed",
+			"sim_inserted":          false,
+			"phone_number":          phone,
+			"phone_number_source":   phoneSource,
+			"model":                 "",
 		}
 	}
 	mcc, mnc := splitPLMN(snapshot.OperatorCode)
+	_, operatorCountryCode, _ := device.CarrierForPLMN(snapshot.OperatorCode)
 	cardMCC, cardMNC := device.CardMCCMNC(snapshot.IMSI)
 	blockedReason := device.RegionBlockReason(snapshot.IMSI)
 	return map[string]any{
-		"operator":            snapshot.OperatorName,
-		"native_mcc":          mcc,
-		"native_mnc":          mnc,
-		"card_mcc":            cardMCC,
-		"card_mnc":            cardMNC,
-		"card_country":        countryNameForMCC(cardMCC),
-		"service_blocked":     blockedReason != "",
-		"blocked_reason":      blockedReason,
-		"network_mode":        snapshot.AccessTech,
-		"network_duplex":      "",
-		"radio_band":          snapshot.Band,
-		"radio_channel":       parseDecimal(snapshot.Channel),
-		"signal_dbm":          pointerInt(snapshot.RSSIDBm),
-		"signal_rsrp":         pointerInt(snapshot.RSRP),
-		"signal_rsrq":         pointerInt(snapshot.RSRQ),
-		"signal_sinr":         pointerInt(snapshot.SINR),
-		"imei":                snapshot.IMEI,
-		"iccid":               snapshot.ICCID,
-		"imsi":                snapshot.IMSI,
-		"firmware":            snapshot.Firmware,
-		"model":               snapshot.Model,
-		"reg_status":          boolInt(snapshot.OperatorName != ""),
-		"reg_status_text":     registrationText(snapshot),
-		"ps_attached":         false,
-		"sim_inserted":        snapshot.SIMStatus != "",
-		"operating_mode":      snapshot.OperatingMode,
-		"phone_number":        phone,
-		"phone_number_source": phoneSource,
+		"operator":              snapshot.OperatorName,
+		"native_mcc":            mcc,
+		"native_mnc":            mnc,
+		"native_spn":            snapshot.SPN,
+		"operator_country_code": operatorCountryCode,
+		"card_mcc":              cardMCC,
+		"card_mnc":              cardMNC,
+		"card_country":          countryNameForMCC(cardMCC),
+		"service_blocked":       blockedReason != "",
+		"blocked_reason":        blockedReason,
+		"network_mode":          snapshot.AccessTech,
+		"network_duplex":        "",
+		"radio_band":            snapshot.Band,
+		"radio_channel":         parseDecimal(snapshot.Channel),
+		"signal_dbm":            pointerInt(snapshot.RSSIDBm),
+		"signal_rsrp":           pointerInt(snapshot.RSRP),
+		"signal_rsrq":           pointerInt(snapshot.RSRQ),
+		"signal_sinr":           pointerInt(snapshot.SINR),
+		"imei":                  snapshot.IMEI,
+		"iccid":                 snapshot.ICCID,
+		"imsi":                  snapshot.IMSI,
+		"firmware":              snapshot.Firmware,
+		"model":                 snapshot.Model,
+		"reg_status":            snapshot.RegistrationStatus,
+		"reg_status_text":       registrationText(snapshot),
+		"ps_attached":           snapshot.PSAttached,
+		"sim_inserted":          snapshot.SIMStatus != "",
+		"operating_mode":        snapshot.OperatingMode,
+		"phone_number":          phone,
+		"phone_number_source":   phoneSource,
 	}
 }
 
@@ -1432,6 +1823,8 @@ func idleVoWiFiRuntime(id string, snapshot *device.Snapshot) map[string]any {
 	return map[string]any{
 		"device_id":           id,
 		"phase":               "idle",
+		"enabled":             false,
+		"active":              false,
 		"dataplane_mode":      "",
 		"iccid":               iccid,
 		"imsi":                imsi,
@@ -1485,17 +1878,39 @@ func lifecyclePhase(entry device.Device) string {
 }
 
 func registrationLabel(snapshot *device.Snapshot) string {
-	if snapshot == nil || snapshot.OperatorName == "" {
+	if snapshot == nil {
+		return "unknown"
+	}
+	switch snapshot.RegistrationStatus {
+	case 1, 5:
+		return "registered"
+	case 2:
+		return "searching"
+	case 3:
+		return "denied"
+	default:
 		return "unknown"
 	}
-	return "registered"
 }
 
 func registrationText(snapshot *device.Snapshot) string {
-	if snapshot.OperatorName != "" {
+	if snapshot == nil {
+		return "unknown"
+	}
+	switch snapshot.RegistrationStatus {
+	case 1:
 		return "registered"
+	case 5:
+		return "registered (roaming)"
+	case 2:
+		return "searching"
+	case 3:
+		return "registration denied"
+	case 0:
+		return "not registered"
+	default:
+		return "unknown"
 	}
-	return "unknown"
 }
 
 func splitPLMN(value string) (string, string) {

internal/server/device_features_api.go

@@ -2,6 +2,7 @@ package server
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 	"time"
@@ -10,6 +11,10 @@ import (
 	"vocat/internal/store"
 )
 
+// overviewStreamInterval is the cadence at which the overview SSE stream pushes
+// a fresh snapshot. It is a package var so tests can shorten it.
+var overviewStreamInterval = 2 * time.Second
+
 // beginSSE prepares a response for Server-Sent Events and returns its response
 // controller for explicit flushes.
 func beginSSE(w http.ResponseWriter) *http.ResponseController {
@@ -50,13 +55,27 @@ func (s *Server) handleOverviewStream(
 	if err := writeSSEEvent(w, controller, "connected", map[string]any{}); err != nil {
 		return true
 	}
-	ticker := time.NewTicker(2 * time.Second)
+	ticker := time.NewTicker(overviewStreamInterval)
 	defer ticker.Stop()
 	for {
 		select {
 		case <-r.Context().Done():
 			return true
 		case <-ticker.C:
+			// The config passed in was read when the stream opened. Re-read it on
+			// every tick so edits made while watching (roaming data, APN, VoWiFi,
+			// name…) take effect; otherwise the stream keeps replaying the stale
+			// snapshot and the UI flaps between SSE-old and REST-new values.
+			fresh, err := s.store.Device(r.Context(), config.ID)
+			if err != nil {
+				if errors.Is(err, store.ErrNotFound) {
+					// The device was deleted while streaming; end the stream.
+					return true
+				}
+				// Transient store hiccup: keep the last known config for this tick.
+			} else {
+				config = fresh
+			}
 			currentEntry, _, present := s.physicalForConfig(config)
 			overview := s.configuredDeviceOverview(config, currentEntry, present)
 			if err := writeSSEEvent(w, controller, "overview", overview); err != nil {
@@ -81,6 +100,7 @@ func operatorCandidateWire(op device.ScannedOperator) map[string]any {
 		"operatorName":     op.Name,
 		"shortName":        op.Short,
 		"plmn":             op.Numeric,
+		"countryCode":      op.Country,
 		"rats":             rats,
 		"includesPcsDigit": false,
 	}

internal/server/device_features_api_test.go

@@ -1,6 +1,7 @@
 package server
 
 import (
+	"bufio"
 	"context"
 	"encoding/json"
 	"errors"
@@ -11,7 +12,9 @@ import (
 	"testing"
 	"time"
 
+	"vocat/internal/developer"
 	"vocat/internal/device"
+	"vocat/internal/exportproxy"
 	"vocat/internal/modem"
 	"vocat/internal/store"
 	"vocat/internal/update"
@@ -28,6 +31,28 @@ func decodeData(t *testing.T, recorder *httptest.ResponseRecorder) map[string]an
 	return envelope.Data
 }
 
+type esimAIDCaptureController struct {
+	fakeDeviceController
+	switchAID  string
+	disableAID string
+	renameAID  string
+}
+
+func (controller *esimAIDCaptureController) ESIMSwitchProfile(_ context.Context, _, _, aidHex string) error {
+	controller.switchAID = aidHex
+	return nil
+}
+
+func (controller *esimAIDCaptureController) ESIMDisableProfile(_ context.Context, _, _, aidHex string) error {
+	controller.disableAID = aidHex
+	return nil
+}
+
+func (controller *esimAIDCaptureController) ESIMRenameProfile(_ context.Context, _, _, _, aidHex string) error {
+	controller.renameAID = aidHex
+	return nil
+}
+
 func TestAttachSingleEUICCIdentityFillsProfileGroupMetadataKey(t *testing.T) {
 	groups := []map[string]any{{"eid": "", "aidHex": "", "profiles": []any{}}}
 	chipInfo := map[string]any{
@@ -253,9 +278,18 @@ func TestHandleESIMShapes(t *testing.T) {
 	}
 
 	// Switch happy path: a present device + fake controller switches by ICCID.
-	present := &Server{logger: regionTestLogger(), maxRequestBodyBytes: 4096, devices: fakeDeviceController{}}
+	database, err := store.Open(context.Background(), ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	if err := database.UpsertDevice(context.Background(), store.Device{ID: "dev1", Name: "dev1"}); err != nil {
+		t.Fatal(err)
+	}
+	controller := &esimAIDCaptureController{}
+	present := &Server{store: database, logger: regionTestLogger(), maxRequestBodyBytes: 4096, devices: controller}
 	swOK := httptest.NewRecorder()
-	swReq := httptest.NewRequest(http.MethodPost, "/esim/actions/switch", strings.NewReader(`{"iccid":"8900000000000000001","aid_hex":"A0"}`))
+	swReq := httptest.NewRequest(http.MethodPost, "/esim/actions/switch", strings.NewReader(`{"iccid":"8900000000000000001","aidHex":"A0000005591010FFFFFFFF8900000177"}`))
 	swReq.Header.Set("Content-Type", "application/json")
 	present.handleESIM(swOK, swReq, []string{"actions", "switch"}, "dev1", true)
 	if swOK.Code != http.StatusOK {
@@ -264,10 +298,13 @@ func TestHandleESIMShapes(t *testing.T) {
 	if data := decodeData(t, swOK); data["status"] != "switched" || data["verified"] != true {
 		t.Fatalf("switch data = %v", data)
 	}
+	if controller.switchAID != "A0000005591010FFFFFFFF8900000177" {
+		t.Fatalf("switch AID = %q, want XeSIM camelCase AID", controller.switchAID)
+	}
 
 	// Disable happy path routes the active profile to ES10c DisableProfile.
 	disableOK := httptest.NewRecorder()
-	disableReq := httptest.NewRequest(http.MethodPost, "/esim/actions/disable", strings.NewReader(`{"iccid":"8900000000000000001","aid_hex":"A0000005591010FFFFFFFF8900000100"}`))
+	disableReq := httptest.NewRequest(http.MethodPost, "/esim/actions/disable", strings.NewReader(`{"iccid":"8900000000000000001","aidHex":"A0000005591010FFFFFFFF8900000177"}`))
 	disableReq.Header.Set("Content-Type", "application/json")
 	present.handleESIM(disableOK, disableReq, []string{"actions", "disable"}, "dev1", true)
 	if disableOK.Code != http.StatusOK {
@@ -276,10 +313,13 @@ func TestHandleESIMShapes(t *testing.T) {
 	if data := decodeData(t, disableOK); data["status"] != "disabled" || data["recovering"] != true {
 		t.Fatalf("disable data = %v", data)
 	}
+	if controller.disableAID != "A0000005591010FFFFFFFF8900000177" {
+		t.Fatalf("disable AID = %q, want XeSIM camelCase AID", controller.disableAID)
+	}
 
 	// Rename happy path routes PATCH to ES10c SetNickname support.
 	renameOK := httptest.NewRecorder()
-	renameReq := httptest.NewRequest(http.MethodPatch, "/esim/profiles/8900000000000000001", strings.NewReader(`{"name":"Test profile","aid_hex":"A0000005591010FFFFFFFF8900000100"}`))
+	renameReq := httptest.NewRequest(http.MethodPatch, "/esim/profiles/8900000000000000001", strings.NewReader(`{"name":"Test profile","aidHex":"A0000005591010FFFFFFFF8900000177"}`))
 	renameReq.Header.Set("Content-Type", "application/json")
 	present.handleESIM(renameOK, renameReq, []string{"profiles", "8900000000000000001"}, "dev1", true)
 	if renameOK.Code != http.StatusOK {
@@ -288,6 +328,9 @@ func TestHandleESIMShapes(t *testing.T) {
 	if data := decodeData(t, renameOK); data["status"] != "renamed" || data["name"] != "Test profile" {
 		t.Fatalf("rename data = %v", data)
 	}
+	if controller.renameAID != "A0000005591010FFFFFFFF8900000177" {
+		t.Fatalf("rename AID = %q, want XeSIM camelCase AID", controller.renameAID)
+	}
 
 	// Download on a present device but with no smdp address reports 400.
 	dlNoSmdp := httptest.NewRecorder()
@@ -467,3 +510,230 @@ func TestE911WebsheetRejectsBadToken(t *testing.T) {
 		t.Fatalf("bad token status = %d, want 403", recorder.Code)
 	}
 }
+
+// readSSEEvent reads one Server-Sent-Events frame ("event:"/"data:" lines
+// terminated by a blank line) and returns the event name and data payload.
+func readSSEEvent(reader *bufio.Reader) (string, []byte, error) {
+	var event string
+	var data []byte
+	for {
+		line, err := reader.ReadString('\n')
+		if err != nil {
+			return "", nil, err
+		}
+		line = strings.TrimRight(line, "\r\n")
+		if line == "" {
+			if event != "" || data != nil {
+				return event, data, nil
+			}
+			continue
+		}
+		if rest, ok := strings.CutPrefix(line, "event: "); ok {
+			event = rest
+		} else if rest, ok := strings.CutPrefix(line, "data: "); ok {
+			data = append(data, rest...)
+		}
+	}
+}
+
+// awaitOverviewNetworkEnabled reads overview SSE events until one reports the
+// requested network_enabled value, or the stream ends / the request times out.
+func awaitOverviewNetworkEnabled(reader *bufio.Reader, want bool) error {
+	for {
+		event, data, err := readSSEEvent(reader)
+		if err != nil {
+			return err
+		}
+		if event != "overview" {
+			continue
+		}
+		var overview struct {
+			NetworkEnabled bool `json:"network_enabled"`
+		}
+		if err := json.Unmarshal(data, &overview); err != nil {
+			return err
+		}
+		if overview.NetworkEnabled == want {
+			return nil
+		}
+	}
+}
+
+// The overview SSE stream must reflect edits made after it opened. Before the
+// fix it rebuilt every tick from the config snapshot captured when the stream
+// opened, so toggling roaming data off was immediately overwritten by the stale
+// "on" snapshot and the switch flapped. This test opens the stream with roaming
+// data on, turns it off in the store, and requires the stream to keep reporting
+// the new "off" state.
+func TestHandleOverviewStreamReflectsConfigChanges(t *testing.T) {
+	previousInterval := overviewStreamInterval
+	overviewStreamInterval = 10 * time.Millisecond
+	t.Cleanup(func() { overviewStreamInterval = previousInterval })
+
+	ctx := context.Background()
+	database, err := store.Open(ctx, ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	if err := database.UpsertAppSetting(ctx, store.AppSetting{
+		Key:   developer.EnabledSettingKey,
+		Value: []byte(`{"enabled":true}`),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if err := database.UpsertDevice(ctx, store.Device{ID: "dev1", Name: "Test device", NetworkEnabled: true}); err != nil {
+		t.Fatal(err)
+	}
+
+	server := &Server{store: database, logger: regionTestLogger(), developerEnabled: true}
+	mux := http.NewServeMux()
+	mux.HandleFunc("/stream", func(w http.ResponseWriter, r *http.Request) {
+		config, err := database.Device(r.Context(), "dev1")
+		if err != nil {
+			writeError(w, http.StatusNotFound, "not_found", err.Error())
+			return
+		}
+		server.handleOverviewStream(w, r, config, device.Device{}, false)
+	})
+	testServer := httptest.NewServer(mux)
+	t.Cleanup(testServer.Close)
+
+	requestCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	t.Cleanup(cancel)
+	request, err := http.NewRequestWithContext(requestCtx, http.MethodGet, testServer.URL+"/stream", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	response, err := http.DefaultClient.Do(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = response.Body.Close() })
+	if response.StatusCode != http.StatusOK {
+		t.Fatalf("stream status = %d", response.StatusCode)
+	}
+	reader := bufio.NewReader(response.Body)
+
+	// The stream opens with roaming data enabled.
+	if err := awaitOverviewNetworkEnabled(reader, true); err != nil {
+		t.Fatalf("initial overview never reported network_enabled=true: %v", err)
+	}
+
+	// Turn roaming data off; the very next ticks must report the new state
+	// instead of replaying the stale enabled snapshot.
+	config, err := database.Device(ctx, "dev1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	config.NetworkEnabled = false
+	if err := database.UpsertDevice(ctx, config); err != nil {
+		t.Fatal(err)
+	}
+	if err := awaitOverviewNetworkEnabled(reader, false); err != nil {
+		t.Fatalf("overview kept replaying stale network_enabled=true after the edit: %v", err)
+	}
+}
+
+// Turning roaming data off must be refused while an enabled export proxy is
+// bound to the device; the user has to disable that binding first.
+func TestHandleCellularDataRejectsDisableWhileExportProxyActive(t *testing.T) {
+	ctx := context.Background()
+	database, err := store.Open(ctx, ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	if err := database.UpsertAppSetting(ctx, store.AppSetting{
+		Key: developer.EnabledSettingKey, Value: json.RawMessage(`{"enabled":true}`),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	deviceConfig := store.Device{ID: "modem-1", Name: "modem-1", Interface: "wwan0", NetworkEnabled: true}
+	if err := database.UpsertDevice(ctx, deviceConfig); err != nil {
+		t.Fatal(err)
+	}
+	// Seed an already-enabled export proxy bound to the device. New only logs a
+	// warning when the Linux-only listener cannot start on this platform, so the
+	// enabled config still loads and the interlock sees it.
+	seeded, err := json.Marshal([]exportproxy.Config{{
+		ID: "proxy-1", Name: "proxy-1", DeviceID: "modem-1", Interface: "wwan0",
+		Mode: "socks5", ListenHost: "127.0.0.1", ListenPort: 1080, Enabled: true,
+	}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := database.UpsertAppSetting(ctx, store.AppSetting{Key: exportproxy.SettingKey, Value: seeded, Sensitive: true}); err != nil {
+		t.Fatal(err)
+	}
+	proxyManager, err := exportproxy.New(ctx, database, regionTestLogger(), "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = proxyManager.Close() })
+	server := &Server{
+		store:               database,
+		logger:              regionTestLogger(),
+		developerEnabled:    true,
+		exportProxy:         proxyManager,
+		devices:             fakeDeviceController{},
+		maxRequestBodyBytes: 1 << 20,
+	}
+
+	patchOff := func() *httptest.ResponseRecorder {
+		recorder := httptest.NewRecorder()
+		request := httptest.NewRequest(http.MethodPatch, "/api/devices/modem-1/cellular-data", strings.NewReader(`{"enabled":false}`))
+		request.Header.Set("Content-Type", "application/json")
+		if !server.handleCellularData(recorder, request, deviceConfig, "physical-1") {
+			t.Fatal("handleCellularData did not handle the request")
+		}
+		return recorder
+	}
+
+	// While the export proxy is enabled, turning roaming data off is rejected and
+	// the stored config keeps roaming data on.
+	recorder := patchOff()
+	if recorder.Code != http.StatusConflict {
+		t.Fatalf("disable with active proxy status = %d, body = %s", recorder.Code, recorder.Body)
+	}
+	var failure struct {
+		Error struct {
+			Code string `json:"code"`
+		} `json:"error"`
+	}
+	if err := json.Unmarshal(recorder.Body.Bytes(), &failure); err != nil {
+		t.Fatal(err)
+	}
+	if failure.Error.Code != "export_proxy_active" {
+		t.Fatalf("error code = %q, body = %s", failure.Error.Code, recorder.Body)
+	}
+	stored, err := database.Device(ctx, "modem-1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !stored.NetworkEnabled {
+		t.Fatal("roaming data was turned off despite the active export proxy")
+	}
+
+	// Once the binding is disabled, the same request goes through.
+	proxies, err := proxyManager.Configs()
+	if err != nil || len(proxies) != 1 {
+		t.Fatalf("configs = %+v, %v", proxies, err)
+	}
+	disabled := proxies[0]
+	disabled.Enabled = false
+	if _, err := proxyManager.Update(ctx, disabled.ID, disabled); err != nil {
+		t.Fatal(err)
+	}
+	recorder = patchOff()
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("disable after proxy off status = %d, body = %s", recorder.Code, recorder.Body)
+	}
+	stored, err = database.Device(ctx, "modem-1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if stored.NetworkEnabled {
+		t.Fatal("roaming data was not turned off after the export proxy was disabled")
+	}
+}

internal/server/device_summary_test.go

@@ -0,0 +1,117 @@
+package server
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"vocat/internal/device"
+	"vocat/internal/store"
+	"vocat/internal/vowifi"
+)
+
+func TestConfiguredDeviceSummaryIgnoresVoWiFiRuntimeFromPreviousSIM(t *testing.T) {
+	database, err := store.Open(context.Background(), ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	if err := database.UpsertDevice(context.Background(), store.Device{ID: "ec20_1", Name: "EC20"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := database.UpsertVoWiFiRuntime(context.Background(), store.VoWiFiRuntime{
+		DeviceID:          "ec20_1",
+		Phase:             "stopping",
+		ICCID:             "89441000400128014257",
+		IMSI:              "234159608751160",
+		TunnelReady:       true,
+		IMSReady:          true,
+		SMSReady:          true,
+		LocalPhone:        "+447386083638",
+		PhoneNumberSource: "ims_p_associated_uri",
+		UpdatedAt:         time.Now().UTC(),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	s := &Server{store: database}
+	entry := &device.Device{ID: "physical", Snapshot: &device.Snapshot{
+		ICCID: "89104100000028106378",
+		IMSI:  "310380500712483",
+	}}
+	got := s.configuredDeviceSummary(store.Device{ID: "ec20_1"}, entry)
+	if got["vowifi_active"] != false {
+		t.Fatalf("vowifi_active = %#v", got["vowifi_active"])
+	}
+	if got["local_phone"] == "+447386083638" {
+		t.Fatalf("old phone leaked into current SIM summary: %#v", got)
+	}
+	runtime, ok := got["vowifi_runtime"].(map[string]any)
+	if !ok || runtime["phase"] != "idle" || runtime["iccid"] != "89104100000028106378" {
+		t.Fatalf("runtime = %#v", got["vowifi_runtime"])
+	}
+}
+
+func TestConfiguredDeviceSummaryPrefersLiveVoWiFiStateOverStoredShutdownState(t *testing.T) {
+	database, err := store.Open(context.Background(), ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	if err := database.UpsertDevice(context.Background(), store.Device{ID: "ec20_1", Name: "EC20"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := database.UpsertVoWiFiRuntime(context.Background(), store.VoWiFiRuntime{
+		DeviceID:   "ec20_1",
+		Phase:      "idle",
+		ICCID:      "89104100000028106378",
+		LastReason: "disabled",
+		UpdatedAt:  time.Now().UTC(),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	live := vowifi.State{
+		DeviceID:    "ec20_1",
+		Phase:       vowifi.PhaseTunnelReady,
+		Enabled:     true,
+		Active:      true,
+		ICCID:       "89104100000028106378",
+		SIMReady:    true,
+		AccessReady: true,
+		TunnelReady: true,
+		LastReason:  "ipsec_tunnel_ready",
+		UpdatedAt:   time.Now().UTC(),
+	}
+	s := &Server{store: database, vowifi: &fakeVoWiFiController{state: live}}
+	entry := &device.Device{ID: "physical", Snapshot: &device.Snapshot{ICCID: live.ICCID}}
+	got := s.configuredDeviceSummary(store.Device{ID: "ec20_1", VoWiFiEnabled: true}, entry)
+	runtime, ok := got["vowifi_runtime"].(map[string]any)
+	if !ok || runtime["phase"] != string(vowifi.PhaseTunnelReady) || runtime["enabled"] != true {
+		t.Fatalf("runtime = %#v", got["vowifi_runtime"])
+	}
+	if got["vowifi_active"] != true {
+		t.Fatalf("vowifi_active = %#v", got["vowifi_active"])
+	}
+}
+
+func TestConfiguredDeviceSummaryMarksIdleRuntimeAsNotInUse(t *testing.T) {
+	database, err := store.Open(context.Background(), ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	s := &Server{
+		store: database,
+		vowifi: &fakeVoWiFiController{state: vowifi.State{
+			DeviceID:   "ec20_1",
+			Phase:      vowifi.PhaseIdle,
+			Enabled:    false,
+			LastReason: "disabled",
+			UpdatedAt:  time.Now().UTC(),
+		}},
+	}
+	got := s.configuredDeviceSummary(store.Device{ID: "ec20_1", VoWiFiEnabled: true}, nil)
+	runtime := got["vowifi_runtime"].(map[string]any)
+	if runtime["enabled"] != false || got["vowifi_active"] != false {
+		t.Fatalf("summary = %#v", got)
+	}
+}

internal/server/esim_api.go

@@ -8,6 +8,7 @@ import (
 	"time"
 
 	"vocat/internal/device"
+	"vocat/internal/store"
 )
 
 func esimUnavailable(w http.ResponseWriter) {
@@ -15,7 +16,11 @@ func esimUnavailable(w http.ResponseWriter) {
 }
 
 // handleESIM routes every /devices/{id}/esim* path.
-func (s *Server) handleESIM(w http.ResponseWriter, r *http.Request, rest []string, physicalID string, physicalPresent bool) bool {
+func (s *Server) handleESIM(w http.ResponseWriter, r *http.Request, rest []string, physicalID string, physicalPresent bool, configuredIDs ...string) bool {
+	configuredID := physicalID
+	if len(configuredIDs) > 0 && strings.TrimSpace(configuredIDs[0]) != "" {
+		configuredID = strings.TrimSpace(configuredIDs[0])
+	}
 	if len(rest) == 0 || (len(rest) == 1 && strings.TrimSpace(rest[0]) == "") {
 		if !requireMethod(w, r, http.MethodGet) {
 			return true
@@ -60,7 +65,7 @@ func (s *Server) handleESIM(w http.ResponseWriter, r *http.Request, rest []strin
 			if !requireMethod(w, r, http.MethodPost) {
 				return true
 			}
-			s.handleEsimSwitch(w, r, physicalID, physicalPresent)
+			s.handleEsimSwitch(w, r, configuredID, physicalID, physicalPresent)
 			return true
 		}
 		if len(rest) == 2 && rest[1] == "disable" {
@@ -295,8 +300,9 @@ func (s *Server) handleEsimRename(w http.ResponseWriter, r *http.Request, physic
 		return
 	}
 	var request struct {
-		Name   string `json:"name"`
-		AIDHex string `json:"aid_hex"` // accepted for the multi-eUICC SPA contract; ICCID addresses the profile
+		Name        string `json:"name"`
+		AIDHex      string `json:"aid_hex"`
+		AIDHexCamel string `json:"aidHex"`
 	}
 	if err := s.decodeJSON(w, r, &request); err != nil {
 		writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
@@ -307,7 +313,8 @@ func (s *Server) handleEsimRename(w http.ResponseWriter, r *http.Request, physic
 		writeError(w, http.StatusBadRequest, "invalid_request", "profile nickname is required")
 		return
 	}
-	if err := s.devices.ESIMRenameProfile(r.Context(), physicalID, iccid, nickname, request.AIDHex); err != nil {
+	aidHex := firstNonEmpty(request.AIDHex, request.AIDHexCamel)
+	if err := s.devices.ESIMRenameProfile(r.Context(), physicalID, iccid, nickname, aidHex); err != nil {
 		s.writeDeviceError(w, err)
 		return
 	}
@@ -316,7 +323,7 @@ func (s *Server) handleEsimRename(w http.ResponseWriter, r *http.Request, physic
 
 // handleEsimSwitch enables one already-installed profile by ICCID (切卡). The
 // eUICC EnableProfile command needs no authentication key.
-func (s *Server) handleEsimSwitch(w http.ResponseWriter, r *http.Request, physicalID string, physicalPresent bool) {
+func (s *Server) handleEsimSwitch(w http.ResponseWriter, r *http.Request, configuredID string, physicalID string, physicalPresent bool) {
 	if s.devices == nil {
 		writeError(w, http.StatusServiceUnavailable, "device_manager_unavailable", "device manager is unavailable")
 		return
@@ -326,8 +333,9 @@ func (s *Server) handleEsimSwitch(w http.ResponseWriter, r *http.Request, physic
 		return
 	}
 	var request struct {
-		ICCID  string `json:"iccid"`
-		AIDHex string `json:"aid_hex"` // accepted for contract compatibility; switching keys off iccid
+		ICCID       string `json:"iccid"`
+		AIDHex      string `json:"aid_hex"`
+		AIDHexCamel string `json:"aidHex"`
 	}
 	if err := s.decodeJSON(w, r, &request); err != nil {
 		writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
@@ -338,14 +346,56 @@ func (s *Server) handleEsimSwitch(w http.ResponseWriter, r *http.Request, physic
 		writeError(w, http.StatusBadRequest, "invalid_request", "iccid is required")
 		return
 	}
+	// Profile operations run with RF disabled. The eUICC remains accessible in
+	// CFUN=4, and the recovery path reapplies CFUN=4 as soon as the AT port comes
+	// back after the mandatory modem reset.
+	if _, err := s.devices.SetFlight(r.Context(), physicalID, true); err != nil {
+		s.writeDeviceError(w, err)
+		return
+	}
 	// A confirmed profile switch includes the EC20 reset and a live ICCID read,
 	// which normally takes longer than the server's ordinary response deadline.
 	controller := http.NewResponseController(w)
 	_ = controller.SetWriteDeadline(time.Time{})
-	if err := s.devices.ESIMSwitchProfile(r.Context(), physicalID, iccid, request.AIDHex); err != nil {
+	aidHex := firstNonEmpty(request.AIDHex, request.AIDHexCamel)
+	if err := s.devices.ESIMSwitchProfile(r.Context(), physicalID, iccid, aidHex); err != nil {
 		s.writeDeviceError(w, err)
 		return
 	}
+	if _, err := s.devices.SetFlight(r.Context(), physicalID, true); err != nil {
+		s.writeDeviceError(w, err)
+		return
+	}
+	if err := s.store.UpsertCardPolicy(r.Context(), store.CardPolicy{
+		ICCID: iccid, VoWiFiEnabled: true, AirplaneEnabled: true,
+		IPVersion: "IPV4V6", Source: "default",
+	}); err != nil {
+		s.writeStoreError(w, err)
+		return
+	}
+	config, err := s.store.Device(r.Context(), configuredID)
+	if err != nil {
+		s.writeStoreError(w, err)
+		return
+	}
+	config.VoWiFiEnabled = true
+	config.NetworkEnabled = false
+	if err := s.store.UpsertDevice(r.Context(), config); err != nil {
+		s.writeStoreError(w, err)
+		return
+	}
+	if s.vowifi != nil {
+		state, stateErr := s.vowifi.State(configuredID)
+		switch {
+		case stateErr == nil && state.Enabled:
+			_, err = s.vowifi.RequestReconnect(configuredID)
+		default:
+			_, err = s.vowifi.RequestEnabled(configuredID, true)
+		}
+		if err != nil {
+			s.logger.Warn("profile switched in safe airplane mode but VoWiFi start was not queued", "device_id", configuredID, "iccid", iccid, "error", err)
+		}
+	}
 	writeJSON(w, http.StatusOK, map[string]any{"data": map[string]any{"status": "switched", "iccid": iccid, "verified": true}})
 }
 
@@ -359,8 +409,9 @@ func (s *Server) handleEsimDisable(w http.ResponseWriter, r *http.Request, physi
 		return
 	}
 	var request struct {
-		ICCID  string `json:"iccid"`
-		AIDHex string `json:"aid_hex"` // accepted for the multi-eUICC SPA contract; disabling keys off ICCID
+		ICCID       string `json:"iccid"`
+		AIDHex      string `json:"aid_hex"`
+		AIDHexCamel string `json:"aidHex"`
 	}
 	if err := s.decodeJSON(w, r, &request); err != nil {
 		writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
@@ -371,7 +422,8 @@ func (s *Server) handleEsimDisable(w http.ResponseWriter, r *http.Request, physi
 		writeError(w, http.StatusBadRequest, "invalid_request", "iccid is required")
 		return
 	}
-	if err := s.devices.ESIMDisableProfile(r.Context(), physicalID, iccid, request.AIDHex); err != nil {
+	aidHex := firstNonEmpty(request.AIDHex, request.AIDHexCamel)
+	if err := s.devices.ESIMDisableProfile(r.Context(), physicalID, iccid, aidHex); err != nil {
 		s.writeDeviceError(w, err)
 		return
 	}

internal/server/export_proxy_api.go

@@ -0,0 +1,102 @@
+package server
+
+import (
+	"errors"
+	"net/http"
+	"strings"
+
+	"vocat/internal/exportproxy"
+)
+
+func (s *Server) routeExportProxyAPI(w http.ResponseWriter, r *http.Request, cleanPath string) bool {
+	if cleanPath != "export-proxies" && !strings.HasPrefix(cleanPath, "export-proxies/") {
+		return false
+	}
+	if !s.developerActive(r.Context()) || s.exportProxy == nil {
+		writeError(w, http.StatusForbidden, "developer_mode_required", "Export Proxy is available only in developer mode")
+		return true
+	}
+
+	segments := splitAPIPath(cleanPath)
+	if len(segments) == 1 {
+		switch r.Method {
+		case http.MethodGet:
+			configs, err := s.exportProxy.Configs()
+			if err != nil {
+				s.writeExportProxyError(w, err)
+				return true
+			}
+			writeJSON(w, http.StatusOK, map[string]any{"data": map[string]any{"configs": configs}})
+		case http.MethodPost:
+			var config exportproxy.Config
+			if err := s.decodeJSON(w, r, &config); err != nil {
+				writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
+				return true
+			}
+			created, err := s.exportProxy.Create(r.Context(), config)
+			if err != nil {
+				s.writeExportProxyError(w, err)
+				return true
+			}
+			writeJSON(w, http.StatusCreated, map[string]any{"data": created})
+		default:
+			w.Header().Set("Allow", "GET, POST")
+			writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "method not allowed")
+		}
+		return true
+	}
+
+	if len(segments) == 2 && segments[1] == "status" {
+		if !requireMethod(w, r, http.MethodGet) {
+			return true
+		}
+		statuses, err := s.exportProxy.Status()
+		if err != nil {
+			s.writeExportProxyError(w, err)
+			return true
+		}
+		writeJSON(w, http.StatusOK, map[string]any{"data": map[string]any{"configs": statuses}})
+		return true
+	}
+
+	if len(segments) != 2 || strings.TrimSpace(segments[1]) == "" {
+		writeError(w, http.StatusNotFound, "not_found", "Export Proxy endpoint not found")
+		return true
+	}
+	id := segments[1]
+	switch r.Method {
+	case http.MethodPut:
+		var config exportproxy.Config
+		if err := s.decodeJSON(w, r, &config); err != nil {
+			writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
+			return true
+		}
+		updated, err := s.exportProxy.Update(r.Context(), id, config)
+		if err != nil {
+			s.writeExportProxyError(w, err)
+			return true
+		}
+		writeJSON(w, http.StatusOK, map[string]any{"data": updated})
+	case http.MethodDelete:
+		if err := s.exportProxy.Delete(r.Context(), id); err != nil {
+			s.writeExportProxyError(w, err)
+			return true
+		}
+		writeJSON(w, http.StatusOK, map[string]any{"data": map[string]bool{"deleted": true}})
+	default:
+		w.Header().Set("Allow", "PUT, DELETE")
+		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "method not allowed")
+	}
+	return true
+}
+
+func (s *Server) writeExportProxyError(w http.ResponseWriter, err error) {
+	switch {
+	case errors.Is(err, exportproxy.ErrDisabled):
+		writeError(w, http.StatusForbidden, "developer_mode_required", "Export Proxy is disabled")
+	case errors.Is(err, exportproxy.ErrNotFound):
+		writeError(w, http.StatusNotFound, "export_proxy_not_found", err.Error())
+	default:
+		writeError(w, http.StatusBadRequest, "export_proxy_invalid", err.Error())
+	}
+}

internal/server/extensions_api.go

@@ -62,7 +62,7 @@ func (s *Server) routeExtensionAPI(w http.ResponseWriter, r *http.Request, clean
 		if !requireMethod(w, r, http.MethodPost) {
 			return true
 		}
-		r.Body = http.MaxBytesReader(w, r.Body, maxPluginUploadBytes+(1<<20))
+		r.Body = http.MaxBytesReader(nil, r.Body, maxPluginUploadBytes+(1<<20))
 		if err := r.ParseMultipartForm(maxPluginUploadBytes); err != nil {
 			writeError(w, http.StatusBadRequest, "invalid_plugin_upload", "plugin upload must be multipart/form-data and no larger than 64 MiB")
 			return true

internal/server/general_api.go

@@ -15,6 +15,7 @@ import (
 
 	"vocat/internal/auth"
 	"vocat/internal/buildinfo"
+	"vocat/internal/developer"
 	"vocat/internal/i18n"
 	"vocat/internal/loghub"
 	"vocat/internal/store"
@@ -23,9 +24,15 @@ import (
 
 func (s *Server) routeGeneralAPI(w http.ResponseWriter, r *http.Request) bool {
 	cleanPath := strings.Trim(strings.TrimPrefix(r.URL.Path, "/api"), "/")
+	if s.routeAutomaticTasksAPI(w, r, cleanPath) {
+		return true
+	}
 	if s.routeExtensionAPI(w, r, cleanPath) {
 		return true
 	}
+	if s.routeExportProxyAPI(w, r, cleanPath) {
+		return true
+	}
 	if s.routeSMSAPI(w, r, cleanPath) {
 		return true
 	}
@@ -50,6 +57,12 @@ func (s *Server) routeGeneralAPI(w http.ResponseWriter, r *http.Request) bool {
 		s.handlePasswordChange(w, r)
 	case "settings/preferences":
 		s.handleUIPreferences(w, r)
+	case "settings/https":
+		s.handleHTTPSSettings(w, r)
+	case "settings/https/certificate":
+		s.handleHTTPSCertificate(w, r)
+	case "settings/developer":
+		s.handleDeveloperSettings(w, r)
 	default:
 		return false
 	}
@@ -314,11 +327,15 @@ func (s *Server) handleSystemInfo(w http.ResponseWriter, r *http.Request) {
 			"os":           runtime.GOOS,
 			"architecture": runtime.GOARCH,
 			"uptime":       formatDuration(time.Since(s.startedAt)),
-			"developer":    s.developerEnabled,
+			"developer":    s.developerActive(r.Context()),
 		},
 	})
 }
 
+func (s *Server) developerActive(ctx context.Context) bool {
+	return s.developerEnabled && developer.Enabled(ctx, s.store)
+}
+
 func (s *Server) handleUpdateCheck(w http.ResponseWriter, r *http.Request) {
 	if !requireMethod(w, r, http.MethodGet) {
 		return

internal/server/https_settings.go

@@ -0,0 +1,64 @@
+package server
+
+import (
+	"net/http"
+	"strconv"
+)
+
+func (s *Server) handleHTTPSSettings(w http.ResponseWriter, r *http.Request) {
+	if !s.developerEnabled {
+		writeError(w, http.StatusNotFound, "not_found", "resource not found")
+		return
+	}
+	if s.https == nil {
+		writeError(w, http.StatusServiceUnavailable, "https_unavailable", "self-signed HTTPS is unavailable")
+		return
+	}
+	switch r.Method {
+	case http.MethodGet:
+		writeJSON(w, http.StatusOK, map[string]any{"data": s.https.State(r.Host)})
+	case http.MethodPut:
+		var request struct {
+			Enabled bool `json:"enabled"`
+		}
+		if err := s.decodeJSON(w, r, &request); err != nil {
+			writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
+			return
+		}
+		state, err := s.https.SetEnabled(r.Context(), request.Enabled)
+		if err != nil {
+			writeError(w, http.StatusInternalServerError, "https_update_failed", err.Error())
+			return
+		}
+		state = s.https.State(r.Host)
+		s.recordAudit(r.Context(), "admin", "settings.https.update", "settings", "https", "success", map[bool]string{true: "enabled", false: "disabled"}[request.Enabled])
+		writeJSON(w, http.StatusOK, map[string]any{"data": state})
+	default:
+		w.Header().Set("Allow", "GET, PUT")
+		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "method not allowed")
+	}
+}
+
+func (s *Server) handleHTTPSCertificate(w http.ResponseWriter, r *http.Request) {
+	if !s.developerEnabled {
+		writeError(w, http.StatusNotFound, "not_found", "resource not found")
+		return
+	}
+	if !requireMethod(w, r, http.MethodGet) {
+		return
+	}
+	if s.https == nil {
+		writeError(w, http.StatusServiceUnavailable, "https_unavailable", "self-signed HTTPS is unavailable")
+		return
+	}
+	certificate, err := s.https.CertificatePEM()
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "certificate_unavailable", err.Error())
+		return
+	}
+	w.Header().Set("Content-Type", "application/x-pem-file")
+	w.Header().Set("Content-Disposition", `attachment; filename="vocat-selfsigned.crt"`)
+	w.Header().Set("Content-Length", strconv.Itoa(len(certificate)))
+	w.WriteHeader(http.StatusOK)
+	_, _ = w.Write(certificate)
+}

internal/server/live_net.go

@@ -0,0 +1,177 @@
+package server
+
+import (
+	"fmt"
+	"math"
+	"net"
+	"sync"
+	"time"
+)
+
+// liveNetWindow is how far back the "last minute" byte totals reach.
+const liveNetWindow = time.Minute
+
+// liveNetMaxGap bounds how far apart two samples may be before a rate computed
+// across them stops being "live". The overview SSE ticks every two seconds, so
+// a gap beyond this means the tab was closed or the device was idle; treat it
+// as a fresh baseline instead of averaging a long dead interval.
+const liveNetMaxGap = 15 * time.Second
+
+// netIfSample is one cumulative counter reading for an interface.
+type netIfSample struct {
+	at    time.Time
+	rxCum uint64
+	txCum uint64
+}
+
+// liveNetDevice holds the per-device sampling state used to derive rates and
+// trailing-window totals from cumulative interface counters.
+type liveNetDevice struct {
+	prev    netIfSample
+	hasPrev bool
+	window  []netIfSample
+}
+
+// liveNetResult is one rendered snapshot of a device's live network state.
+type liveNetResult struct {
+	ipv4     string
+	rxRate   float64 // bytes/sec over the trailing sample interval
+	txRate   float64
+	minuteRx int64 // bytes over the trailing liveNetWindow
+	minuteTx int64
+	status   string // "", "waiting_sample", or "stale"
+}
+
+// liveNetTracker derives live rates and last-minute totals from cumulative
+// /sys interface counters. It is driven on demand by the overview builders, so
+// no separate goroutine is required; the SSE overview cadence keeps it warm.
+type liveNetTracker struct {
+	mu      sync.Mutex
+	devices map[string]*liveNetDevice
+}
+
+func newLiveNetTracker() *liveNetTracker {
+	return &liveNetTracker{devices: map[string]*liveNetDevice{}}
+}
+
+// sample reads the interface's current counters and addresses and returns the
+// device's live network state. Interface addresses resolve even on the first
+// call; rates and totals need a second reading, reported as waiting_sample.
+func (t *liveNetTracker) sample(deviceID, iface string, now time.Time) liveNetResult {
+	ipv4 := netIfAddrs(iface)
+	rxCum, txCum, err := netIfCounters(iface)
+	if err != nil {
+		// The interface briefly disappears while QMI reconnects. Drop the
+		// baseline so the next good read starts fresh rather than counting the
+		// reconnect as one giant delta.
+		t.mu.Lock()
+		delete(t.devices, deviceID)
+		t.mu.Unlock()
+		return liveNetResult{ipv4: ipv4, status: "stale"}
+	}
+	rxRate, txRate, minuteRx, minuteTx, status := t.record(deviceID, rxCum, txCum, now)
+	return liveNetResult{
+		ipv4: ipv4,
+		rxRate: rxRate, txRate: txRate,
+		minuteRx: minuteRx, minuteTx: minuteTx,
+		status: status,
+	}
+}
+
+// record folds one cumulative counter reading into the device's sampling state
+// and returns the derived rates and trailing-window totals. It is pure (no
+// interface I/O) so the rate/window logic is unit-testable.
+func (t *liveNetTracker) record(deviceID string, rxCum, txCum uint64, now time.Time) (rxRate, txRate float64, minuteRx, minuteTx int64, status string) {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
+	d := t.devices[deviceID]
+	if d == nil {
+		d = &liveNetDevice{}
+		t.devices[deviceID] = d
+	}
+	current := netIfSample{at: now, rxCum: rxCum, txCum: txCum}
+
+	// First sighting, a counter reset (interface reconnected), or a gap too
+	// long to average honestly: establish a baseline and wait for the next
+	// reading before reporting a rate.
+	if !d.hasPrev || rxCum < d.prev.rxCum || txCum < d.prev.txCum || now.Sub(d.prev.at) > liveNetMaxGap {
+		d.prev = current
+		d.hasPrev = true
+		d.window = []netIfSample{current}
+		return 0, 0, 0, 0, "waiting_sample"
+	}
+
+	if elapsed := now.Sub(d.prev.at).Seconds(); elapsed > 0 {
+		rxRate = float64(rxCum-d.prev.rxCum) / elapsed
+		txRate = float64(txCum-d.prev.txCum) / elapsed
+	}
+	d.prev = current
+	d.window = append(d.window, current)
+
+	// Drop samples outside the trailing window, then measure totals against
+	// the oldest surviving reading.
+	cutoff := now.Add(-liveNetWindow)
+	kept := d.window[:0]
+	for _, s := range d.window {
+		if !s.at.Before(cutoff) {
+			kept = append(kept, s)
+		}
+	}
+	d.window = kept
+	minuteRx = int64(rxCum - d.window[0].rxCum)
+	minuteTx = int64(txCum - d.window[0].txCum)
+	return rxRate, txRate, minuteRx, minuteTx, ""
+}
+
+// netIfAddrs returns the interface's first global IPv4 address. It uses only
+// the net package, so it compiles on every platform; on hosts without the
+// interface it returns an empty string.
+func netIfAddrs(iface string) (ipv4 string) {
+	if iface == "" {
+		return ""
+	}
+	netIf, err := net.InterfaceByName(iface)
+	if err != nil {
+		return ""
+	}
+	addrs, err := netIf.Addrs()
+	if err != nil {
+		return ""
+	}
+	for _, addr := range addrs {
+		var ip net.IP
+		switch a := addr.(type) {
+		case *net.IPNet:
+			ip = a.IP
+		case *net.IPAddr:
+			ip = a.IP
+		}
+		if ip == nil || ip.IsLoopback() {
+			continue
+		}
+		if v4 := ip.To4(); v4 != nil {
+			return v4.String()
+		}
+	}
+	return ""
+}
+
+// formatLiveBytes mirrors the SPA's formatBytes so the live strings match the
+// chart's formatting: 1024-based units, rounded once the value reaches 100.
+func formatLiveBytes(value float64) string {
+	if math.IsNaN(value) || math.IsInf(value, 0) || value < 0 {
+		value = 0
+	}
+	units := []string{"B", "KB", "MB", "GB", "TB"}
+	size := value
+	unit := 0
+	for size >= 1024 && unit < len(units)-1 {
+		size /= 1024
+		unit++
+	}
+	if size >= 100 {
+		return fmt.Sprintf("%.0f %s", size, units[unit])
+	}
+	return fmt.Sprintf("%.1f %s", size, units[unit])
+}

internal/server/live_net_test.go

@@ -0,0 +1,143 @@
+package server
+
+import (
+	"testing"
+	"time"
+)
+
+// record is the pure rate/window core of the tracker; these tests drive it
+// directly with synthetic cumulative counters, no interface I/O involved.
+func TestLiveNetRecordFirstSampleWaits(t *testing.T) {
+	tracker := newLiveNetTracker()
+	now := time.Unix(1_700_000_000, 0)
+
+	_, _, _, _, status := tracker.record("dev1", 1000, 500, now)
+	if status != "waiting_sample" {
+		t.Fatalf("first sample status = %q, want waiting_sample", status)
+	}
+}
+
+func TestLiveNetRecordComputesRateAndMinute(t *testing.T) {
+	tracker := newLiveNetTracker()
+	base := time.Unix(1_700_000_000, 0)
+
+	tracker.record("dev1", 1000, 500, base)
+	rxRate, txRate, minuteRx, minuteTx, status := tracker.record("dev1", 2000, 700, base.Add(2*time.Second))
+
+	if status != "" {
+		t.Fatalf("second sample status = %q, want empty", status)
+	}
+	// 1000 rx bytes and 200 tx bytes over 2s.
+	if rxRate != 500 {
+		t.Errorf("rxRate = %v, want 500", rxRate)
+	}
+	if txRate != 100 {
+		t.Errorf("txRate = %v, want 100", txRate)
+	}
+	if minuteRx != 1000 {
+		t.Errorf("minuteRx = %v, want 1000", minuteRx)
+	}
+	if minuteTx != 200 {
+		t.Errorf("minuteTx = %v, want 200", minuteTx)
+	}
+}
+
+func TestLiveNetRecordUsesActualElapsed(t *testing.T) {
+	tracker := newLiveNetTracker()
+	base := time.Unix(1_700_000_000, 0)
+
+	tracker.record("dev1", 0, 0, base)
+	// A 4s gap (not the usual 2s tick) must divide by 4, not 2.
+	rxRate, _, _, _, status := tracker.record("dev1", 400, 0, base.Add(4*time.Second))
+	if status != "" {
+		t.Fatalf("status = %q, want empty", status)
+	}
+	if rxRate != 100 {
+		t.Errorf("rxRate = %v, want 100", rxRate)
+	}
+}
+
+func TestLiveNetRecordCounterResetRebaselines(t *testing.T) {
+	tracker := newLiveNetTracker()
+	base := time.Unix(1_700_000_000, 0)
+
+	tracker.record("dev1", 5000, 5000, base)
+	tracker.record("dev1", 6000, 6000, base.Add(2*time.Second))
+	// Counter drops (interface reconnected): must re-baseline, not go negative.
+	_, _, _, _, status := tracker.record("dev1", 100, 100, base.Add(4*time.Second))
+	if status != "waiting_sample" {
+		t.Fatalf("after reset status = %q, want waiting_sample", status)
+	}
+}
+
+func TestLiveNetRecordLongGapRebaselines(t *testing.T) {
+	tracker := newLiveNetTracker()
+	base := time.Unix(1_700_000_000, 0)
+
+	tracker.record("dev1", 1000, 1000, base)
+	// Gap beyond liveNetMaxGap (tab closed / idle): treat as fresh baseline.
+	_, _, _, _, status := tracker.record("dev1", 2000, 2000, base.Add(liveNetMaxGap+time.Second))
+	if status != "waiting_sample" {
+		t.Fatalf("after long gap status = %q, want waiting_sample", status)
+	}
+}
+
+func TestLiveNetRecordSlidesWindow(t *testing.T) {
+	tracker := newLiveNetTracker()
+	base := time.Unix(1_700_000_000, 0)
+
+	// One sample every 2s, rx climbing 100 bytes each tick (50 B/s).
+	tracker.record("dev1", 0, 0, base)
+	var minuteRx int64
+	var status string
+	for i := 1; i <= 31; i++ {
+		now := base.Add(time.Duration(2*i) * time.Second) // t=2s .. t=62s
+		_, _, minuteRx, _, status = tracker.record("dev1", uint64(100*i), 0, now)
+	}
+	if status != "" {
+		t.Fatalf("status = %q, want empty", status)
+	}
+	// At t=62s the cutoff is t=2s, so the t=0 baseline has slid out. The window
+	// now spans t=2s..t=62s = 60s and 30 ticks of 100 bytes.
+	if minuteRx != 3000 {
+		t.Errorf("minuteRx = %v, want 3000 (only trailing window)", minuteRx)
+	}
+}
+
+func TestLiveNetRecordTracksDevicesIndependently(t *testing.T) {
+	tracker := newLiveNetTracker()
+	base := time.Unix(1_700_000_000, 0)
+
+	tracker.record("a", 1000, 0, base)
+	tracker.record("b", 9000, 0, base)
+	rxRateA, _, _, _, _ := tracker.record("a", 2000, 0, base.Add(2*time.Second))
+	rxRateB, _, _, _, _ := tracker.record("b", 9100, 0, base.Add(2*time.Second))
+	if rxRateA != 500 {
+		t.Errorf("device a rxRate = %v, want 500", rxRateA)
+	}
+	if rxRateB != 50 {
+		t.Errorf("device b rxRate = %v, want 50", rxRateB)
+	}
+}
+
+func TestFormatLiveBytes(t *testing.T) {
+	cases := []struct {
+		in   float64
+		want string
+	}{
+		{0, "0.0 B"},
+		{512, "512 B"},
+		{1023, "1023 B"},
+		{1024, "1.0 KB"},
+		{1536, "1.5 KB"},
+		{100 * 1024, "100 KB"},
+		{5 * 1024 * 1024, "5.0 MB"},
+		{3 * 1024 * 1024 * 1024, "3.0 GB"},
+		{-5, "0.0 B"},
+	}
+	for _, c := range cases {
+		if got := formatLiveBytes(c.in); got != c.want {
+			t.Errorf("formatLiveBytes(%v) = %q, want %q", c.in, got, c.want)
+		}
+	}
+}

internal/server/netif_linux.go

@@ -0,0 +1,40 @@
+//go:build linux
+
+package server
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+)
+
+// netIfCounters reads the interface's cumulative rx/tx byte counters from
+// /sys/class/net. The interface briefly disappears while QMI reconnects, in
+// which case an error is returned and the caller re-baselines.
+func netIfCounters(iface string) (uint64, uint64, error) {
+	if strings.TrimSpace(iface) == "" {
+		return 0, 0, fmt.Errorf("interface name is empty")
+	}
+	read := func(counter string) (uint64, error) {
+		raw, err := os.ReadFile(filepath.Join("/sys/class/net", iface, "statistics", counter))
+		if err != nil {
+			return 0, err
+		}
+		parsed, err := strconv.ParseUint(strings.TrimSpace(string(raw)), 10, 64)
+		if err != nil {
+			return 0, fmt.Errorf("parse %s %s counter: %w", iface, counter, err)
+		}
+		return parsed, nil
+	}
+	rxBytes, err := read("rx_bytes")
+	if err != nil {
+		return 0, 0, err
+	}
+	txBytes, err := read("tx_bytes")
+	if err != nil {
+		return 0, 0, err
+	}
+	return rxBytes, txBytes, nil
+}

internal/server/netif_other.go

@@ -0,0 +1,11 @@
+//go:build !linux
+
+package server
+
+import "fmt"
+
+// netIfCounters is only meaningful on the Linux deployment target; elsewhere
+// there is no cellular /sys interface to read.
+func netIfCounters(string) (uint64, uint64, error) {
+	return 0, 0, fmt.Errorf("interface counters are only available on Linux")
+}

internal/server/proxy_api.go

@@ -26,8 +26,8 @@ func (s *Server) routeProxyAPI(w http.ResponseWriter, r *http.Request, cleanPath
 		writeJSON(w, http.StatusOK, map[string]any{"data": proxyCountries})
 	case "upstream-proxy-country-rules":
 		s.handleCountryRules(w, r)
-	case "upstream-proxy-device-bindings":
-		s.handleDeviceProxyBindings(w, r)
+	case "upstream-proxy-profile-bindings":
+		s.handleProfileProxyBindings(w, r)
 	default:
 		segments := splitAPIPath(cleanPath)
 		switch {
@@ -40,8 +40,6 @@ func (s *Server) routeProxyAPI(w http.ResponseWriter, r *http.Request, cleanPath
 			s.handleUpstreamProbe(w, r, segments[1])
 		case len(segments) == 2 && segments[0] == "upstream-proxy-country-rules":
 			s.handleCountryRule(w, r, segments[1])
-		case len(segments) == 2 && segments[0] == "upstream-proxy-device-bindings":
-			s.handleDeviceProxyBinding(w, r, segments[1])
 		default:
 			return false
 		}
@@ -114,7 +112,7 @@ func (s *Server) handleUpstreamProxy(w http.ResponseWriter, r *http.Request, id
 		}
 		for _, binding := range bindings {
 			if binding.UpstreamProxyID == id {
-				s.requestProxyRouteReconnect(binding.DeviceID)
+				s.requestProfileProxyRouteReconnect(binding.DeviceID, binding.ICCID)
 			}
 		}
 		writeJSON(w, http.StatusOK, map[string]any{"data": map[string]any{"deleted": true}})
@@ -124,36 +122,32 @@ func (s *Server) handleUpstreamProxy(w http.ResponseWriter, r *http.Request, id
 	}
 }
 
-func (s *Server) handleDeviceProxyBindings(w http.ResponseWriter, r *http.Request) {
-	if !requireMethod(w, r, http.MethodGet) {
-		return
-	}
-	values, err := s.store.ListDeviceProxyBindings(r.Context())
-	if err != nil {
-		s.writeStoreError(w, err)
-		return
-	}
-	result := make([]map[string]any, 0, len(values))
-	for _, value := range values {
-		result = append(result, deviceProxyBindingResponse(value))
-	}
-	writeJSON(w, http.StatusOK, map[string]any{"data": result})
+type profileProxyBindingPayload struct {
+	DeviceID    string `json:"device_id"`
+	ICCID       string `json:"iccid"`
+	ProfileName string `json:"profile_name"`
+	// Accepted for compatibility with the first profile-picker bundle, which
+	// sent the read-only display state together with the writable identity.
+	StateText string `json:"state_text,omitempty"`
 }
 
-func (s *Server) handleDeviceProxyBinding(w http.ResponseWriter, r *http.Request, deviceID string) {
-	deviceID = strings.TrimSpace(deviceID)
-	if !validDeviceID(deviceID) {
-		writeError(w, http.StatusBadRequest, "invalid_device_id", "device ID must use 1-64 safe characters")
-		return
-	}
-	if _, err := s.store.Device(r.Context(), deviceID); err != nil {
-		s.writeStoreError(w, err)
-		return
-	}
+func (s *Server) handleProfileProxyBindings(w http.ResponseWriter, r *http.Request) {
 	switch r.Method {
-	case http.MethodPut:
+	case http.MethodGet:
+		values, err := s.store.ListDeviceProxyBindings(r.Context())
+		if err != nil {
+			s.writeStoreError(w, err)
+			return
+		}
+		result := make([]map[string]any, 0, len(values))
+		for _, value := range values {
+			result = append(result, deviceProxyBindingResponse(value))
+		}
+		writeJSON(w, http.StatusOK, map[string]any{"data": result})
+	case http.MethodPost:
 		var request struct {
-			UpstreamProxyID string `json:"upstream_proxy_id"`
+			UpstreamProxyID string                       `json:"upstream_proxy_id"`
+			Bindings        []profileProxyBindingPayload `json:"bindings"`
 		}
 		if err := s.decodeJSON(w, r, &request); err != nil {
 			writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
@@ -166,44 +160,114 @@ func (s *Server) handleDeviceProxyBinding(w http.ResponseWriter, r *http.Request
 			return
 		}
 		if !upstream.Enabled {
-			writeError(w, http.StatusConflict, "upstream_proxy_disabled", "enable the upstream proxy before binding a device")
+			writeError(w, http.StatusConflict, "upstream_proxy_disabled", "enable the upstream proxy before binding a profile")
 			return
 		}
-		// Once bound, a device may not be silently rebinded to a different
-		// upstream proxy. Force the caller to DELETE first so the change is
-		// intentional. Re-binding the same upstream stays idempotent.
-		if existing, err := s.store.DeviceProxyBinding(r.Context(), deviceID); err == nil && existing.UpstreamProxyID != upstream.ID {
-			writeError(w, http.StatusConflict, "device_already_bound", "device is already bound to another upstream proxy; delete the binding first")
-			return
-		} else if err != nil && !errors.Is(err, store.ErrNotFound) {
-			s.writeStoreError(w, err)
+		if len(request.Bindings) == 0 || len(request.Bindings) > 200 {
+			writeError(w, http.StatusBadRequest, "invalid_bindings", "select between 1 and 200 profiles")
 			return
 		}
-		value := store.DeviceProxyBinding{DeviceID: deviceID, UpstreamProxyID: upstream.ID}
-		if err := s.store.UpsertDeviceProxyBinding(r.Context(), value); err != nil {
-			s.writeStoreError(w, err)
-			return
+		values := make([]store.DeviceProxyBinding, 0, len(request.Bindings))
+		seen := make(map[string]struct{}, len(request.Bindings))
+		for _, item := range request.Bindings {
+			deviceID := strings.TrimSpace(item.DeviceID)
+			iccid := strings.TrimSpace(item.ICCID)
+			if !validDeviceID(deviceID) {
+				writeError(w, http.StatusBadRequest, "invalid_device_id", "device ID must use 1-64 safe characters")
+				return
+			}
+			if !validProfileICCID(iccid) {
+				writeError(w, http.StatusBadRequest, "invalid_iccid", "profile ICCID must contain 18 to 22 digits")
+				return
+			}
+			if _, duplicate := seen[iccid]; duplicate {
+				writeError(w, http.StatusBadRequest, "duplicate_iccid", "the same ICCID was selected more than once")
+				return
+			}
+			seen[iccid] = struct{}{}
+			if _, err := s.store.Device(r.Context(), deviceID); err != nil {
+				s.writeStoreError(w, err)
+				return
+			}
+			if existing, err := s.store.DeviceProxyBinding(r.Context(), iccid); err == nil && existing.UpstreamProxyID != upstream.ID {
+				writeError(w, http.StatusConflict, "profile_already_bound", "this ICCID is already bound to another upstream proxy; delete that binding first")
+				return
+			} else if err != nil && !errors.Is(err, store.ErrNotFound) {
+				s.writeStoreError(w, err)
+				return
+			}
+			name := strings.TrimSpace(item.ProfileName)
+			if name == "" {
+				name = iccid
+			}
+			values = append(values, store.DeviceProxyBinding{DeviceID: deviceID, ICCID: iccid, ProfileName: name, UpstreamProxyID: upstream.ID})
 		}
-		reconnected, reconnectErr := s.requestProxyRouteReconnect(deviceID)
-		response := deviceProxyBindingResponse(value)
-		response["reconnect_requested"] = reconnected
-		if reconnectErr != nil {
-			response["reconnect_error"] = reconnectErr.Error()
+		requested := false
+		var reconnectErrors []string
+		for _, value := range values {
+			if err := s.store.UpsertDeviceProxyBinding(r.Context(), value); err != nil {
+				s.writeStoreError(w, err)
+				return
+			}
+			reconnected, reconnectErr := s.requestProfileProxyRouteReconnect(value.DeviceID, value.ICCID)
+			requested = requested || reconnected
+			if reconnectErr != nil {
+				reconnectErrors = append(reconnectErrors, reconnectErr.Error())
+			}
+		}
+		response := map[string]any{"created": len(values), "reconnect_requested": requested}
+		if len(reconnectErrors) > 0 {
+			response["reconnect_error"] = strings.Join(reconnectErrors, "; ")
 		}
 		writeJSON(w, http.StatusOK, map[string]any{"data": response})
 	case http.MethodDelete:
-		if err := s.store.DeleteDeviceProxyBinding(r.Context(), deviceID); err != nil {
-			s.writeStoreError(w, err)
+		var request struct {
+			UpstreamProxyID string   `json:"upstream_proxy_id"`
+			ICCIDs          []string `json:"iccids"`
+		}
+		if err := s.decodeJSON(w, r, &request); err != nil {
+			writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
 			return
 		}
-		reconnected, reconnectErr := s.requestProxyRouteReconnect(deviceID)
-		response := map[string]any{"deleted": true, "reconnect_requested": reconnected}
-		if reconnectErr != nil {
-			response["reconnect_error"] = reconnectErr.Error()
+		if len(request.ICCIDs) == 0 || len(request.ICCIDs) > 200 {
+			writeError(w, http.StatusBadRequest, "invalid_bindings", "select between 1 and 200 profiles")
+			return
+		}
+		requested := false
+		deleted := 0
+		var reconnectErrors []string
+		for _, rawICCID := range request.ICCIDs {
+			iccid := strings.TrimSpace(rawICCID)
+			binding, err := s.store.DeviceProxyBinding(r.Context(), iccid)
+			if errors.Is(err, store.ErrNotFound) {
+				continue
+			}
+			if err != nil {
+				s.writeStoreError(w, err)
+				return
+			}
+			if strings.TrimSpace(request.UpstreamProxyID) != "" && binding.UpstreamProxyID != strings.TrimSpace(request.UpstreamProxyID) {
+				writeError(w, http.StatusConflict, "binding_proxy_mismatch", "selected ICCID is not bound to this upstream proxy")
+				return
+			}
+			if err := s.store.DeleteDeviceProxyBinding(r.Context(), iccid); err != nil {
+				s.writeStoreError(w, err)
+				return
+			}
+			deleted++
+			reconnected, reconnectErr := s.requestProfileProxyRouteReconnect(binding.DeviceID, binding.ICCID)
+			requested = requested || reconnected
+			if reconnectErr != nil {
+				reconnectErrors = append(reconnectErrors, reconnectErr.Error())
+			}
+		}
+		response := map[string]any{"deleted": deleted, "reconnect_requested": requested}
+		if len(reconnectErrors) > 0 {
+			response["reconnect_error"] = strings.Join(reconnectErrors, "; ")
 		}
 		writeJSON(w, http.StatusOK, map[string]any{"data": response})
 	default:
-		w.Header().Set("Allow", "PUT, DELETE")
+		w.Header().Set("Allow", "GET, POST, DELETE")
 		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "method not allowed")
 	}
 }
@@ -211,7 +275,7 @@ func (s *Server) handleDeviceProxyBinding(w http.ResponseWriter, r *http.Request
 // A binding is already durable before this is called. Reconnect failures are
 // returned as advisory information: the chosen route will still be used on
 // the next VoWiFi start/reconnect.
-func (s *Server) requestProxyRouteReconnect(deviceID string) (bool, error) {
+func (s *Server) requestProfileProxyRouteReconnect(deviceID, iccid string) (bool, error) {
 	if s.vowifi == nil {
 		return false, nil
 	}
@@ -222,6 +286,10 @@ func (s *Server) requestProxyRouteReconnect(deviceID string) (bool, error) {
 	if !config.VoWiFiEnabled {
 		return false, nil
 	}
+	state, stateErr := s.vowifi.State(deviceID)
+	if stateErr != nil || strings.TrimSpace(state.ICCID) == "" || strings.TrimSpace(state.ICCID) != strings.TrimSpace(iccid) {
+		return false, nil
+	}
 	if _, err := s.vowifi.RequestReconnect(deviceID); err != nil {
 		s.logger.Warn("VoWiFi proxy route saved but immediate reconnect was not started", "device_id", deviceID, "error", err)
 		return false, err
@@ -229,6 +297,19 @@ func (s *Server) requestProxyRouteReconnect(deviceID string) (bool, error) {
 	return true, nil
 }
 
+func validProfileICCID(value string) bool {
+	value = strings.TrimSpace(value)
+	if len(value) < 18 || len(value) > 22 {
+		return false
+	}
+	for _, digit := range value {
+		if digit < '0' || digit > '9' {
+			return false
+		}
+	}
+	return true
+}
+
 func (s *Server) saveAndProbeUpstream(
 	w http.ResponseWriter,
 	r *http.Request,
@@ -258,7 +339,7 @@ func (s *Server) saveAndProbeUpstream(
 	}
 	for _, binding := range bindings {
 		if binding.UpstreamProxyID == saved.ID {
-			s.requestProxyRouteReconnect(binding.DeviceID)
+			s.requestProfileProxyRouteReconnect(binding.DeviceID, binding.ICCID)
 		}
 	}
 	probe, probeErr := localproxy.ProbeSOCKS5(
@@ -449,6 +530,8 @@ func countryRuleResponse(value store.CountryRule) map[string]any {
 func deviceProxyBindingResponse(value store.DeviceProxyBinding) map[string]any {
 	return map[string]any{
 		"device_id":         value.DeviceID,
+		"iccid":             value.ICCID,
+		"profile_name":      value.ProfileName,
 		"upstream_proxy_id": value.UpstreamProxyID,
 	}
 }

internal/server/proxy_binding_test.go

@@ -10,120 +10,86 @@ import (
 	"testing"
 
 	"vocat/internal/store"
+	"vocat/internal/vowifi"
 )
 
-func TestDeviceProxyBindingPersistsAndReconnectsEnabledVoWiFi(t *testing.T) {
+const testProfileICCID = "89441000400128014257"
+
+func newProfileBindingTestServer(t *testing.T) (*Server, *store.Store, *fakeVoWiFiController) {
+	t.Helper()
 	database, err := store.Open(context.Background(), ":memory:")
 	if err != nil {
 		t.Fatal(err)
 	}
 	t.Cleanup(func() { _ = database.Close() })
-	if err := database.UpsertDevice(context.Background(), store.Device{
-		ID: "ec20", Name: "EC20", VoWiFiEnabled: true,
-	}); err != nil {
+	if err := database.UpsertDevice(context.Background(), store.Device{ID: "ec20", Name: "EC20", VoWiFiEnabled: true}); err != nil {
 		t.Fatal(err)
 	}
-	if err := database.UpsertUpstreamProxy(context.Background(), store.UpstreamProxy{
-		ID: "route-1", Name: "Route 1", Addr: "127.0.0.1:1080", Enabled: true,
-	}); err != nil {
-		t.Fatal(err)
-	}
-	controller := &fakeVoWiFiController{}
-	server := &Server{
-		store:               database,
-		vowifi:              controller,
-		logger:              slog.New(slog.NewTextHandler(io.Discard, nil)),
-		maxRequestBodyBytes: 4096,
-	}
-
-	request := httptest.NewRequest(
-		http.MethodPut,
-		"/api/upstream-proxy-device-bindings/ec20",
-		bytes.NewBufferString(`{"upstream_proxy_id":"route-1"}`),
-	)
-	request.Header.Set("Content-Type", "application/json")
-	response := httptest.NewRecorder()
-	server.handleDeviceProxyBinding(response, request, "ec20")
-	if response.Code != http.StatusOK {
-		t.Fatalf("PUT status = %d, body = %s", response.Code, response.Body.String())
-	}
-	binding, err := database.DeviceProxyBinding(context.Background(), "ec20")
-	if err != nil || binding.UpstreamProxyID != "route-1" {
-		t.Fatalf("binding = %+v, %v", binding, err)
-	}
-	if controller.reconnects != 1 {
-		t.Fatalf("reconnects = %d, want 1", controller.reconnects)
-	}
-
-	request = httptest.NewRequest(http.MethodDelete, "/api/upstream-proxy-device-bindings/ec20", nil)
-	response = httptest.NewRecorder()
-	server.handleDeviceProxyBinding(response, request, "ec20")
-	if response.Code != http.StatusOK {
-		t.Fatalf("DELETE status = %d, body = %s", response.Code, response.Body.String())
-	}
-	if _, err := database.DeviceProxyBinding(context.Background(), "ec20"); err != store.ErrNotFound {
-		t.Fatalf("binding after delete error = %v, want ErrNotFound", err)
-	}
-	if controller.reconnects != 2 {
-		t.Fatalf("reconnects = %d, want 2", controller.reconnects)
-	}
-}
-
-func TestDeviceProxyBindingRejectsRebindToDifferentUpstream(t *testing.T) {
-	database, err := store.Open(context.Background(), ":memory:")
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = database.Close() })
-	if err := database.UpsertDevice(context.Background(), store.Device{
-		ID: "ec20", Name: "EC20", VoWiFiEnabled: true,
-	}); err != nil {
-		t.Fatal(err)
-	}
-	for _, up := range []store.UpstreamProxy{
+	for _, upstream := range []store.UpstreamProxy{
 		{ID: "route-1", Name: "Route 1", Addr: "127.0.0.1:1080", Enabled: true},
 		{ID: "route-2", Name: "Route 2", Addr: "127.0.0.1:1081", Enabled: true},
 	} {
-		if err := database.UpsertUpstreamProxy(context.Background(), up); err != nil {
+		if err := database.UpsertUpstreamProxy(context.Background(), upstream); err != nil {
 			t.Fatal(err)
 		}
 	}
-	server := &Server{
-		store:               database,
-		vowifi:              &fakeVoWiFiController{},
-		logger:              slog.New(slog.NewTextHandler(io.Discard, nil)),
-		maxRequestBodyBytes: 4096,
+	controller := &fakeVoWiFiController{state: vowifi.State{DeviceID: "ec20", ICCID: testProfileICCID, Enabled: true}}
+	return &Server{store: database, vowifi: controller, logger: slog.New(slog.NewTextHandler(io.Discard, nil)), maxRequestBodyBytes: 16 << 10}, database, controller
+}
+
+func profileBindingRequest(t *testing.T, server *Server, method, body string) *httptest.ResponseRecorder {
+	t.Helper()
+	request := httptest.NewRequest(method, "/api/upstream-proxy-profile-bindings", bytes.NewBufferString(body))
+	request.Header.Set("Content-Type", "application/json")
+	response := httptest.NewRecorder()
+	server.handleProfileProxyBindings(response, request)
+	return response
+}
+
+func TestProfileProxyBindingPersistsAndReconnectsOnlyCurrentICCID(t *testing.T) {
+	server, database, controller := newProfileBindingTestServer(t)
+	response := profileBindingRequest(t, server, http.MethodPost, `{
+		"upstream_proxy_id":"route-1",
+		"bindings":[
+			{"device_id":"ec20","iccid":"89441000400128014257","profile_name":"Vodafone UK","state_text":"Enabled"},
+			{"device_id":"ec20","iccid":"89104100000028106378","profile_name":"TIM"}
+		]
+	}`)
+	if response.Code != http.StatusOK {
+		t.Fatalf("POST status = %d, body = %s", response.Code, response.Body.String())
+	}
+	binding, err := database.DeviceProxyBinding(context.Background(), testProfileICCID)
+	if err != nil || binding.UpstreamProxyID != "route-1" || binding.ProfileName != "Vodafone UK" {
+		t.Fatalf("binding = %+v, %v", binding, err)
+	}
+	if controller.reconnects != 1 {
+		t.Fatalf("reconnects = %d, want only the current ICCID to reconnect", controller.reconnects)
 	}
 
-	// First bind to route-1 succeeds.
-	put := func(proxyID string) *httptest.ResponseRecorder {
-		req := httptest.NewRequest(
-			http.MethodPut,
-			"/api/upstream-proxy-device-bindings/ec20",
-			bytes.NewBufferString(`{"upstream_proxy_id":"`+proxyID+`"}`),
-		)
-		req.Header.Set("Content-Type", "application/json")
-		rec := httptest.NewRecorder()
-		server.handleDeviceProxyBinding(rec, req, "ec20")
-		return rec
+	response = profileBindingRequest(t, server, http.MethodDelete, `{"upstream_proxy_id":"route-1","iccids":["89441000400128014257","89104100000028106378"]}`)
+	if response.Code != http.StatusOK {
+		t.Fatalf("DELETE status = %d, body = %s", response.Code, response.Body.String())
 	}
-	if rec := put("route-1"); rec.Code != http.StatusOK {
-		t.Fatalf("initial bind status = %d, body = %s", rec.Code, rec.Body.String())
+	if _, err := database.DeviceProxyBinding(context.Background(), testProfileICCID); err != store.ErrNotFound {
+		t.Fatalf("binding after delete error = %v, want ErrNotFound", err)
 	}
-
-	// Rebind to a different upstream must be rejected with 409.
-	rec := put("route-2")
-	if rec.Code != http.StatusConflict {
-		t.Fatalf("rebind status = %d, want 409, body = %s", rec.Code, rec.Body.String())
-	}
-	binding, err := database.DeviceProxyBinding(context.Background(), "ec20")
-	if err != nil || binding.UpstreamProxyID != "route-1" {
-		t.Fatalf("binding after rejected rebind = %+v, %v (want route-1 unchanged)", binding, err)
-	}
-
-	// Re-binding the SAME upstream stays idempotent (no 409).
-	if rec := put("route-1"); rec.Code != http.StatusOK {
-		t.Fatalf("idempotent rebind status = %d, want 200, body = %s", rec.Code, rec.Body.String())
+	if controller.reconnects != 2 {
+		t.Fatalf("reconnects after delete = %d, want 2", controller.reconnects)
 	}
 }
 
+func TestProfileProxyBindingRejectsSameICCIDOnDifferentProxy(t *testing.T) {
+	server, database, _ := newProfileBindingTestServer(t)
+	first := profileBindingRequest(t, server, http.MethodPost, `{"upstream_proxy_id":"route-1","bindings":[{"device_id":"ec20","iccid":"89441000400128014257","profile_name":"Profile"}]}`)
+	if first.Code != http.StatusOK {
+		t.Fatalf("initial bind status = %d, body = %s", first.Code, first.Body.String())
+	}
+	second := profileBindingRequest(t, server, http.MethodPost, `{"upstream_proxy_id":"route-2","bindings":[{"device_id":"ec20","iccid":"89441000400128014257","profile_name":"Profile"}]}`)
+	if second.Code != http.StatusConflict {
+		t.Fatalf("rebind status = %d, want 409, body = %s", second.Code, second.Body.String())
+	}
+	binding, err := database.DeviceProxyBinding(context.Background(), testProfileICCID)
+	if err != nil || binding.UpstreamProxyID != "route-1" {
+		t.Fatalf("binding after rejected rebind = %+v, %v", binding, err)
+	}
+}

internal/server/public_ip_api.go

@@ -0,0 +1,96 @@
+package server
+
+import (
+	"context"
+	"net/http"
+	"strings"
+	"time"
+
+	"vocat/internal/exportproxy"
+	"vocat/internal/store"
+)
+
+type cachedPublicIP struct {
+	ICCID string
+	Info  exportproxy.PublicIPInfo
+}
+
+type publicIPResponse struct {
+	Detected bool `json:"detected"`
+	exportproxy.PublicIPInfo
+}
+
+func (s *Server) clearPublicIP(deviceID string) {
+	s.publicIPMu.Lock()
+	delete(s.publicIPs, strings.TrimSpace(deviceID))
+	s.publicIPMu.Unlock()
+}
+
+func (s *Server) loadPublicIP(deviceID, iccid string) (exportproxy.PublicIPInfo, bool) {
+	deviceID = strings.TrimSpace(deviceID)
+	iccid = strings.TrimSpace(iccid)
+	s.publicIPMu.RLock()
+	entry, ok := s.publicIPs[deviceID]
+	s.publicIPMu.RUnlock()
+	if !ok {
+		return exportproxy.PublicIPInfo{}, false
+	}
+	// A missing live ICCID means the modem is resetting or no card is present.
+	// A different ICCID means the SIM/eSIM profile changed. Either transition
+	// invalidates the old cellular exit immediately.
+	if iccid == "" || !strings.EqualFold(strings.TrimSpace(entry.ICCID), iccid) {
+		s.clearPublicIP(deviceID)
+		return exportproxy.PublicIPInfo{}, false
+	}
+	return entry.Info, true
+}
+
+func (s *Server) savePublicIP(deviceID, iccid string, info exportproxy.PublicIPInfo) {
+	s.publicIPMu.Lock()
+	s.publicIPs[strings.TrimSpace(deviceID)] = cachedPublicIP{
+		ICCID: strings.TrimSpace(iccid),
+		Info:  info,
+	}
+	s.publicIPMu.Unlock()
+}
+
+func (s *Server) handleCellularPublicIP(w http.ResponseWriter, r *http.Request, config store.Device, iccid string) bool {
+	if r.Method != http.MethodGet && r.Method != http.MethodPost {
+		w.Header().Set("Allow", "GET, POST")
+		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "method not allowed")
+		return true
+	}
+	if !s.developerActive(r.Context()) {
+		writeError(w, http.StatusForbidden, "developer_mode_required", "public IP detection through roaming data is available only in developer mode")
+		return true
+	}
+	w.Header().Set("Cache-Control", "no-store")
+	if r.Method == http.MethodGet {
+		info, ok := s.loadPublicIP(config.ID, iccid)
+		writeJSON(w, http.StatusOK, map[string]any{"data": publicIPResponse{Detected: ok, PublicIPInfo: info}})
+		return true
+	}
+	if !config.NetworkEnabled {
+		writeError(w, http.StatusConflict, "cellular_data_disabled", "enable roaming data before detecting its public IP")
+		return true
+	}
+	if strings.TrimSpace(iccid) == "" {
+		writeError(w, http.StatusConflict, "sim_identity_unavailable", "the modem has no current ICCID; refresh it before detecting the public IP")
+		return true
+	}
+	if strings.TrimSpace(config.Interface) == "" {
+		writeError(w, http.StatusConflict, "cellular_interface_missing", "the device has no cellular network interface")
+		return true
+	}
+	ctx, cancel := context.WithTimeout(r.Context(), 15*time.Second)
+	defer cancel()
+	info, err := exportproxy.LookupPublicIP(ctx, config.Interface)
+	if err != nil {
+		s.logger.Warn("detect roaming public IP failed", "device_id", config.ID, "interface", config.Interface, "error", err)
+		writeError(w, http.StatusBadGateway, "public_ip_lookup_failed", err.Error())
+		return true
+	}
+	s.savePublicIP(config.ID, iccid, info)
+	writeJSON(w, http.StatusOK, map[string]any{"data": publicIPResponse{Detected: true, PublicIPInfo: info}})
+	return true
+}

internal/server/public_ip_api_test.go

@@ -0,0 +1,33 @@
+package server
+
+import (
+	"testing"
+
+	"vocat/internal/exportproxy"
+)
+
+func TestPublicIPCacheFollowsCurrentICCID(t *testing.T) {
+	server := &Server{publicIPs: make(map[string]cachedPublicIP)}
+	want := exportproxy.PublicIPInfo{IP: "203.0.113.8", CountryCode: "GB"}
+	server.savePublicIP("ec20", "8944100001", want)
+
+	got, ok := server.loadPublicIP("ec20", "8944100001")
+	if !ok || got != want {
+		t.Fatalf("loadPublicIP() = (%+v, %v), want (%+v, true)", got, ok, want)
+	}
+
+	if _, ok := server.loadPublicIP("ec20", "8944100002"); ok {
+		t.Fatal("cache survived an ICCID change")
+	}
+	if _, ok := server.loadPublicIP("ec20", "8944100001"); ok {
+		t.Fatal("stale cache was not deleted after an ICCID change")
+	}
+}
+
+func TestPublicIPCacheClearsWhileModemIsResetting(t *testing.T) {
+	server := &Server{publicIPs: make(map[string]cachedPublicIP)}
+	server.savePublicIP("ec20", "8944100001", exportproxy.PublicIPInfo{IP: "203.0.113.8", CountryCode: "GB"})
+	if _, ok := server.loadPublicIP("ec20", ""); ok {
+		t.Fatal("cache survived a missing live ICCID")
+	}
+}

internal/server/region_test.go

@@ -21,6 +21,9 @@ import (
 // USSD, and USB-net results are configurable for the feature endpoint tests.
 type fakeDeviceController struct {
 	entry      device.Device
+	atResponse modem.Response
+	atErr      error
+	atHandler  func(string) (modem.Response, error)
 	scanResult device.OperatorScanResult
 	scanErr    error
 	ussdResult device.USSDResult
@@ -42,12 +45,16 @@ func (f fakeDeviceController) Get(id string) (device.Device, error) {
 func (f fakeDeviceController) Refresh(context.Context, string) (device.Snapshot, error) {
 	return device.Snapshot{}, nil
 }
-func (f fakeDeviceController) ExecuteAT(context.Context, string, string) (modem.Response, error) {
-	return modem.Response{}, nil
+
+func (f fakeDeviceController) ExecuteAT(_ context.Context, _ string, command string) (modem.Response, error) {
+	if f.atHandler != nil {
+		return f.atHandler(command)
+	}
+	return f.atResponse, f.atErr
 }
 func (f fakeDeviceController) Reboot(context.Context, string) error { return nil }
 func (f fakeDeviceController) USSD(context.Context, string, string) (device.USSDResult, error) {
-	return device.USSDResult{}, nil
+	return f.ussdResult, f.ussdErr
 }
 func (f fakeDeviceController) ContinueUSSD(context.Context, string, string) (device.USSDResult, error) {
 	return f.ussdResult, f.ussdErr
@@ -74,6 +81,10 @@ func (f fakeDeviceController) OperatorSelection(context.Context, string) (device
 func (f fakeDeviceController) SetOperatorSelection(context.Context, string, bool, string, *int) (device.OperatorSelection, error) {
 	return device.OperatorSelection{}, nil
 }
+
+func (f fakeDeviceController) ReRegisterOperator(context.Context, string) (device.OperatorSelection, error) {
+	return device.OperatorSelection{}, nil
+}
 func (f fakeDeviceController) ScanOperators(context.Context, string) (device.OperatorScanResult, error) {
 	return f.scanResult, f.scanErr
 }

internal/server/server.go

@@ -18,7 +18,9 @@ import (
 	"time"
 
 	"vocat/internal/auth"
+	"vocat/internal/exportproxy"
 	"vocat/internal/extensions"
+	"vocat/internal/httpsmode"
 	"vocat/internal/loghub"
 	"vocat/internal/store"
 	"vocat/internal/update"
@@ -42,9 +44,11 @@ type Options struct {
 	SecureCookies       bool
 	MaxRequestBodyBytes int64
 	Extensions          *extensions.Manager
+	ExportProxy         *exportproxy.Manager
 	DeveloperEnabled    bool
 	UpdateRepository    string
 	UpdateToken         string
+	HTTPS               *httpsmode.Manager
 }
 
 // Server is the single HTTP handler for the JSON API and embedded SPA.
@@ -67,6 +71,7 @@ type Server struct {
 	access              parsedAccessConfig
 	loginLimiter        *loginRateLimiter
 	extensions          *extensions.Manager
+	exportProxy         *exportproxy.Manager
 	developerEnabled    bool
 	updateRepository    string
 	updateToken         string
@@ -75,6 +80,11 @@ type Server struct {
 	updateRestart       func(*slog.Logger) error
 	updateMu            sync.Mutex
 	updateApplying      bool
+	https               *httpsmode.Manager
+	netTraffic          *liveNetTracker
+	publicIPMu          sync.RWMutex
+	publicIPs           map[string]cachedPublicIP
+	automaticTasks      *automaticTaskScheduler
 }
 
 func New(options Options) (*Server, error) {
@@ -117,9 +127,13 @@ func New(options Options) (*Server, error) {
 		websheets:           newWebsheetManager(),
 		loginLimiter:        newLoginRateLimiter(),
 		extensions:          options.Extensions,
+		exportProxy:         options.ExportProxy,
 		developerEnabled:    options.DeveloperEnabled,
 		updateRepository:    strings.TrimSpace(options.UpdateRepository),
 		updateToken:         strings.TrimSpace(options.UpdateToken),
+		https:               options.HTTPS,
+		netTraffic:          newLiveNetTracker(),
+		publicIPs:           make(map[string]cachedPublicIP),
 		updateCheck:         update.CheckLatest,
 		updateApply:         update.ApplyLatest,
 		updateRestart:       update.RestartService,
@@ -160,6 +174,10 @@ type VoWiFiCallController interface {
 	HangupCall(context.Context, string, string) error
 }
 
+type VoWiFiCallMediaController interface {
+	CallMedia(context.Context, string, string) (vowifi.CallMedia, error)
+}
+
 func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	s.handler.ServeHTTP(w, r)
 }
@@ -396,7 +414,10 @@ func (s *Server) decodeJSON(w http.ResponseWriter, r *http.Request, destination
 		}
 	}
 
-	r.Body = http.MaxBytesReader(w, r.Body, s.maxRequestBodyBytes)
+	// MaxBytesReader's ResponseWriter parameter is deprecated and unused by Go.
+	// Passing nil also makes the request body and response data flows explicitly
+	// separate for static analysis.
+	r.Body = http.MaxBytesReader(nil, r.Body, s.maxRequestBodyBytes)
 	decoder := json.NewDecoder(r.Body)
 	decoder.DisallowUnknownFields()
 	if err := decoder.Decode(destination); err != nil {
@@ -571,7 +592,7 @@ func (s *Server) securityHeaders(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("X-Content-Type-Options", "nosniff")
 		w.Header().Set("Referrer-Policy", "same-origin")
-		w.Header().Set("Permissions-Policy", "camera=(), microphone=(), geolocation=()")
+		w.Header().Set("Permissions-Policy", "camera=(), microphone=(self), geolocation=()")
 		if strings.HasPrefix(r.URL.Path, "/websheets/") || strings.HasPrefix(r.URL.Path, "/plugin-assets/") {
 			// The self-hosted E911 websheet is embedded in an iframe by the SPA, so
 			// it must be frameable same-origin. Every other route stays DENY.
@@ -593,7 +614,7 @@ func (s *Server) securityHeaders(next http.Handler) http.Handler {
 					"img-src 'self' data:; connect-src 'self'",
 			)
 		}
-		if s.secureCookies {
+		if s.secureCookies && s.https == nil {
 			w.Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
 		}
 		next.ServeHTTP(w, r)

internal/server/settings_api.go

@@ -11,6 +11,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"mime"
 	"net"
 	"net/http"
 	"net/mail"
@@ -21,6 +22,7 @@ import (
 	"sort"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
 	"vocat/internal/store"
@@ -277,7 +279,7 @@ func validateNotificationField(
 			}
 		}
 		if name == "from_address" && value != "" {
-			if _, err := mail.ParseAddress(value); err != nil {
+			if _, err := parseMailAddress(value); err != nil {
 				return fmt.Errorf("%s is not a valid email address", field)
 			}
 		}
@@ -762,13 +764,13 @@ func sendEmailNotificationTest(ctx context.Context, config map[string]any) error
 			return fmt.Errorf("%w: SMTP authentication failed", errProviderRejected)
 		}
 	}
-	from, err := mail.ParseAddress(configString(config, "from_address"))
+	from, err := parseMailAddress(configString(config, "from_address"))
 	if err != nil {
 		return fmt.Errorf("parse sender address: %w", err)
 	}
 	recipients := make([]*mail.Address, 0)
 	for _, item := range configStrings(config, "to_addresses") {
-		address, err := mail.ParseAddress(item)
+		address, err := parseMailAddress(item)
 		if err != nil {
 			return fmt.Errorf("parse recipient address: %w", err)
 		}
@@ -788,7 +790,7 @@ func sendEmailNotificationTest(ctx context.Context, config map[string]any) error
 	}
 	message := strings.Join([]string{
 		"Date: " + time.Now().UTC().Format(time.RFC1123Z),
-		"From: " + from.String(),
+		"From: " + formatMailAddress(from),
 		"To: " + joinMailAddresses(recipients),
 		"Subject: vocat notification test",
 		"MIME-Version: 1.0",
@@ -813,11 +815,35 @@ func sendEmailNotificationTest(ctx context.Context, config map[string]any) error
 func joinMailAddresses(values []*mail.Address) string {
 	result := make([]string, 0, len(values))
 	for _, value := range values {
-		result = append(result, value.String())
+		result = append(result, formatMailAddress(value))
 	}
 	return strings.Join(result, ", ")
 }
 
+func parseMailAddress(value string) (*mail.Address, error) {
+	value = strings.TrimSpace(value)
+	if value == "" || strings.ContainsAny(value, "\r\n\x00") {
+		return nil, errors.New("email address contains a prohibited control character")
+	}
+	address, err := mail.ParseAddress(value)
+	if err != nil || address.Address == "" || strings.ContainsAny(address.Address, "\r\n\x00") {
+		return nil, errors.New("invalid email address")
+	}
+	for _, character := range address.Name {
+		if character < 0x20 || character == 0x7f {
+			return nil, errors.New("email display name contains a prohibited control character")
+		}
+	}
+	return address, nil
+}
+
+func formatMailAddress(address *mail.Address) string {
+	if address.Name == "" {
+		return address.Address
+	}
+	return mime.QEncoding.Encode("UTF-8", address.Name) + " <" + address.Address + ">"
+}
+
 func restrictedHTTPClient(
 	ctx context.Context,
 	timeout time.Duration,
@@ -932,18 +958,77 @@ func dialRestricted(
 	if err != nil {
 		return nil, err
 	}
-	dialer := net.Dialer{Timeout: clampNotificationTimeout(timeout)}
-	var failures []error
-	for _, ip := range addresses {
-		connection, err := dialer.DialContext(
-			ctx,
-			network,
-			net.JoinHostPort(ip.String(), port),
-		)
-		if err == nil {
-			return connection, nil
+	perAddress := clampNotificationTimeout(timeout)
+	stagger := 300 * time.Millisecond
+	if perAddress < stagger {
+		stagger = perAddress / 2
+	}
+
+	raceContext, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	type attempt struct {
+		conn net.Conn
+		err  error
+	}
+	resultCh := make(chan attempt, len(addresses))
+	var wg sync.WaitGroup
+
+	launcher := time.NewTicker(stagger)
+	defer launcher.Stop()
+	for index, ip := range addresses {
+		if index > 0 {
+			select {
+			case <-raceContext.Done():
+				break
+			case <-launcher.C:
+			}
 		}
-		failures = append(failures, err)
+		if raceContext.Err() != nil {
+			break
+		}
+		ip := ip
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			dialer := net.Dialer{Timeout: perAddress}
+			connection, dialErr := dialer.DialContext(
+				raceContext,
+				network,
+				net.JoinHostPort(ip.String(), port),
+			)
+			if dialErr != nil {
+				resultCh <- attempt{err: dialErr}
+				return
+			}
+			if raceContext.Err() != nil {
+				connection.Close()
+				resultCh <- attempt{err: raceContext.Err()}
+				return
+			}
+			resultCh <- attempt{conn: connection}
+		}()
+	}
+	go func() {
+		wg.Wait()
+		close(resultCh)
+	}()
+
+	var failures []error
+	for result := range resultCh {
+		if result.conn != nil {
+			cancel()
+			return result.conn, nil
+		}
+		if result.err != nil && !errors.Is(result.err, context.Canceled) {
+			failures = append(failures, result.err)
+		}
+		if ctx.Err() != nil {
+			return nil, ctx.Err()
+		}
+	}
+	if len(failures) == 0 {
+		return nil, ctx.Err()
 	}
 	return nil, fmt.Errorf("dial public notification destination: %w", errors.Join(failures...))
 }
@@ -1108,11 +1193,11 @@ func (s *Server) liveCardPolicyFlags(ctx context.Context, iccid string) (vowifi,
 		if !strings.EqualFold(strings.TrimSpace(entry.Snapshot.ICCID), clean) {
 			continue
 		}
-		// VoWiFi deliberately puts the modem into RF-off mode while the SWu/IMS
-		// path owns service. That physical CFUN state is not the user's separate
-		// airplane-mode policy; exposing both toggles as enabled is contradictory
-		// and makes the UI unable to represent the active policy correctly.
-		return config.VoWiFiEnabled, entry.Snapshot.FlightMode && !config.VoWiFiEnabled, true
+		// VoWiFi is an RF-off service mode. Surface that fact explicitly: while
+		// VoWiFi is selected both switches are on, but the airplane switch is
+		// read-only in the UI. Once VoWiFi is disabled, airplane remains on until
+		// the user explicitly turns it off.
+		return config.VoWiFiEnabled, config.VoWiFiEnabled || entry.Snapshot.FlightMode, true
 	}
 	return false, false, false
 }
@@ -1133,9 +1218,11 @@ func (s *Server) handleCardPolicy(w http.ResponseWriter, r *http.Request, iccid
 		policy, err := s.store.CardPolicy(r.Context(), iccid)
 		if errors.Is(err, store.ErrNotFound) {
 			policy = store.CardPolicy{
-				ICCID:     iccid,
-				IPVersion: "IPV4V6",
-				Source:    "default",
+				ICCID:           iccid,
+				VoWiFiEnabled:   true,
+				AirplaneEnabled: true,
+				IPVersion:       "IPV4V6",
+				Source:          "default",
 			}
 		} else if err != nil {
 			s.writeStoreError(w, err)
@@ -1190,14 +1277,11 @@ func (s *Server) handleCardPolicy(w http.ResponseWriter, r *http.Request, iccid
 			)
 			return
 		}
-		if *request.VoWiFiEnabled && *request.AirplaneEnabled {
-			writeError(
-				w,
-				http.StatusBadRequest,
-				"invalid_card_policy",
-				"VoWiFi and airplane mode cannot both be enabled",
-			)
-			return
+		// VoWiFi always owns an RF-off modem. Store airplane=true even when an
+		// older client omits that implication, so disabling VoWiFi cannot expose a
+		// brief cellular attach window.
+		if *request.VoWiFiEnabled {
+			*request.AirplaneEnabled = true
 		}
 		policy := store.CardPolicy{
 			ICCID:           iccid,
@@ -1259,6 +1343,10 @@ func (s *Server) handleTrafficAnalysis(w http.ResponseWriter, r *http.Request) {
 	if !requireMethod(w, r, http.MethodGet) {
 		return
 	}
+	if !s.developerActive(r.Context()) {
+		writeError(w, http.StatusForbidden, "developer_mode_required", "traffic analysis is available only in developer mode")
+		return
+	}
 	rangeName := strings.ToLower(strings.TrimSpace(r.URL.Query().Get("range")))
 	if rangeName == "" {
 		rangeName = "day"

internal/server/settings_api_test.go

@@ -14,6 +14,7 @@ import (
 	"testing"
 	"time"
 
+	"vocat/internal/developer"
 	"vocat/internal/store"
 )
 
@@ -423,7 +424,8 @@ func TestCardPolicyDefaultValidationAndPersistence(t *testing.T) {
 	response := decodeSettingsResponse(t, recorder)
 	policy := response["data"].(map[string]any)
 	if policy["iccid"] != iccid || policy["source"] != "default" ||
-		policy["ip_version"] != "IPV4V6" {
+		policy["ip_version"] != "IPV4V6" || policy["vowifi_enabled"] != true ||
+		policy["airplane_enabled"] != true {
 		t.Fatalf("default policy = %#v", policy)
 	}
 
@@ -433,8 +435,8 @@ func TestCardPolicyDefaultValidationAndPersistence(t *testing.T) {
 		"/api/cards/"+iccid+"/policy",
 		`{"vowifi_enabled":true,"airplane_enabled":true,"apn":"ims","ip_version":"IPV4V6"}`,
 	)
-	if recorder.Code != http.StatusBadRequest {
-		t.Fatalf("conflicting policy status = %d, body = %s", recorder.Code, recorder.Body)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("RF-safe policy status = %d, body = %s", recorder.Code, recorder.Body)
 	}
 
 	recorder = test.request(
@@ -449,11 +451,11 @@ func TestCardPolicyDefaultValidationAndPersistence(t *testing.T) {
 	response = decodeSettingsResponse(t, recorder)
 	policy = response["data"].(map[string]any)
 	if policy["source"] != "manual" || policy["vowifi_enabled"] != true ||
-		policy["ip_version"] != "IPV4V6" {
+		policy["airplane_enabled"] != true || policy["ip_version"] != "IPV4V6" {
 		t.Fatalf("saved policy = %#v", policy)
 	}
 	stored, err := test.database.CardPolicy(context.Background(), iccid)
-	if err != nil || !stored.VoWiFiEnabled || stored.APN != "ims" {
+	if err != nil || !stored.VoWiFiEnabled || !stored.AirplaneEnabled || stored.APN != "ims" {
 		t.Fatalf("stored policy = %+v, %v", stored, err)
 	}
 
@@ -465,6 +467,12 @@ func TestCardPolicyDefaultValidationAndPersistence(t *testing.T) {
 
 func TestTrafficAnalysisUsesAndAggregatesStoredBuckets(t *testing.T) {
 	test := newSettingsAPITest(t)
+	test.server.developerEnabled = true
+	if err := test.database.UpsertAppSetting(context.Background(), store.AppSetting{
+		Key: developer.EnabledSettingKey, Value: json.RawMessage(`{"enabled":true}`),
+	}); err != nil {
+		t.Fatal(err)
+	}
 	period := time.Now().UTC().Add(-time.Hour).Truncate(time.Minute)
 	for _, bucket := range []store.TrafficBucket{
 		{
@@ -517,6 +525,14 @@ func TestTrafficAnalysisUsesAndAggregatesStoredBuckets(t *testing.T) {
 	}
 }
 
+func TestTrafficAnalysisIsUnavailableOutsideDeveloperMode(t *testing.T) {
+	test := newSettingsAPITest(t)
+	recorder := test.request(t, http.MethodGet, "/api/traffic/analysis?range=week", "")
+	if recorder.Code != http.StatusForbidden {
+		t.Fatalf("traffic status = %d, want %d; body = %s", recorder.Code, http.StatusForbidden, recorder.Body)
+	}
+}
+
 func TestNotificationDestinationAddressPolicy(t *testing.T) {
 	blocked := []string{
 		"0.0.0.0", "10.0.0.1", "100.100.100.200", "127.0.0.1",
@@ -567,3 +583,23 @@ func TestRouteSettingsAPIReturnsFalseForUnknownPath(t *testing.T) {
 		t.Fatal("unknown path was claimed by settings router")
 	}
 }
+
+func TestParseMailAddressRejectsHeaderInjection(t *testing.T) {
+	for _, value := range []string{
+		"[email protected]\r\nBcc: [email protected]",
+		"[email protected]\nX-Test: injected",
+		"display\x00name <[email protected]>",
+	} {
+		if _, err := parseMailAddress(value); err == nil {
+			t.Errorf("parseMailAddress(%q) accepted header injection", value)
+		}
+	}
+	address, err := parseMailAddress("Vocat Alerts <[email protected]>")
+	if err != nil {
+		t.Fatal(err)
+	}
+	header := formatMailAddress(address)
+	if strings.ContainsAny(header, "\r\n") {
+		t.Fatalf("formatted address contains a line break: %q", header)
+	}
+}

internal/server/sms_api.go

@@ -12,6 +12,7 @@ import (
 	"strings"
 	"time"
 
+	"vocat/internal/developer"
 	"vocat/internal/device"
 	"vocat/internal/store"
 	"vocat/internal/vowifi"
@@ -224,6 +225,12 @@ func (s *Server) handleSMSSend(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, "blocked_destination", reason)
 		return
 	}
+	// Validate the logical message before consuming a global send slot. Both
+	// cellular AT and VoWiFi IMS use this same encoder/validator.
+	if _, err := device.PrepareSMSSubmitTPDUs(request.Phone, request.Message); err != nil {
+		s.writeDeviceError(w, err)
+		return
+	}
 	config, err := s.store.Device(r.Context(), request.DeviceID)
 	if err != nil {
 		s.writeStoreError(w, err)
@@ -233,6 +240,33 @@ func (s *Server) handleSMSSend(w http.ResponseWriter, r *http.Request) {
 	if !s.requirePhysicalDevice(w, present) {
 		return
 	}
+	limit := developer.SMSHourlyLimit(r.Context(), s.store)
+	reservation, err := s.store.ReserveSMSSend(r.Context(), request.DeviceID, limit, time.Now().UTC())
+	if err != nil {
+		s.writeStoreError(w, err)
+		return
+	}
+	if !reservation.Allowed {
+		retryAfter := time.Until(reservation.ResetAt)
+		if retryAfter < time.Second {
+			retryAfter = time.Second
+		}
+		w.Header().Set("Retry-After", strconv.FormatInt(int64((retryAfter+time.Second-1)/time.Second), 10))
+		writeJSON(w, http.StatusTooManyRequests, map[string]any{
+			"error": apiError{
+				Code:    "sms_rate_limited",
+				Message: fmt.Sprintf("Global SMS limit reached: at most %d messages may be submitted in a rolling one-hour window.", reservation.Limit),
+			},
+			"data": map[string]any{
+				"limit":       reservation.Limit,
+				"used":        reservation.Used,
+				"remaining":   reservation.Remaining,
+				"reset_at":    reservation.ResetAt,
+				"retry_after": int64((retryAfter + time.Second - 1) / time.Second),
+			},
+		})
+		return
+	}
 	if config.VoWiFiEnabled && s.vowifi != nil {
 		state, stateErr := s.vowifi.State(request.DeviceID)
 		sender, canSendIMS := s.vowifi.(imsSMSController)
@@ -581,6 +615,15 @@ func (s *Server) syncModemSMS(ctx context.Context, onlyDevice string) {
 				message.Index,
 				hex.EncodeToString(digest[:8]),
 			)
+			if message.Concat != nil && message.Concat.Total > 1 {
+				// A segment of a carrier-split long SMS. Address the whole message
+				// with a stable id so SaveSMSMessage folds every segment into one
+				// progressively merged row instead of one row per segment.
+				messageID = store.StableConcatMessageID(
+					"cellular_at", modemIMEI, config.ID, peer,
+					message.Concat.Reference, message.Concat.Total,
+				)
+			}
 			extra, _ := json.Marshal(map[string]any{
 				"modem_index":        message.Index,
 				"storage":            message.Storage,

internal/server/sms_api_test.go

@@ -5,9 +5,12 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 	"time"
 
+	"vocat/internal/developer"
+	"vocat/internal/device"
 	"vocat/internal/store"
 )
 
@@ -155,3 +158,52 @@ func TestBlockedSMSDestination(t *testing.T) {
 		})
 	}
 }
+
+func TestHandleSMSSendEnforcesGlobalHourlyLimit(t *testing.T) {
+	ctx := context.Background()
+	database, err := store.Open(ctx, ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	if err := developer.SetSMSHourlyLimit(ctx, database, 1); err != nil {
+		t.Fatal(err)
+	}
+	if err := database.UpsertDevice(ctx, store.Device{ID: "ec20_1", Name: "EC20"}); err != nil {
+		t.Fatal(err)
+	}
+	if reservation, err := database.ReserveSMSSend(ctx, "another-device", 1, time.Now().UTC()); err != nil || !reservation.Allowed {
+		t.Fatalf("seed global SMS reservation = %+v, %v", reservation, err)
+	}
+	server := &Server{
+		store:               database,
+		logger:              regionTestLogger(),
+		maxRequestBodyBytes: 4096,
+		devices: fakeDeviceController{entry: device.Device{
+			ID:         "ec20_1",
+			Discovered: true,
+			Snapshot:   &device.Snapshot{DeviceID: "ec20_1"},
+		}},
+	}
+	request := httptest.NewRequest(
+		http.MethodPost,
+		"/api/sms/send",
+		strings.NewReader(`{"device_id":"ec20_1","phone":"+447700900123","message":"hello"}`),
+	)
+	request.Header.Set("Content-Type", "application/json")
+	response := httptest.NewRecorder()
+	server.handleSMSSend(response, request)
+	if response.Code != http.StatusTooManyRequests {
+		t.Fatalf("status = %d, want 429; body=%s", response.Code, response.Body.String())
+	}
+	if response.Header().Get("Retry-After") == "" {
+		t.Fatal("Retry-After header is missing")
+	}
+	var envelope errorEnvelope
+	if err := json.Unmarshal(response.Body.Bytes(), &envelope); err != nil {
+		t.Fatal(err)
+	}
+	if envelope.Error.Code != "sms_rate_limited" {
+		t.Fatalf("error code = %q, want sms_rate_limited", envelope.Error.Code)
+	}
+}

internal/server/sms_notifications.go

@@ -402,13 +402,13 @@ func sendEmailSMSNotification(ctx context.Context, config map[string]any, messag
 			return fmt.Errorf("%w: SMTP authentication failed", errProviderRejected)
 		}
 	}
-	from, err := mail.ParseAddress(configString(config, "from_address"))
+	from, err := parseMailAddress(configString(config, "from_address"))
 	if err != nil {
 		return fmt.Errorf("parse sender address: %w", err)
 	}
 	recipients := make([]*mail.Address, 0)
 	for _, item := range configStrings(config, "to_addresses") {
-		address, err := mail.ParseAddress(item)
+		address, err := parseMailAddress(item)
 		if err != nil {
 			return fmt.Errorf("parse recipient address: %w", err)
 		}
@@ -428,7 +428,7 @@ func sendEmailSMSNotification(ctx context.Context, config map[string]any, messag
 	}
 	email := strings.Join([]string{
 		"Date: " + time.Now().UTC().Format(time.RFC1123Z),
-		"From: " + from.String(),
+		"From: " + formatMailAddress(from),
 		"To: " + joinMailAddresses(recipients),
 		"Subject: " + mime.QEncoding.Encode("UTF-8", "收到新短信 - "+message.DeviceLabel),
 		"MIME-Version: 1.0",

internal/server/telegram_bot_test.go

@@ -1,11 +1,16 @@
 package server
 
 import (
+	"context"
+	"errors"
 	"strings"
 	"testing"
 	"time"
 
+	"vocat/internal/device"
 	"vocat/internal/modem"
+	"vocat/internal/store"
+	"vocat/internal/vowifi"
 )
 
 func TestTelegramAPIURLSupportsBaseAndTemplate(t *testing.T) {
@@ -82,6 +87,59 @@ func TestValidTelegramDialNumber(t *testing.T) {
 	}
 }
 
+func TestResolveTelegramPhoneNumberPrefersCurrentSIMAssociation(t *testing.T) {
+	snapshot := &device.Snapshot{
+		ICCID: "89441000400128013903",
+		Phone: device.PhoneNumber{Number: "00000000000"},
+	}
+	state := &vowifi.State{
+		ICCID:       snapshot.ICCID,
+		PhoneNumber: "+447386125520",
+	}
+	if got := resolveTelegramPhoneNumber("+447700900123", state, snapshot); got != "+447700900123" {
+		t.Fatalf("resolved association number = %q", got)
+	}
+	if got := resolveTelegramPhoneNumber("", state, snapshot); got != "+447386125520" {
+		t.Fatalf("resolved IMS number = %q", got)
+	}
+}
+
+func TestResolveTelegramPhoneNumberRejectsPlaceholderAndStaleRuntime(t *testing.T) {
+	snapshot := &device.Snapshot{
+		ICCID: "current-card",
+		Phone: device.PhoneNumber{Number: "00000000000"},
+	}
+	state := &vowifi.State{
+		ICCID:       "previous-card",
+		PhoneNumber: "+447386083638",
+	}
+	if got := resolveTelegramPhoneNumber("", state, snapshot); got != "--" {
+		t.Fatalf("stale or placeholder number leaked as %q", got)
+	}
+	for _, placeholder := range []string{"00000000000", "1111111111", "+0000000000", "not-a-number"} {
+		if usableTelegramPhoneNumber(placeholder) {
+			t.Errorf("placeholder %q was accepted", placeholder)
+		}
+	}
+}
+
+func TestTelegramCarrierPresentationSeparatesHomeAndServingNetworks(t *testing.T) {
+	if got := telegramHomeCarrier("234336570710174"); !strings.Contains(got, "🇬🇧") || !strings.Contains(got, "23433") {
+		t.Fatalf("home carrier = %q", got)
+	}
+	if got := telegramHomeCarrier("204040123456789", "Lebara"); !strings.Contains(got, "Lebara") || !strings.Contains(got, "20404") || !strings.Contains(got, "🇬🇧") || strings.Contains(got, "🇳🇱") {
+		t.Fatalf("branded foreign-core carrier = %q", got)
+	}
+	flight := &device.Snapshot{FlightMode: true, OperatorName: "stale network", RegistrationStatus: 1}
+	if got := telegramCurrentNetwork(flight); got != "--（飞行模式）" {
+		t.Fatalf("flight-mode serving network = %q", got)
+	}
+	serving := &device.Snapshot{OperatorCode: "46001", RegistrationStatus: 5, AccessTech: "LTE", Band: "B3"}
+	if got := telegramCurrentNetwork(serving); !strings.Contains(got, "🇨🇳") || !strings.Contains(got, "已驻网（漫游）") {
+		t.Fatalf("serving network = %q", got)
+	}
+}
+
 func TestTelegramPendingActionIsAuthorizedOneShot(t *testing.T) {
 	bot := &telegramBot{pending: make(map[string]telegramPendingAction)}
 	action := telegramPendingAction{Kind: "call", ChatID: -1001, AdminID: 42, CreatedAt: time.Now()}
@@ -97,6 +155,61 @@ func TestTelegramPendingActionIsAuthorizedOneShot(t *testing.T) {
 	}
 }
 
+func TestTelegramMenuCallbackParsing(t *testing.T) {
+	prefix, token, operation, ok := parseTelegramMenuCallback("call:0123456789abcdef:answer")
+	if !ok || prefix != "call" || token != "0123456789abcdef" || operation != "answer" {
+		t.Fatalf("parsed callback = %q %q %q %t", prefix, token, operation, ok)
+	}
+	for _, invalid := range []string{"", "call:token", "unknown:token:op", "d::status"} {
+		if _, _, _, ok := parseTelegramMenuCallback(invalid); ok {
+			t.Fatalf("invalid callback %q was accepted", invalid)
+		}
+	}
+}
+
+func TestTelegramMenuPendingCanBeReusedButConfirmationCannot(t *testing.T) {
+	bot := &telegramBot{pending: make(map[string]telegramPendingAction)}
+	menuToken, err := bot.putPending(telegramPendingAction{
+		Kind: "menu_device", DeviceID: "EC20", ChatID: 1, AdminID: 2, CreatedAt: time.Now(),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := bot.getPending(menuToken, 1, 2); !ok {
+		t.Fatal("first menu lookup failed")
+	}
+	if _, ok := bot.getPending(menuToken, 1, 2); !ok {
+		t.Fatal("menu token was unexpectedly consumed")
+	}
+	confirmToken, err := bot.putPending(telegramPendingAction{
+		Kind: "sms", ChatID: 1, AdminID: 2, CreatedAt: time.Now(),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := bot.takePending(confirmToken, 1, 2); !ok {
+		t.Fatal("confirmation token lookup failed")
+	}
+	if _, ok := bot.takePending(confirmToken, 1, 2); ok {
+		t.Fatal("confirmation token was reusable")
+	}
+}
+
+func TestTelegramInputStateIsScopedAndCancelable(t *testing.T) {
+	bot := &telegramBot{inputs: make(map[string]telegramInputState)}
+	bot.setInput(telegramInputState{Kind: "sms_phone", DeviceID: "EC20", ChatID: 10, AdminID: 20})
+	if state, ok := bot.input(10, 20); !ok || state.DeviceID != "EC20" || state.Kind != "sms_phone" {
+		t.Fatalf("input state = %#v, %t", state, ok)
+	}
+	if _, ok := bot.input(10, 21); ok {
+		t.Fatal("another administrator read the input state")
+	}
+	bot.clearInput(10, 20)
+	if _, ok := bot.input(10, 20); ok {
+		t.Fatal("cleared input state remained available")
+	}
+}
+
 func TestFormatTelegramATIncludesFinalResult(t *testing.T) {
 	if got := formatTelegramAT(modem.Response{Final: "OK"}); got != "OK" {
 		t.Fatalf("formatTelegramAT(OK) = %q", got)
@@ -105,3 +218,217 @@ func TestFormatTelegramATIncludesFinalResult(t *testing.T) {
 		t.Fatalf("formatTelegramAT(lines) = %q", got)
 	}
 }
+
+func TestTelegramExecutesGuardedATForConfiguredDevice(t *testing.T) {
+	database, err := store.Open(context.Background(), ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	if err := database.UpsertDevice(context.Background(), store.Device{ID: "EC20", Name: "EC20"}); err != nil {
+		t.Fatal(err)
+	}
+	bot := &telegramBot{server: &Server{
+		store: database,
+		devices: fakeDeviceController{
+			entry:      device.Device{ID: "EC20", Discovered: true},
+			atResponse: modem.Response{Lines: []string{"+CSQ: 18,99"}, Final: "OK"},
+		},
+	}}
+	result, err := bot.executeATCommand(context.Background(), "EC20", "AT+CSQ")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, expected := range []string{"设备：EC20", "> AT+CSQ", "+CSQ: 18,99", "OK"} {
+		if !strings.Contains(result, expected) {
+			t.Fatalf("AT result %q does not contain %q", result, expected)
+		}
+	}
+	if _, err := bot.executeATCommand(context.Background(), "EC20", "AT+CFUN=0"); err == nil {
+		t.Fatal("guarded AT command unexpectedly succeeded")
+	}
+}
+
+func TestTelegramExecutesInteractiveUSSDForConfiguredDevice(t *testing.T) {
+	database, err := store.Open(context.Background(), ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	if err := database.UpsertDevice(context.Background(), store.Device{ID: "EC20", Name: "EC20"}); err != nil {
+		t.Fatal(err)
+	}
+	bot := &telegramBot{server: &Server{
+		store: database,
+		devices: fakeDeviceController{
+			entry: device.Device{ID: "EC20", Discovered: true},
+			ussdResult: device.USSDResult{
+				Code: "*100#", Text: "1. Balance\n2. Bundles", Status: "awaiting_input",
+				SessionID: "0123456789abcdef", Continueable: true,
+			},
+		},
+	}}
+	result, err := bot.executeUSSDCommand(context.Background(), "EC20", "*100#")
+	if err != nil {
+		t.Fatal(err)
+	}
+	formatted := formatTelegramUSSD("EC20", result)
+	for _, expected := range []string{
+		"设备：EC20", "状态：awaiting_input", "1. Balance", "请直接发送回复内容",
+	} {
+		if !strings.Contains(formatted, expected) {
+			t.Fatalf("USSD result %q does not contain %q", formatted, expected)
+		}
+	}
+}
+
+func TestTelegramErrorsRedactBotTokens(t *testing.T) {
+	token := "1234567890:abcdefghijklmnopqrstuvwxyzABCDE"
+	err := errors.New(`Post "https://api.telegram.org/bot` + token + `/getUpdates": context canceled`)
+	redacted := redactTelegramError(err, token)
+	if strings.Contains(redacted.Error(), token) || !strings.Contains(redacted.Error(), "bot[REDACTED]") {
+		t.Fatalf("redacted error = %q", redacted)
+	}
+}
+
+func TestTelegramCallTransportFollowsConfiguredCardMode(t *testing.T) {
+	controller := &telegramTestCallController{state: vowifi.State{IMSReady: true, Phase: vowifi.PhaseIMSReady}}
+	bot := &telegramBot{server: &Server{vowifi: controller}}
+
+	transport, gotController, err := bot.telegramCallTransport(
+		store.Device{ID: "EC20", VoWiFiEnabled: true},
+		device.Device{Snapshot: &device.Snapshot{FlightMode: true}},
+	)
+	if err != nil || transport != "vowifi" || gotController == nil {
+		t.Fatalf("VoWiFi route = %q, %#v, %v", transport, gotController, err)
+	}
+
+	transport, gotController, err = bot.telegramCallTransport(
+		store.Device{ID: "EC20", VoWiFiEnabled: false},
+		device.Device{Snapshot: &device.Snapshot{FlightMode: false}},
+	)
+	if err != nil || transport != "cellular" || gotController != nil {
+		t.Fatalf("cellular route = %q, %#v, %v", transport, gotController, err)
+	}
+}
+
+func TestTelegramCallTransportDoesNotFallBackFromUnreadyVoWiFi(t *testing.T) {
+	controller := &telegramTestCallController{state: vowifi.State{
+		Phase: vowifi.PhaseFailed, LastError: "SIP registration was rejected: SIP 403",
+	}}
+	bot := &telegramBot{server: &Server{vowifi: controller}}
+	_, _, err := bot.telegramCallTransport(
+		store.Device{ID: "EC20", VoWiFiEnabled: true},
+		device.Device{Snapshot: &device.Snapshot{FlightMode: true}},
+	)
+	if err == nil || !strings.Contains(err.Error(), "SIP 403") {
+		t.Fatalf("unready VoWiFi route error = %v", err)
+	}
+}
+
+func TestTelegramTimedVoWiFiCallUsesIMSAndHangsUpByCallID(t *testing.T) {
+	controller := &telegramTestCallController{state: vowifi.State{IMSReady: true}}
+	controller.dialResult = vowifi.Call{ID: "ims-call-1", Number: "+447700900123", Direction: "outgoing", State: "dialing"}
+	controller.calls = []vowifi.Call{{ID: "ims-call-1", Number: "+447700900123", Direction: "outgoing", State: "active"}}
+	bot := &telegramBot{server: &Server{vowifi: controller}}
+	result, err := bot.executeTimedVoWiFiCall(context.Background(), telegramRuntimeConfig{}, telegramPendingAction{
+		DeviceID: "EC20", Argument: "+447700900123", Duration: 20 * time.Millisecond,
+	}, controller)
+	if err != nil || !strings.Contains(result, "已接通") {
+		t.Fatalf("timed VoWiFi result = %q, %v", result, err)
+	}
+	if controller.dialed != "+447700900123" || len(controller.hungUp) != 1 || controller.hungUp[0] != "ims-call-1" {
+		t.Fatalf("IMS actions dial=%q hangup=%#v", controller.dialed, controller.hungUp)
+	}
+}
+
+func TestTelegramTimedCellularCallUsesATDCLCCAndATH(t *testing.T) {
+	commands := make([]string, 0, 3)
+	devices := fakeDeviceController{atHandler: func(command string) (modem.Response, error) {
+		commands = append(commands, command)
+		switch {
+		case strings.HasPrefix(command, "ATD"):
+			return modem.Response{Final: "OK"}, nil
+		case command == "AT+CLCC":
+			return modem.Response{Lines: []string{`+CLCC: 1,0,2,0,0,"+447700900123",145`}, Final: "OK"}, nil
+		case command == "ATH":
+			return modem.Response{Final: "OK"}, nil
+		default:
+			return modem.Response{}, errors.New("unexpected command")
+		}
+	}}
+	bot := &telegramBot{server: &Server{devices: devices}}
+	result, err := bot.executeTimedCellularCall(context.Background(), telegramRuntimeConfig{}, telegramPendingAction{
+		DeviceID: "EC20", Argument: "+447700900123", Duration: 20 * time.Millisecond,
+	}, "physical")
+	if err != nil || !strings.Contains(result, "正在拨号") {
+		t.Fatalf("timed cellular result = %q, %v", result, err)
+	}
+	joined := strings.Join(commands, ",")
+	for _, expected := range []string{"ATD+447700900123;", "AT+CLCC", "ATH"} {
+		if !strings.Contains(joined, expected) {
+			t.Fatalf("commands %q omit %q", joined, expected)
+		}
+	}
+}
+
+func TestTelegramVoWiFiFailureIncludesSIPDiagnostic(t *testing.T) {
+	err := telegramVoWiFiCallFailure(vowifi.Call{State: "failed", SIPCode: 403, Reason: "Forbidden"})
+	if !strings.Contains(err.Error(), "SIP 403") || !strings.Contains(err.Error(), "Forbidden") {
+		t.Fatalf("VoWiFi diagnostic = %q", err)
+	}
+}
+
+func TestTelegramVoWiFi487IsReportedAsCancelledOutcome(t *testing.T) {
+	result, err := telegramVoWiFiCallOutcome("888", vowifi.Call{
+		State: "failed", SIPCode: 487, Reason: "Request Terminated",
+	})
+	if err != nil || !strings.Contains(result, "取消或终止") || !strings.Contains(result, "SIP 487") {
+		t.Fatalf("487 outcome = %q, %v", result, err)
+	}
+}
+
+type telegramTestCallController struct {
+	state      vowifi.State
+	calls      []vowifi.Call
+	dialResult vowifi.Call
+	dialErr    error
+	dialed     string
+	hungUp     []string
+}
+
+func (controller *telegramTestCallController) State(string) (vowifi.State, error) {
+	return controller.state, nil
+}
+
+func (controller *telegramTestCallController) RequestEnabled(string, bool) (vowifi.State, error) {
+	return controller.state, nil
+}
+
+func (controller *telegramTestCallController) RequestReconnect(string) (vowifi.State, error) {
+	return controller.state, nil
+}
+
+func (controller *telegramTestCallController) Calls(string) ([]vowifi.Call, error) {
+	return append([]vowifi.Call(nil), controller.calls...), nil
+}
+
+func (controller *telegramTestCallController) DialCall(_ context.Context, _ string, number string) (vowifi.Call, error) {
+	controller.dialed = number
+	return controller.dialResult, controller.dialErr
+}
+
+func (controller *telegramTestCallController) AnswerCall(_ context.Context, _ string, id string) (vowifi.Call, error) {
+	for _, call := range controller.calls {
+		if call.ID == id {
+			call.State = "active"
+			return call, nil
+		}
+	}
+	return vowifi.Call{}, errors.New("call not found")
+}
+
+func (controller *telegramTestCallController) HangupCall(_ context.Context, _ string, id string) error {
+	controller.hungUp = append(controller.hungUp, id)
+	return nil
+}

internal/store/automatic_tasks.go

@@ -0,0 +1,276 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+)
+
+const automaticTaskSelect = `
+	SELECT id, name, enabled, device_id, profile_iccid, profile_aid,
+		task_type, environment, interval_days, start_date, run_time,
+		timezone, payload_json, retry_count, notify, next_run_at, last_run_at,
+		last_status, last_error, created_at, updated_at
+	FROM automatic_tasks`
+
+func (s *Store) SaveAutomaticTask(ctx context.Context, value AutomaticTask) (AutomaticTask, error) {
+	now := time.Now().UTC()
+	if strings.TrimSpace(value.Timezone) == "" {
+		value.Timezone = time.Local.String()
+	}
+	if value.CreatedAt.IsZero() {
+		value.CreatedAt = now
+	}
+	value.UpdatedAt = now
+	if len(value.Payload) == 0 {
+		value.Payload = []byte(`{}`)
+	}
+	if value.ID == 0 {
+		result, err := s.db.ExecContext(ctx, `INSERT INTO automatic_tasks (
+			name, enabled, device_id, profile_iccid, profile_aid, task_type,
+			environment, interval_days, start_date, run_time, timezone, payload_json,
+			retry_count, notify, next_run_at, last_run_at, last_status,
+			last_error, created_at, updated_at
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+			strings.TrimSpace(value.Name), value.Enabled, strings.TrimSpace(value.DeviceID),
+			strings.TrimSpace(value.ProfileICCID), strings.TrimSpace(value.ProfileAID),
+			value.TaskType, value.Environment, value.IntervalDays, value.StartDate,
+			value.RunTime, value.Timezone, string(value.Payload), value.RetryCount, value.Notify,
+			value.NextRunAt.Unix(), unixOrZero(value.LastRunAt), value.LastStatus,
+			value.LastError, value.CreatedAt.Unix(), value.UpdatedAt.Unix())
+		if err != nil {
+			return AutomaticTask{}, fmt.Errorf("create automatic task: %w", err)
+		}
+		value.ID, _ = result.LastInsertId()
+	} else {
+		result, err := s.db.ExecContext(ctx, `UPDATE automatic_tasks SET
+			name = ?, enabled = ?, device_id = ?, profile_iccid = ?, profile_aid = ?,
+			task_type = ?, environment = ?, interval_days = ?, start_date = ?,
+			run_time = ?, timezone = ?, payload_json = ?, retry_count = ?, notify = ?,
+			next_run_at = ?, updated_at = ? WHERE id = ?`,
+			strings.TrimSpace(value.Name), value.Enabled, strings.TrimSpace(value.DeviceID),
+			strings.TrimSpace(value.ProfileICCID), strings.TrimSpace(value.ProfileAID),
+			value.TaskType, value.Environment, value.IntervalDays, value.StartDate,
+			value.RunTime, value.Timezone, string(value.Payload), value.RetryCount, value.Notify,
+			value.NextRunAt.Unix(), value.UpdatedAt.Unix(), value.ID)
+		if err != nil {
+			return AutomaticTask{}, fmt.Errorf("update automatic task %d: %w", value.ID, err)
+		}
+		if count, _ := result.RowsAffected(); count == 0 {
+			return AutomaticTask{}, ErrNotFound
+		}
+	}
+	return s.AutomaticTask(ctx, value.ID)
+}
+
+func (s *Store) AutomaticTask(ctx context.Context, id int64) (AutomaticTask, error) {
+	return scanAutomaticTask(s.db.QueryRowContext(ctx, automaticTaskSelect+` WHERE id = ?`, id))
+}
+
+func (s *Store) ListAutomaticTasks(ctx context.Context) ([]AutomaticTask, error) {
+	rows, err := s.db.QueryContext(ctx, automaticTaskSelect+` ORDER BY created_at DESC, id DESC`)
+	if err != nil {
+		return nil, fmt.Errorf("list automatic tasks: %w", err)
+	}
+	defer rows.Close()
+	var result []AutomaticTask
+	for rows.Next() {
+		value, scanErr := scanAutomaticTask(rows)
+		if scanErr != nil {
+			return nil, scanErr
+		}
+		result = append(result, value)
+	}
+	return result, rows.Err()
+}
+
+func (s *Store) DeleteAutomaticTask(ctx context.Context, id int64) error {
+	result, err := s.db.ExecContext(ctx, `DELETE FROM automatic_tasks WHERE id = ?`, id)
+	if err != nil {
+		return fmt.Errorf("delete automatic task %d: %w", id, err)
+	}
+	if count, _ := result.RowsAffected(); count == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
+func (s *Store) ClaimDueAutomaticTasks(ctx context.Context, now time.Time, limit int) ([]AutomaticTaskRun, error) {
+	if limit <= 0 || limit > 100 {
+		limit = 50
+	}
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer tx.Rollback()
+	rows, err := tx.QueryContext(ctx, automaticTaskSelect+`
+		WHERE enabled = 1 AND next_run_at <= ? ORDER BY next_run_at, id LIMIT ?`, now.Unix(), limit)
+	if err != nil {
+		return nil, err
+	}
+	var tasks []AutomaticTask
+	for rows.Next() {
+		task, scanErr := scanAutomaticTask(rows)
+		if scanErr != nil {
+			rows.Close()
+			return nil, scanErr
+		}
+		tasks = append(tasks, task)
+	}
+	rows.Close()
+	result := make([]AutomaticTaskRun, 0, len(tasks))
+	for _, task := range tasks {
+		next := task.NextRunAt
+		location := time.Local
+		if loaded, loadErr := time.LoadLocation(task.Timezone); loadErr == nil {
+			location = loaded
+		}
+		for !next.After(now) {
+			next = next.In(location).AddDate(0, 0, task.IntervalDays).UTC()
+		}
+		if _, err = tx.ExecContext(ctx, `UPDATE automatic_tasks SET next_run_at = ?, updated_at = ? WHERE id = ?`, next.Unix(), now.Unix(), task.ID); err != nil {
+			return nil, err
+		}
+		created, createErr := tx.ExecContext(ctx, `INSERT INTO automatic_task_runs (
+			task_id, device_id, scheduled_at, status, created_at, updated_at
+		) VALUES (?, ?, ?, 'queued', ?, ?)`, task.ID, task.DeviceID, task.NextRunAt.Unix(), now.Unix(), now.Unix())
+		if createErr != nil {
+			return nil, createErr
+		}
+		runID, _ := created.LastInsertId()
+		result = append(result, AutomaticTaskRun{ID: runID, TaskID: task.ID, DeviceID: task.DeviceID, ScheduledAt: task.NextRunAt, Status: "queued", CreatedAt: now, UpdatedAt: now})
+	}
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return result, nil
+}
+
+func (s *Store) QueueAutomaticTaskNow(ctx context.Context, task AutomaticTask) (AutomaticTaskRun, error) {
+	now := time.Now().UTC()
+	result, err := s.db.ExecContext(ctx, `INSERT INTO automatic_task_runs (
+		task_id, device_id, scheduled_at, status, created_at, updated_at
+	) VALUES (?, ?, ?, 'queued', ?, ?)`, task.ID, task.DeviceID, now.Unix(), now.Unix(), now.Unix())
+	if err != nil {
+		return AutomaticTaskRun{}, fmt.Errorf("queue automatic task: %w", err)
+	}
+	id, _ := result.LastInsertId()
+	return AutomaticTaskRun{ID: id, TaskID: task.ID, DeviceID: task.DeviceID, ScheduledAt: now, Status: "queued", CreatedAt: now, UpdatedAt: now}, nil
+}
+
+func (s *Store) UpdateAutomaticTaskRun(ctx context.Context, run AutomaticTaskRun) error {
+	now := time.Now().UTC()
+	_, err := s.db.ExecContext(ctx, `UPDATE automatic_task_runs SET
+		started_at = ?, finished_at = ?, status = ?, attempts = ?, output = ?, error = ?, updated_at = ?
+		WHERE id = ?`, unixOrZero(run.StartedAt), unixOrZero(run.FinishedAt), run.Status,
+		run.Attempts, run.Output, run.Error, now.Unix(), run.ID)
+	if err != nil {
+		return fmt.Errorf("update automatic task run %d: %w", run.ID, err)
+	}
+	if run.Status == "success" || run.Status == "failed" {
+		_, err = s.db.ExecContext(ctx, `UPDATE automatic_tasks SET
+			last_run_at = ?, last_status = ?, last_error = ?, updated_at = ? WHERE id = ?`,
+			run.FinishedAt.Unix(), run.Status, run.Error, now.Unix(), run.TaskID)
+	}
+	return err
+}
+
+const automaticTaskRunSelect = `
+	SELECT id, task_id, device_id, scheduled_at, started_at, finished_at,
+		status, attempts, output, error, created_at, updated_at
+	FROM automatic_task_runs`
+
+func (s *Store) ListAutomaticTaskRuns(ctx context.Context, limit int) ([]AutomaticTaskRun, error) {
+	if limit <= 0 || limit > 500 {
+		limit = 100
+	}
+	rows, err := s.db.QueryContext(ctx, automaticTaskRunSelect+` ORDER BY id DESC LIMIT ?`, limit)
+	if err != nil {
+		return nil, err
+	}
+	return scanAutomaticTaskRuns(rows)
+}
+
+// ListAutomaticTaskRunsPaginated returns one page of runs (newest first) plus
+// the total run count, so the UI can page through the full history instead of
+// a fixed recent window.
+func (s *Store) ListAutomaticTaskRunsPaginated(ctx context.Context, limit, offset int) ([]AutomaticTaskRun, int, error) {
+	if limit <= 0 {
+		limit = 20
+	}
+	if limit > 100 {
+		limit = 100
+	}
+	if offset < 0 {
+		offset = 0
+	}
+	total := 0
+	if err := s.db.QueryRowContext(ctx, `SELECT COUNT(*) FROM automatic_task_runs`).Scan(&total); err != nil {
+		return nil, 0, fmt.Errorf("count automatic task runs: %w", err)
+	}
+	rows, err := s.db.QueryContext(ctx, automaticTaskRunSelect+` ORDER BY id DESC LIMIT ? OFFSET ?`, limit, offset)
+	if err != nil {
+		return nil, 0, err
+	}
+	runs, err := scanAutomaticTaskRuns(rows)
+	if err != nil {
+		return nil, 0, err
+	}
+	return runs, total, nil
+}
+
+func scanAutomaticTaskRuns(rows *sql.Rows) ([]AutomaticTaskRun, error) {
+	defer rows.Close()
+	var result []AutomaticTaskRun
+	for rows.Next() {
+		var value AutomaticTaskRun
+		var scheduled, started, finished, created, updated int64
+		if err := rows.Scan(&value.ID, &value.TaskID, &value.DeviceID, &scheduled, &started,
+			&finished, &value.Status, &value.Attempts, &value.Output, &value.Error, &created, &updated); err != nil {
+			return nil, err
+		}
+		value.ScheduledAt, value.StartedAt, value.FinishedAt = time.Unix(scheduled, 0).UTC(), timeFromUnix(started), timeFromUnix(finished)
+		value.CreatedAt, value.UpdatedAt = time.Unix(created, 0).UTC(), time.Unix(updated, 0).UTC()
+		result = append(result, value)
+	}
+	return result, rows.Err()
+}
+
+func scanAutomaticTask(row rowScanner) (AutomaticTask, error) {
+	var value AutomaticTask
+	var enabled, notify bool
+	var payload string
+	var nextRun, lastRun, created, updated int64
+	if err := row.Scan(&value.ID, &value.Name, &enabled, &value.DeviceID, &value.ProfileICCID,
+		&value.ProfileAID, &value.TaskType, &value.Environment, &value.IntervalDays,
+		&value.StartDate, &value.RunTime, &value.Timezone, &payload, &value.RetryCount, &notify,
+		&nextRun, &lastRun, &value.LastStatus, &value.LastError, &created, &updated); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return AutomaticTask{}, ErrNotFound
+		}
+		return AutomaticTask{}, err
+	}
+	value.Enabled, value.Notify = enabled, notify
+	value.Payload = []byte(payload)
+	value.NextRunAt, value.LastRunAt = time.Unix(nextRun, 0).UTC(), timeFromUnix(lastRun)
+	value.CreatedAt, value.UpdatedAt = time.Unix(created, 0).UTC(), time.Unix(updated, 0).UTC()
+	return value, nil
+}
+
+func unixOrZero(value time.Time) int64 {
+	if value.IsZero() {
+		return 0
+	}
+	return value.Unix()
+}
+
+func timeFromUnix(value int64) time.Time {
+	if value <= 0 {
+		return time.Time{}
+	}
+	return time.Unix(value, 0).UTC()
+}

internal/store/automatic_tasks_test.go

@@ -0,0 +1,120 @@
+package store
+
+import (
+	"context"
+	"encoding/json"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+func TestAutomaticTasksAreClaimedInDeviceQueueOrderAndAdvanceSchedule(t *testing.T) {
+	ctx := context.Background()
+	database := openTestStore(t, filepath.Join(t.TempDir(), "automatic-tasks.db"))
+	mustSaveDevice(t, database, "ec20", "EC20")
+	now := time.Now().UTC().Truncate(time.Second)
+	for index := 0; index < 2; index++ {
+		payload, _ := json.Marshal(map[string]any{"phone": "10086", "message": "test"})
+		if _, err := database.SaveAutomaticTask(ctx, AutomaticTask{
+			Name: "task", Enabled: true, DeviceID: "ec20", ProfileICCID: "8944100000000000000",
+			TaskType: "sms", Environment: "vowifi", IntervalDays: 2,
+			StartDate: "2026-08-10", RunTime: "12:00", Timezone: "Asia/Shanghai", Payload: payload,
+			NextRunAt: now.Add(time.Duration(index-2) * time.Minute),
+		}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	runs, err := database.ClaimDueAutomaticTasks(ctx, now, 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(runs) != 2 || runs[0].DeviceID != "ec20" || runs[1].DeviceID != "ec20" || runs[0].TaskID >= runs[1].TaskID {
+		t.Fatalf("claimed runs = %+v", runs)
+	}
+	tasks, err := database.ListAutomaticTasks(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, task := range tasks {
+		if !task.NextRunAt.After(now) {
+			t.Fatalf("task %d next run was not advanced: %v", task.ID, task.NextRunAt)
+		}
+	}
+	second, err := database.ClaimDueAutomaticTasks(ctx, now, 10)
+	if err != nil || len(second) != 0 {
+		t.Fatalf("same schedule claimed twice: %+v, %v", second, err)
+	}
+}
+
+func TestDeletingAutomaticTaskRemovesRunHistory(t *testing.T) {
+	ctx := context.Background()
+	database := openTestStore(t, filepath.Join(t.TempDir(), "automatic-task-delete.db"))
+	mustSaveDevice(t, database, "ec20", "EC20")
+	task, err := database.SaveAutomaticTask(ctx, AutomaticTask{
+		Name: "task", Enabled: true, DeviceID: "ec20", ProfileICCID: "one",
+		TaskType: "call", Environment: "cellular", IntervalDays: 1,
+		StartDate: "2026-08-10", RunTime: "12:00", Timezone: "Asia/Shanghai", Payload: []byte(`{"phone":"10086","duration_seconds":10}`),
+		NextRunAt: time.Now().Add(time.Hour),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := database.QueueAutomaticTaskNow(ctx, task); err != nil {
+		t.Fatal(err)
+	}
+	if err := database.DeleteAutomaticTask(ctx, task.ID); err != nil {
+		t.Fatal(err)
+	}
+	runs, err := database.ListAutomaticTaskRuns(ctx, 10)
+	if err != nil || len(runs) != 0 {
+		t.Fatalf("orphan runs = %+v, %v", runs, err)
+	}
+}
+
+func TestListAutomaticTaskRunsPaginated(t *testing.T) {
+	ctx := context.Background()
+	database := openTestStore(t, filepath.Join(t.TempDir(), "automatic-task-runs-page.db"))
+	mustSaveDevice(t, database, "ec20", "EC20")
+	task, err := database.SaveAutomaticTask(ctx, AutomaticTask{
+		Name: "task", Enabled: true, DeviceID: "ec20", ProfileICCID: "one",
+		TaskType: "call", Environment: "cellular", IntervalDays: 1,
+		StartDate: "2026-08-10", RunTime: "12:00", Timezone: "Asia/Shanghai", Payload: []byte(`{"phone":"10086","duration_seconds":10}`),
+		NextRunAt: time.Now().Add(time.Hour),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for index := 0; index < 5; index++ {
+		if _, err := database.QueueAutomaticTaskNow(ctx, task); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	first, total, err := database.ListAutomaticTaskRunsPaginated(ctx, 2, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if total != 5 || len(first) != 2 {
+		t.Fatalf("first page: total = %d, runs = %+v", total, first)
+	}
+	if first[0].ID <= first[1].ID {
+		t.Fatalf("runs not newest-first: %+v", first)
+	}
+
+	last, total, err := database.ListAutomaticTaskRunsPaginated(ctx, 2, 4)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if total != 5 || len(last) != 1 {
+		t.Fatalf("last page: total = %d, runs = %+v", total, last)
+	}
+
+	// Out-of-range paging inputs are clamped to defaults, not errors.
+	all, total, err := database.ListAutomaticTaskRunsPaginated(ctx, 0, -5)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if total != 5 || len(all) != 5 {
+		t.Fatalf("clamped page: total = %d, runs = %+v", total, all)
+	}
+}

internal/store/devices.go

@@ -13,6 +13,27 @@ type contextExecer interface {
 	ExecContext(context.Context, string, ...any) (sql.Result, error)
 }
 
+const (
+	DeviceTypeWiFi410      = "wifi_410"
+	DeviceTypeDJI4G        = "dji_4g"
+	DeviceTypePCIeEC20EC25 = "pcie_ec20_ec25"
+)
+
+// NormalizeDeviceType returns a stable persisted device type identifier.
+// Empty values use the legacy EC20/EC25 type for backwards compatibility.
+func NormalizeDeviceType(value string) string {
+	switch strings.ToLower(strings.TrimSpace(value)) {
+	case DeviceTypeWiFi410:
+		return DeviceTypeWiFi410
+	case DeviceTypeDJI4G:
+		return DeviceTypeDJI4G
+	case "", DeviceTypePCIeEC20EC25:
+		return DeviceTypePCIeEC20EC25
+	default:
+		return ""
+	}
+}
+
 func (s *Store) UpsertDevice(ctx context.Context, value Device) error {
 	return upsertDevice(ctx, s.db, value)
 }
@@ -73,6 +94,10 @@ func upsertDevice(ctx context.Context, executor contextExecer, value Device) err
 	if value.Name == "" {
 		return errors.New("device name is required")
 	}
+	value.DeviceType = NormalizeDeviceType(value.DeviceType)
+	if value.DeviceType == "" {
+		return errors.New("unsupported device type")
+	}
 	if value.ProxyPort < 0 || value.ProxyPort > 65535 {
 		return errors.New("device proxy port must be between 0 and 65535")
 	}
@@ -133,15 +158,16 @@ func upsertDevice(ctx context.Context, executor contextExecer, value Device) err
 
 	_, err = executor.ExecContext(ctx, `
 		INSERT INTO devices (
-			id, name, interface, control_device, at_port, usb_path,
+			id, name, device_type, interface, control_device, at_port, usb_path,
 			audio_device, modem_imei, apn, proxy_port, baud_rate,
 			data_bits, stop_bits, parity, device_backend, esim_transport,
 			qmi_use_proxy, qmi_proxy_path, qmi_proxy_executable,
 			network_enabled, sms_enabled, vowifi_enabled, extra_json,
 			created_at, updated_at
-		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
 		ON CONFLICT(id) DO UPDATE SET
 			name = excluded.name,
+			device_type = excluded.device_type,
 			interface = excluded.interface,
 			control_device = excluded.control_device,
 			at_port = excluded.at_port,
@@ -165,7 +191,7 @@ func upsertDevice(ctx context.Context, executor contextExecer, value Device) err
 			extra_json = excluded.extra_json,
 			updated_at = excluded.updated_at
 	`,
-		value.ID, value.Name, value.Interface, value.ControlDevice, value.ATPort,
+		value.ID, value.Name, value.DeviceType, value.Interface, value.ControlDevice, value.ATPort,
 		value.USBPath, value.AudioDevice, value.ModemIMEI, value.APN,
 		value.ProxyPort, value.BaudRate, value.DataBits, value.StopBits,
 		value.Parity, value.DeviceBackend, value.ESIMTransport,
@@ -255,7 +281,7 @@ func (s *Store) DeleteDevice(ctx context.Context, id string) error {
 }
 
 const deviceSelect = `
-	SELECT id, name, interface, control_device, at_port, usb_path,
+	SELECT id, name, device_type, interface, control_device, at_port, usb_path,
 		audio_device, modem_imei, apn, proxy_port, baud_rate, data_bits,
 		stop_bits, parity, device_backend, esim_transport, qmi_use_proxy,
 		qmi_proxy_path, qmi_proxy_executable, network_enabled, sms_enabled,
@@ -268,7 +294,7 @@ func scanDevice(row rowScanner) (Device, error) {
 	var extra string
 	var createdAt, updatedAt int64
 	err := row.Scan(
-		&value.ID, &value.Name, &value.Interface, &value.ControlDevice,
+		&value.ID, &value.Name, &value.DeviceType, &value.Interface, &value.ControlDevice,
 		&value.ATPort, &value.USBPath, &value.AudioDevice, &value.ModemIMEI,
 		&value.APN, &value.ProxyPort, &value.BaudRate, &value.DataBits,
 		&value.StopBits, &value.Parity, &value.DeviceBackend,
@@ -286,6 +312,7 @@ func scanDevice(row rowScanner) (Device, error) {
 	value.NetworkEnabled = networkEnabled != 0
 	value.SMSEnabled = smsEnabled != 0
 	value.VoWiFiEnabled = vowifiEnabled != 0
+	value.DeviceType = NormalizeDeviceType(value.DeviceType)
 	value.Extra = []byte(extra)
 	value.CreatedAt = time.Unix(createdAt, 0).UTC()
 	value.UpdatedAt = time.Unix(updatedAt, 0).UTC()

internal/store/domain_test.go

@@ -59,6 +59,7 @@ func TestMigrationFromAuthenticationSchema(t *testing.T) {
 		"device_proxy_bindings",
 		"notification_settings", "app_settings", "audit_events",
 		"log_events", "card_policies", "traffic_buckets",
+		"sms_send_attempts",
 	} {
 		var found string
 		err := database.db.QueryRowContext(ctx, `
@@ -105,6 +106,120 @@ func TestMigration7BackfillsSMSModemIMEI(t *testing.T) {
 	}
 }
 
+func TestMigration12ConvertsOnlyKnownActiveDeviceBindingToICCID(t *testing.T) {
+	ctx := context.Background()
+	path := filepath.Join(t.TempDir(), "profile-proxy-binding.db")
+	raw, err := sql.Open("sqlite", path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for version := 1; version <= 11; version++ {
+		for _, statement := range migrationStatements(version) {
+			if _, err := raw.ExecContext(ctx, statement); err != nil {
+				t.Fatalf("create v%d schema: %v", version, err)
+			}
+		}
+	}
+	if _, err := raw.ExecContext(ctx, `
+		INSERT INTO devices (id, name, created_at, updated_at) VALUES
+			('known', 'Known', 100, 100), ('unknown', 'Unknown', 100, 100);
+		INSERT INTO upstream_proxies (id, name, addr, created_at, updated_at)
+			VALUES ('route', 'Route', '127.0.0.1:1080', 100, 100);
+		INSERT INTO device_proxy_bindings (device_id, upstream_proxy_id, created_at, updated_at) VALUES
+			('known', 'route', 100, 100), ('unknown', 'route', 100, 100);
+		INSERT INTO vowifi_runtime (device_id, iccid, updated_at)
+			VALUES ('known', '89441000400128014257', 100);
+		PRAGMA user_version = 11;
+	`); err != nil {
+		t.Fatal(err)
+	}
+	if err := raw.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	database := openTestStore(t, path)
+	binding, err := database.DeviceProxyBinding(ctx, "89441000400128014257")
+	if err != nil || binding.DeviceID != "known" || binding.UpstreamProxyID != "route" {
+		t.Fatalf("migrated binding = %+v, %v", binding, err)
+	}
+	bindings, err := database.ListDeviceProxyBindings(ctx)
+	if err != nil || len(bindings) != 1 {
+		t.Fatalf("migrated bindings = %+v, %v; unknown ICCID binding must be dropped", bindings, err)
+	}
+}
+
+func TestMigration9NormalizesVoWiFiAirplanePolicy(t *testing.T) {
+	ctx := context.Background()
+	path := filepath.Join(t.TempDir(), "rf-safe-policy.db")
+	raw, err := sql.Open("sqlite", path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for version := 1; version <= 8; version++ {
+		for _, statement := range migrationStatements(version) {
+			if _, err := raw.ExecContext(ctx, statement); err != nil {
+				t.Fatalf("create v%d schema: %v", version, err)
+			}
+		}
+	}
+	if _, err := raw.ExecContext(ctx, `
+		INSERT INTO card_policies (
+			iccid, network_enabled, vowifi_enabled, airplane_enabled,
+			created_at, updated_at
+		) VALUES ('8900000000000000001', 0, 1, 0, 100, 100);
+		PRAGMA user_version = 8;
+	`); err != nil {
+		t.Fatal(err)
+	}
+	if err := raw.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	database := openTestStore(t, path)
+	policy, err := database.CardPolicy(ctx, "8900000000000000001")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !policy.VoWiFiEnabled || !policy.AirplaneEnabled || policy.NetworkEnabled {
+		t.Fatalf("migrated policy = %#v, want VoWiFi+airplane with data off", policy)
+	}
+}
+
+func TestMigration8DefaultsExistingDevicesToPCIeType(t *testing.T) {
+	ctx := context.Background()
+	path := filepath.Join(t.TempDir(), "device-type.db")
+	raw, err := sql.Open("sqlite", path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for version := 1; version <= 7; version++ {
+		for _, statement := range migrationStatements(version) {
+			if _, err := raw.ExecContext(ctx, statement); err != nil {
+				t.Fatalf("create v%d schema: %v", version, err)
+			}
+		}
+	}
+	if _, err := raw.ExecContext(ctx, `
+		INSERT INTO devices (id, name, created_at, updated_at)
+		VALUES ('legacy', 'Legacy modem', 100, 100);
+		PRAGMA user_version = 7;
+	`); err != nil {
+		t.Fatal(err)
+	}
+	if err := raw.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	database := openTestStore(t, path)
+	got, err := database.Device(ctx, "legacy")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.DeviceType != DeviceTypePCIeEC20EC25 {
+		t.Fatalf("legacy device type = %q", got.DeviceType)
+	}
+}
+
 func TestMigration4PreservesIMSRedeliveryAndUsesReceiptTime(t *testing.T) {
 	ctx := context.Background()
 	path := filepath.Join(t.TempDir(), "ims-redelivery.db")
@@ -170,6 +285,7 @@ func TestDeviceStateRoundTripAndCascade(t *testing.T) {
 	device := Device{
 		ID:             "ec20-1",
 		Name:           "EC20 一号",
+		DeviceType:     DeviceTypeDJI4G,
 		Interface:      "wwan0",
 		ControlDevice:  "/dev/cdc-wdm0",
 		ATPort:         "/dev/ttyUSB2",
@@ -219,7 +335,7 @@ func TestDeviceStateRoundTripAndCascade(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if gotDevice.BaudRate != 115200 || gotDevice.DataBits != 8 ||
+	if gotDevice.DeviceType != DeviceTypeDJI4G || gotDevice.BaudRate != 115200 || gotDevice.DataBits != 8 ||
 		gotDevice.StopBits != 1 || gotDevice.DeviceBackend != "at" {
 		t.Fatalf("device defaults not applied: %+v", gotDevice)
 	}
@@ -530,12 +646,12 @@ func TestProxyCredentialsAndCountryRules(t *testing.T) {
 		t.Fatalf("CountryRule() = %+v, %v", rule, err)
 	}
 	if err := database.UpsertDeviceProxyBinding(ctx, DeviceProxyBinding{
-		DeviceID: "ec20-1", UpstreamProxyID: "up-1",
+		DeviceID: "ec20-1", ICCID: "89441000400128014257", ProfileName: "Vodafone", UpstreamProxyID: "up-1",
 	}); err != nil {
 		t.Fatal(err)
 	}
-	binding, err := database.DeviceProxyBinding(ctx, "ec20-1")
-	if err != nil || binding.UpstreamProxyID != "up-1" {
+	binding, err := database.DeviceProxyBinding(ctx, "89441000400128014257")
+	if err != nil || binding.UpstreamProxyID != "up-1" || binding.DeviceID != "ec20-1" || binding.ProfileName != "Vodafone" {
 		t.Fatalf("DeviceProxyBinding() = %+v, %v", binding, err)
 	}
 	if err := database.DeleteUpstreamProxy(ctx, "up-1"); err != nil {
@@ -544,7 +660,7 @@ func TestProxyCredentialsAndCountryRules(t *testing.T) {
 	if _, err := database.CountryRule(ctx, "CN"); !errors.Is(err, ErrNotFound) {
 		t.Fatalf("country rule should cascade with upstream deletion, got %v", err)
 	}
-	if _, err := database.DeviceProxyBinding(ctx, "ec20-1"); !errors.Is(err, ErrNotFound) {
+	if _, err := database.DeviceProxyBinding(ctx, "89441000400128014257"); !errors.Is(err, ErrNotFound) {
 		t.Fatalf("device binding should cascade with upstream deletion, got %v", err)
 	}
 }
@@ -673,14 +789,18 @@ func TestEventsPoliciesAndTraffic(t *testing.T) {
 		t.Fatal(err)
 	}
 	if err := database.UpsertCardPolicy(ctx, CardPolicy{
-		ICCID: "invalid", VoWiFiEnabled: true, AirplaneEnabled: true,
-	}); err == nil {
-		t.Fatal("invalid mutually exclusive card policy was accepted")
+		ICCID: "89860002", VoWiFiEnabled: true, AirplaneEnabled: true,
+	}); err != nil {
+		t.Fatalf("RF-safe VoWiFi policy was rejected: %v", err)
 	}
 	policy, err := database.CardPolicy(ctx, "89860001")
 	if err != nil || !policy.VoWiFiEnabled {
 		t.Fatalf("CardPolicy() = %+v, %v", policy, err)
 	}
+	safePolicy, err := database.CardPolicy(ctx, "89860002")
+	if err != nil || !safePolicy.VoWiFiEnabled || !safePolicy.AirplaneEnabled {
+		t.Fatalf("safe CardPolicy() = %+v, %v", safePolicy, err)
+	}
 
 	period := old.Truncate(time.Hour)
 	if err := database.UpsertTrafficBucket(ctx, TrafficBucket{

internal/store/migrations.go

@@ -106,6 +106,127 @@ func migrationStatements(version int) []string {
 			`CREATE INDEX IF NOT EXISTS sms_messages_hardware_thread_idx
 				ON sms_messages(modem_imei, imsi, peer, message_time DESC, id DESC)`,
 		}
+	case 8:
+		return []string{
+			`ALTER TABLE devices
+				ADD COLUMN device_type TEXT NOT NULL DEFAULT 'pcie_ec20_ec25'`,
+		}
+	case 9:
+		return []string{
+			// VoWiFi deliberately owns airplane mode. Earlier schemas treated
+			// these flags as mutually exclusive, which made the RF-safe state
+			// impossible to persist. Rebuild the table without changing rows.
+			`ALTER TABLE card_policies RENAME TO card_policies_v8`,
+			`CREATE TABLE card_policies (
+				iccid TEXT PRIMARY KEY,
+				network_enabled INTEGER NOT NULL DEFAULT 0 CHECK (network_enabled IN (0, 1)),
+				vowifi_enabled INTEGER NOT NULL DEFAULT 0 CHECK (vowifi_enabled IN (0, 1)),
+				airplane_enabled INTEGER NOT NULL DEFAULT 0 CHECK (airplane_enabled IN (0, 1)),
+				apn TEXT NOT NULL DEFAULT '',
+				ip_version TEXT NOT NULL DEFAULT '',
+				source TEXT NOT NULL DEFAULT '',
+				created_at INTEGER NOT NULL,
+				updated_at INTEGER NOT NULL
+			)`,
+			`INSERT INTO card_policies (
+				iccid, network_enabled, vowifi_enabled, airplane_enabled,
+				apn, ip_version, source, created_at, updated_at
+			) SELECT
+				iccid, network_enabled, vowifi_enabled, airplane_enabled,
+				apn, ip_version, source, created_at, updated_at
+			FROM card_policies_v8`,
+			`UPDATE card_policies
+			SET airplane_enabled = 1, network_enabled = 0
+			WHERE vowifi_enabled = 1`,
+			`DROP TABLE card_policies_v8`,
+		}
+	case 10:
+		return []string{
+			`CREATE TABLE IF NOT EXISTS automatic_tasks (
+				id INTEGER PRIMARY KEY AUTOINCREMENT,
+				name TEXT NOT NULL,
+				enabled INTEGER NOT NULL DEFAULT 1 CHECK (enabled IN (0, 1)),
+				device_id TEXT NOT NULL,
+				profile_iccid TEXT NOT NULL,
+				profile_aid TEXT NOT NULL DEFAULT '',
+				task_type TEXT NOT NULL CHECK (task_type IN ('sms', 'call', 'public_ip')),
+				environment TEXT NOT NULL CHECK (environment IN ('vowifi', 'cellular')),
+				interval_days INTEGER NOT NULL CHECK (interval_days BETWEEN 1 AND 365),
+				start_date TEXT NOT NULL,
+				run_time TEXT NOT NULL,
+				timezone TEXT NOT NULL DEFAULT 'Local',
+				payload_json TEXT NOT NULL DEFAULT '{}',
+				retry_count INTEGER NOT NULL DEFAULT 0 CHECK (retry_count BETWEEN 0 AND 10),
+				notify INTEGER NOT NULL DEFAULT 0 CHECK (notify IN (0, 1)),
+				next_run_at INTEGER NOT NULL,
+				last_run_at INTEGER NOT NULL DEFAULT 0,
+				last_status TEXT NOT NULL DEFAULT '',
+				last_error TEXT NOT NULL DEFAULT '',
+				created_at INTEGER NOT NULL,
+				updated_at INTEGER NOT NULL,
+				FOREIGN KEY (device_id) REFERENCES devices(id) ON DELETE CASCADE
+			)`,
+			`CREATE INDEX IF NOT EXISTS automatic_tasks_due_idx ON automatic_tasks(enabled, next_run_at, id)`,
+			`CREATE INDEX IF NOT EXISTS automatic_tasks_device_idx ON automatic_tasks(device_id, next_run_at, id)`,
+			`CREATE TABLE IF NOT EXISTS automatic_task_runs (
+				id INTEGER PRIMARY KEY AUTOINCREMENT,
+				task_id INTEGER NOT NULL,
+				device_id TEXT NOT NULL,
+				scheduled_at INTEGER NOT NULL,
+				started_at INTEGER NOT NULL DEFAULT 0,
+				finished_at INTEGER NOT NULL DEFAULT 0,
+				status TEXT NOT NULL CHECK (status IN ('queued', 'running', 'success', 'failed')),
+				attempts INTEGER NOT NULL DEFAULT 0,
+				output TEXT NOT NULL DEFAULT '',
+				error TEXT NOT NULL DEFAULT '',
+				created_at INTEGER NOT NULL,
+				updated_at INTEGER NOT NULL,
+				FOREIGN KEY (task_id) REFERENCES automatic_tasks(id) ON DELETE CASCADE
+			)`,
+			`CREATE INDEX IF NOT EXISTS automatic_task_runs_task_idx ON automatic_task_runs(task_id, id DESC)`,
+			`CREATE INDEX IF NOT EXISTS automatic_task_runs_status_idx ON automatic_task_runs(status, id)`,
+		}
+	case 11:
+		return []string{
+			`CREATE TABLE IF NOT EXISTS sms_send_attempts (
+				id INTEGER PRIMARY KEY AUTOINCREMENT,
+				device_id TEXT NOT NULL DEFAULT '',
+				created_at INTEGER NOT NULL
+			)`,
+			`CREATE INDEX IF NOT EXISTS sms_send_attempts_created_idx
+				ON sms_send_attempts(created_at, id)`,
+		}
+	case 12:
+		return []string{
+			`ALTER TABLE device_proxy_bindings RENAME TO device_proxy_bindings_v11`,
+			`CREATE TABLE device_proxy_bindings (
+				iccid TEXT PRIMARY KEY,
+				device_id TEXT NOT NULL,
+				profile_name TEXT NOT NULL DEFAULT '',
+				upstream_proxy_id TEXT NOT NULL,
+				created_at INTEGER NOT NULL,
+				updated_at INTEGER NOT NULL,
+				FOREIGN KEY (device_id) REFERENCES devices(id) ON DELETE CASCADE,
+				FOREIGN KEY (upstream_proxy_id) REFERENCES upstream_proxies(id) ON DELETE CASCADE
+			)`,
+			// A legacy device-wide binding is safe to preserve only when the
+			// currently observed ICCID is known. It then becomes one profile binding
+			// instead of leaking onto every future profile used by that device.
+			`INSERT OR IGNORE INTO device_proxy_bindings (
+				iccid, device_id, profile_name, upstream_proxy_id, created_at, updated_at
+			)
+			SELECT COALESCE(NULLIF(v.iccid, ''), NULLIF(d.iccid, '')),
+				b.device_id, '', b.upstream_proxy_id, b.created_at, b.updated_at
+			FROM device_proxy_bindings_v11 b
+			LEFT JOIN vowifi_runtime v ON v.device_id = b.device_id
+			LEFT JOIN device_runtime d ON d.device_id = b.device_id
+			WHERE COALESCE(NULLIF(v.iccid, ''), NULLIF(d.iccid, '')) IS NOT NULL`,
+			`DROP TABLE device_proxy_bindings_v11`,
+			`CREATE INDEX device_proxy_bindings_proxy_idx
+				ON device_proxy_bindings(upstream_proxy_id)`,
+			`CREATE INDEX device_proxy_bindings_device_idx
+				ON device_proxy_bindings(device_id, iccid)`,
+		}
 	default:
 		return nil
 	}

internal/store/models.go

@@ -17,6 +17,7 @@ const SecretMask = "********"
 type Device struct {
 	ID                 string
 	Name               string
+	DeviceType         string
 	Interface          string
 	ControlDevice      string
 	ATPort             string
@@ -123,6 +124,45 @@ type PhoneAssociation struct {
 	UpdatedAt time.Time
 }
 
+type AutomaticTask struct {
+	ID           int64           `json:"id"`
+	Name         string          `json:"name"`
+	Enabled      bool            `json:"enabled"`
+	DeviceID     string          `json:"device_id"`
+	ProfileICCID string          `json:"profile_iccid"`
+	ProfileAID   string          `json:"profile_aid"`
+	TaskType     string          `json:"task_type"`
+	Environment  string          `json:"environment"`
+	IntervalDays int             `json:"interval_days"`
+	StartDate    string          `json:"start_date"`
+	RunTime      string          `json:"run_time"`
+	Timezone     string          `json:"timezone"`
+	Payload      json.RawMessage `json:"payload"`
+	RetryCount   int             `json:"retry_count"`
+	Notify       bool            `json:"notify"`
+	NextRunAt    time.Time       `json:"next_run_at"`
+	LastRunAt    time.Time       `json:"last_run_at,omitempty"`
+	LastStatus   string          `json:"last_status"`
+	LastError    string          `json:"last_error"`
+	CreatedAt    time.Time       `json:"created_at"`
+	UpdatedAt    time.Time       `json:"updated_at"`
+}
+
+type AutomaticTaskRun struct {
+	ID          int64     `json:"id"`
+	TaskID      int64     `json:"task_id"`
+	DeviceID    string    `json:"device_id"`
+	ScheduledAt time.Time `json:"scheduled_at"`
+	StartedAt   time.Time `json:"started_at,omitempty"`
+	FinishedAt  time.Time `json:"finished_at,omitempty"`
+	Status      string    `json:"status"`
+	Attempts    int       `json:"attempts"`
+	Output      string    `json:"output"`
+	Error       string    `json:"error"`
+	CreatedAt   time.Time `json:"created_at"`
+	UpdatedAt   time.Time `json:"updated_at"`
+}
+
 type SMSMessage struct {
 	ID            int64
 	MessageID     string
@@ -262,11 +302,12 @@ type CountryRule struct {
 	UpdatedAt       time.Time
 }
 
-// DeviceProxyBinding selects the SOCKS5 upstream used by one device's whole
-// VoWiFi runtime. The IKE/IPsec transport uses this route and IMS/SMS then
-// travel inside that tunnel.
+// DeviceProxyBinding selects the SOCKS5 upstream for exactly one eSIM profile.
+// ICCID is globally unique, while one proxy may serve profiles on many devices.
 type DeviceProxyBinding struct {
 	DeviceID        string
+	ICCID           string
+	ProfileName     string
 	UpstreamProxyID string
 	CreatedAt       time.Time
 	UpdatedAt       time.Time

internal/store/proxy.go

@@ -358,9 +358,11 @@ func upstreamProxy(row rowScanner) (UpstreamProxy, error) {
 
 func (s *Store) UpsertDeviceProxyBinding(ctx context.Context, value DeviceProxyBinding) error {
 	value.DeviceID = strings.TrimSpace(value.DeviceID)
+	value.ICCID = strings.TrimSpace(value.ICCID)
+	value.ProfileName = strings.TrimSpace(value.ProfileName)
 	value.UpstreamProxyID = strings.TrimSpace(value.UpstreamProxyID)
-	if value.DeviceID == "" || value.UpstreamProxyID == "" {
-		return errors.New("device proxy binding requires device and upstream proxy IDs")
+	if value.DeviceID == "" || value.ICCID == "" || value.UpstreamProxyID == "" {
+		return errors.New("profile proxy binding requires device ID, ICCID, and upstream proxy ID")
 	}
 	now := time.Now().UTC()
 	createdAt := value.CreatedAt
@@ -373,28 +375,30 @@ func (s *Store) UpsertDeviceProxyBinding(ctx context.Context, value DeviceProxyB
 	}
 	_, err := s.db.ExecContext(ctx, `
 		INSERT INTO device_proxy_bindings (
-			device_id, upstream_proxy_id, created_at, updated_at
-		) VALUES (?, ?, ?, ?)
-		ON CONFLICT(device_id) DO UPDATE SET
+			iccid, device_id, profile_name, upstream_proxy_id, created_at, updated_at
+		) VALUES (?, ?, ?, ?, ?, ?)
+		ON CONFLICT(iccid) DO UPDATE SET
+			device_id = excluded.device_id,
+			profile_name = excluded.profile_name,
 			upstream_proxy_id = excluded.upstream_proxy_id,
 			updated_at = excluded.updated_at
-	`, value.DeviceID, value.UpstreamProxyID, createdAt.Unix(), updatedAt.Unix())
+	`, value.ICCID, value.DeviceID, value.ProfileName, value.UpstreamProxyID, createdAt.Unix(), updatedAt.Unix())
 	if err != nil {
-		return fmt.Errorf("upsert proxy binding for device %q: %w", value.DeviceID, err)
+		return fmt.Errorf("upsert proxy binding for ICCID %q: %w", value.ICCID, err)
 	}
 	return nil
 }
 
-func (s *Store) DeviceProxyBinding(ctx context.Context, deviceID string) (DeviceProxyBinding, error) {
+func (s *Store) DeviceProxyBinding(ctx context.Context, iccid string) (DeviceProxyBinding, error) {
 	return deviceProxyBinding(s.db.QueryRowContext(
 		ctx,
-		deviceProxyBindingSelect+` WHERE device_id = ?`,
-		strings.TrimSpace(deviceID),
+		deviceProxyBindingSelect+` WHERE iccid = ?`,
+		strings.TrimSpace(iccid),
 	))
 }
 
 func (s *Store) ListDeviceProxyBindings(ctx context.Context) ([]DeviceProxyBinding, error) {
-	rows, err := s.db.QueryContext(ctx, deviceProxyBindingSelect+` ORDER BY device_id`)
+	rows, err := s.db.QueryContext(ctx, deviceProxyBindingSelect+` ORDER BY device_id, profile_name COLLATE NOCASE, iccid`)
 	if err != nil {
 		return nil, fmt.Errorf("list device proxy bindings: %w", err)
 	}
@@ -413,26 +417,26 @@ func (s *Store) ListDeviceProxyBindings(ctx context.Context) ([]DeviceProxyBindi
 	return values, nil
 }
 
-func (s *Store) DeleteDeviceProxyBinding(ctx context.Context, deviceID string) error {
+func (s *Store) DeleteDeviceProxyBinding(ctx context.Context, iccid string) error {
 	result, err := s.db.ExecContext(
 		ctx,
-		`DELETE FROM device_proxy_bindings WHERE device_id = ?`,
-		strings.TrimSpace(deviceID),
+		`DELETE FROM device_proxy_bindings WHERE iccid = ?`,
+		strings.TrimSpace(iccid),
 	)
 	if err != nil {
-		return fmt.Errorf("delete proxy binding for device %q: %w", deviceID, err)
+		return fmt.Errorf("delete proxy binding for ICCID %q: %w", iccid, err)
 	}
 	return requireAffected(result)
 }
 
 const deviceProxyBindingSelect = `
-	SELECT device_id, upstream_proxy_id, created_at, updated_at
+	SELECT device_id, iccid, profile_name, upstream_proxy_id, created_at, updated_at
 	FROM device_proxy_bindings`
 
 func deviceProxyBinding(row rowScanner) (DeviceProxyBinding, error) {
 	var value DeviceProxyBinding
 	var createdAt, updatedAt int64
-	err := row.Scan(&value.DeviceID, &value.UpstreamProxyID, &createdAt, &updatedAt)
+	err := row.Scan(&value.DeviceID, &value.ICCID, &value.ProfileName, &value.UpstreamProxyID, &createdAt, &updatedAt)
 	if errors.Is(err, sql.ErrNoRows) {
 		return DeviceProxyBinding{}, ErrNotFound
 	}

internal/store/settings.go

@@ -369,9 +369,6 @@ func (s *Store) UpsertCardPolicy(ctx context.Context, value CardPolicy) error {
 	default:
 		return fmt.Errorf("unsupported card policy IP version %q", value.IPVersion)
 	}
-	if value.VoWiFiEnabled && value.AirplaneEnabled {
-		return errors.New("VoWiFi and airplane mode cannot both be enabled")
-	}
 	now := time.Now().UTC()
 	createdAt := value.CreatedAt
 	if createdAt.IsZero() {