feat: enhance URL validation and email address parsing; refactor related components

- Increment schema version from 11 to 12.
- Modify ProxyResolver to use ICCID for device proxy binding resolution.
- Update tests to reflect changes in proxy binding logic using ICCID.
- Enhance DeviceBindingsDialog to manage eSIM profile bindings instead of device bindings.
- Update UI components and translations to reflect the new profile binding terminology.
- Implement pagination for automatic task runs in AutomaticTasksPage.
- Create a new Pagination component for better navigation in lists.

README.md

@@ -305,6 +305,14 @@ cd web && npm run build
 - [Linux.do](https://linux.do) — An inspiring tech community
 - [iniwex5](https://github.com/iniwex5) - Style and Functionality Guidelines
 
+## Buy me a coffee
+
+| Network | Address |
+| ------- | ------- |
+| USDT-TRON (TRC20) | `TQQAbboBoU8h5xX4YCA1rqWJU2WjK3seSg` |
+| USDT-BSC (BEP20) | `0xdbfcd4a462550d6ff06d09cbd89026c6b145d9c4` |
+| USDT-Polygon | `0xdbfcd4a462550d6ff06d09cbd89026c6b145d9c4` |
+
 ## License
 
 See [LICENSE](LICENSE).

cmd/vocat/main.go

@@ -13,6 +13,7 @@ import (
 	"os/signal"
 	"path/filepath"
 	"strings"
+	"sync"
 	"syscall"
 	"time"
 
@@ -193,6 +194,7 @@ func run(logger *slog.Logger, logs *loghub.Hub) error {
 	if err := provisionDiscoveredDevices(startupContext, database, deviceManager); err != nil {
 		logger.Warn("automatic first-run device provisioning failed", "error", err)
 	}
+	configureDeviceBackends(startupContext, logger, database, deviceManager)
 	restoreDefaultCellularRadios(startupContext, logger, database, deviceManager)
 	defer func() {
 		stopContext, cancel := context.WithTimeout(context.Background(), 5*time.Second)
@@ -222,6 +224,7 @@ func run(logger *slog.Logger, logs *loghub.Hub) error {
 	if err != nil {
 		return fmt.Errorf("configure VoWiFi runtime: %w", err)
 	}
+	go reconcileCardPolicies(pollContext, logger, database, deviceManager, vowifiManager)
 	defer func() {
 		stopContext, cancel := context.WithTimeout(context.Background(), 15*time.Second)
 		defer cancel()
@@ -254,6 +257,7 @@ func run(logger *slog.Logger, logs *loghub.Hub) error {
 	go handler.StartSMSSyncLoop(pollContext, 15*time.Second)
 	handler.StartTelegramBot(pollContext)
 	handler.StartSMSNotificationDispatchers(pollContext)
+	handler.StartAutomaticTasks(pollContext)
 
 	serverConfig := func(handler http.Handler) *http.Server {
 		return &http.Server{
@@ -341,11 +345,32 @@ func run(logger *slog.Logger, logs *loghub.Hub) error {
 	return nil
 }
 
-// restoreDefaultCellularRadios repairs an interrupted VoWiFi teardown. CFUN=4
-// survives process restarts, while the in-memory radio checkpoint does not. If
-// VoWiFi is disabled and the current SIM has no explicit airplane policy, the
-// automatic/default policy is cellular service and the modem must return to
-// CFUN=1.
+func configureDeviceBackends(
+	ctx context.Context,
+	logger *slog.Logger,
+	database *store.Store,
+	manager *device.Manager,
+) {
+	configs, err := database.ListDevices(ctx)
+	if err != nil {
+		logger.Warn("configure device backends: list devices", "error", err)
+		return
+	}
+	mapper := integration.ATMapper{Store: database, Devices: manager}
+	for _, config := range configs {
+		entry, mapErr := mapper.Get(config.ID)
+		if mapErr != nil {
+			continue
+		}
+		if err := manager.SetBackend(entry.ID, config.DeviceBackend); err != nil {
+			logger.Warn("configure device backend", "device_id", config.ID, "backend", config.DeviceBackend, "error", err)
+		}
+	}
+}
+
+// restoreDefaultCellularRadios applies an explicitly saved cellular policy
+// after restart. Missing policies remain RF-off and are claimed by the safe
+// default policy; there is no automatic cellular fallback.
 func restoreDefaultCellularRadios(
 	ctx context.Context,
 	logger *slog.Logger,
@@ -367,11 +392,16 @@ func restoreDefaultCellularRadios(
 			continue
 		}
 		iccid := strings.TrimSpace(entry.Snapshot.ICCID)
+		if iccid == "" {
+			continue
+		}
 		if iccid != "" {
 			policy, policyErr := database.CardPolicy(ctx, iccid)
 			switch {
 			case policyErr == nil && policy.AirplaneEnabled:
 				continue
+			case errors.Is(policyErr, store.ErrNotFound):
+				continue
 			case policyErr != nil && !errors.Is(policyErr, store.ErrNotFound):
 				logger.Warn("startup cellular recovery: read card policy", "device_id", config.ID, "error", policyErr)
 				continue
@@ -410,7 +440,7 @@ func restoreConfiguredCellularData(
 		}
 		dataContext, cancel := context.WithTimeout(ctx, 60*time.Second)
 		_, err = manager.SetNetwork(dataContext, entry.ID, device.NetworkRequest{
-			Enabled: true, APN: config.APN, IPVersion: "IPV4V6",
+			Enabled: true, APN: config.APN, IPVersion: "IPV4V6", Backend: config.DeviceBackend,
 		})
 		cancel()
 		if err != nil {
@@ -439,7 +469,7 @@ func disableAllDeveloperCellularData(
 			continue
 		}
 		disableContext, cancel := context.WithTimeout(ctx, 30*time.Second)
-		_, err = manager.SetNetwork(disableContext, entry.ID, device.NetworkRequest{Enabled: false})
+		_, err = manager.SetNetwork(disableContext, entry.ID, device.NetworkRequest{Enabled: false, Backend: config.DeviceBackend})
 		cancel()
 		if err != nil && ctx.Err() == nil {
 			logger.Warn("developer cleanup: stop cellular data", "device_id", config.ID, "error", err)
@@ -497,6 +527,13 @@ func configureVoWiFiRuntime(
 		// The test deployment is deliberately non-cellular. VoWiFi teardown
 		// may restore CFUN, but it must never reactivate a PDP context.
 		RestoreCellularData: false,
+		// VoWiFi is always fail-closed with respect to cellular RF. Its teardown
+		// leaves CFUN=4; only the explicit airplane-mode-off endpoint restores
+		// CFUN=1.
+		PureAirplanePolicy: func(deviceID string) bool {
+			deviceConfig, configErr := database.Device(context.Background(), deviceID)
+			return configErr == nil && deviceConfig.VoWiFiEnabled
+		},
 	})
 	if err != nil {
 		return nil, err
@@ -528,6 +565,15 @@ func configureVoWiFiRuntime(
 			return nil, fmt.Errorf("register device %q VoWiFi runtime: %w", deviceConfig.ID, err)
 		}
 		if deviceConfig.VoWiFiEnabled {
+			if entry, mapErr := mapper.Get(deviceConfig.ID); mapErr == nil {
+				flightContext, cancelFlight := context.WithTimeout(ctx, 10*time.Second)
+				_, flightErr := deviceManager.SetFlight(flightContext, entry.ID, true)
+				cancelFlight()
+				if flightErr != nil {
+					_ = manager.Close(context.Background())
+					return nil, fmt.Errorf("protect device %q before VoWiFi startup: %w", deviceConfig.ID, flightErr)
+				}
+			}
 			if _, err := manager.RequestEnabled(deviceConfig.ID, true); err != nil {
 				_ = manager.Close(context.Background())
 				return nil, fmt.Errorf("start device %q VoWiFi policy: %w", deviceConfig.ID, err)
@@ -694,7 +740,7 @@ func provisionDiscoveredDevices(
 			ESIMTransport:  backend,
 			NetworkEnabled: false,
 			SMSEnabled:     true,
-			VoWiFiEnabled:  false,
+			VoWiFiEnabled:  true,
 		}); err != nil {
 			return err
 		}
@@ -754,20 +800,42 @@ func pollDeviceSnapshots(
 			logger.Debug("periodic modem discovery failed", "error", err)
 			return
 		}
-		for _, entry := range manager.List() {
+		// Hotplug can replace the physical discovery ID. Rebind each configured
+		// device's selected QMI/AT control plane before collecting its snapshot.
+		configureDeviceBackends(ctx, logger, database, manager)
+		entries := manager.List()
+		// Each physical modem owns its own operation lock. Refresh them in
+		// parallel so a slow or wedged EC20 on one hub port cannot delay signal
+		// and identity updates for every other modem by 30 seconds at a time.
+		var refreshGroup sync.WaitGroup
+		refreshSlots := make(chan struct{}, 4)
+		for _, entry := range entries {
 			if !entry.Discovered {
 				continue
 			}
-			refreshContext, cancelRefresh := context.WithTimeout(ctx, 30*time.Second)
-			snapshot, err := manager.Refresh(refreshContext, entry.ID)
-			cancelRefresh()
-			if err != nil && ctx.Err() == nil {
-				logger.Warn("modem snapshot refresh failed", "device_id", entry.ID, "error", err)
-			}
-			if err == nil && ctx.Err() == nil {
-				enforceCardRegion(ctx, logger, database, manager, entry.ID, &snapshot)
-			}
+			entry := entry
+			refreshGroup.Add(1)
+			go func() {
+				defer refreshGroup.Done()
+				select {
+				case refreshSlots <- struct{}{}:
+					defer func() { <-refreshSlots }()
+				case <-ctx.Done():
+					return
+				}
+				refreshContext, cancelRefresh := context.WithTimeout(ctx, 30*time.Second)
+				snapshot, refreshErr := manager.Refresh(refreshContext, entry.ID)
+				cancelRefresh()
+				if refreshErr != nil && ctx.Err() == nil {
+					logger.Warn("modem snapshot refresh failed", "device_id", entry.ID, "error", refreshErr)
+				}
+				if refreshErr == nil && ctx.Err() == nil {
+					enforceCardRegion(ctx, logger, database, manager, entry.ID, &snapshot)
+					enforceDefaultSafeCardPolicy(ctx, logger, database, manager, entry.ID, &snapshot)
+				}
+			}()
 		}
+		refreshGroup.Wait()
 	}
 	refresh()
 	ticker := time.NewTicker(30 * time.Second)
@@ -782,6 +850,158 @@ func pollDeviceSnapshots(
 	}
 }
 
+// enforceDefaultSafeCardPolicy handles a newly inserted physical SIM or a
+// profile that has never had a policy. RF is turned off before the default is
+// persisted; the VoWiFi runtime reconciler then starts service asynchronously.
+func enforceDefaultSafeCardPolicy(
+	ctx context.Context,
+	logger *slog.Logger,
+	database *store.Store,
+	manager *device.Manager,
+	physicalID string,
+	snapshot *device.Snapshot,
+) {
+	if snapshot == nil || !snapshot.SIMReady || strings.TrimSpace(snapshot.ICCID) == "" ||
+		device.RegionBlockReason(snapshot.IMSI) != "" {
+		return
+	}
+	iccid := strings.TrimSpace(snapshot.ICCID)
+	if _, err := database.CardPolicy(ctx, iccid); err == nil && !snapshot.SIMChanged {
+		return
+	} else if !errors.Is(err, store.ErrNotFound) {
+		logger.Warn("default card policy: read policy", "iccid", iccid, "error", err)
+		return
+	}
+	flightContext, cancel := context.WithTimeout(ctx, 10*time.Second)
+	_, err := manager.SetFlight(flightContext, physicalID, true)
+	cancel()
+	if err != nil {
+		logger.Warn("default card policy: failed to establish airplane mode", "device_id", physicalID, "iccid", iccid, "error", err)
+		return
+	}
+	if err := database.UpsertCardPolicy(ctx, store.CardPolicy{
+		ICCID: iccid, VoWiFiEnabled: true, AirplaneEnabled: true,
+		IPVersion: "IPV4V6", Source: "default",
+	}); err != nil {
+		logger.Warn("default card policy: persist policy", "iccid", iccid, "error", err)
+		return
+	}
+	mapper := integration.ATMapper{Store: database, Devices: manager}
+	configs, err := database.ListDevices(ctx)
+	if err != nil {
+		return
+	}
+	for _, config := range configs {
+		entry, mapErr := mapper.Get(config.ID)
+		if mapErr != nil || entry.ID != physicalID {
+			continue
+		}
+		config.NetworkEnabled = false
+		config.VoWiFiEnabled = true
+		if err := database.UpsertDevice(ctx, config); err != nil {
+			logger.Warn("default card policy: update device policy", "device_id", config.ID, "error", err)
+		}
+		break
+	}
+	logger.Info("new SIM protected by default VoWiFi/airplane policy", "device_id", physicalID, "iccid", iccid)
+}
+
+func reconcileCardPolicies(
+	ctx context.Context,
+	logger *slog.Logger,
+	database *store.Store,
+	manager *device.Manager,
+	vowifiManager *vowifiruntime.Manager,
+) {
+	reconcile := func() {
+		policies, policyListErr := database.ListCardPolicies(ctx)
+		if policyListErr == nil {
+			for _, policy := range policies {
+				if !policy.VoWiFiEnabled || (policy.AirplaneEnabled && !policy.NetworkEnabled) {
+					continue
+				}
+				policy.AirplaneEnabled = true
+				policy.NetworkEnabled = false
+				if err := database.UpsertCardPolicy(ctx, policy); err != nil {
+					logger.Warn("reconcile card policy: normalize stored RF-safe VoWiFi policy", "iccid", policy.ICCID, "error", err)
+				}
+			}
+		}
+		configs, err := database.ListDevices(ctx)
+		if err != nil {
+			return
+		}
+		mapper := integration.ATMapper{Store: database, Devices: manager}
+		for _, config := range configs {
+			entry, mapErr := mapper.Get(config.ID)
+			if mapErr != nil || entry.Snapshot == nil {
+				continue
+			}
+			iccid := strings.TrimSpace(entry.Snapshot.ICCID)
+			if iccid == "" {
+				continue
+			}
+			policy, policyErr := database.CardPolicy(ctx, iccid)
+			if policyErr != nil {
+				continue
+			}
+			if policy.VoWiFiEnabled && (!policy.AirplaneEnabled || policy.NetworkEnabled) {
+				policy.AirplaneEnabled = true
+				policy.NetworkEnabled = false
+				if err := database.UpsertCardPolicy(ctx, policy); err != nil {
+					logger.Warn("reconcile card policy: normalize RF-safe VoWiFi policy", "device_id", config.ID, "iccid", iccid, "error", err)
+					continue
+				}
+			}
+			if config.VoWiFiEnabled != policy.VoWiFiEnabled || (policy.VoWiFiEnabled && config.NetworkEnabled) {
+				config.VoWiFiEnabled = policy.VoWiFiEnabled
+				if policy.VoWiFiEnabled {
+					config.NetworkEnabled = false
+				}
+				if err := database.UpsertDevice(ctx, config); err != nil {
+					logger.Warn("reconcile card policy: update device", "device_id", config.ID, "error", err)
+					continue
+				}
+			}
+			state, stateErr := vowifiManager.State(config.ID)
+			if policy.VoWiFiEnabled {
+				if !entry.Snapshot.FlightMode {
+					flightContext, cancel := context.WithTimeout(ctx, 10*time.Second)
+					_, _ = manager.SetFlight(flightContext, entry.ID, true)
+					cancel()
+				}
+				switch {
+				case stateErr != nil || !state.Enabled:
+					_, _ = vowifiManager.RequestEnabled(config.ID, true)
+				case state.ICCID != "" && !strings.EqualFold(strings.TrimSpace(state.ICCID), iccid):
+					_, _ = vowifiManager.RequestReconnect(config.ID)
+				}
+				continue
+			}
+			if stateErr == nil && state.Enabled {
+				_, _ = vowifiManager.RequestEnabled(config.ID, false)
+				continue
+			}
+			if policy.AirplaneEnabled != entry.Snapshot.FlightMode {
+				flightContext, cancel := context.WithTimeout(ctx, 10*time.Second)
+				_, _ = manager.SetFlight(flightContext, entry.ID, policy.AirplaneEnabled)
+				cancel()
+			}
+		}
+	}
+	reconcile()
+	ticker := time.NewTicker(5 * time.Second)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			reconcile()
+		}
+	}
+}
+
 // cardPolicySourceRegionBlock marks a card policy that was written automatically
 // because the inserted SIM belongs to a region the product does not serve. It
 // doubles as the persistent record that the radio was forced off by us, so the
@@ -848,10 +1068,10 @@ func enforceCardRegion(
 	liftCardRegionBlock(ctx, logger, database, manager, id, snapshot)
 }
 
-// liftCardRegionBlock reverses an automatic region block once the current SIM
-// is positively confirmed to be allowed. It restores the radio only when an
-// outstanding auto-forced block exists, so it never overrides a flight mode the
-// user enabled deliberately.
+// liftCardRegionBlock removes the regional marker once an allowed SIM is
+// confirmed. It deliberately does not restore RF: the replacement SIM is
+// picked up by enforceDefaultSafeCardPolicy and remains in airplane/VoWiFi
+// mode until an explicit user action.
 func liftCardRegionBlock(
 	ctx context.Context,
 	logger *slog.Logger,
@@ -876,18 +1096,6 @@ func liftCardRegionBlock(
 	if len(outstanding) == 0 {
 		return
 	}
-	if snapshot.FlightMode {
-		flightContext, cancelFlight := context.WithTimeout(ctx, 30*time.Second)
-		_, err := manager.SetFlight(flightContext, id, false)
-		cancelFlight()
-		if err != nil && ctx.Err() == nil {
-			logger.Warn(
-				"region block: failed to restore radio",
-				"device_id", id, "error", err,
-			)
-			return
-		}
-	}
 	for _, policy := range outstanding {
 		if err := database.DeleteCardPolicy(ctx, policy.ICCID); err != nil && ctx.Err() == nil {
 			logger.Warn(
@@ -897,7 +1105,7 @@ func liftCardRegionBlock(
 		}
 	}
 	logger.Info(
-		"region block lifted; SIM is allowed",
+		"region marker removed; allowed SIM remains RF protected",
 		"device_id", id, "iccid", snapshot.ICCID, "imsi", snapshot.IMSI,
 	)
 }

cmd/vocat/main_test.go

@@ -152,11 +152,7 @@ func TestEnforceCardRegionSkipsRadioWhenAlreadyOff(t *testing.T) {
 }
 
 func TestEnforceCardRegionLiftsBlockForAllowedSIM(t *testing.T) {
-	client := &fakeModemClient{steps: []fakeStep{
-		{command: "AT+CFUN?", lines: []string{"+CFUN: 4"}},
-		{command: "AT+CFUN=1"},
-		{command: "AT+CFUN?", lines: []string{"+CFUN: 1"}},
-	}}
+	client := &fakeModemClient{}
 	manager := newRegionTestManager(t, client)
 	database := newRegionTestStore(t)
 

internal/developer/settings.go

@@ -25,8 +25,11 @@ func Enabled(ctx context.Context, database *store.Store) bool {
 const (
 	EnabledSettingKey     = "developer.enabled"
 	DeviceLimitSettingKey = "developer.device_limit"
+	SMSHourlyLimitKey     = "developer.sms_hourly_limit"
 	DefaultDeviceLimit    = 5
 	MaxDeviceLimit        = 128
+	DefaultSMSHourlyLimit = 10
+	MaxSMSHourlyLimit     = 1000
 )
 
 func DeviceLimit(ctx context.Context, database *store.Store, enabled bool) int {
@@ -57,6 +60,33 @@ func SetDeviceLimit(ctx context.Context, database *store.Store, limit int) error
 	return database.UpsertAppSetting(ctx, store.AppSetting{Key: DeviceLimitSettingKey, Value: value})
 }
 
+// SMSHourlyLimit is enforced regardless of developer mode. Developer mode
+// only controls whether administrators can see and modify this value.
+func SMSHourlyLimit(ctx context.Context, database *store.Store) int {
+	setting, err := database.AppSetting(ctx, SMSHourlyLimitKey)
+	if err != nil {
+		return DefaultSMSHourlyLimit
+	}
+	var document struct {
+		Limit int `json:"limit"`
+	}
+	if json.Unmarshal(setting.Value, &document) != nil || document.Limit < 1 || document.Limit > MaxSMSHourlyLimit {
+		return DefaultSMSHourlyLimit
+	}
+	return document.Limit
+}
+
+func SetSMSHourlyLimit(ctx context.Context, database *store.Store, limit int) error {
+	if limit < 1 || limit > MaxSMSHourlyLimit {
+		return fmt.Errorf("SMS hourly limit must be between 1 and %d", MaxSMSHourlyLimit)
+	}
+	value, err := json.Marshal(map[string]int{"limit": limit})
+	if err != nil {
+		return err
+	}
+	return database.UpsertAppSetting(ctx, store.AppSetting{Key: SMSHourlyLimitKey, Value: value})
+}
+
 // ResetExperimental restores every mutable developer-only setting. It is
 // called both by `vocat develop off` and at startup whenever developer mode is
 // disabled, so stale database values cannot silently remain active.
@@ -72,6 +102,9 @@ func ResetExperimental(ctx context.Context, database *store.Store) error {
 	if err := SetDeviceLimit(ctx, database, DefaultDeviceLimit); err != nil {
 		resetErrors = append(resetErrors, fmt.Errorf("reset device limit: %w", err))
 	}
+	if err := SetSMSHourlyLimit(ctx, database, DefaultSMSHourlyLimit); err != nil {
+		resetErrors = append(resetErrors, fmt.Errorf("reset SMS hourly limit: %w", err))
+	}
 	if err := database.DeleteAppSetting(ctx, exportproxy.SettingKey); err != nil && !errors.Is(err, store.ErrNotFound) {
 		resetErrors = append(resetErrors, fmt.Errorf("delete export proxy configurations: %w", err))
 	}

internal/developer/settings_test.go

@@ -22,6 +22,9 @@ func TestResetExperimentalRestoresDefaults(t *testing.T) {
 	if err := SetDeviceLimit(ctx, database, 24); err != nil {
 		t.Fatal(err)
 	}
+	if err := SetSMSHourlyLimit(ctx, database, 42); err != nil {
+		t.Fatal(err)
+	}
 	enabled, _ := json.Marshal(map[string]bool{"enabled": true})
 	if err := database.UpsertAppSetting(ctx, store.AppSetting{Key: httpsmode.SettingKey, Value: enabled}); err != nil {
 		t.Fatal(err)
@@ -41,6 +44,9 @@ func TestResetExperimentalRestoresDefaults(t *testing.T) {
 	if limit := DeviceLimit(ctx, database, true); limit != DefaultDeviceLimit {
 		t.Fatalf("device limit = %d, want %d", limit, DefaultDeviceLimit)
 	}
+	if limit := SMSHourlyLimit(ctx, database); limit != DefaultSMSHourlyLimit {
+		t.Fatalf("SMS hourly limit = %d, want %d", limit, DefaultSMSHourlyLimit)
+	}
 	setting, err := database.AppSetting(ctx, httpsmode.SettingKey)
 	if err != nil {
 		t.Fatal(err)
@@ -75,3 +81,21 @@ func TestSetDeviceLimitValidatesRange(t *testing.T) {
 		t.Fatal("out-of-range device limit was accepted")
 	}
 }
+
+func TestSetSMSHourlyLimitValidatesRange(t *testing.T) {
+	ctx := context.Background()
+	database, err := store.Open(ctx, filepath.Join(t.TempDir(), "vocat.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer database.Close()
+	if SetSMSHourlyLimit(ctx, database, 0) == nil || SetSMSHourlyLimit(ctx, database, MaxSMSHourlyLimit+1) == nil {
+		t.Fatal("out-of-range SMS hourly limit was accepted")
+	}
+	if err := SetSMSHourlyLimit(ctx, database, 25); err != nil {
+		t.Fatal(err)
+	}
+	if got := SMSHourlyLimit(ctx, database); got != 25 {
+		t.Fatalf("SMS hourly limit = %d, want 25", got)
+	}
+}

internal/device/carrier_db.go

@@ -42,3 +42,25 @@ func CarrierForPLMN(plmn string) (name, countryCode string, ok bool) {
 	}
 	return name, countryCode, true
 }
+
+// CarrierForIMSI resolves the home PLMN carried by an IMSI. MNCs may contain
+// either two or three digits, so prefer an exact six-digit database match and
+// then fall back to the five-digit form. This avoids treating the first three
+// subscriber digits as a three-digit MNC for networks such as 234-33.
+func CarrierForIMSI(imsi string) (plmn, name, countryCode string, ok bool) {
+	imsi = strings.TrimSpace(imsi)
+	if !decimalDigits(imsi, 5, 20) {
+		return "", "", "", false
+	}
+	for _, length := range []int{6, 5} {
+		if len(imsi) < length {
+			continue
+		}
+		candidate := imsi[:length]
+		carrier, country, found := CarrierForPLMN(candidate)
+		if found {
+			return candidate, carrier, country, true
+		}
+	}
+	return "", "", "", false
+}

internal/device/data.go

@@ -43,7 +43,21 @@ func (manager *Manager) SetNetwork(
 		}
 	}
 	candidate := manager.candidateFor(state)
-	if candidate.QMIControl != "" && candidate.NetworkInterface != "" {
+	backend := strings.ToLower(strings.TrimSpace(request.Backend))
+	if backend == "" {
+		if candidate.QMIControl != "" && candidate.NetworkInterface != "" {
+			backend = "qmi"
+		} else {
+			backend = "at"
+		}
+	}
+	if backend != "at" && backend != "qmi" {
+		return NetworkResult{}, fmt.Errorf("unsupported cellular data backend %q", request.Backend)
+	}
+	if backend == "qmi" {
+		if candidate.QMIControl == "" || candidate.NetworkInterface == "" {
+			return NetworkResult{}, fmt.Errorf("%w: QMI control device and network interface are required", ErrDataBackendUnavailable)
+		}
 		return setQMINetwork(ctx, candidate, request.Enabled, apn, ipVersion)
 	}
 

internal/device/es9p.go

@@ -3,14 +3,17 @@ package device
 import (
 	"bytes"
 	"context"
-	"crypto/tls"
 	"encoding/base64"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
 	"strings"
 	"time"
+
+	"vocat/internal/netguard"
 )
 
 // es9pClient speaks SGP.22 ES9+ — JSON over HTTPS — to one SM-DP+. It is the
@@ -24,25 +27,31 @@ import (
 // header.functionExecutionStatus (with statusCodeData.message holding the
 // human-readable failure, e.g. "The matchingID is not found").
 type es9pClient struct {
-	smdp string
-	http *http.Client
+	smdp     string
+	endpoint *url.URL
+	http     *http.Client
 }
 
-func newES9PClient(smdp string) *es9pClient {
-	// The eUICC — not the host — is the root of trust for RSP: during
-	// AuthenticateServer the card verifies the SM-DP+'s CERT.DPauth.SIG against
-	// its embedded CI root, so a rogue/TLS-MitM server cannot forge a signature
-	// the card will accept. The host TLS layer is transport only, and a minimal
-	// embedded box may ship no CA bundle (this is exactly what broke on the test
-	// machine), so we don't anchor host TLS to system roots. InsecureSkipVerify
-	// is safe here specifically because the card does the authoritative check.
-	transport := &http.Transport{
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //nolint:gosec // eUICC is the RSP trust anchor
+func newES9PClient(ctx context.Context, smdp string) (*es9pClient, error) {
+	smdp = strings.TrimSpace(smdp)
+	if smdp == "" || strings.Contains(smdp, "://") {
+		return nil, errors.New("esim: SM-DP+ address must be a hostname with an optional port")
+	}
+	candidate, err := url.Parse("https://" + smdp)
+	if err != nil || candidate.Hostname() == "" || candidate.User != nil ||
+		(candidate.Path != "" && candidate.Path != "/") || candidate.RawQuery != "" || candidate.Fragment != "" {
+		return nil, errors.New("esim: SM-DP+ address must be a hostname with an optional port")
+	}
+	candidate.Path = ""
+	validated, err := netguard.ValidatePublicURL(ctx, candidate.String(), true)
+	if err != nil {
+		return nil, fmt.Errorf("esim: unsafe SM-DP+ address: %w", err)
 	}
 	return &es9pClient{
-		smdp: strings.TrimSpace(smdp),
-		http: &http.Client{Timeout: 90 * time.Second, Transport: transport},
-	}
+		smdp:     validated.Host,
+		endpoint: validated,
+		http:     netguard.NewPublicHTTPClient(90*time.Second, true),
+	}, nil
 }
 
 // es9pError is a failed ES9+ functionExecutionStatus. Message is the SM-DP+'s
@@ -80,12 +89,13 @@ type es9pStatusCodeData struct {
 // is decided the way lpac decides it: a non-success execution status, or a
 // missing required output field, yields an es9pError carrying the SM-DP+ message.
 func (c *es9pClient) call(ctx context.Context, function string, request map[string]string, requiredOut ...string) (map[string]json.RawMessage, error) {
-	url := "https://" + c.smdp + "/gsma/rsp2/es9plus/" + function
+	endpoint := *c.endpoint
+	endpoint.Path = "/gsma/rsp2/es9plus/" + function
 	body, err := json.Marshal(request)
 	if err != nil {
 		return nil, err
 	}
-	httpReq, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(body))
+	httpReq, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint.String(), bytes.NewReader(body))
 	if err != nil {
 		return nil, err
 	}

internal/device/es9p_test.go

@@ -7,6 +7,7 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"strings"
 	"testing"
 )
@@ -16,9 +17,15 @@ func newTestES9P(t *testing.T, handler http.HandlerFunc) *es9pClient {
 	t.Helper()
 	server := httptest.NewTLSServer(handler)
 	t.Cleanup(server.Close)
-	client := newES9PClient(strings.TrimPrefix(server.URL, "https://"))
-	client.http = server.Client()
-	return client
+	endpoint, err := url.Parse(server.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return &es9pClient{
+		smdp:     strings.TrimPrefix(server.URL, "https://"),
+		endpoint: endpoint,
+		http:     server.Client(),
+	}
 }
 
 func successEnvelope(fields map[string]any) map[string]any {
@@ -33,6 +40,20 @@ func successEnvelope(fields map[string]any) map[string]any {
 
 func b64(value []byte) string { return base64.StdEncoding.EncodeToString(value) }
 
+func TestNewES9PClientRejectsUnsafeAddress(t *testing.T) {
+	for _, address := range []string{
+		"https://rsp.example.com",
+		"127.0.0.1",
+		"169.254.169.254",
+		"rsp.example.com/unexpected/path",
+		"user:[email protected]",
+	} {
+		if _, err := newES9PClient(context.Background(), address); err == nil {
+			t.Errorf("newES9PClient(%q) accepted an unsafe address", address)
+		}
+	}
+}
+
 func TestInitiateAuthenticationSuccess(t *testing.T) {
 	signed1 := []byte{0x30, 0x03, 0x80, 0x01, 0x09}
 	client := newTestES9P(t, func(w http.ResponseWriter, r *http.Request) {

internal/device/esim.go

@@ -26,6 +26,12 @@ import (
 // isdRAID is the standard ISD-R AID that hosts the LPA functions (ES10).
 const isdRAID = "A0000005591010FFFFFFFF8900000100"
 
+// xesimISDRAID is the alternate ISD-R application exposed by XeSIM cards.
+// It implements the same ES10 interface, but is not selectable through the
+// standard ...0100 AID. Selecting it is a read-only capability probe; profile
+// state is never changed during discovery.
+const xesimISDRAID = "A0000005591010FFFFFFFF8900000177"
+
 // eSTK multi-SE products expose each eUICC storage through its own vendor
 // ISD-R AID. The standard GSMA AID aliases one of them, so probing only that
 // AID silently hides the second storage.
@@ -296,20 +302,32 @@ func (manager *Manager) openEuiccOnceAID(ctx context.Context, id, aidHex string)
 	return channel, nil
 }
 
-// discoverEuiccAIDs detects eSTK multi-SE cards without changing any profile
-// state. The vendor product applet is selected only as a read-only capability
-// probe; when present, both vendor ISD-R AIDs are tried. Per OpenEUICC's eSTK
-// integration, the generic GSMA AID is not appended after an eSTK SE opens,
-// because it aliases one of the same storages.
+// discoverEuiccAIDs detects eSTK multi-SE and alternate-ISD-R cards without
+// changing any profile state. The vendor product applet and candidate ISD-R
+// applications are selected only as read-only capability probes. Per
+// OpenEUICC's eSTK integration, generic AIDs are not appended after an eSTK SE
+// opens, because the standard AID aliases one of the same storages.
 func (manager *Manager) discoverEuiccAIDs(ctx context.Context, id string) []string {
 	product, err := manager.openEuiccAID(ctx, id, estkProductAID)
-	if err != nil {
-		return []string{isdRAID}
+	if err == nil {
+		product.close(context.Background())
+
+		var found []string
+		for _, aid := range []string{estkSE0AID, estkSE1AID} {
+			channel, err := manager.openEuiccAID(ctx, id, aid)
+			if err != nil {
+				continue
+			}
+			channel.close(context.Background())
+			found = append(found, aid)
+		}
+		if len(found) > 0 {
+			return found
+		}
 	}
-	product.close(context.Background())
 
 	var found []string
-	for _, aid := range []string{estkSE0AID, estkSE1AID} {
+	for _, aid := range []string{isdRAID, xesimISDRAID} {
 		channel, err := manager.openEuiccAID(ctx, id, aid)
 		if err != nil {
 			continue
@@ -317,10 +335,12 @@ func (manager *Manager) discoverEuiccAIDs(ctx context.Context, id string) []stri
 		channel.close(context.Background())
 		found = append(found, aid)
 	}
-	if len(found) == 0 {
-		return []string{isdRAID}
+	if len(found) > 0 {
+		return found
 	}
-	return found
+	// Preserve the old error path for a physical SIM with no eUICC. The caller
+	// retries the standard AID once and returns ErrNoEUICC to the HTTP layer.
+	return []string{isdRAID}
 }
 
 func isTransientEuiccCME(err error) bool {
@@ -531,18 +551,27 @@ func (manager *Manager) ESIMListProfiles(ctx context.Context, id string) (EsimIn
 		}
 		return EsimInfo{}, errESIMRecovering
 	}
-	channel, err := manager.openEuicc(ctx, id)
-	if err != nil {
-		return EsimInfo{}, err
+	var lastErr error
+	for _, aid := range manager.discoverEuiccAIDs(ctx, id) {
+		channel, err := manager.openEuiccAID(ctx, id, aid)
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		payload, err := channel.es10(ctx, []byte{0xBF, 0x2D, 0x00}) // GetProfilesInfo
+		channel.close(context.Background())
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		info := EsimInfo{AID: aid, Profiles: parseProfilesInfo(payload)}
+		manager.cacheESIMInfo(id, info)
+		return info, nil
 	}
-	defer channel.close(context.Background())
-	payload, err := channel.es10(ctx, []byte{0xBF, 0x2D, 0x00}) // GetProfilesInfo
-	if err != nil {
-		return EsimInfo{}, err
+	if lastErr != nil {
+		return EsimInfo{}, lastErr
 	}
-	info := EsimInfo{Profiles: parseProfilesInfo(payload)}
-	manager.cacheESIMInfo(id, info)
-	return info, nil
+	return EsimInfo{}, ErrNoEUICC
 }
 
 // ESIMSwitchProfile enables one profile by ICCID via ES10c EnableProfile.
@@ -774,7 +803,14 @@ func (manager *Manager) refreshAfterProfileSwitch(id string) {
 	time.Sleep(settle)
 	for attempt := 0; attempt < attempts; attempt++ {
 		ctx, cancel := context.WithTimeout(context.Background(), manager.commandTimeout*4)
-		_, err := manager.Refresh(ctx, id)
+		_, _ = manager.Discover(ctx)
+		_, flightErr := manager.SetFlight(ctx, id, true)
+		var err error
+		if flightErr == nil {
+			_, err = manager.Refresh(ctx, id)
+		} else {
+			err = flightErr
+		}
 		cancel()
 		if err == nil {
 			return

internal/device/esim_download.go

@@ -74,7 +74,10 @@ func (manager *Manager) ESIMDownloadProfile(ctx context.Context, id string, para
 		return nil, err
 	}
 
-	client := newES9PClient(smdp)
+	client, err := newES9PClient(ctx, smdp)
+	if err != nil {
+		return nil, err
+	}
 
 	report("auth_client", "正在向 SM-DP+ 进行客户端身份认证...", 30)
 	init, err := client.initiateAuthentication(ctx, challenge, info1)
@@ -217,17 +220,26 @@ type EsimChipInfo struct {
 func (manager *Manager) ESIMChipInfo(ctx context.Context, id string) (*EsimChipInfo, error) {
 	manager.esimMu.Lock()
 	defer manager.esimMu.Unlock()
-	channel, err := manager.openEuicc(ctx, id)
-	if err != nil {
-		return nil, err
-	}
-	defer channel.close(context.Background())
 
-	info, err := readEsimChipInfo(ctx, channel, isdRAID)
-	if err != nil {
-		return nil, err
+	var lastErr error
+	for _, aid := range manager.discoverEuiccAIDs(ctx, id) {
+		channel, err := manager.openEuiccAID(ctx, id, aid)
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		info, err := readEsimChipInfo(ctx, channel, aid)
+		channel.close(context.Background())
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		return &info, nil
 	}
-	return &info, nil
+	if lastErr != nil {
+		return nil, lastErr
+	}
+	return nil, ErrNoEUICC
 }
 
 func readEsimChipInfo(ctx context.Context, channel *euiccChannel, aidHex string) (EsimChipInfo, error) {

internal/device/esim_test.go

@@ -244,6 +244,45 @@ func TestTransientEuiccCMEClassification(t *testing.T) {
 	}
 }
 
+func TestDiscoverEuiccAIDsFindsXeSIMAlternateISDR(t *testing.T) {
+	manageChannel := clientStep{
+		command:  `AT+CSIM=10,"0070000001"`,
+		response: okResponse(`+CSIM: 6,"019000"`),
+	}
+	closeChannel := clientStep{
+		command:  `AT+CSIM=10,"0070800100"`,
+		response: okResponse(`+CSIM: 4,"9000"`),
+	}
+	selectStep := func(aid, response string) clientStep {
+		return clientStep{
+			command:  fmt.Sprintf(`AT+CSIM=42,"01A4040010%s"`, aid),
+			response: okResponse(fmt.Sprintf(`+CSIM: 4,"%s"`, response)),
+		}
+	}
+
+	client := &transcriptClient{steps: []clientStep{
+		// No eSTK product applet on this card.
+		manageChannel,
+		selectStep(estkProductAID, "6A82"),
+		closeChannel,
+		// XeSIM does not expose the standard GSMA ...0100 application.
+		manageChannel,
+		selectStep(isdRAID, "6A82"),
+		closeChannel,
+		// Its dedicated ...0177 ISD-R is selectable.
+		manageChannel,
+		selectStep(xesimISDRAID, "9000"),
+		closeChannel,
+	}}
+	manager, id := newStartedTestManager(t, client)
+
+	aids := manager.discoverEuiccAIDs(context.Background(), id)
+	if len(aids) != 1 || aids[0] != xesimISDRAID {
+		t.Fatalf("discovered AIDs = %#v, want XeSIM %s", aids, xesimISDRAID)
+	}
+	client.assertDone(t)
+}
+
 func TestEUICCChannelStuckWrapsTransientCME(t *testing.T) {
 	cause := &modem.CommandError{
 		Command: `AT+CSIM=10,"0070000001"`,

internal/device/manager.go

@@ -50,6 +50,8 @@ type ussdSession struct {
 type managedDevice struct {
 	opMu              sync.Mutex
 	candidate         modem.Candidate
+	backend           string
+	lastICCID         string
 	client            modem.Client
 	snapshot          *Snapshot
 	lastError         string
@@ -358,16 +360,44 @@ func (manager *Manager) Refresh(ctx context.Context, id string) (Snapshot, error
 		return Snapshot{}, err
 	}
 	candidate := manager.candidateFor(state)
+	backend := manager.backendFor(state)
 	client, err := manager.clientLocked(ctx, state, candidate)
 	if err != nil {
 		manager.setResult(id, state, nil, err)
 		return Snapshot{}, err
 	}
-	snapshot, err := manager.readSnapshot(ctx, id, candidate, client)
+	previousICCID := state.lastICCID
+	snapshot, err := manager.readSnapshot(ctx, id, candidate, backend, previousICCID, client)
+	if err == nil && strings.TrimSpace(snapshot.ICCID) != "" {
+		state.lastICCID = strings.TrimSpace(snapshot.ICCID)
+	}
 	manager.setResult(id, state, &snapshot, err)
 	return snapshot, err
 }
 
+// SetBackend selects which control plane supplies registration and data state.
+// AT remains available in either mode for UICC, RF, SMS, voice and diagnostics.
+func (manager *Manager) SetBackend(id, backend string) error {
+	backend = strings.ToLower(strings.TrimSpace(backend))
+	if backend != "at" && backend != "qmi" {
+		return fmt.Errorf("unsupported device backend %q", backend)
+	}
+	manager.mu.Lock()
+	defer manager.mu.Unlock()
+	state := manager.devices[id]
+	if state == nil || !state.discovered {
+		return ErrNotFound
+	}
+	state.backend = backend
+	return nil
+}
+
+func (manager *Manager) backendFor(state *managedDevice) string {
+	manager.mu.RLock()
+	defer manager.mu.RUnlock()
+	return state.backend
+}
+
 func (manager *Manager) ExecuteAT(
 	ctx context.Context,
 	id string,

internal/device/manager_test.go

@@ -19,6 +19,14 @@ func TestManagerRefreshBuildsEC20Snapshot(t *testing.T) {
 			),
 		},
 		{command: "AT+CPIN?", response: okResponse("+CPIN: READY")},
+		{
+			command:  "AT+CCID",
+			response: modem.Response{Final: "+CME ERROR: 100"},
+			err:      errors.New("CCID unsupported"),
+		},
+		{command: "AT+QCCID", response: okResponse("+QCCID: 8986001234567890123F")},
+		{command: "AT+CIMI", response: okResponse("460001234567890")},
+		{command: "AT+CRSM=176,28486,0,0,17", response: okResponse(`+CRSM: 144,0,"00434D4343FFFFFFFFFFFFFFFFFFFFFFFF"`)},
 		{command: "AT+CSQ", response: okResponse("+CSQ: 20,99")},
 		{
 			command: `AT+QENG="servingcell"`,
@@ -29,13 +37,6 @@ func TestManagerRefreshBuildsEC20Snapshot(t *testing.T) {
 		{command: "AT+COPS?", response: okResponse(`+COPS: 0,0,"China Mobile",7`)},
 		{command: "AT+CEREG?", response: okResponse(`+CEREG: 0,5`)},
 		{command: "AT+CGSN", response: okResponse("867123456789012")},
-		{
-			command:  "AT+CCID",
-			response: modem.Response{Final: "+CME ERROR: 100"},
-			err:      errors.New("CCID unsupported"),
-		},
-		{command: "AT+QCCID", response: okResponse("+QCCID: 8986001234567890123F")},
-		{command: "AT+CIMI", response: okResponse("460001234567890")},
 		{command: "AT+CFUN?", response: okResponse("+CFUN: 1")},
 		{command: "AT+CNUM", response: okResponse(`+CNUM: "","+8613800138000",145`)},
 	}}
@@ -74,7 +75,7 @@ func TestManagerRefreshBuildsEC20Snapshot(t *testing.T) {
 	}
 	if snapshot.IMEI != "867123456789012" ||
 		snapshot.ICCID != "8986001234567890123" ||
-		snapshot.IMSI != "460001234567890" {
+		snapshot.IMSI != "460001234567890" || snapshot.SPN != "CMCC" {
 		t.Fatalf("subscriber identifiers = %#v", snapshot)
 	}
 	if !snapshot.ModeKnown || snapshot.OperatingMode != 1 ||
@@ -96,6 +97,18 @@ func TestManagerRefreshBuildsEC20Snapshot(t *testing.T) {
 	client.assertDone(t)
 }
 
+func TestParseSPNASCIIAndUCS2(t *testing.T) {
+	if got := parseSPN(okResponse(`+CRSM: 144,0,"004C6562617261FFFFFFFFFFFFFFFFFFFF"`)); got != "Lebara" {
+		t.Fatalf("ASCII SPN = %q", got)
+	}
+	if got := parseSPN(okResponse(`+CRSM: 144,0,"0080004C00650062006100720061FFFF"`)); got != "Lebara" {
+		t.Fatalf("UCS2 SPN = %q", got)
+	}
+	if got := parseSPN(okResponse(`+CRSM: 106,130,""`)); got != "" {
+		t.Fatalf("failed CRSM SPN = %q", got)
+	}
+}
+
 func TestParseICCIDIdentifierStripsTwoFillerNibbles(t *testing.T) {
 	response := modem.Response{Lines: []string{"+CCID: 894921007608519523FF"}}
 	if got := parseICCIDIdentifier(response, []string{"+CCID:", "+QCCID:"}, 18, 22); got != "894921007608519523" {
@@ -122,6 +135,57 @@ func TestManagerRequiresStartAndKnownDevice(t *testing.T) {
 	}
 }
 
+func TestManagerBackendSelectionIsExplicit(t *testing.T) {
+	manager, id := newStartedTestManager(t, &transcriptClient{})
+	if err := manager.SetBackend(id, "qmi"); err != nil {
+		t.Fatal(err)
+	}
+	state, err := manager.lookup(id)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := manager.backendFor(state); got != "qmi" {
+		t.Fatalf("backend = %q, want qmi", got)
+	}
+	if err := manager.SetBackend(id, "mbim"); err == nil {
+		t.Fatal("unsupported backend was accepted")
+	}
+}
+
+func TestManagerForcesRFOffBeforeInspectingChangedSIMNetwork(t *testing.T) {
+	client := &transcriptClient{steps: []clientStep{
+		{command: "ATI", response: okResponse("Quectel", "EC20", "Revision: test")},
+		{command: "AT+CPIN?", response: okResponse("+CPIN: READY")},
+		{command: "AT+CCID", response: okResponse("+CCID: 8900000000000000002")},
+		// This must precede CIMI, signal, serving-cell and operator queries.
+		{command: "AT+CFUN=4", response: okResponse()},
+		{command: "AT+CIMI", response: okResponse("234150000000002")},
+		{command: "AT+CRSM=176,28486,0,0,17", response: okResponse(`+CRSM: 144,0,"004C6562617261FFFFFFFFFFFFFFFFFFFF"`)},
+		{command: "AT+CSQ", response: okResponse("+CSQ: 99,99")},
+		{command: `AT+QENG="servingcell"`, response: okResponse(`+QENG: "servingcell","SEARCH"`)},
+		{command: "AT+COPS?", response: okResponse("+COPS: 0")},
+		{command: "AT+CEREG?", response: okResponse("+CEREG: 0,0")},
+		{command: "AT+CGSN", response: okResponse("867123456789012")},
+		{command: "AT+CFUN?", response: okResponse("+CFUN: 4")},
+		{command: "AT+CNUM", response: okResponse(`+CNUM: "","+447700900002",145`)},
+	}}
+	manager, id := newStartedTestManager(t, client)
+	state, err := manager.lookup(id)
+	if err != nil {
+		t.Fatal(err)
+	}
+	state.lastICCID = "8900000000000000001"
+
+	snapshot, err := manager.Refresh(context.Background(), id)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !snapshot.SIMChanged || !snapshot.FlightMode || snapshot.OperatingMode != 4 {
+		t.Fatalf("changed SIM snapshot = %#v", snapshot)
+	}
+	client.assertDone(t)
+}
+
 func TestExecuteSensitiveATDoesNotPersistCommandOrModemError(t *testing.T) {
 	const secretCommand = `AT+CSIM=78,"00880081221000112233445566778899AABBCCDDEEFF1000112233445566778899AABBCCDDEEFF00"`
 	client := &transcriptClient{steps: []clientStep{{

internal/device/scan_test.go

@@ -40,6 +40,7 @@ func TestCarrierNameForPLMNUsesGlobalDatabase(t *testing.T) {
 func TestCarrierForPLMNReturnsCountryCode(t *testing.T) {
 	tests := map[string]string{
 		"23415":  "GB",
+		"23487":  "GB",
 		"26202":  "DE",
 		"310260": "US",
 		"22201":  "IT",
@@ -53,3 +54,22 @@ func TestCarrierForPLMNReturnsCountryCode(t *testing.T) {
 		}
 	}
 }
+
+func TestCarrierForIMSIHandlesTwoAndThreeDigitMNCs(t *testing.T) {
+	tests := []struct {
+		imsi        string
+		wantPLMN    string
+		wantCountry string
+	}{
+		{imsi: "234336570710174", wantPLMN: "23433", wantCountry: "GB"},
+		{imsi: "234159609054263", wantPLMN: "23415", wantCountry: "GB"},
+		{imsi: "234870123456789", wantPLMN: "23487", wantCountry: "GB"},
+		{imsi: "310260123456789", wantPLMN: "310260", wantCountry: "US"},
+	}
+	for _, item := range tests {
+		plmn, name, country, ok := CarrierForIMSI(item.imsi)
+		if !ok || plmn != item.wantPLMN || name == "" || country != item.wantCountry {
+			t.Errorf("CarrierForIMSI(%q) = (%q, %q, %q, %v), want PLMN %q and country %q", item.imsi, plmn, name, country, ok, item.wantPLMN, item.wantCountry)
+		}
+	}
+}

internal/device/snapshot.go

@@ -3,12 +3,14 @@ package device
 import (
 	"context"
 	"encoding/csv"
+	"encoding/hex"
 	"fmt"
 	"io"
 	"strconv"
 	"strings"
 	"time"
 	"unicode"
+	"unicode/utf16"
 
 	"vocat/internal/modem"
 )
@@ -17,6 +19,8 @@ func (manager *Manager) readSnapshot(
 	ctx context.Context,
 	id string,
 	candidate modem.Candidate,
+	backend string,
+	previousICCID string,
 	client modem.Client,
 ) (Snapshot, error) {
 	snapshot := Snapshot{
@@ -47,6 +51,36 @@ func (manager *Manager) readSnapshot(
 	if response, ok := optional("AT+CPIN?"); ok {
 		snapshot.SIMStatus, snapshot.SIMReady = parseCPIN(response)
 	}
+	ccid, ccidErr := manager.command(ctx, client, "AT+CCID")
+	if ccidErr != nil {
+		ccid, ccidErr = manager.command(ctx, client, "AT+QCCID")
+	}
+	if ccidErr != nil {
+		snapshot.Warnings = append(snapshot.Warnings, "read ICCID: "+ccidErr.Error())
+	} else {
+		snapshot.ICCID = parseICCIDIdentifier(ccid, []string{"+CCID:", "+QCCID:"}, 18, 22)
+	}
+	previousICCID = strings.TrimSpace(previousICCID)
+	if previousICCID != "" && snapshot.ICCID != "" && !strings.EqualFold(previousICCID, snapshot.ICCID) {
+		// A different physical SIM must never inherit the previous card's
+		// permission to use cellular RF. Disable RF before reading serving-cell
+		// or operator state; policy reconciliation will then start VoWiFi.
+		if _, err := manager.command(ctx, client, "AT+CFUN=4"); err != nil {
+			return snapshot, fmt.Errorf("protect changed SIM with RF off: %w", err)
+		}
+		snapshot.SIMChanged = true
+	}
+	if response, ok := optional("AT+CIMI"); ok {
+		snapshot.IMSI = parseIdentifier(response, []string{"+CIMI:"}, 10, 18)
+	}
+	// EF_SPN is the SIM-issued brand (for example "Lebara"), which is distinct
+	// from the IMSI sponsor/core PLMN. A Lebara UK subscription may therefore
+	// legitimately carry a Vodafone NL IMSI while still presenting Lebara as
+	// its customer-facing operator. Failure is intentionally silent because
+	// EF_SPN is optional and some physical SIMs deny CRSM access to it.
+	if response, spnErr := manager.command(ctx, client, "AT+CRSM=176,28486,0,0,17"); spnErr == nil {
+		snapshot.SPN = parseSPN(response)
+	}
 	if response, ok := optional("AT+CSQ"); ok {
 		snapshot.SignalRaw, snapshot.SignalPercent, snapshot.RSSIDBm = parseCSQ(response)
 	}
@@ -87,13 +121,16 @@ func (manager *Manager) readSnapshot(
 			break
 		}
 	}
-	if registration, found := readPlatformRegistration(ctx, candidate); found {
-		snapshot.RegistrationStatus = registration.Status
-		snapshot.RegistrationSource = "QMI NAS"
-		snapshot.PSAttached = registration.PSAttached
-		if registration.PLMN != "" {
-			snapshot.OperatorCode = registration.PLMN
-			snapshot.OperatorName = carrierNameForPLMN(registration.PLMN, registration.Name)
+	if strings.EqualFold(backend, "qmi") {
+		registration, found := readPlatformRegistration(ctx, candidate)
+		if found {
+			snapshot.RegistrationStatus = registration.Status
+			snapshot.RegistrationSource = "QMI NAS"
+			snapshot.PSAttached = registration.PSAttached
+			if registration.PLMN != "" {
+				snapshot.OperatorCode = registration.PLMN
+				snapshot.OperatorName = carrierNameForPLMN(registration.PLMN, registration.Name)
+			}
 		}
 	}
 	if snapshot.RegistrationSource == "" && (snapshot.OperatorName != "" || snapshot.OperatorCode != "") {
@@ -111,18 +148,6 @@ func (manager *Manager) readSnapshot(
 		)
 	}
 
-	ccid, ccidErr := manager.command(ctx, client, "AT+CCID")
-	if ccidErr != nil {
-		ccid, ccidErr = manager.command(ctx, client, "AT+QCCID")
-	}
-	if ccidErr != nil {
-		snapshot.Warnings = append(snapshot.Warnings, "read ICCID: "+ccidErr.Error())
-	} else {
-		snapshot.ICCID = parseICCIDIdentifier(ccid, []string{"+CCID:", "+QCCID:"}, 18, 22)
-	}
-	if response, ok := optional("AT+CIMI"); ok {
-		snapshot.IMSI = parseIdentifier(response, []string{"+CIMI:"}, 10, 18)
-	}
 	if response, ok := optional("AT+CFUN?"); ok {
 		if mode, found := parseCFUN(response); found {
 			snapshot.OperatingMode = mode
@@ -139,6 +164,53 @@ func (manager *Manager) readSnapshot(
 	return snapshot, nil
 }
 
+func parseSPN(response modem.Response) string {
+	value := valueAfterPrefix(response, "+CRSM:")
+	fields := csvValues(value)
+	if len(fields) < 3 {
+		return ""
+	}
+	sw1, sw1Err := strconv.Atoi(strings.TrimSpace(fields[0]))
+	sw2, sw2Err := strconv.Atoi(strings.TrimSpace(fields[1]))
+	if sw1Err != nil || sw2Err != nil || (sw1 != 0x90 && sw1 != 0x91 && sw1 != 0x9f) || sw2 < 0 || sw2 > 255 {
+		return ""
+	}
+	raw, err := hex.DecodeString(strings.Trim(strings.TrimSpace(fields[2]), `"`))
+	if err != nil || len(raw) < 2 {
+		return ""
+	}
+	alpha := raw[1:] // byte 0 is the display-condition bit field.
+	for len(alpha) > 0 && (alpha[len(alpha)-1] == 0xff || alpha[len(alpha)-1] == 0x00) {
+		alpha = alpha[:len(alpha)-1]
+	}
+	if len(alpha) == 0 {
+		return ""
+	}
+	if alpha[0] == 0x80 {
+		ucs2 := alpha[1:]
+		if len(ucs2)%2 != 0 {
+			ucs2 = ucs2[:len(ucs2)-1]
+		}
+		units := make([]uint16, 0, len(ucs2)/2)
+		for index := 0; index+1 < len(ucs2); index += 2 {
+			unit := uint16(ucs2[index])<<8 | uint16(ucs2[index+1])
+			if unit != 0xffff && unit != 0 {
+				units = append(units, unit)
+			}
+		}
+		return strings.TrimSpace(string(utf16.Decode(units)))
+	}
+	// EF_SPN uses the unpacked GSM default alphabet. Its printable Latin subset
+	// is byte-compatible with UTF-8/ASCII and covers operator brands in practice.
+	printable := make([]byte, 0, len(alpha))
+	for _, value := range alpha {
+		if value >= 0x20 && value <= 0x7e {
+			printable = append(printable, value)
+		}
+	}
+	return strings.TrimSpace(string(printable))
+}
+
 func parseRegistrationStatus(response modem.Response) (int, bool) {
 	for _, prefix := range []string{"+CEREG:", "+CGREG:", "+CREG:"} {
 		values := csvValues(valueAfterPrefix(response, prefix))

internal/device/types.go

@@ -27,6 +27,7 @@ type NetworkRequest struct {
 	Enabled   bool   `json:"enabled"`
 	APN       string `json:"apn"`
 	IPVersion string `json:"ipVersion"`
+	Backend   string `json:"backend,omitempty"`
 }
 
 type NetworkResult struct {
@@ -81,6 +82,7 @@ type Snapshot struct {
 	Firmware           string      `json:"firmware"`
 	SIMStatus          string      `json:"simStatus"`
 	SIMReady           bool        `json:"simReady"`
+	SIMChanged         bool        `json:"simChanged,omitempty"`
 	SignalRaw          *int        `json:"signalRaw,omitempty"`
 	SignalPercent      *int        `json:"signalPercent,omitempty"`
 	RSSIDBm            *int        `json:"rssiDbm,omitempty"`
@@ -98,6 +100,7 @@ type Snapshot struct {
 	IMEI               string      `json:"imei"`
 	ICCID              string      `json:"iccid"`
 	IMSI               string      `json:"imsi"`
+	SPN                string      `json:"spn,omitempty"`
 	OperatingMode      int         `json:"operatingMode"`
 	ModeKnown          bool        `json:"modeKnown"`
 	FlightMode         bool        `json:"flightMode"`

internal/exportproxy/bind_linux.go

@@ -8,9 +8,9 @@ import (
 	"hash/fnv"
 	"net"
 	"os"
-	"path/filepath"
 	"strings"
 	"syscall"
+	"unicode"
 )
 
 func platformSupported() error { return nil }
@@ -54,14 +54,15 @@ func boundResolver(networkInterface string) *net.Resolver {
 }
 
 func exportRouteDNSServers(networkInterface string) []string {
-	safeName := strings.Map(func(character rune) rune {
-		if character >= 'a' && character <= 'z' || character >= 'A' && character <= 'Z' ||
-			character >= '0' && character <= '9' || character == '-' || character == '_' || character == '.' {
-			return character
-		}
-		return '_'
-	}, networkInterface)
-	file, err := os.Open(filepath.Join("/run/vocat", "cellular-"+safeName+".dns"))
+	if !validInterfaceName(networkInterface) {
+		return []string{"1.1.1.1", "8.8.8.8"}
+	}
+	root, err := os.OpenRoot("/run/vocat")
+	if err != nil {
+		return []string{"1.1.1.1", "8.8.8.8"}
+	}
+	defer root.Close()
+	file, err := root.Open("cellular-" + networkInterface + ".dns")
 	if err != nil {
 		return []string{"1.1.1.1", "8.8.8.8"}
 	}
@@ -78,3 +79,20 @@ func exportRouteDNSServers(networkInterface string) []string {
 	}
 	return servers
 }
+
+// Linux IFNAMSIZ is 16 including the terminator. Restricting names here both
+// matches kernel interface names and prevents a stored device value from ever
+// becoming a filesystem path component.
+func validInterfaceName(value string) bool {
+	if value == "" || len(value) > 15 || value == "." || value == ".." {
+		return false
+	}
+	for _, character := range value {
+		if character > unicode.MaxASCII || !(character >= 'a' && character <= 'z' ||
+			character >= 'A' && character <= 'Z' || character >= '0' && character <= '9' ||
+			character == '-' || character == '_' || character == '.') {
+			return false
+		}
+	}
+	return true
+}

internal/exportproxy/bind_linux_test.go

@@ -0,0 +1,18 @@
+//go:build linux
+
+package exportproxy
+
+import "testing"
+
+func TestValidInterfaceName(t *testing.T) {
+	for _, value := range []string{"wwan0", "wwp0s20f0u5i4", "rmnet_data0", "usb.1"} {
+		if !validInterfaceName(value) {
+			t.Errorf("validInterfaceName(%q) = false", value)
+		}
+	}
+	for _, value := range []string{"", ".", "..", "../wwan0", `..\wwan0`, "wwan0/evil", "interface-name-too-long"} {
+		if validInterfaceName(value) {
+			t.Errorf("validInterfaceName(%q) = true", value)
+		}
+	}
+}

internal/extensions/manager.go

@@ -26,6 +26,7 @@ import (
 	"time"
 
 	"vocat/internal/exportproxy"
+	"vocat/internal/netguard"
 )
 
 const maxPackageBytes int64 = 64 << 20
@@ -73,7 +74,7 @@ func NewManager(root string, logger *slog.Logger) (*Manager, error) {
 	}
 	manager := &Manager{
 		root: root, logger: logger, plugins: make(map[string]*Plugin),
-		client: &http.Client{Timeout: 45 * time.Second},
+		client: netguard.NewPublicHTTPClient(45*time.Second, true),
 	}
 	if err := manager.scan(); err != nil {
 		return nil, err
@@ -155,9 +156,9 @@ func (manager *Manager) List() []Plugin {
 }
 
 func (manager *Manager) InstallURL(ctx context.Context, rawURL, expectedSHA string) (Plugin, error) {
-	parsed, err := url.Parse(strings.TrimSpace(rawURL))
-	if err != nil || (parsed.Scheme != "https" && parsed.Scheme != "http") || parsed.Host == "" {
-		return Plugin{}, errors.New("plugin URL must be an absolute HTTP or HTTPS URL")
+	parsed, err := netguard.ValidatePublicURL(ctx, rawURL, true)
+	if err != nil {
+		return Plugin{}, fmt.Errorf("plugin URL must be a public absolute HTTPS URL: %w", err)
 	}
 	request, err := http.NewRequestWithContext(ctx, http.MethodGet, parsed.String(), nil)
 	if err != nil {
@@ -353,12 +354,13 @@ func (manager *Manager) ServeAsset(w http.ResponseWriter, r *http.Request, id, n
 		http.NotFound(w, r)
 		return
 	}
-	filename := filepath.Join(plugin.dir, filepath.FromSlash(name))
-	if !strings.HasPrefix(filepath.Clean(filename), filepath.Clean(plugin.dir)+string(os.PathSeparator)) {
+	root, err := os.OpenRoot(plugin.dir)
+	if err != nil {
 		http.NotFound(w, r)
 		return
 	}
-	file, err := os.Open(filename)
+	defer root.Close()
+	file, err := root.Open(filepath.FromSlash(name))
 	if err != nil {
 		http.NotFound(w, r)
 		return
@@ -369,7 +371,7 @@ func (manager *Manager) ServeAsset(w http.ResponseWriter, r *http.Request, id, n
 		http.NotFound(w, r)
 		return
 	}
-	contentType := mime.TypeByExtension(filepath.Ext(filename))
+	contentType := mime.TypeByExtension(filepath.Ext(name))
 	if contentType != "" {
 		w.Header().Set("Content-Type", contentType)
 	}

internal/extensions/manager_test.go

@@ -3,12 +3,30 @@ package extensions
 import (
 	"archive/zip"
 	"bytes"
+	"context"
 	"io"
 	"log/slog"
 	"strings"
 	"testing"
 )
 
+func TestInstallURLRejectsNonHTTPSAndPrivateDestinations(t *testing.T) {
+	manager, err := NewManager(t.TempDir(), nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer manager.Close()
+	for _, raw := range []string{
+		"http://example.com/plugin.zip",
+		"https://127.0.0.1/plugin.zip",
+		"https://169.254.169.254/latest/meta-data/",
+	} {
+		if _, err := manager.InstallURL(context.Background(), raw, ""); err == nil {
+			t.Errorf("InstallURL(%q) accepted an unsafe destination", raw)
+		}
+	}
+}
+
 func TestInstallListDisableAndUninstall(t *testing.T) {
 	manager, err := NewManager(t.TempDir(), slog.New(slog.NewTextHandler(io.Discard, nil)))
 	if err != nil {

internal/modem/discovery.go

@@ -221,7 +221,13 @@ func readSerialAliases(root string) map[string]string {
 func candidateID(productID, serialNumber, usbName string) string {
 	serialNumber = strings.TrimSpace(serialNumber)
 	if serialNumber != "" && !strings.EqualFold(serialNumber, "android") {
-		return "quectel-" + sanitizeID(serialNumber)
+		// A surprising number of EC20/EC25 carrier boards expose the same
+		// factory/default USB serial number.  The device manager is keyed by this
+		// value, so using the serial alone silently collapsed two modems connected
+		// to the same hub into one entry.  Include the physical USB topology in the
+		// discovery key; configured devices remain stable through ATMapper's
+		// USB-path/IMEI matching even when Linux renumbers ttyUSB nodes.
+		return "quectel-" + sanitizeID(serialNumber+"-"+usbName)
 	}
 	return "quectel-" + sanitizeID(productID+"-"+usbName)
 }

internal/modem/discovery_test.go

@@ -171,6 +171,51 @@ func TestSysFSDiscoverySelectsATPortForSecondQMIUSBModem(t *testing.T) {
 	}
 }
 
+func TestSysFSDiscoveryDoesNotCollapseModemsWithSharedFactorySerial(t *testing.T) {
+	root := t.TempDir()
+	sysRoot := filepath.Join(root, "sys")
+	devRoot := filepath.Join(root, "dev")
+	usbRoot := filepath.Join(sysRoot, "bus", "usb", "devices")
+
+	for index, item := range []struct {
+		usbName string
+		ttyBase int
+	}{
+		{usbName: "1-5.1", ttyBase: 0},
+		{usbName: "1-5.2", ttyBase: 4},
+	} {
+		mustWrite(t, filepath.Join(usbRoot, item.usbName, "idVendor"), "2c7c\n")
+		mustWrite(t, filepath.Join(usbRoot, item.usbName, "idProduct"), "0125\n")
+		mustWrite(t, filepath.Join(usbRoot, item.usbName, "serial"), "0123456789ABCDEF\n")
+		for number := 0; number < 4; number++ {
+			interfaceName := item.usbName + ":1." + strconv.Itoa(number)
+			tty := fmt.Sprintf("ttyUSB%d", item.ttyBase+number)
+			mustWrite(t, filepath.Join(usbRoot, interfaceName, "bInterfaceNumber"), fmt.Sprintf("%02x\n", number))
+			mustMkdir(t, filepath.Join(usbRoot, interfaceName, tty, "tty", tty))
+		}
+		mustMkdir(t, filepath.Join(usbRoot, item.usbName+":1.4", "usbmisc", fmt.Sprintf("cdc-wdm%d", index)))
+	}
+
+	candidates, err := NewSysFSDiscoverer(sysRoot, devRoot).Discover(context.Background())
+	if err != nil {
+		t.Fatalf("Discover: %v", err)
+	}
+	if len(candidates) != 2 {
+		t.Fatalf("got %d candidates, want 2", len(candidates))
+	}
+	if candidates[0].ID == candidates[1].ID {
+		t.Fatalf("shared factory serial collapsed discovery IDs to %q", candidates[0].ID)
+	}
+	for _, candidate := range candidates {
+		if candidate.SerialNumber != "0123456789ABCDEF" {
+			t.Fatalf("serial = %q", candidate.SerialNumber)
+		}
+		if candidate.ATPort.Role != PortRoleAT {
+			t.Fatalf("AT port = %#v", candidate.ATPort)
+		}
+	}
+}
+
 func TestSysFSDiscoveryIgnoresNonQuectelUSB(t *testing.T) {
 	root := t.TempDir()
 	usbRoot := filepath.Join(root, "sys", "bus", "usb", "devices")

internal/netguard/public.go

@@ -0,0 +1,170 @@
+package netguard
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"net/netip"
+	"net/url"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// ValidatePublicURL accepts an absolute HTTP(S) URL only when every currently
+// resolved address is publicly routable. The transport returned by
+// NewPublicHTTPClient repeats the same check when it dials, which also prevents
+// DNS rebinding between validation and connection establishment.
+func ValidatePublicURL(ctx context.Context, raw string, requireHTTPS bool) (*url.URL, error) {
+	parsed, err := url.Parse(strings.TrimSpace(raw))
+	if err != nil || !parsed.IsAbs() || parsed.Hostname() == "" {
+		return nil, errors.New("destination must be an absolute HTTP URL")
+	}
+	if parsed.User != nil {
+		return nil, errors.New("destination URL cannot contain user information")
+	}
+	if parsed.Scheme != "http" && parsed.Scheme != "https" {
+		return nil, errors.New("destination URL must use HTTP or HTTPS")
+	}
+	if requireHTTPS && parsed.Scheme != "https" {
+		return nil, errors.New("destination URL must use HTTPS")
+	}
+	if port := parsed.Port(); port != "" {
+		value, err := strconv.Atoi(port)
+		if err != nil || value < 1 || value > 65535 {
+			return nil, errors.New("destination URL has an invalid port")
+		}
+	}
+	if _, err := resolvePublic(ctx, parsed.Hostname()); err != nil {
+		return nil, err
+	}
+	return parsed, nil
+}
+
+// NewPublicHTTPClient creates a client that never uses environment proxies,
+// rejects private/special-use destinations at dial time, and validates every
+// redirect before following it.
+func NewPublicHTTPClient(timeout time.Duration, requireHTTPS bool) *http.Client {
+	if timeout <= 0 {
+		timeout = 30 * time.Second
+	}
+	transport := &http.Transport{
+		Proxy:                 nil,
+		DialContext:           PublicDialer(timeout),
+		ForceAttemptHTTP2:     true,
+		TLSHandshakeTimeout:   timeout,
+		ResponseHeaderTimeout: timeout,
+		ExpectContinueTimeout: time.Second,
+		TLSClientConfig: &tls.Config{
+			MinVersion: tls.VersionTLS12,
+		},
+	}
+	return &http.Client{
+		Transport: transport,
+		Timeout:   timeout,
+		CheckRedirect: func(request *http.Request, via []*http.Request) error {
+			if len(via) >= 4 {
+				return errors.New("too many redirects")
+			}
+			_, err := ValidatePublicURL(request.Context(), request.URL.String(), requireHTTPS)
+			return err
+		},
+	}
+}
+
+// PublicDialer resolves the original hostname and connects directly to one of
+// its validated public addresses. It does not pass the hostname back through a
+// second resolver, so a DNS rebinding response cannot redirect the connection.
+func PublicDialer(timeout time.Duration) func(context.Context, string, string) (net.Conn, error) {
+	return func(ctx context.Context, network, address string) (net.Conn, error) {
+		host, port, err := net.SplitHostPort(address)
+		if err != nil {
+			return nil, fmt.Errorf("parse outbound address: %w", err)
+		}
+		addresses, err := resolvePublic(ctx, host)
+		if err != nil {
+			return nil, err
+		}
+		dialer := net.Dialer{Timeout: timeout}
+		var lastErr error
+		for _, address := range addresses {
+			connection, err := dialer.DialContext(ctx, network, net.JoinHostPort(address.String(), port))
+			if err == nil {
+				return connection, nil
+			}
+			lastErr = err
+		}
+		return nil, fmt.Errorf("connect to public destination: %w", lastErr)
+	}
+}
+
+func resolvePublic(ctx context.Context, host string) ([]netip.Addr, error) {
+	if literal, err := netip.ParseAddr(strings.Trim(host, "[]")); err == nil {
+		literal = literal.Unmap()
+		if !publicAddress(literal) {
+			return nil, errors.New("destination resolves to a private or special-use address")
+		}
+		return []netip.Addr{literal}, nil
+	}
+	addresses, err := net.DefaultResolver.LookupNetIP(ctx, "ip", host)
+	if err != nil {
+		return nil, fmt.Errorf("resolve destination: %w", err)
+	}
+	result := make([]netip.Addr, 0, len(addresses))
+	for _, address := range addresses {
+		address = address.Unmap()
+		if !publicAddress(address) {
+			return nil, errors.New("destination resolves to a private or special-use address")
+		}
+		result = append(result, address)
+	}
+	if len(result) == 0 {
+		return nil, errors.New("destination has no IP address")
+	}
+	return result, nil
+}
+
+var blockedNetworks = []netip.Prefix{
+	netip.MustParsePrefix("0.0.0.0/8"),
+	netip.MustParsePrefix("10.0.0.0/8"),
+	netip.MustParsePrefix("100.64.0.0/10"),
+	netip.MustParsePrefix("127.0.0.0/8"),
+	netip.MustParsePrefix("169.254.0.0/16"),
+	netip.MustParsePrefix("172.16.0.0/12"),
+	netip.MustParsePrefix("192.0.0.0/24"),
+	netip.MustParsePrefix("192.0.2.0/24"),
+	netip.MustParsePrefix("192.88.99.0/24"),
+	netip.MustParsePrefix("192.168.0.0/16"),
+	netip.MustParsePrefix("198.18.0.0/15"),
+	netip.MustParsePrefix("198.51.100.0/24"),
+	netip.MustParsePrefix("203.0.113.0/24"),
+	netip.MustParsePrefix("224.0.0.0/4"),
+	netip.MustParsePrefix("240.0.0.0/4"),
+	netip.MustParsePrefix("::/128"),
+	netip.MustParsePrefix("::1/128"),
+	netip.MustParsePrefix("64:ff9b:1::/48"),
+	netip.MustParsePrefix("100::/64"),
+	netip.MustParsePrefix("2001:db8::/32"),
+	netip.MustParsePrefix("fc00::/7"),
+	netip.MustParsePrefix("fe80::/10"),
+	netip.MustParsePrefix("ff00::/8"),
+	// Block both the well-known and local-use NAT64 prefixes. Otherwise a
+	// public-looking IPv6 literal could translate to a private IPv4 target.
+	netip.MustParsePrefix("64:ff9b::/96"),
+	netip.MustParsePrefix("2002::/16"),
+}
+
+func publicAddress(address netip.Addr) bool {
+	if !address.IsValid() || !address.IsGlobalUnicast() {
+		return false
+	}
+	for _, blocked := range blockedNetworks {
+		if blocked.Contains(address) {
+			return false
+		}
+	}
+	return true
+}

internal/netguard/public_test.go

@@ -0,0 +1,29 @@
+package netguard
+
+import (
+	"context"
+	"testing"
+)
+
+func TestValidatePublicURLRejectsUnsafeDestinations(t *testing.T) {
+	tests := []string{
+		"http://127.0.0.1/plugin.zip",
+		"https://[::1]/plugin.zip",
+		"https://169.254.169.254/latest/meta-data/",
+		"https://[64:ff9b::7f00:1]/",
+		"https://[2002:7f00:1::]/",
+		"file:///etc/passwd",
+		"https://user:[email protected]/plugin.zip",
+	}
+	for _, raw := range tests {
+		if _, err := ValidatePublicURL(context.Background(), raw, false); err == nil {
+			t.Errorf("ValidatePublicURL(%q) accepted an unsafe destination", raw)
+		}
+	}
+}
+
+func TestValidatePublicURLCanRequireHTTPS(t *testing.T) {
+	if _, err := ValidatePublicURL(context.Background(), "http://8.8.8.8/plugin.zip", true); err == nil {
+		t.Fatal("HTTP destination was accepted while HTTPS was required")
+	}
+}

internal/server/automatic_task_notifications.go

@@ -0,0 +1,306 @@
+package server
+
+import (
+	"bytes"
+	"context"
+	"crypto/hmac"
+	"crypto/sha256"
+	"crypto/tls"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"mime"
+	"net"
+	"net/http"
+	"net/mail"
+	"net/smtp"
+	"strconv"
+	"strings"
+	"time"
+
+	"vocat/internal/store"
+)
+
+type automaticTaskNotification struct {
+	Title string
+	Text  string
+	Time  time.Time
+	Task  store.AutomaticTask
+	Run   store.AutomaticTaskRun
+}
+
+func (s *Server) notifyAutomaticTask(ctx context.Context, task store.AutomaticTask, run store.AutomaticTaskRun) {
+	deviceLabel := task.DeviceID
+	if configured, err := s.store.Device(ctx, task.DeviceID); err == nil {
+		deviceLabel = firstNonEmpty(configured.Name, configured.ID)
+	}
+	status := "成功"
+	detail := firstNonEmpty(run.Output, "任务已完成")
+	if run.Status != "success" {
+		status = "失败"
+		detail = firstNonEmpty(run.Error, "未知错误")
+	}
+	taskType := map[string]string{"sms": "发送短信", "call": "拨打电话", "public_ip": "获取漫游公网 IP"}[task.TaskType]
+	environment := map[string]string{"vowifi": "VoWiFi", "cellular": "基站直连"}[task.Environment]
+	notification := automaticTaskNotification{
+		Title: "自动任务执行" + status,
+		Text: strings.Join([]string{
+			"自动任务执行" + status,
+			"任务  " + task.Name,
+			"设备  " + deviceLabel,
+			"类型  " + firstNonEmpty(taskType, task.TaskType),
+			"环境  " + firstNonEmpty(environment, task.Environment),
+			"时间  " + run.FinishedAt.Local().Format("2006-01-02 15:04:05"),
+			"结果  " + detail,
+		}, "\n"),
+		Time: run.FinishedAt, Task: task, Run: run,
+	}
+	for _, channel := range []string{"telegram", "bark", "email", "pushplus", "webhook"} {
+		setting, err := s.store.NotificationSetting(ctx, channel)
+		if errors.Is(err, store.ErrNotFound) || (err == nil && !setting.Enabled) {
+			continue
+		}
+		if err != nil {
+			s.logger.Warn("read automatic task notification setting", "channel", channel, "error", err)
+			continue
+		}
+		var config map[string]any
+		if err := json.Unmarshal(setting.Config, &config); err != nil {
+			s.logger.Warn("decode automatic task notification setting", "channel", channel, "error", err)
+			continue
+		}
+		if err := sendAutomaticTaskNotification(ctx, channel, config, notification); err != nil {
+			s.logger.Warn("send automatic task notification", "channel", channel, "task_id", task.ID, "error", err)
+		}
+	}
+}
+
+func sendAutomaticTaskNotification(ctx context.Context, channel string, config map[string]any, message automaticTaskNotification) error {
+	switch channel {
+	case "telegram":
+		return sendTelegramTextNotification(ctx, config, message.Text)
+	case "bark":
+		return sendBarkTextNotification(ctx, config, message.Title, message.Text)
+	case "email":
+		return sendEmailTextNotification(ctx, config, message.Title, message.Text)
+	case "pushplus":
+		return sendPushplusTextNotification(ctx, config, message.Title, message.Text)
+	case "webhook":
+		return sendAutomaticTaskWebhook(ctx, config, message)
+	default:
+		return fmt.Errorf("unsupported notification channel %q", channel)
+	}
+}
+
+func sendTelegramTextNotification(ctx context.Context, config map[string]any, text string) error {
+	token := configString(config, "bot_token")
+	parsed, err := validateTelegramAPIURL(ctx, configString(config, "base_url"), token, "sendMessage")
+	if err != nil {
+		return err
+	}
+	client, err := restrictedHTTPClient(ctx, 8*time.Second, configString(config, "proxy"))
+	if err != nil {
+		return err
+	}
+	payload, _ := json.Marshal(map[string]any{"chat_id": configString(config, "chat_id"), "text": text})
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, parsed.String(), bytes.NewReader(payload))
+	if err != nil {
+		return err
+	}
+	request.Header.Set("Content-Type", "application/json")
+	request.Header.Set("User-Agent", "vocat-automatic-task/1")
+	return performNotificationRequest(client, request, true)
+}
+
+func sendBarkTextNotification(ctx context.Context, config map[string]any, title, text string) error {
+	client, err := restrictedHTTPClient(ctx, 8*time.Second, "")
+	if err != nil {
+		return err
+	}
+	payload := map[string]any{"title": title, "body": text}
+	for _, field := range []string{"group", "icon", "level"} {
+		if value := configString(config, field); value != "" {
+			payload[field] = value
+		}
+	}
+	encoded, _ := json.Marshal(payload)
+	for _, destination := range configStrings(config, "urls") {
+		parsed, err := validateOutboundURL(ctx, destination, false)
+		if err != nil {
+			return err
+		}
+		request, err := http.NewRequestWithContext(ctx, http.MethodPost, parsed.String(), bytes.NewReader(encoded))
+		if err != nil {
+			return err
+		}
+		request.Header.Set("Content-Type", "application/json; charset=utf-8")
+		request.Header.Set("User-Agent", "vocat-automatic-task/1")
+		if err := performNotificationRequest(client, request, false); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func sendPushplusTextNotification(ctx context.Context, config map[string]any, title, text string) error {
+	destination, err := validateOutboundURL(ctx, "https://www.pushplus.plus/send", true)
+	if err != nil {
+		return err
+	}
+	payload := map[string]any{"token": configString(config, "token"), "title": title, "content": text, "template": "txt", "timestamp": time.Now().UnixMilli()}
+	if topic := configString(config, "topic"); topic != "" {
+		payload["topic"] = topic
+	}
+	if channel := configString(config, "channel"); channel != "" {
+		payload["channel"] = channel
+	}
+	encoded, _ := json.Marshal(payload)
+	client, err := restrictedHTTPClient(ctx, 8*time.Second, "")
+	if err != nil {
+		return err
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, destination.String(), bytes.NewReader(encoded))
+	if err != nil {
+		return err
+	}
+	request.Header.Set("Content-Type", "application/json; charset=utf-8")
+	request.Header.Set("User-Agent", "vocat-automatic-task/1")
+	response, err := client.Do(request)
+	if err != nil {
+		return err
+	}
+	defer response.Body.Close()
+	body, _ := io.ReadAll(io.LimitReader(response.Body, 64<<10))
+	var result struct {
+		Code int    `json:"code"`
+		Msg  string `json:"msg"`
+	}
+	if response.StatusCode < 200 || response.StatusCode >= 300 || json.Unmarshal(body, &result) != nil || result.Code != 200 {
+		return fmt.Errorf("%w: Pushplus HTTP %d code %d %s", errProviderRejected, response.StatusCode, result.Code, result.Msg)
+	}
+	return nil
+}
+
+func sendAutomaticTaskWebhook(ctx context.Context, config map[string]any, message automaticTaskNotification) error {
+	payload, _ := json.Marshal(map[string]any{
+		"event": "automatic_task.completed", "message": message.Text,
+		"timestamp": message.Time.UTC().Format(time.RFC3339), "task_id": message.Task.ID,
+		"task_name": message.Task.Name, "device_id": message.Task.DeviceID,
+		"task_type": message.Task.TaskType, "environment": message.Task.Environment,
+		"status": message.Run.Status, "attempts": message.Run.Attempts,
+		"output": message.Run.Output, "error": message.Run.Error,
+	})
+	client, err := restrictedHTTPClient(ctx, durationMilliseconds(configInt(config, "timeout_ms"), 5*time.Second), "")
+	if err != nil {
+		return err
+	}
+	for _, destination := range configStrings(config, "urls") {
+		parsed, err := validateOutboundURL(ctx, destination, false)
+		if err != nil {
+			return err
+		}
+		request, err := http.NewRequestWithContext(ctx, http.MethodPost, parsed.String(), bytes.NewReader(payload))
+		if err != nil {
+			return err
+		}
+		for name, value := range configStringMap(config, "headers") {
+			request.Header.Set(name, value)
+		}
+		request.Header.Set("Content-Type", "application/json")
+		request.Header.Set("User-Agent", "vocat-automatic-task/1")
+		if secret := configString(config, "secret"); secret != "" {
+			signature := hmac.New(sha256.New, []byte(secret))
+			_, _ = signature.Write(payload)
+			request.Header.Set("X-vocat-Signature", "sha256="+hex.EncodeToString(signature.Sum(nil)))
+		}
+		if err := performNotificationRequest(client, request, false); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func sendEmailTextNotification(ctx context.Context, config map[string]any, subject, text string) error {
+	host := strings.TrimSpace(configString(config, "smtp_host"))
+	port := configInt(config, "smtp_port")
+	if port == 0 {
+		port = 587
+	}
+	timeout := 8 * time.Second
+	connection, err := dialRestricted(ctx, "tcp", net.JoinHostPort(host, strconv.Itoa(port)), timeout)
+	if err != nil {
+		return err
+	}
+	defer connection.Close()
+	if err := connection.SetDeadline(time.Now().Add(timeout)); err != nil {
+		return err
+	}
+	tlsConfig := &tls.Config{MinVersion: tls.VersionTLS12, ServerName: host}
+	useSSL, _ := config["use_ssl"].(bool)
+	implicitTLS := port == 465 || useSSL
+	if implicitTLS {
+		secure := tls.Client(connection, tlsConfig)
+		if err := secure.HandshakeContext(ctx); err != nil {
+			return err
+		}
+		connection = secure
+	}
+	client, err := smtp.NewClient(connection, host)
+	if err != nil {
+		return err
+	}
+	defer client.Close()
+	if !implicitTLS {
+		if available, _ := client.Extension("STARTTLS"); !available {
+			return errors.New("SMTP server does not offer STARTTLS")
+		}
+		if err := client.StartTLS(tlsConfig); err != nil {
+			return err
+		}
+	}
+	username, password := configString(config, "username"), configString(config, "password")
+	if username != "" {
+		if err := client.Auth(smtp.PlainAuth("", username, password, host)); err != nil {
+			return err
+		}
+	}
+	from, err := parseMailAddress(configString(config, "from_address"))
+	if err != nil {
+		return err
+	}
+	var recipients []*mail.Address
+	for _, item := range configStrings(config, "to_addresses") {
+		address, err := parseMailAddress(item)
+		if err != nil {
+			return err
+		}
+		recipients = append(recipients, address)
+	}
+	if err := client.Mail(from.Address); err != nil {
+		return err
+	}
+	for _, recipient := range recipients {
+		if err := client.Rcpt(recipient.Address); err != nil {
+			return err
+		}
+	}
+	writer, err := client.Data()
+	if err != nil {
+		return err
+	}
+	email := strings.Join([]string{
+		"Date: " + time.Now().UTC().Format(time.RFC1123Z), "From: " + formatMailAddress(from),
+		"To: " + joinMailAddresses(recipients), "Subject: " + mime.QEncoding.Encode("UTF-8", subject),
+		"MIME-Version: 1.0", "Content-Type: text/plain; charset=UTF-8", "Content-Transfer-Encoding: 8bit", "", text, "",
+	}, "\r\n")
+	if _, err := io.WriteString(writer, email); err != nil {
+		_ = writer.Close()
+		return err
+	}
+	if err := writer.Close(); err != nil {
+		return err
+	}
+	return client.Quit()
+}

internal/server/automatic_tasks.go

@@ -0,0 +1,665 @@
+package server
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"vocat/internal/device"
+	"vocat/internal/exportproxy"
+	"vocat/internal/store"
+)
+
+const (
+	automaticTaskPollInterval = 5 * time.Second
+	automaticTaskMaxRuntime   = 8 * time.Minute
+)
+
+type automaticTaskPayload struct {
+	Phone           string `json:"phone,omitempty"`
+	Message         string `json:"message,omitempty"`
+	DurationSeconds int    `json:"duration_seconds,omitempty"`
+}
+
+type automaticTaskExecutionError struct {
+	err       error
+	retryable bool
+}
+
+func (value automaticTaskExecutionError) Error() string { return value.err.Error() }
+func (value automaticTaskExecutionError) Unwrap() error { return value.err }
+
+type automaticTaskScheduler struct {
+	server *Server
+	ctx    context.Context
+	mu     sync.Mutex
+	queues map[string]chan store.AutomaticTaskRun
+}
+
+func (s *Server) StartAutomaticTasks(ctx context.Context) {
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	scheduler := &automaticTaskScheduler{server: s, ctx: ctx, queues: make(map[string]chan store.AutomaticTaskRun)}
+	s.automaticTasks = scheduler
+	go scheduler.run()
+}
+
+func (scheduler *automaticTaskScheduler) run() {
+	ticker := time.NewTicker(automaticTaskPollInterval)
+	defer ticker.Stop()
+	scheduler.claim()
+	for {
+		select {
+		case <-scheduler.ctx.Done():
+			return
+		case <-ticker.C:
+			scheduler.claim()
+		}
+	}
+}
+
+func (scheduler *automaticTaskScheduler) claim() {
+	runs, err := scheduler.server.store.ClaimDueAutomaticTasks(scheduler.ctx, time.Now().UTC(), 50)
+	if err != nil {
+		scheduler.server.logger.Warn("claim automatic tasks", "error", err)
+		return
+	}
+	for _, run := range runs {
+		scheduler.enqueue(run)
+	}
+}
+
+func (scheduler *automaticTaskScheduler) enqueue(run store.AutomaticTaskRun) {
+	deviceID := strings.TrimSpace(run.DeviceID)
+	scheduler.mu.Lock()
+	queue := scheduler.queues[deviceID]
+	if queue == nil {
+		queue = make(chan store.AutomaticTaskRun, 100)
+		scheduler.queues[deviceID] = queue
+		go scheduler.worker(deviceID, queue)
+	}
+	scheduler.mu.Unlock()
+	select {
+	case queue <- run:
+	case <-scheduler.ctx.Done():
+	}
+}
+
+func (scheduler *automaticTaskScheduler) worker(deviceID string, queue <-chan store.AutomaticTaskRun) {
+	for {
+		select {
+		case <-scheduler.ctx.Done():
+			return
+		case run := <-queue:
+			scheduler.execute(run)
+		}
+	}
+}
+
+func (scheduler *automaticTaskScheduler) execute(run store.AutomaticTaskRun) {
+	task, err := scheduler.server.store.AutomaticTask(scheduler.ctx, run.TaskID)
+	if err != nil {
+		run.Status, run.Error, run.FinishedAt = "failed", err.Error(), time.Now().UTC()
+		_ = scheduler.server.store.UpdateAutomaticTaskRun(context.Background(), run)
+		return
+	}
+	run.Status, run.StartedAt = "running", time.Now().UTC()
+	_ = scheduler.server.store.UpdateAutomaticTaskRun(context.Background(), run)
+	var output string
+	for attempt := 1; attempt <= task.RetryCount+1; attempt++ {
+		run.Attempts = attempt
+		_ = scheduler.server.store.UpdateAutomaticTaskRun(context.Background(), run)
+		operationContext, cancel := context.WithTimeout(scheduler.ctx, automaticTaskMaxRuntime)
+		output, err = scheduler.server.executeAutomaticTask(operationContext, task)
+		cancel()
+		if err == nil {
+			break
+		}
+		var executionError automaticTaskExecutionError
+		if errors.As(err, &executionError) && !executionError.retryable {
+			break
+		}
+		if attempt <= task.RetryCount {
+			scheduler.server.logger.Warn("automatic task attempt failed", "task_id", task.ID, "device_id", task.DeviceID, "attempt", attempt, "error", err)
+			select {
+			case <-scheduler.ctx.Done():
+				break
+			case <-time.After(time.Duration(attempt*5) * time.Second):
+			}
+		}
+	}
+	run.FinishedAt = time.Now().UTC()
+	if err == nil {
+		run.Status, run.Output, run.Error = "success", output, ""
+	} else {
+		run.Status, run.Error = "failed", err.Error()
+	}
+	if updateErr := scheduler.server.store.UpdateAutomaticTaskRun(context.Background(), run); updateErr != nil {
+		scheduler.server.logger.Warn("finish automatic task run", "run_id", run.ID, "error", updateErr)
+	}
+	if task.Notify {
+		go scheduler.server.notifyAutomaticTask(context.Background(), task, run)
+	}
+}
+
+func (s *Server) executeAutomaticTask(ctx context.Context, task store.AutomaticTask) (string, error) {
+	config, entry, physicalID, err := s.ensureAutomaticTaskProfile(ctx, task)
+	if err != nil {
+		return "", err
+	}
+	networkWasEnabled := config.NetworkEnabled
+	if err := s.prepareAutomaticTaskEnvironment(ctx, &config, entry, physicalID, task); err != nil {
+		return "", err
+	}
+	var payload automaticTaskPayload
+	if err := json.Unmarshal(task.Payload, &payload); err != nil {
+		return "", fmt.Errorf("decode task payload: %w", err)
+	}
+	switch task.TaskType {
+	case "sms":
+		return s.executeAutomaticSMS(ctx, task, payload)
+	case "call":
+		return s.executeAutomaticCall(ctx, task, payload)
+	case "public_ip":
+		return s.executeAutomaticPublicIP(ctx, config, physicalID, task.ProfileICCID, networkWasEnabled)
+	default:
+		return "", fmt.Errorf("unsupported automatic task type %q", task.TaskType)
+	}
+}
+
+func (s *Server) ensureAutomaticTaskProfile(ctx context.Context, task store.AutomaticTask) (store.Device, device.Device, string, error) {
+	config, err := s.store.Device(ctx, task.DeviceID)
+	if err != nil {
+		return store.Device{}, device.Device{}, "", fmt.Errorf("read device: %w", err)
+	}
+	entry, physicalID, present := s.physicalForConfig(config)
+	if !present || entry.Snapshot == nil {
+		return store.Device{}, device.Device{}, "", errors.New("configured device is offline")
+	}
+	if strings.EqualFold(strings.TrimSpace(entry.Snapshot.ICCID), strings.TrimSpace(task.ProfileICCID)) {
+		return config, entry, physicalID, nil
+	}
+	if _, err := s.devices.SetFlight(ctx, physicalID, true); err != nil {
+		return store.Device{}, device.Device{}, "", fmt.Errorf("enter airplane mode before profile switch: %w", err)
+	}
+	if err := s.devices.ESIMSwitchProfile(ctx, physicalID, task.ProfileICCID, task.ProfileAID); err != nil {
+		return store.Device{}, device.Device{}, "", fmt.Errorf("switch eSIM profile: %w", err)
+	}
+	entry, physicalID, present = s.physicalForConfig(config)
+	if !present {
+		return store.Device{}, device.Device{}, "", errors.New("device did not recover after profile switch")
+	}
+	snapshot, err := s.devices.Refresh(ctx, physicalID)
+	if err != nil {
+		return store.Device{}, device.Device{}, "", fmt.Errorf("verify switched profile: %w", err)
+	}
+	if !strings.EqualFold(strings.TrimSpace(snapshot.ICCID), strings.TrimSpace(task.ProfileICCID)) {
+		return store.Device{}, device.Device{}, "", fmt.Errorf("profile verification failed: current ICCID is %s", firstNonEmpty(snapshot.ICCID, "unavailable"))
+	}
+	entry.Snapshot = &snapshot
+	return config, entry, physicalID, nil
+}
+
+func (s *Server) prepareAutomaticTaskEnvironment(ctx context.Context, config *store.Device, entry device.Device, physicalID string, task store.AutomaticTask) error {
+	iccid := strings.TrimSpace(task.ProfileICCID)
+	if task.Environment == "vowifi" {
+		if task.TaskType == "public_ip" {
+			return errors.New("public IP tasks cannot run over VoWiFi")
+		}
+		if _, err := s.devices.SetFlight(ctx, physicalID, true); err != nil {
+			return fmt.Errorf("enable airplane mode for VoWiFi: %w", err)
+		}
+		config.VoWiFiEnabled, config.NetworkEnabled = true, false
+		if err := s.store.UpsertDevice(ctx, *config); err != nil {
+			return err
+		}
+		if err := s.store.UpsertCardPolicy(ctx, store.CardPolicy{ICCID: iccid, VoWiFiEnabled: true, AirplaneEnabled: true, IPVersion: "IPV4V6", Source: "automatic_task"}); err != nil {
+			return err
+		}
+		if s.vowifi == nil {
+			return errors.New("VoWiFi runtime is unavailable")
+		}
+		state, stateErr := s.vowifi.State(config.ID)
+		stateMatchesCard := state.ICCID == "" || strings.EqualFold(strings.TrimSpace(state.ICCID), iccid)
+		if stateErr == nil && stateMatchesCard && state.IMSReady && (task.TaskType != "sms" || state.SMSReady) {
+			return nil
+		}
+		if stateErr == nil && state.Enabled {
+			_, stateErr = s.vowifi.RequestReconnect(config.ID)
+		} else {
+			_, stateErr = s.vowifi.RequestEnabled(config.ID, true)
+		}
+		if stateErr != nil {
+			return fmt.Errorf("start VoWiFi: %w", stateErr)
+		}
+		return s.waitAutomaticVoWiFi(ctx, config.ID, iccid, task.TaskType == "sms")
+	}
+	if s.vowifi != nil {
+		if state, stateErr := s.vowifi.State(config.ID); stateErr == nil && (state.Enabled || state.Active) {
+			if _, stateErr = s.vowifi.RequestEnabled(config.ID, false); stateErr != nil {
+				return fmt.Errorf("stop VoWiFi: %w", stateErr)
+			}
+			if err := s.waitAutomaticVoWiFiStopped(ctx, config.ID); err != nil {
+				return err
+			}
+		}
+	}
+	config.VoWiFiEnabled = false
+	config.NetworkEnabled = task.TaskType == "public_ip"
+	if err := s.store.UpsertDevice(ctx, *config); err != nil {
+		return err
+	}
+	if err := s.store.UpsertCardPolicy(ctx, store.CardPolicy{ICCID: iccid, NetworkEnabled: config.NetworkEnabled, VoWiFiEnabled: false, AirplaneEnabled: false, APN: config.APN, IPVersion: "IPV4V6", Source: "automatic_task"}); err != nil {
+		return err
+	}
+	if task.TaskType != "public_ip" {
+		if _, err := s.devices.SetNetwork(ctx, physicalID, device.NetworkRequest{Enabled: false, APN: config.APN, IPVersion: "IPV4V6", Backend: config.DeviceBackend}); err != nil {
+			s.logger.Warn("automatic task could not stop unused cellular data", "device_id", config.ID, "error", err)
+		}
+	}
+	if _, err := s.devices.SetFlight(ctx, physicalID, false); err != nil {
+		return fmt.Errorf("enable cellular radio: %w", err)
+	}
+	if _, err := s.devices.SetOperatorSelection(ctx, physicalID, true, "", nil); err != nil {
+		return fmt.Errorf("enable automatic network selection: %w", err)
+	}
+	if _, err := s.devices.ReRegisterOperator(ctx, physicalID); err != nil {
+		return fmt.Errorf("re-register cellular network: %w", err)
+	}
+	if err := s.waitAutomaticCellular(ctx, physicalID, task.TaskType == "public_ip"); err != nil {
+		return err
+	}
+	if task.TaskType == "public_ip" {
+		if !s.developerActive(ctx) {
+			return errors.New("roaming public IP tasks require developer mode")
+		}
+		if _, err := s.devices.SetNetwork(ctx, physicalID, device.NetworkRequest{Enabled: true, APN: config.APN, IPVersion: "IPV4V6", Backend: config.DeviceBackend}); err != nil {
+			s.rollbackAutomaticNetwork(config.ID, physicalID, iccid, *config)
+			return fmt.Errorf("start roaming data: %w", err)
+		}
+	}
+	return nil
+}
+
+func (s *Server) waitAutomaticVoWiFi(ctx context.Context, deviceID, iccid string, requireSMS bool) error {
+	ticker := time.NewTicker(2 * time.Second)
+	defer ticker.Stop()
+	for {
+		state, err := s.vowifi.State(deviceID)
+		if err == nil && state.IMSReady && (!requireSMS || state.SMSReady) && (state.ICCID == "" || strings.EqualFold(state.ICCID, iccid)) {
+			return nil
+		}
+		if err == nil && state.LastError != "" && !state.Active && !state.Enabled {
+			return errors.New(state.LastError)
+		}
+		select {
+		case <-ctx.Done():
+			if err == nil && state.LastError != "" {
+				return fmt.Errorf("wait for VoWiFi readiness: %s", state.LastError)
+			}
+			return fmt.Errorf("wait for VoWiFi readiness: %w", ctx.Err())
+		case <-ticker.C:
+		}
+	}
+}
+
+func (s *Server) waitAutomaticVoWiFiStopped(ctx context.Context, deviceID string) error {
+	ticker := time.NewTicker(time.Second)
+	defer ticker.Stop()
+	for {
+		state, err := s.vowifi.State(deviceID)
+		if err != nil || (!state.Active && !state.Enabled) {
+			return nil
+		}
+		select {
+		case <-ctx.Done():
+			return fmt.Errorf("wait for VoWiFi shutdown: %w", ctx.Err())
+		case <-ticker.C:
+		}
+	}
+}
+
+func (s *Server) waitAutomaticCellular(ctx context.Context, physicalID string, requirePacketAttach bool) error {
+	ticker := time.NewTicker(3 * time.Second)
+	defer ticker.Stop()
+	stableSamples := 0
+	for {
+		snapshot, err := s.devices.Refresh(ctx, physicalID)
+		registered := err == nil && (snapshot.RegistrationStatus == 1 || snapshot.RegistrationStatus == 5)
+		if registered && (!requirePacketAttach || snapshot.PSAttached) {
+			stableSamples++
+			if stableSamples >= 2 {
+				return nil
+			}
+		} else {
+			stableSamples = 0
+		}
+		if err == nil && snapshot.RegistrationStatus == 3 {
+			return errors.New("cellular network registration was denied")
+		}
+		select {
+		case <-ctx.Done():
+			return fmt.Errorf("wait for cellular registration: %w", ctx.Err())
+		case <-ticker.C:
+		}
+	}
+}
+
+func (s *Server) executeAutomaticSMS(ctx context.Context, task store.AutomaticTask, payload automaticTaskPayload) (string, error) {
+	body, _ := json.Marshal(map[string]any{"device_id": task.DeviceID, "phone": payload.Phone, "message": payload.Message})
+	recorder := httptest.NewRecorder()
+	request := httptest.NewRequestWithContext(ctx, http.MethodPost, "/api/sms/send", bytes.NewReader(body))
+	request.Header.Set("Content-Type", "application/json")
+	s.handleSMSSend(recorder, request)
+	if recorder.Code < 200 || recorder.Code >= 300 {
+		failure := fmt.Errorf("send SMS failed (HTTP %d): %s", recorder.Code, compactAutomaticResponse(recorder.Body.Bytes()))
+		// Once any part reached the modem/IMS transaction, retrying the whole
+		// message could deliver a duplicate. Preparation failures remain safe to
+		// retry according to the configured count.
+		return "", automaticTaskExecutionError{err: failure, retryable: automaticSMSRetrySafe(recorder.Body.Bytes())}
+	}
+	return "短信已提交到 " + payload.Phone, nil
+}
+
+func automaticSMSRetrySafe(body []byte) bool {
+	var payload struct {
+		Data struct {
+			PartsAttempted int   `json:"parts_attempted"`
+			PartsAccepted  int   `json:"parts_accepted"`
+			RetrySafe      *bool `json:"retry_safe"`
+		} `json:"data"`
+	}
+	if json.Unmarshal(body, &payload) != nil {
+		return false
+	}
+	if payload.Data.RetrySafe != nil {
+		return *payload.Data.RetrySafe
+	}
+	return payload.Data.PartsAttempted == 0 && payload.Data.PartsAccepted == 0
+}
+
+func (s *Server) executeAutomaticCall(ctx context.Context, task store.AutomaticTask, payload automaticTaskPayload) (string, error) {
+	config, err := s.store.Device(ctx, task.DeviceID)
+	if err != nil {
+		return "", err
+	}
+	_, physicalID, present := s.physicalForConfig(config)
+	if !present {
+		return "", errors.New("configured device is offline")
+	}
+	body, _ := json.Marshal(map[string]any{"number": payload.Phone, "duration_seconds": payload.DurationSeconds})
+	recorder := httptest.NewRecorder()
+	request := httptest.NewRequestWithContext(ctx, http.MethodPost, "/api/devices/calls/dial", bytes.NewReader(body))
+	request.Header.Set("Content-Type", "application/json")
+	s.handleCallAction(recorder, request, config, physicalID, "dial")
+	if recorder.Code < 200 || recorder.Code >= 300 {
+		return "", fmt.Errorf("dial failed (HTTP %d): %s", recorder.Code, compactAutomaticResponse(recorder.Body.Bytes()))
+	}
+	return fmt.Sprintf("已拨打 %s，将在 %d 秒后自动挂断", payload.Phone, payload.DurationSeconds), nil
+}
+
+func (s *Server) executeAutomaticPublicIP(ctx context.Context, config store.Device, physicalID, iccid string, networkWasEnabled bool) (string, error) {
+	if !networkWasEnabled {
+		defer s.rollbackAutomaticNetwork(config.ID, physicalID, iccid, config)
+	}
+	if strings.TrimSpace(config.Interface) == "" {
+		return "", errors.New("device has no cellular network interface")
+	}
+	info, err := exportproxy.LookupPublicIP(ctx, config.Interface)
+	if err != nil {
+		return "", fmt.Errorf("detect roaming public IP: %w", err)
+	}
+	s.savePublicIP(config.ID, iccid, info)
+	return strings.TrimSpace(fmt.Sprintf("公网 IP %s · %s %s", info.IP, info.CountryCode, info.Region)), nil
+}
+
+func (s *Server) rollbackAutomaticNetwork(deviceID, physicalID, iccid string, config store.Device) {
+	cleanupContext, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	if _, err := s.devices.SetNetwork(cleanupContext, physicalID, device.NetworkRequest{Enabled: false, APN: config.APN, IPVersion: "IPV4V6", Backend: config.DeviceBackend}); err != nil {
+		s.logger.Warn("stop one-shot automatic roaming data", "device_id", deviceID, "error", err)
+	}
+	config.NetworkEnabled = false
+	if err := s.store.UpsertDevice(cleanupContext, config); err != nil {
+		s.logger.Warn("restore automatic roaming data setting", "device_id", deviceID, "error", err)
+	}
+	if err := s.store.UpsertCardPolicy(cleanupContext, store.CardPolicy{ICCID: iccid, NetworkEnabled: false, VoWiFiEnabled: false, AirplaneEnabled: false, APN: config.APN, IPVersion: "IPV4V6", Source: "automatic_task"}); err != nil {
+		s.logger.Warn("restore automatic roaming card policy", "device_id", deviceID, "error", err)
+	}
+}
+
+func compactAutomaticResponse(body []byte) string {
+	var payload map[string]any
+	if json.Unmarshal(body, &payload) == nil {
+		if apiErr, ok := payload["error"].(map[string]any); ok {
+			return firstNonEmpty(fmt.Sprint(apiErr["message"]), fmt.Sprint(apiErr["code"]), "request failed")
+		}
+	}
+	return strings.TrimSpace(string(body))
+}
+
+func (s *Server) routeAutomaticTasksAPI(w http.ResponseWriter, r *http.Request, cleanPath string) bool {
+	segments := splitAPIPath(cleanPath)
+	if len(segments) == 0 || segments[0] != "automatic-tasks" {
+		return false
+	}
+	if len(segments) == 1 {
+		s.handleAutomaticTasks(w, r)
+		return true
+	}
+	if len(segments) == 2 && segments[1] == "runs" {
+		s.handleAutomaticTaskRuns(w, r)
+		return true
+	}
+	id, err := strconv.ParseInt(segments[1], 10, 64)
+	if err != nil || id <= 0 {
+		writeError(w, http.StatusBadRequest, "invalid_task_id", "automatic task ID is invalid")
+		return true
+	}
+	if len(segments) == 2 {
+		s.handleAutomaticTask(w, r, id)
+		return true
+	}
+	if len(segments) == 3 && segments[2] == "run" {
+		s.handleAutomaticTaskRunNow(w, r, id)
+		return true
+	}
+	writeError(w, http.StatusNotFound, "not_found", "automatic task endpoint not found")
+	return true
+}
+
+func (s *Server) handleAutomaticTasks(w http.ResponseWriter, r *http.Request) {
+	switch r.Method {
+	case http.MethodGet:
+		tasks, err := s.store.ListAutomaticTasks(r.Context())
+		if err != nil {
+			s.writeStoreError(w, err)
+			return
+		}
+		writeJSON(w, http.StatusOK, map[string]any{"data": map[string]any{"tasks": tasks}})
+	case http.MethodPost:
+		task, err := s.decodeAutomaticTask(r, 0)
+		if err != nil {
+			writeError(w, http.StatusBadRequest, "invalid_automatic_task", err.Error())
+			return
+		}
+		saved, err := s.store.SaveAutomaticTask(r.Context(), task)
+		if err != nil {
+			s.writeStoreError(w, err)
+			return
+		}
+		writeJSON(w, http.StatusCreated, map[string]any{"data": saved})
+	default:
+		w.Header().Set("Allow", "GET, POST")
+		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "method not allowed")
+	}
+}
+
+func (s *Server) handleAutomaticTask(w http.ResponseWriter, r *http.Request, id int64) {
+	switch r.Method {
+	case http.MethodPut:
+		task, err := s.decodeAutomaticTask(r, id)
+		if err != nil {
+			writeError(w, http.StatusBadRequest, "invalid_automatic_task", err.Error())
+			return
+		}
+		saved, err := s.store.SaveAutomaticTask(r.Context(), task)
+		if err != nil {
+			s.writeStoreError(w, err)
+			return
+		}
+		writeJSON(w, http.StatusOK, map[string]any{"data": saved})
+	case http.MethodDelete:
+		if err := s.store.DeleteAutomaticTask(r.Context(), id); err != nil {
+			s.writeStoreError(w, err)
+			return
+		}
+		writeJSON(w, http.StatusOK, map[string]any{"data": map[string]any{"deleted": true}})
+	default:
+		w.Header().Set("Allow", "PUT, DELETE")
+		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "method not allowed")
+	}
+}
+
+func (s *Server) handleAutomaticTaskRuns(w http.ResponseWriter, r *http.Request) {
+	if !requireMethod(w, r, http.MethodGet) {
+		return
+	}
+	query := r.URL.Query()
+	limit, _ := strconv.Atoi(query.Get("limit"))
+	offset, _ := strconv.Atoi(query.Get("offset"))
+	runs, total, err := s.store.ListAutomaticTaskRunsPaginated(r.Context(), limit, offset)
+	if err != nil {
+		s.writeStoreError(w, err)
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"data": map[string]any{"runs": runs, "total": total}})
+}
+
+func (s *Server) handleAutomaticTaskRunNow(w http.ResponseWriter, r *http.Request, id int64) {
+	if !requireMethod(w, r, http.MethodPost) {
+		return
+	}
+	if s.automaticTasks == nil {
+		writeError(w, http.StatusServiceUnavailable, "scheduler_unavailable", "automatic task scheduler is unavailable")
+		return
+	}
+	task, err := s.store.AutomaticTask(r.Context(), id)
+	if err != nil {
+		s.writeStoreError(w, err)
+		return
+	}
+	run, err := s.store.QueueAutomaticTaskNow(r.Context(), task)
+	if err != nil {
+		s.writeStoreError(w, err)
+		return
+	}
+	s.automaticTasks.enqueue(run)
+	writeJSON(w, http.StatusAccepted, map[string]any{"data": run})
+}
+
+func (s *Server) decodeAutomaticTask(r *http.Request, id int64) (store.AutomaticTask, error) {
+	var request struct {
+		Name         string               `json:"name"`
+		Enabled      bool                 `json:"enabled"`
+		DeviceID     string               `json:"device_id"`
+		ProfileICCID string               `json:"profile_iccid"`
+		ProfileAID   string               `json:"profile_aid"`
+		TaskType     string               `json:"task_type"`
+		Environment  string               `json:"environment"`
+		IntervalDays int                  `json:"interval_days"`
+		StartDate    string               `json:"start_date"`
+		RunTime      string               `json:"run_time"`
+		Timezone     string               `json:"timezone"`
+		RetryCount   int                  `json:"retry_count"`
+		Notify       bool                 `json:"notify"`
+		Payload      automaticTaskPayload `json:"payload"`
+	}
+	if err := s.decodeJSON(nilResponseWriter{}, r, &request); err != nil {
+		return store.AutomaticTask{}, err
+	}
+	request.Name, request.DeviceID = strings.TrimSpace(request.Name), strings.TrimSpace(request.DeviceID)
+	request.ProfileICCID, request.ProfileAID = strings.TrimSpace(request.ProfileICCID), strings.TrimSpace(request.ProfileAID)
+	request.TaskType, request.Environment = strings.ToLower(strings.TrimSpace(request.TaskType)), strings.ToLower(strings.TrimSpace(request.Environment))
+	if request.Name == "" || request.DeviceID == "" || request.ProfileICCID == "" {
+		return store.AutomaticTask{}, errors.New("name, device, and eSIM profile are required")
+	}
+	if _, err := s.store.Device(r.Context(), request.DeviceID); err != nil {
+		return store.AutomaticTask{}, errors.New("selected device does not exist")
+	}
+	if request.Environment != "vowifi" && request.Environment != "cellular" {
+		return store.AutomaticTask{}, errors.New("environment must be vowifi or cellular")
+	}
+	if request.TaskType != "sms" && request.TaskType != "call" && request.TaskType != "public_ip" {
+		return store.AutomaticTask{}, errors.New("unsupported task type")
+	}
+	if request.TaskType == "public_ip" && request.Environment != "cellular" {
+		return store.AutomaticTask{}, errors.New("public IP tasks must use cellular direct mode")
+	}
+	if request.IntervalDays < 1 || request.IntervalDays > 365 || request.RetryCount < 0 || request.RetryCount > 10 {
+		return store.AutomaticTask{}, errors.New("interval_days must be 1-365 and retry_count must be 0-10")
+	}
+	if request.TaskType == "sms" {
+		if !validDialNumber(request.Payload.Phone) || strings.TrimSpace(request.Payload.Message) == "" {
+			return store.AutomaticTask{}, errors.New("SMS phone and message are required")
+		}
+		if blocked, reason := blockedSMSDestination(request.Payload.Phone); blocked {
+			return store.AutomaticTask{}, errors.New(reason)
+		}
+	}
+	if request.TaskType == "call" && (!validDialNumber(request.Payload.Phone) || request.Payload.DurationSeconds < 1 || request.Payload.DurationSeconds > 600) {
+		return store.AutomaticTask{}, errors.New("call phone is required and automatic hang-up must be 1-600 seconds")
+	}
+	request.Timezone = strings.TrimSpace(request.Timezone)
+	if request.Timezone == "" {
+		request.Timezone = time.Local.String()
+	}
+	location, err := time.LoadLocation(request.Timezone)
+	if err != nil {
+		return store.AutomaticTask{}, errors.New("timezone must be a valid IANA time zone")
+	}
+	nextRun, err := nextAutomaticRun(request.StartDate, request.RunTime, request.IntervalDays, time.Now().In(location))
+	if err != nil {
+		return store.AutomaticTask{}, err
+	}
+	payload, _ := json.Marshal(request.Payload)
+	task := store.AutomaticTask{ID: id, Name: request.Name, Enabled: request.Enabled, DeviceID: request.DeviceID,
+		ProfileICCID: request.ProfileICCID, ProfileAID: request.ProfileAID, TaskType: request.TaskType,
+		Environment: request.Environment, IntervalDays: request.IntervalDays, StartDate: request.StartDate,
+		RunTime: request.RunTime, Timezone: request.Timezone, Payload: payload, RetryCount: request.RetryCount, Notify: request.Notify, NextRunAt: nextRun.UTC()}
+	if id != 0 {
+		if previous, previousErr := s.store.AutomaticTask(r.Context(), id); previousErr == nil {
+			task.CreatedAt, task.LastRunAt, task.LastStatus, task.LastError = previous.CreatedAt, previous.LastRunAt, previous.LastStatus, previous.LastError
+		}
+	}
+	return task, nil
+}
+
+func nextAutomaticRun(date, clock string, intervalDays int, now time.Time) (time.Time, error) {
+	location := now.Location()
+	start, err := time.ParseInLocation("2006-01-02 15:04", strings.TrimSpace(date)+" "+strings.TrimSpace(clock), location)
+	if err != nil {
+		return time.Time{}, errors.New("start_date and run_time must use YYYY-MM-DD and HH:MM")
+	}
+	for start.Before(now) {
+		start = start.AddDate(0, 0, intervalDays)
+	}
+	return start, nil
+}
+
+// nilResponseWriter is used only because decodeJSON's size/error contract is
+// shared with HTTP handlers; decode errors are returned to the real handler.
+type nilResponseWriter struct{}
+
+func (nilResponseWriter) Header() http.Header        { return make(http.Header) }
+func (nilResponseWriter) Write([]byte) (int, error)  { return 0, nil }
+func (nilResponseWriter) WriteHeader(statusCode int) {}

internal/server/automatic_tasks_test.go

@@ -0,0 +1,30 @@
+package server
+
+import (
+	"testing"
+	"time"
+)
+
+func TestNextAutomaticRunUsesIntervalAndLocalClock(t *testing.T) {
+	location := time.FixedZone("test", 8*60*60)
+	now := time.Date(2026, 8, 10, 12, 0, 0, 0, location)
+	next, err := nextAutomaticRun("2026-08-01", "09:30", 3, now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := time.Date(2026, 8, 13, 9, 30, 0, 0, location)
+	if !next.Equal(want) {
+		t.Fatalf("next run = %v, want %v", next, want)
+	}
+}
+
+func TestAutomaticSMSRetrySafetyPreventsDuplicateSubmission(t *testing.T) {
+	unsafe := []byte(`{"data":{"parts_attempted":1,"parts_accepted":1,"retry_safe":false}}`)
+	if automaticSMSRetrySafe(unsafe) {
+		t.Fatal("partially submitted SMS was considered safe to retry")
+	}
+	safe := []byte(`{"data":{"parts_attempted":0,"parts_accepted":0}}`)
+	if !automaticSMSRetrySafe(safe) {
+		t.Fatal("unattempted SMS was not considered safe to retry")
+	}
+}

internal/server/developer_settings.go

@@ -7,37 +7,62 @@ import (
 )
 
 func (s *Server) handleDeveloperSettings(w http.ResponseWriter, r *http.Request) {
-	if !s.developerEnabled {
+	if !s.developerActive(r.Context()) {
 		writeError(w, http.StatusNotFound, "not_found", "resource not found")
 		return
 	}
 	switch r.Method {
 	case http.MethodGet:
-		writeJSON(w, http.StatusOK, map[string]any{"data": map[string]any{
-			"device_limit":         developer.DeviceLimit(r.Context(), s.store, true),
-			"default_device_limit": developer.DefaultDeviceLimit,
-			"max_device_limit":     developer.MaxDeviceLimit,
-		}})
+		s.writeDeveloperSettings(w, r)
 	case http.MethodPut:
 		var request struct {
-			DeviceLimit int `json:"device_limit"`
+			DeviceLimit    *int `json:"device_limit"`
+			SMSHourlyLimit *int `json:"sms_hourly_limit"`
 		}
 		if err := s.decodeJSON(w, r, &request); err != nil {
 			writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
 			return
 		}
-		if err := developer.SetDeviceLimit(r.Context(), s.store, request.DeviceLimit); err != nil {
-			writeError(w, http.StatusBadRequest, "invalid_device_limit", err.Error())
+		if request.DeviceLimit == nil && request.SMSHourlyLimit == nil {
+			writeError(w, http.StatusBadRequest, "invalid_request", "at least one developer setting is required")
 			return
 		}
-		s.recordAudit(r.Context(), "admin", "settings.developer.device_limit", "settings", "developer", "success", "device limit updated")
-		writeJSON(w, http.StatusOK, map[string]any{"data": map[string]any{
-			"device_limit":         request.DeviceLimit,
-			"default_device_limit": developer.DefaultDeviceLimit,
-			"max_device_limit":     developer.MaxDeviceLimit,
-		}})
+		if request.DeviceLimit != nil && (*request.DeviceLimit < 1 || *request.DeviceLimit > developer.MaxDeviceLimit) {
+			writeError(w, http.StatusBadRequest, "invalid_device_limit", "device limit is outside the supported range")
+			return
+		}
+		if request.SMSHourlyLimit != nil && (*request.SMSHourlyLimit < 1 || *request.SMSHourlyLimit > developer.MaxSMSHourlyLimit) {
+			writeError(w, http.StatusBadRequest, "invalid_sms_hourly_limit", "SMS hourly limit is outside the supported range")
+			return
+		}
+		if request.DeviceLimit != nil {
+			if err := developer.SetDeviceLimit(r.Context(), s.store, *request.DeviceLimit); err != nil {
+				writeError(w, http.StatusBadRequest, "invalid_device_limit", err.Error())
+				return
+			}
+			s.recordAudit(r.Context(), "admin", "settings.developer.device_limit", "settings", "developer", "success", "device limit updated")
+		}
+		if request.SMSHourlyLimit != nil {
+			if err := developer.SetSMSHourlyLimit(r.Context(), s.store, *request.SMSHourlyLimit); err != nil {
+				writeError(w, http.StatusBadRequest, "invalid_sms_hourly_limit", err.Error())
+				return
+			}
+			s.recordAudit(r.Context(), "admin", "settings.developer.sms_hourly_limit", "settings", "developer", "success", "global SMS hourly limit updated")
+		}
+		s.writeDeveloperSettings(w, r)
 	default:
 		w.Header().Set("Allow", "GET, PUT")
 		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "method not allowed")
 	}
 }
+
+func (s *Server) writeDeveloperSettings(w http.ResponseWriter, r *http.Request) {
+	writeJSON(w, http.StatusOK, map[string]any{"data": map[string]any{
+		"device_limit":             developer.DeviceLimit(r.Context(), s.store, true),
+		"default_device_limit":     developer.DefaultDeviceLimit,
+		"max_device_limit":         developer.MaxDeviceLimit,
+		"sms_hourly_limit":         developer.SMSHourlyLimit(r.Context(), s.store),
+		"default_sms_hourly_limit": developer.DefaultSMSHourlyLimit,
+		"max_sms_hourly_limit":     developer.MaxSMSHourlyLimit,
+	}})
+}

internal/server/developer_settings_test.go

@@ -1,9 +1,15 @@
 package server
 
 import (
+	"context"
+	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
+
+	"vocat/internal/developer"
+	"vocat/internal/store"
 )
 
 func TestDeveloperOnlySettingsAreHiddenWhenModeIsOff(t *testing.T) {
@@ -20,3 +26,27 @@ func TestDeveloperOnlySettingsAreHiddenWhenModeIsOff(t *testing.T) {
 		}
 	}
 }
+
+func TestDeveloperSettingsUpdatesGlobalSMSLimit(t *testing.T) {
+	ctx := context.Background()
+	database, err := store.Open(ctx, ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	enabled, _ := json.Marshal(map[string]bool{"enabled": true})
+	if err := database.UpsertAppSetting(ctx, store.AppSetting{Key: developer.EnabledSettingKey, Value: enabled}); err != nil {
+		t.Fatal(err)
+	}
+	server := &Server{store: database, developerEnabled: true, logger: regionTestLogger(), maxRequestBodyBytes: 4096}
+	request := httptest.NewRequest(http.MethodPut, "/api/settings/developer", strings.NewReader(`{"sms_hourly_limit":25}`))
+	request.Header.Set("Content-Type", "application/json")
+	response := httptest.NewRecorder()
+	server.handleDeveloperSettings(response, request)
+	if response.Code != http.StatusOK {
+		t.Fatalf("status = %d, body=%s", response.Code, response.Body.String())
+	}
+	if got := developer.SMSHourlyLimit(ctx, database); got != 25 {
+		t.Fatalf("SMS hourly limit = %d, want 25", got)
+	}
+}

internal/server/device_api.go

@@ -236,14 +236,46 @@ func (s *Server) handleDevices(w http.ResponseWriter, r *http.Request) bool {
 			return true
 		}
 		config := payload.toStoreDevice()
+		// Newly added hardware starts fail-closed: RF is disabled immediately and
+		// VoWiFi becomes the desired service. Cellular registration is only
+		// restored by the user's later airplane-mode-off action.
+		config.VoWiFiEnabled = true
+		config.NetworkEnabled = false
 		if !s.developerActive(r.Context()) {
 			config.NetworkEnabled = false
 		}
 		fillConfigFromPhysical(&config, *selected)
+		if selector, ok := s.devices.(interface{ SetBackend(string, string) error }); ok {
+			if err := selector.SetBackend(selected.ID, config.DeviceBackend); err != nil {
+				s.writeDeviceError(w, err)
+				return true
+			}
+		}
+		if _, err := s.devices.SetFlight(r.Context(), selected.ID, true); err != nil {
+			s.writeDeviceError(w, err)
+			return true
+		}
 		if err := s.store.UpsertDevice(r.Context(), config); err != nil {
 			s.writeStoreError(w, err)
 			return true
 		}
+		if selected.Snapshot != nil {
+			iccid := strings.TrimSpace(selected.Snapshot.ICCID)
+			if iccid != "" {
+				if err := s.store.UpsertCardPolicy(r.Context(), store.CardPolicy{
+					ICCID: iccid, VoWiFiEnabled: true, AirplaneEnabled: true,
+					IPVersion: "IPV4V6", Source: "default",
+				}); err != nil {
+					s.writeStoreError(w, err)
+					return true
+				}
+			}
+		}
+		if s.vowifi != nil {
+			if _, err := s.vowifi.RequestEnabled(config.ID, true); err != nil {
+				s.logger.Warn("new device saved in safe airplane mode but VoWiFi start was not queued", "device_id", config.ID, "error", err)
+			}
+		}
 		writeJSON(w, http.StatusCreated, map[string]any{
 			"data": map[string]any{
 				"status":          "created",
@@ -416,9 +448,20 @@ func (s *Server) handleDevicePath(
 			}
 			next.ID = id
 			next.CreatedAt = config.CreatedAt
+			// VoWiFi/airplane transitions are transactional device actions. A
+			// general config save must not silently bypass their RF-safe ordering.
+			next.VoWiFiEnabled = config.VoWiFiEnabled
 			if next.Name == id && strings.TrimSpace(payload.Name) == "" {
 				next.Name = config.Name
 			}
+			if _, physicalID, present := s.physicalForConfig(next); present {
+				if selector, ok := s.devices.(interface{ SetBackend(string, string) error }); ok {
+					if err := selector.SetBackend(physicalID, next.DeviceBackend); err != nil {
+						s.writeDeviceError(w, err)
+						return true
+					}
+				}
+			}
 			if err := s.store.UpsertDevice(r.Context(), next); err != nil {
 				s.writeStoreError(w, err)
 				return true
@@ -435,7 +478,7 @@ func (s *Server) handleDevicePath(
 
 	entry, physicalID, physicalPresent := s.physicalForConfig(config)
 	if len(tail) > 0 && tail[0] == "esim" {
-		return s.handleESIM(w, r, tail[1:], physicalID, physicalPresent)
+		return s.handleESIM(w, r, tail[1:], physicalID, physicalPresent, config.ID)
 	}
 	switch strings.Join(tail, "/") {
 	case "overview":
@@ -503,7 +546,7 @@ func (s *Server) handleDevicePath(
 		if !s.requirePhysicalDevice(w, physicalPresent) {
 			return true
 		}
-		return s.handleFlightMode(w, r, physicalID)
+		return s.handleFlightMode(w, r, config, physicalID)
 	case "network":
 		if !s.requirePhysicalDevice(w, physicalPresent) {
 			return true
@@ -756,9 +799,59 @@ func (s *Server) handleVoWiFiEnabled(
 		}
 	}
 
+	// Establish RF-off synchronously before changing the asynchronous VoWiFi
+	// lifecycle. This removes the attach window both when entering VoWiFi and
+	// when leaving it: teardown starts from CFUN=4 and is required to remain
+	// there until the user explicitly disables airplane mode.
 	previous := config.VoWiFiEnabled
+	liveICCID := ""
+	entry, physicalID, present := s.physicalForConfig(config)
+	if present {
+		if _, err := s.devices.SetFlight(r.Context(), physicalID, true); err != nil {
+			s.writeDeviceError(w, err)
+			return true
+		}
+	}
+	if entry.Snapshot != nil {
+		iccid := strings.TrimSpace(entry.Snapshot.ICCID)
+		if iccid != "" {
+			liveICCID = iccid
+			policy, policyErr := s.store.CardPolicy(r.Context(), iccid)
+			if errors.Is(policyErr, store.ErrNotFound) {
+				policy = store.CardPolicy{ICCID: iccid, IPVersion: "IPV4V6"}
+				policyErr = nil
+			}
+			if policyErr != nil {
+				s.writeStoreError(w, policyErr)
+				return true
+			}
+			policy.VoWiFiEnabled = request.Enabled
+			policy.AirplaneEnabled = true
+			policy.NetworkEnabled = false
+			policy.Source = "manual"
+			if err := s.store.UpsertCardPolicy(r.Context(), policy); err != nil {
+				s.writeStoreError(w, err)
+				return true
+			}
+		}
+	}
+
+	rollbackCardPolicy := func() {
+		if liveICCID == "" {
+			return
+		}
+		policy, policyErr := s.store.CardPolicy(context.Background(), liveICCID)
+		if policyErr != nil {
+			return
+		}
+		policy.VoWiFiEnabled = previous
+		policy.AirplaneEnabled = true
+		policy.NetworkEnabled = false
+		_ = s.store.UpsertCardPolicy(context.Background(), policy)
+	}
 	config.VoWiFiEnabled = request.Enabled
 	if err := s.store.UpsertDevice(r.Context(), config); err != nil {
+		rollbackCardPolicy()
 		s.writeStoreError(w, err)
 		return true
 	}
@@ -780,6 +873,7 @@ func (s *Server) handleVoWiFiEnabled(
 			return true
 		}
 		config.VoWiFiEnabled = previous
+		rollbackCardPolicy()
 		if restoreErr := s.store.UpsertDevice(r.Context(), config); restoreErr != nil {
 			s.logger.Error(
 				"restore VoWiFi policy after rejected runtime operation",
@@ -983,7 +1077,7 @@ func (s *Server) handleUSSD(w http.ResponseWriter, r *http.Request, id string) b
 	return true
 }
 
-func (s *Server) handleFlightMode(w http.ResponseWriter, r *http.Request, id string) bool {
+func (s *Server) handleFlightMode(w http.ResponseWriter, r *http.Request, config store.Device, physicalID string) bool {
 	if !requireMethod(w, r, http.MethodPatch) {
 		return true
 	}
@@ -994,7 +1088,11 @@ func (s *Server) handleFlightMode(w http.ResponseWriter, r *http.Request, id str
 		writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
 		return true
 	}
-	result, err := s.devices.SetFlight(r.Context(), id, request.Enabled)
+	if config.VoWiFiEnabled {
+		writeError(w, http.StatusConflict, "vowifi_owns_airplane_mode", "airplane mode is locked on while VoWiFi is enabled")
+		return true
+	}
+	result, err := s.devices.SetFlight(r.Context(), physicalID, request.Enabled)
 	if err != nil {
 		s.writeDeviceError(w, err)
 		return true
@@ -1002,7 +1100,7 @@ func (s *Server) handleFlightMode(w http.ResponseWriter, r *http.Request, id str
 	// Unlike VoWiFi, CFUN airplane state is not represented in the device row.
 	// Persist it against the live ICCID so a restart can distinguish an
 	// intentional airplane policy from an interrupted VoWiFi teardown.
-	if entry, getErr := s.devices.Get(id); getErr == nil && entry.Snapshot != nil {
+	if entry, getErr := s.devices.Get(physicalID); getErr == nil && entry.Snapshot != nil {
 		iccid := strings.TrimSpace(entry.Snapshot.ICCID)
 		if iccid != "" {
 			policy, policyErr := s.store.CardPolicy(r.Context(), iccid)
@@ -1073,7 +1171,7 @@ func (s *Server) handleCellularData(
 		controller := http.NewResponseController(w)
 		_ = controller.SetWriteDeadline(time.Time{})
 		result, err := s.devices.SetNetwork(r.Context(), physicalID, device.NetworkRequest{
-			Enabled: request.Enabled, APN: apn, IPVersion: "IPV4V6",
+			Enabled: request.Enabled, APN: apn, IPVersion: "IPV4V6", Backend: config.DeviceBackend,
 		})
 		if err != nil {
 			s.writeDeviceError(w, err)
@@ -1087,7 +1185,7 @@ func (s *Server) handleCellularData(
 		if err := s.store.UpsertDevice(r.Context(), config); err != nil {
 			rollbackContext, cancel := context.WithTimeout(context.Background(), 20*time.Second)
 			_, _ = s.devices.SetNetwork(rollbackContext, physicalID, device.NetworkRequest{
-				Enabled: previous, APN: config.APN, IPVersion: "IPV4V6",
+				Enabled: previous, APN: config.APN, IPVersion: "IPV4V6", Backend: config.DeviceBackend,
 			})
 			cancel()
 			s.writeStoreError(w, err)
@@ -1266,28 +1364,46 @@ func (s *Server) configuredDeviceSummary(
 	result["network_connected"] = config.NetworkEnabled
 	result["data_connected"] = config.NetworkEnabled
 	result["vowifi_enabled"] = config.VoWiFiEnabled
-	if runtime, err := s.store.VoWiFiRuntime(context.Background(), config.ID); err == nil {
-		currentICCID := ""
-		var currentSnapshot *device.Snapshot
-		if entry != nil {
-			currentSnapshot = entry.Snapshot
-			if entry.Snapshot != nil {
-				currentICCID = strings.TrimSpace(entry.Snapshot.ICCID)
+	var runtimeResponse map[string]any
+	runtimeMatchesCard := true
+	if s.vowifi != nil {
+		if runtime, err := s.vowifi.State(config.ID); err == nil {
+			runtimeMatchesCard = voWiFiRuntimeMatchesSnapshot(runtime.ICCID, entry)
+			if runtimeMatchesCard {
+				runtimeResponse = liveVoWiFiRuntime(runtime)
+			} else {
+				runtimeResponse = idleVoWiFiRuntime(config.ID, snapshotForEntry(entry))
 			}
 		}
-		runtimeMatchesCard := currentICCID == "" || runtime.ICCID == "" ||
-			strings.EqualFold(currentICCID, strings.TrimSpace(runtime.ICCID))
-		var runtimeResponse map[string]any
-		if runtimeMatchesCard {
-			runtimeResponse = storedVoWiFiRuntime(runtime)
-		} else {
-			// The saved IMS session belongs to a different eSIM profile. Never
-			// project its registration or number onto the currently selected SIM.
-			runtimeResponse = idleVoWiFiRuntime(config.ID, currentSnapshot)
-		}
-		result["vowifi_runtime"] = runtimeResponse
-		result["vowifi_active"] = config.VoWiFiEnabled && runtimeMatchesCard && runtime.TunnelReady
 	}
+	if runtimeResponse == nil {
+		if runtime, err := s.store.VoWiFiRuntime(context.Background(), config.ID); err == nil {
+			currentICCID := ""
+			var currentSnapshot *device.Snapshot
+			if entry != nil {
+				currentSnapshot = entry.Snapshot
+				if entry.Snapshot != nil {
+					currentICCID = strings.TrimSpace(entry.Snapshot.ICCID)
+				}
+			}
+			runtimeMatchesCard = currentICCID == "" || runtime.ICCID == "" ||
+				strings.EqualFold(currentICCID, strings.TrimSpace(runtime.ICCID))
+			if runtimeMatchesCard {
+				runtimeResponse = storedVoWiFiRuntime(runtime)
+			} else {
+				// The saved IMS session belongs to a different eSIM profile. Never
+				// project its registration or number onto the currently selected SIM.
+				runtimeResponse = idleVoWiFiRuntime(config.ID, currentSnapshot)
+			}
+		}
+	}
+	if runtimeResponse == nil {
+		runtimeResponse = idleVoWiFiRuntime(config.ID, snapshotForEntry(entry))
+	}
+	result["vowifi_runtime"] = runtimeResponse
+	runtimeEnabled, _ := runtimeResponse["enabled"].(bool)
+	runtimeTunnelReady, _ := runtimeResponse["tunnel_ready"].(bool)
+	result["vowifi_active"] = config.VoWiFiEnabled && runtimeMatchesCard && runtimeEnabled && runtimeTunnelReady
 	// Numbers are SIM-owned data. Resolve the association by the live ICCID
 	// instead of reusing the last VoWiFi runtime attached to this device ID.
 	if entry != nil && entry.Snapshot != nil {
@@ -1390,9 +1506,14 @@ func (s *Server) configuredDeviceStatus(
 }
 
 func storedVoWiFiRuntime(runtime store.VoWiFiRuntime) map[string]any {
+	extra, _ := rawJSONObject(runtime.Extra).(map[string]any)
+	enabled, _ := extra["enabled"].(bool)
+	active, _ := extra["active"].(bool)
 	return map[string]any{
 		"device_id":           runtime.DeviceID,
 		"phase":               runtime.Phase,
+		"enabled":             enabled,
+		"active":              active,
 		"dataplane_mode":      runtime.DataplaneMode,
 		"iccid":               runtime.ICCID,
 		"imsi":                runtime.IMSI,
@@ -1416,6 +1537,63 @@ func storedVoWiFiRuntime(runtime store.VoWiFiRuntime) map[string]any {
 	}
 }
 
+func liveVoWiFiRuntime(runtime vowifi.State) map[string]any {
+	return map[string]any{
+		"device_id":           runtime.DeviceID,
+		"phase":               string(runtime.Phase),
+		"enabled":             runtime.Enabled,
+		"active":              runtime.Active,
+		"dataplane_mode":      runtime.DataplaneMode,
+		"iccid":               runtime.ICCID,
+		"imsi":                runtime.IMSI,
+		"sim_ready":           runtime.SIMReady,
+		"access_ready":        runtime.AccessReady,
+		"tunnel_ready":        runtime.TunnelReady,
+		"ims_ready":           runtime.IMSReady,
+		"sms_ready":           runtime.SMSReady,
+		"reg_status":          map[bool]int{true: 1, false: 0}[runtime.IMSReady],
+		"reg_status_text":     map[bool]string{true: "registered", false: "not registered"}[runtime.IMSReady],
+		"network_mode":        "Wi-Fi",
+		"local_phone":         runtime.PhoneNumber,
+		"phone_number_source": runtime.PhoneNumberSource,
+		"last_error_class":    runtime.LastErrorClass,
+		"last_error":          runtime.LastError,
+		"last_reason":         runtime.LastReason,
+		"updated_at":          runtime.UpdatedAt,
+		"tunnel": map[string]any{
+			"established":    runtime.TunnelReady,
+			"name":           runtime.TunnelName,
+			"dataplane_mode": runtime.DataplaneMode,
+			"epdg":           runtime.EPDG,
+			"proxy_mode":     runtime.ProxyMode,
+			"proxy_id":       runtime.ProxyID,
+			"security_audit": runtime.Security,
+		},
+		"imscore": map[string]any{
+			"registered":         runtime.IMSReady,
+			"registration_state": runtime.IMSRegistration,
+			"associated_number":  runtime.PhoneNumber,
+			"number_source":      runtime.PhoneNumberSource,
+		},
+		"smsip": map[string]any{"ready": runtime.SMSReady},
+	}
+}
+
+func snapshotForEntry(entry *device.Device) *device.Snapshot {
+	if entry == nil {
+		return nil
+	}
+	return entry.Snapshot
+}
+
+func voWiFiRuntimeMatchesSnapshot(runtimeICCID string, entry *device.Device) bool {
+	current := strings.TrimSpace(snapshotString(snapshotForEntry(entry), func(snapshot *device.Snapshot) string {
+		return snapshot.ICCID
+	}))
+	runtimeICCID = strings.TrimSpace(runtimeICCID)
+	return current == "" || runtimeICCID == "" || strings.EqualFold(current, runtimeICCID)
+}
+
 func rawJSONObject(value json.RawMessage) any {
 	var result any
 	if len(value) != 0 && json.Unmarshal(value, &result) == nil {
@@ -1569,6 +1747,7 @@ func modemSummary(snapshot *device.Snapshot, phone string, phoneSource string) m
 			"operator":              "",
 			"native_mcc":            "",
 			"native_mnc":            "",
+			"native_spn":            "",
 			"operator_country_code": "",
 			"card_mcc":              "",
 			"card_mnc":              "",
@@ -1598,6 +1777,7 @@ func modemSummary(snapshot *device.Snapshot, phone string, phoneSource string) m
 		"operator":              snapshot.OperatorName,
 		"native_mcc":            mcc,
 		"native_mnc":            mnc,
+		"native_spn":            snapshot.SPN,
 		"operator_country_code": operatorCountryCode,
 		"card_mcc":              cardMCC,
 		"card_mnc":              cardMNC,
@@ -1643,6 +1823,8 @@ func idleVoWiFiRuntime(id string, snapshot *device.Snapshot) map[string]any {
 	return map[string]any{
 		"device_id":           id,
 		"phase":               "idle",
+		"enabled":             false,
+		"active":              false,
 		"dataplane_mode":      "",
 		"iccid":               iccid,
 		"imsi":                imsi,

internal/server/device_features_api_test.go

@@ -31,6 +31,28 @@ func decodeData(t *testing.T, recorder *httptest.ResponseRecorder) map[string]an
 	return envelope.Data
 }
 
+type esimAIDCaptureController struct {
+	fakeDeviceController
+	switchAID  string
+	disableAID string
+	renameAID  string
+}
+
+func (controller *esimAIDCaptureController) ESIMSwitchProfile(_ context.Context, _, _, aidHex string) error {
+	controller.switchAID = aidHex
+	return nil
+}
+
+func (controller *esimAIDCaptureController) ESIMDisableProfile(_ context.Context, _, _, aidHex string) error {
+	controller.disableAID = aidHex
+	return nil
+}
+
+func (controller *esimAIDCaptureController) ESIMRenameProfile(_ context.Context, _, _, _, aidHex string) error {
+	controller.renameAID = aidHex
+	return nil
+}
+
 func TestAttachSingleEUICCIdentityFillsProfileGroupMetadataKey(t *testing.T) {
 	groups := []map[string]any{{"eid": "", "aidHex": "", "profiles": []any{}}}
 	chipInfo := map[string]any{
@@ -256,9 +278,18 @@ func TestHandleESIMShapes(t *testing.T) {
 	}
 
 	// Switch happy path: a present device + fake controller switches by ICCID.
-	present := &Server{logger: regionTestLogger(), maxRequestBodyBytes: 4096, devices: fakeDeviceController{}}
+	database, err := store.Open(context.Background(), ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	if err := database.UpsertDevice(context.Background(), store.Device{ID: "dev1", Name: "dev1"}); err != nil {
+		t.Fatal(err)
+	}
+	controller := &esimAIDCaptureController{}
+	present := &Server{store: database, logger: regionTestLogger(), maxRequestBodyBytes: 4096, devices: controller}
 	swOK := httptest.NewRecorder()
-	swReq := httptest.NewRequest(http.MethodPost, "/esim/actions/switch", strings.NewReader(`{"iccid":"8900000000000000001","aid_hex":"A0"}`))
+	swReq := httptest.NewRequest(http.MethodPost, "/esim/actions/switch", strings.NewReader(`{"iccid":"8900000000000000001","aidHex":"A0000005591010FFFFFFFF8900000177"}`))
 	swReq.Header.Set("Content-Type", "application/json")
 	present.handleESIM(swOK, swReq, []string{"actions", "switch"}, "dev1", true)
 	if swOK.Code != http.StatusOK {
@@ -267,10 +298,13 @@ func TestHandleESIMShapes(t *testing.T) {
 	if data := decodeData(t, swOK); data["status"] != "switched" || data["verified"] != true {
 		t.Fatalf("switch data = %v", data)
 	}
+	if controller.switchAID != "A0000005591010FFFFFFFF8900000177" {
+		t.Fatalf("switch AID = %q, want XeSIM camelCase AID", controller.switchAID)
+	}
 
 	// Disable happy path routes the active profile to ES10c DisableProfile.
 	disableOK := httptest.NewRecorder()
-	disableReq := httptest.NewRequest(http.MethodPost, "/esim/actions/disable", strings.NewReader(`{"iccid":"8900000000000000001","aid_hex":"A0000005591010FFFFFFFF8900000100"}`))
+	disableReq := httptest.NewRequest(http.MethodPost, "/esim/actions/disable", strings.NewReader(`{"iccid":"8900000000000000001","aidHex":"A0000005591010FFFFFFFF8900000177"}`))
 	disableReq.Header.Set("Content-Type", "application/json")
 	present.handleESIM(disableOK, disableReq, []string{"actions", "disable"}, "dev1", true)
 	if disableOK.Code != http.StatusOK {
@@ -279,10 +313,13 @@ func TestHandleESIMShapes(t *testing.T) {
 	if data := decodeData(t, disableOK); data["status"] != "disabled" || data["recovering"] != true {
 		t.Fatalf("disable data = %v", data)
 	}
+	if controller.disableAID != "A0000005591010FFFFFFFF8900000177" {
+		t.Fatalf("disable AID = %q, want XeSIM camelCase AID", controller.disableAID)
+	}
 
 	// Rename happy path routes PATCH to ES10c SetNickname support.
 	renameOK := httptest.NewRecorder()
-	renameReq := httptest.NewRequest(http.MethodPatch, "/esim/profiles/8900000000000000001", strings.NewReader(`{"name":"Test profile","aid_hex":"A0000005591010FFFFFFFF8900000100"}`))
+	renameReq := httptest.NewRequest(http.MethodPatch, "/esim/profiles/8900000000000000001", strings.NewReader(`{"name":"Test profile","aidHex":"A0000005591010FFFFFFFF8900000177"}`))
 	renameReq.Header.Set("Content-Type", "application/json")
 	present.handleESIM(renameOK, renameReq, []string{"profiles", "8900000000000000001"}, "dev1", true)
 	if renameOK.Code != http.StatusOK {
@@ -291,6 +328,9 @@ func TestHandleESIMShapes(t *testing.T) {
 	if data := decodeData(t, renameOK); data["status"] != "renamed" || data["name"] != "Test profile" {
 		t.Fatalf("rename data = %v", data)
 	}
+	if controller.renameAID != "A0000005591010FFFFFFFF8900000177" {
+		t.Fatalf("rename AID = %q, want XeSIM camelCase AID", controller.renameAID)
+	}
 
 	// Download on a present device but with no smdp address reports 400.
 	dlNoSmdp := httptest.NewRecorder()

internal/server/device_summary_test.go

@@ -7,6 +7,7 @@ import (
 
 	"vocat/internal/device"
 	"vocat/internal/store"
+	"vocat/internal/vowifi"
 )
 
 func TestConfiguredDeviceSummaryIgnoresVoWiFiRuntimeFromPreviousSIM(t *testing.T) {
@@ -49,3 +50,68 @@ func TestConfiguredDeviceSummaryIgnoresVoWiFiRuntimeFromPreviousSIM(t *testing.T
 		t.Fatalf("runtime = %#v", got["vowifi_runtime"])
 	}
 }
+
+func TestConfiguredDeviceSummaryPrefersLiveVoWiFiStateOverStoredShutdownState(t *testing.T) {
+	database, err := store.Open(context.Background(), ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	if err := database.UpsertDevice(context.Background(), store.Device{ID: "ec20_1", Name: "EC20"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := database.UpsertVoWiFiRuntime(context.Background(), store.VoWiFiRuntime{
+		DeviceID:   "ec20_1",
+		Phase:      "idle",
+		ICCID:      "89104100000028106378",
+		LastReason: "disabled",
+		UpdatedAt:  time.Now().UTC(),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	live := vowifi.State{
+		DeviceID:    "ec20_1",
+		Phase:       vowifi.PhaseTunnelReady,
+		Enabled:     true,
+		Active:      true,
+		ICCID:       "89104100000028106378",
+		SIMReady:    true,
+		AccessReady: true,
+		TunnelReady: true,
+		LastReason:  "ipsec_tunnel_ready",
+		UpdatedAt:   time.Now().UTC(),
+	}
+	s := &Server{store: database, vowifi: &fakeVoWiFiController{state: live}}
+	entry := &device.Device{ID: "physical", Snapshot: &device.Snapshot{ICCID: live.ICCID}}
+	got := s.configuredDeviceSummary(store.Device{ID: "ec20_1", VoWiFiEnabled: true}, entry)
+	runtime, ok := got["vowifi_runtime"].(map[string]any)
+	if !ok || runtime["phase"] != string(vowifi.PhaseTunnelReady) || runtime["enabled"] != true {
+		t.Fatalf("runtime = %#v", got["vowifi_runtime"])
+	}
+	if got["vowifi_active"] != true {
+		t.Fatalf("vowifi_active = %#v", got["vowifi_active"])
+	}
+}
+
+func TestConfiguredDeviceSummaryMarksIdleRuntimeAsNotInUse(t *testing.T) {
+	database, err := store.Open(context.Background(), ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	s := &Server{
+		store: database,
+		vowifi: &fakeVoWiFiController{state: vowifi.State{
+			DeviceID:   "ec20_1",
+			Phase:      vowifi.PhaseIdle,
+			Enabled:    false,
+			LastReason: "disabled",
+			UpdatedAt:  time.Now().UTC(),
+		}},
+	}
+	got := s.configuredDeviceSummary(store.Device{ID: "ec20_1", VoWiFiEnabled: true}, nil)
+	runtime := got["vowifi_runtime"].(map[string]any)
+	if runtime["enabled"] != false || got["vowifi_active"] != false {
+		t.Fatalf("summary = %#v", got)
+	}
+}

internal/server/esim_api.go

@@ -8,6 +8,7 @@ import (
 	"time"
 
 	"vocat/internal/device"
+	"vocat/internal/store"
 )
 
 func esimUnavailable(w http.ResponseWriter) {
@@ -15,7 +16,11 @@ func esimUnavailable(w http.ResponseWriter) {
 }
 
 // handleESIM routes every /devices/{id}/esim* path.
-func (s *Server) handleESIM(w http.ResponseWriter, r *http.Request, rest []string, physicalID string, physicalPresent bool) bool {
+func (s *Server) handleESIM(w http.ResponseWriter, r *http.Request, rest []string, physicalID string, physicalPresent bool, configuredIDs ...string) bool {
+	configuredID := physicalID
+	if len(configuredIDs) > 0 && strings.TrimSpace(configuredIDs[0]) != "" {
+		configuredID = strings.TrimSpace(configuredIDs[0])
+	}
 	if len(rest) == 0 || (len(rest) == 1 && strings.TrimSpace(rest[0]) == "") {
 		if !requireMethod(w, r, http.MethodGet) {
 			return true
@@ -60,7 +65,7 @@ func (s *Server) handleESIM(w http.ResponseWriter, r *http.Request, rest []strin
 			if !requireMethod(w, r, http.MethodPost) {
 				return true
 			}
-			s.handleEsimSwitch(w, r, physicalID, physicalPresent)
+			s.handleEsimSwitch(w, r, configuredID, physicalID, physicalPresent)
 			return true
 		}
 		if len(rest) == 2 && rest[1] == "disable" {
@@ -295,8 +300,9 @@ func (s *Server) handleEsimRename(w http.ResponseWriter, r *http.Request, physic
 		return
 	}
 	var request struct {
-		Name   string `json:"name"`
-		AIDHex string `json:"aid_hex"` // accepted for the multi-eUICC SPA contract; ICCID addresses the profile
+		Name        string `json:"name"`
+		AIDHex      string `json:"aid_hex"`
+		AIDHexCamel string `json:"aidHex"`
 	}
 	if err := s.decodeJSON(w, r, &request); err != nil {
 		writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
@@ -307,7 +313,8 @@ func (s *Server) handleEsimRename(w http.ResponseWriter, r *http.Request, physic
 		writeError(w, http.StatusBadRequest, "invalid_request", "profile nickname is required")
 		return
 	}
-	if err := s.devices.ESIMRenameProfile(r.Context(), physicalID, iccid, nickname, request.AIDHex); err != nil {
+	aidHex := firstNonEmpty(request.AIDHex, request.AIDHexCamel)
+	if err := s.devices.ESIMRenameProfile(r.Context(), physicalID, iccid, nickname, aidHex); err != nil {
 		s.writeDeviceError(w, err)
 		return
 	}
@@ -316,7 +323,7 @@ func (s *Server) handleEsimRename(w http.ResponseWriter, r *http.Request, physic
 
 // handleEsimSwitch enables one already-installed profile by ICCID (切卡). The
 // eUICC EnableProfile command needs no authentication key.
-func (s *Server) handleEsimSwitch(w http.ResponseWriter, r *http.Request, physicalID string, physicalPresent bool) {
+func (s *Server) handleEsimSwitch(w http.ResponseWriter, r *http.Request, configuredID string, physicalID string, physicalPresent bool) {
 	if s.devices == nil {
 		writeError(w, http.StatusServiceUnavailable, "device_manager_unavailable", "device manager is unavailable")
 		return
@@ -326,8 +333,9 @@ func (s *Server) handleEsimSwitch(w http.ResponseWriter, r *http.Request, physic
 		return
 	}
 	var request struct {
-		ICCID  string `json:"iccid"`
-		AIDHex string `json:"aid_hex"` // accepted for contract compatibility; switching keys off iccid
+		ICCID       string `json:"iccid"`
+		AIDHex      string `json:"aid_hex"`
+		AIDHexCamel string `json:"aidHex"`
 	}
 	if err := s.decodeJSON(w, r, &request); err != nil {
 		writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
@@ -338,14 +346,56 @@ func (s *Server) handleEsimSwitch(w http.ResponseWriter, r *http.Request, physic
 		writeError(w, http.StatusBadRequest, "invalid_request", "iccid is required")
 		return
 	}
+	// Profile operations run with RF disabled. The eUICC remains accessible in
+	// CFUN=4, and the recovery path reapplies CFUN=4 as soon as the AT port comes
+	// back after the mandatory modem reset.
+	if _, err := s.devices.SetFlight(r.Context(), physicalID, true); err != nil {
+		s.writeDeviceError(w, err)
+		return
+	}
 	// A confirmed profile switch includes the EC20 reset and a live ICCID read,
 	// which normally takes longer than the server's ordinary response deadline.
 	controller := http.NewResponseController(w)
 	_ = controller.SetWriteDeadline(time.Time{})
-	if err := s.devices.ESIMSwitchProfile(r.Context(), physicalID, iccid, request.AIDHex); err != nil {
+	aidHex := firstNonEmpty(request.AIDHex, request.AIDHexCamel)
+	if err := s.devices.ESIMSwitchProfile(r.Context(), physicalID, iccid, aidHex); err != nil {
 		s.writeDeviceError(w, err)
 		return
 	}
+	if _, err := s.devices.SetFlight(r.Context(), physicalID, true); err != nil {
+		s.writeDeviceError(w, err)
+		return
+	}
+	if err := s.store.UpsertCardPolicy(r.Context(), store.CardPolicy{
+		ICCID: iccid, VoWiFiEnabled: true, AirplaneEnabled: true,
+		IPVersion: "IPV4V6", Source: "default",
+	}); err != nil {
+		s.writeStoreError(w, err)
+		return
+	}
+	config, err := s.store.Device(r.Context(), configuredID)
+	if err != nil {
+		s.writeStoreError(w, err)
+		return
+	}
+	config.VoWiFiEnabled = true
+	config.NetworkEnabled = false
+	if err := s.store.UpsertDevice(r.Context(), config); err != nil {
+		s.writeStoreError(w, err)
+		return
+	}
+	if s.vowifi != nil {
+		state, stateErr := s.vowifi.State(configuredID)
+		switch {
+		case stateErr == nil && state.Enabled:
+			_, err = s.vowifi.RequestReconnect(configuredID)
+		default:
+			_, err = s.vowifi.RequestEnabled(configuredID, true)
+		}
+		if err != nil {
+			s.logger.Warn("profile switched in safe airplane mode but VoWiFi start was not queued", "device_id", configuredID, "iccid", iccid, "error", err)
+		}
+	}
 	writeJSON(w, http.StatusOK, map[string]any{"data": map[string]any{"status": "switched", "iccid": iccid, "verified": true}})
 }
 
@@ -359,8 +409,9 @@ func (s *Server) handleEsimDisable(w http.ResponseWriter, r *http.Request, physi
 		return
 	}
 	var request struct {
-		ICCID  string `json:"iccid"`
-		AIDHex string `json:"aid_hex"` // accepted for the multi-eUICC SPA contract; disabling keys off ICCID
+		ICCID       string `json:"iccid"`
+		AIDHex      string `json:"aid_hex"`
+		AIDHexCamel string `json:"aidHex"`
 	}
 	if err := s.decodeJSON(w, r, &request); err != nil {
 		writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
@@ -371,7 +422,8 @@ func (s *Server) handleEsimDisable(w http.ResponseWriter, r *http.Request, physi
 		writeError(w, http.StatusBadRequest, "invalid_request", "iccid is required")
 		return
 	}
-	if err := s.devices.ESIMDisableProfile(r.Context(), physicalID, iccid, request.AIDHex); err != nil {
+	aidHex := firstNonEmpty(request.AIDHex, request.AIDHexCamel)
+	if err := s.devices.ESIMDisableProfile(r.Context(), physicalID, iccid, aidHex); err != nil {
 		s.writeDeviceError(w, err)
 		return
 	}

internal/server/extensions_api.go

@@ -62,7 +62,7 @@ func (s *Server) routeExtensionAPI(w http.ResponseWriter, r *http.Request, clean
 		if !requireMethod(w, r, http.MethodPost) {
 			return true
 		}
-		r.Body = http.MaxBytesReader(w, r.Body, maxPluginUploadBytes+(1<<20))
+		r.Body = http.MaxBytesReader(nil, r.Body, maxPluginUploadBytes+(1<<20))
 		if err := r.ParseMultipartForm(maxPluginUploadBytes); err != nil {
 			writeError(w, http.StatusBadRequest, "invalid_plugin_upload", "plugin upload must be multipart/form-data and no larger than 64 MiB")
 			return true

internal/server/general_api.go

@@ -24,6 +24,9 @@ import (
 
 func (s *Server) routeGeneralAPI(w http.ResponseWriter, r *http.Request) bool {
 	cleanPath := strings.Trim(strings.TrimPrefix(r.URL.Path, "/api"), "/")
+	if s.routeAutomaticTasksAPI(w, r, cleanPath) {
+		return true
+	}
 	if s.routeExtensionAPI(w, r, cleanPath) {
 		return true
 	}

internal/server/proxy_api.go

@@ -26,8 +26,8 @@ func (s *Server) routeProxyAPI(w http.ResponseWriter, r *http.Request, cleanPath
 		writeJSON(w, http.StatusOK, map[string]any{"data": proxyCountries})
 	case "upstream-proxy-country-rules":
 		s.handleCountryRules(w, r)
-	case "upstream-proxy-device-bindings":
-		s.handleDeviceProxyBindings(w, r)
+	case "upstream-proxy-profile-bindings":
+		s.handleProfileProxyBindings(w, r)
 	default:
 		segments := splitAPIPath(cleanPath)
 		switch {
@@ -40,8 +40,6 @@ func (s *Server) routeProxyAPI(w http.ResponseWriter, r *http.Request, cleanPath
 			s.handleUpstreamProbe(w, r, segments[1])
 		case len(segments) == 2 && segments[0] == "upstream-proxy-country-rules":
 			s.handleCountryRule(w, r, segments[1])
-		case len(segments) == 2 && segments[0] == "upstream-proxy-device-bindings":
-			s.handleDeviceProxyBinding(w, r, segments[1])
 		default:
 			return false
 		}
@@ -114,7 +112,7 @@ func (s *Server) handleUpstreamProxy(w http.ResponseWriter, r *http.Request, id
 		}
 		for _, binding := range bindings {
 			if binding.UpstreamProxyID == id {
-				s.requestProxyRouteReconnect(binding.DeviceID)
+				s.requestProfileProxyRouteReconnect(binding.DeviceID, binding.ICCID)
 			}
 		}
 		writeJSON(w, http.StatusOK, map[string]any{"data": map[string]any{"deleted": true}})
@@ -124,36 +122,32 @@ func (s *Server) handleUpstreamProxy(w http.ResponseWriter, r *http.Request, id
 	}
 }
 
-func (s *Server) handleDeviceProxyBindings(w http.ResponseWriter, r *http.Request) {
-	if !requireMethod(w, r, http.MethodGet) {
-		return
-	}
-	values, err := s.store.ListDeviceProxyBindings(r.Context())
-	if err != nil {
-		s.writeStoreError(w, err)
-		return
-	}
-	result := make([]map[string]any, 0, len(values))
-	for _, value := range values {
-		result = append(result, deviceProxyBindingResponse(value))
-	}
-	writeJSON(w, http.StatusOK, map[string]any{"data": result})
+type profileProxyBindingPayload struct {
+	DeviceID    string `json:"device_id"`
+	ICCID       string `json:"iccid"`
+	ProfileName string `json:"profile_name"`
+	// Accepted for compatibility with the first profile-picker bundle, which
+	// sent the read-only display state together with the writable identity.
+	StateText string `json:"state_text,omitempty"`
 }
 
-func (s *Server) handleDeviceProxyBinding(w http.ResponseWriter, r *http.Request, deviceID string) {
-	deviceID = strings.TrimSpace(deviceID)
-	if !validDeviceID(deviceID) {
-		writeError(w, http.StatusBadRequest, "invalid_device_id", "device ID must use 1-64 safe characters")
-		return
-	}
-	if _, err := s.store.Device(r.Context(), deviceID); err != nil {
-		s.writeStoreError(w, err)
-		return
-	}
+func (s *Server) handleProfileProxyBindings(w http.ResponseWriter, r *http.Request) {
 	switch r.Method {
-	case http.MethodPut:
+	case http.MethodGet:
+		values, err := s.store.ListDeviceProxyBindings(r.Context())
+		if err != nil {
+			s.writeStoreError(w, err)
+			return
+		}
+		result := make([]map[string]any, 0, len(values))
+		for _, value := range values {
+			result = append(result, deviceProxyBindingResponse(value))
+		}
+		writeJSON(w, http.StatusOK, map[string]any{"data": result})
+	case http.MethodPost:
 		var request struct {
-			UpstreamProxyID string `json:"upstream_proxy_id"`
+			UpstreamProxyID string                       `json:"upstream_proxy_id"`
+			Bindings        []profileProxyBindingPayload `json:"bindings"`
 		}
 		if err := s.decodeJSON(w, r, &request); err != nil {
 			writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
@@ -166,44 +160,114 @@ func (s *Server) handleDeviceProxyBinding(w http.ResponseWriter, r *http.Request
 			return
 		}
 		if !upstream.Enabled {
-			writeError(w, http.StatusConflict, "upstream_proxy_disabled", "enable the upstream proxy before binding a device")
+			writeError(w, http.StatusConflict, "upstream_proxy_disabled", "enable the upstream proxy before binding a profile")
 			return
 		}
-		// Once bound, a device may not be silently rebinded to a different
-		// upstream proxy. Force the caller to DELETE first so the change is
-		// intentional. Re-binding the same upstream stays idempotent.
-		if existing, err := s.store.DeviceProxyBinding(r.Context(), deviceID); err == nil && existing.UpstreamProxyID != upstream.ID {
-			writeError(w, http.StatusConflict, "device_already_bound", "device is already bound to another upstream proxy; delete the binding first")
-			return
-		} else if err != nil && !errors.Is(err, store.ErrNotFound) {
-			s.writeStoreError(w, err)
+		if len(request.Bindings) == 0 || len(request.Bindings) > 200 {
+			writeError(w, http.StatusBadRequest, "invalid_bindings", "select between 1 and 200 profiles")
 			return
 		}
-		value := store.DeviceProxyBinding{DeviceID: deviceID, UpstreamProxyID: upstream.ID}
-		if err := s.store.UpsertDeviceProxyBinding(r.Context(), value); err != nil {
-			s.writeStoreError(w, err)
-			return
+		values := make([]store.DeviceProxyBinding, 0, len(request.Bindings))
+		seen := make(map[string]struct{}, len(request.Bindings))
+		for _, item := range request.Bindings {
+			deviceID := strings.TrimSpace(item.DeviceID)
+			iccid := strings.TrimSpace(item.ICCID)
+			if !validDeviceID(deviceID) {
+				writeError(w, http.StatusBadRequest, "invalid_device_id", "device ID must use 1-64 safe characters")
+				return
+			}
+			if !validProfileICCID(iccid) {
+				writeError(w, http.StatusBadRequest, "invalid_iccid", "profile ICCID must contain 18 to 22 digits")
+				return
+			}
+			if _, duplicate := seen[iccid]; duplicate {
+				writeError(w, http.StatusBadRequest, "duplicate_iccid", "the same ICCID was selected more than once")
+				return
+			}
+			seen[iccid] = struct{}{}
+			if _, err := s.store.Device(r.Context(), deviceID); err != nil {
+				s.writeStoreError(w, err)
+				return
+			}
+			if existing, err := s.store.DeviceProxyBinding(r.Context(), iccid); err == nil && existing.UpstreamProxyID != upstream.ID {
+				writeError(w, http.StatusConflict, "profile_already_bound", "this ICCID is already bound to another upstream proxy; delete that binding first")
+				return
+			} else if err != nil && !errors.Is(err, store.ErrNotFound) {
+				s.writeStoreError(w, err)
+				return
+			}
+			name := strings.TrimSpace(item.ProfileName)
+			if name == "" {
+				name = iccid
+			}
+			values = append(values, store.DeviceProxyBinding{DeviceID: deviceID, ICCID: iccid, ProfileName: name, UpstreamProxyID: upstream.ID})
 		}
-		reconnected, reconnectErr := s.requestProxyRouteReconnect(deviceID)
-		response := deviceProxyBindingResponse(value)
-		response["reconnect_requested"] = reconnected
-		if reconnectErr != nil {
-			response["reconnect_error"] = reconnectErr.Error()
+		requested := false
+		var reconnectErrors []string
+		for _, value := range values {
+			if err := s.store.UpsertDeviceProxyBinding(r.Context(), value); err != nil {
+				s.writeStoreError(w, err)
+				return
+			}
+			reconnected, reconnectErr := s.requestProfileProxyRouteReconnect(value.DeviceID, value.ICCID)
+			requested = requested || reconnected
+			if reconnectErr != nil {
+				reconnectErrors = append(reconnectErrors, reconnectErr.Error())
+			}
+		}
+		response := map[string]any{"created": len(values), "reconnect_requested": requested}
+		if len(reconnectErrors) > 0 {
+			response["reconnect_error"] = strings.Join(reconnectErrors, "; ")
 		}
 		writeJSON(w, http.StatusOK, map[string]any{"data": response})
 	case http.MethodDelete:
-		if err := s.store.DeleteDeviceProxyBinding(r.Context(), deviceID); err != nil {
-			s.writeStoreError(w, err)
+		var request struct {
+			UpstreamProxyID string   `json:"upstream_proxy_id"`
+			ICCIDs          []string `json:"iccids"`
+		}
+		if err := s.decodeJSON(w, r, &request); err != nil {
+			writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
 			return
 		}
-		reconnected, reconnectErr := s.requestProxyRouteReconnect(deviceID)
-		response := map[string]any{"deleted": true, "reconnect_requested": reconnected}
-		if reconnectErr != nil {
-			response["reconnect_error"] = reconnectErr.Error()
+		if len(request.ICCIDs) == 0 || len(request.ICCIDs) > 200 {
+			writeError(w, http.StatusBadRequest, "invalid_bindings", "select between 1 and 200 profiles")
+			return
+		}
+		requested := false
+		deleted := 0
+		var reconnectErrors []string
+		for _, rawICCID := range request.ICCIDs {
+			iccid := strings.TrimSpace(rawICCID)
+			binding, err := s.store.DeviceProxyBinding(r.Context(), iccid)
+			if errors.Is(err, store.ErrNotFound) {
+				continue
+			}
+			if err != nil {
+				s.writeStoreError(w, err)
+				return
+			}
+			if strings.TrimSpace(request.UpstreamProxyID) != "" && binding.UpstreamProxyID != strings.TrimSpace(request.UpstreamProxyID) {
+				writeError(w, http.StatusConflict, "binding_proxy_mismatch", "selected ICCID is not bound to this upstream proxy")
+				return
+			}
+			if err := s.store.DeleteDeviceProxyBinding(r.Context(), iccid); err != nil {
+				s.writeStoreError(w, err)
+				return
+			}
+			deleted++
+			reconnected, reconnectErr := s.requestProfileProxyRouteReconnect(binding.DeviceID, binding.ICCID)
+			requested = requested || reconnected
+			if reconnectErr != nil {
+				reconnectErrors = append(reconnectErrors, reconnectErr.Error())
+			}
+		}
+		response := map[string]any{"deleted": deleted, "reconnect_requested": requested}
+		if len(reconnectErrors) > 0 {
+			response["reconnect_error"] = strings.Join(reconnectErrors, "; ")
 		}
 		writeJSON(w, http.StatusOK, map[string]any{"data": response})
 	default:
-		w.Header().Set("Allow", "PUT, DELETE")
+		w.Header().Set("Allow", "GET, POST, DELETE")
 		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "method not allowed")
 	}
 }
@@ -211,7 +275,7 @@ func (s *Server) handleDeviceProxyBinding(w http.ResponseWriter, r *http.Request
 // A binding is already durable before this is called. Reconnect failures are
 // returned as advisory information: the chosen route will still be used on
 // the next VoWiFi start/reconnect.
-func (s *Server) requestProxyRouteReconnect(deviceID string) (bool, error) {
+func (s *Server) requestProfileProxyRouteReconnect(deviceID, iccid string) (bool, error) {
 	if s.vowifi == nil {
 		return false, nil
 	}
@@ -222,6 +286,10 @@ func (s *Server) requestProxyRouteReconnect(deviceID string) (bool, error) {
 	if !config.VoWiFiEnabled {
 		return false, nil
 	}
+	state, stateErr := s.vowifi.State(deviceID)
+	if stateErr != nil || strings.TrimSpace(state.ICCID) == "" || strings.TrimSpace(state.ICCID) != strings.TrimSpace(iccid) {
+		return false, nil
+	}
 	if _, err := s.vowifi.RequestReconnect(deviceID); err != nil {
 		s.logger.Warn("VoWiFi proxy route saved but immediate reconnect was not started", "device_id", deviceID, "error", err)
 		return false, err
@@ -229,6 +297,19 @@ func (s *Server) requestProxyRouteReconnect(deviceID string) (bool, error) {
 	return true, nil
 }
 
+func validProfileICCID(value string) bool {
+	value = strings.TrimSpace(value)
+	if len(value) < 18 || len(value) > 22 {
+		return false
+	}
+	for _, digit := range value {
+		if digit < '0' || digit > '9' {
+			return false
+		}
+	}
+	return true
+}
+
 func (s *Server) saveAndProbeUpstream(
 	w http.ResponseWriter,
 	r *http.Request,
@@ -258,7 +339,7 @@ func (s *Server) saveAndProbeUpstream(
 	}
 	for _, binding := range bindings {
 		if binding.UpstreamProxyID == saved.ID {
-			s.requestProxyRouteReconnect(binding.DeviceID)
+			s.requestProfileProxyRouteReconnect(binding.DeviceID, binding.ICCID)
 		}
 	}
 	probe, probeErr := localproxy.ProbeSOCKS5(
@@ -449,6 +530,8 @@ func countryRuleResponse(value store.CountryRule) map[string]any {
 func deviceProxyBindingResponse(value store.DeviceProxyBinding) map[string]any {
 	return map[string]any{
 		"device_id":         value.DeviceID,
+		"iccid":             value.ICCID,
+		"profile_name":      value.ProfileName,
 		"upstream_proxy_id": value.UpstreamProxyID,
 	}
 }

internal/server/proxy_binding_test.go

@@ -10,120 +10,86 @@ import (
 	"testing"
 
 	"vocat/internal/store"
+	"vocat/internal/vowifi"
 )
 
-func TestDeviceProxyBindingPersistsAndReconnectsEnabledVoWiFi(t *testing.T) {
+const testProfileICCID = "89441000400128014257"
+
+func newProfileBindingTestServer(t *testing.T) (*Server, *store.Store, *fakeVoWiFiController) {
+	t.Helper()
 	database, err := store.Open(context.Background(), ":memory:")
 	if err != nil {
 		t.Fatal(err)
 	}
 	t.Cleanup(func() { _ = database.Close() })
-	if err := database.UpsertDevice(context.Background(), store.Device{
-		ID: "ec20", Name: "EC20", VoWiFiEnabled: true,
-	}); err != nil {
+	if err := database.UpsertDevice(context.Background(), store.Device{ID: "ec20", Name: "EC20", VoWiFiEnabled: true}); err != nil {
 		t.Fatal(err)
 	}
-	if err := database.UpsertUpstreamProxy(context.Background(), store.UpstreamProxy{
-		ID: "route-1", Name: "Route 1", Addr: "127.0.0.1:1080", Enabled: true,
-	}); err != nil {
-		t.Fatal(err)
-	}
-	controller := &fakeVoWiFiController{}
-	server := &Server{
-		store:               database,
-		vowifi:              controller,
-		logger:              slog.New(slog.NewTextHandler(io.Discard, nil)),
-		maxRequestBodyBytes: 4096,
-	}
-
-	request := httptest.NewRequest(
-		http.MethodPut,
-		"/api/upstream-proxy-device-bindings/ec20",
-		bytes.NewBufferString(`{"upstream_proxy_id":"route-1"}`),
-	)
-	request.Header.Set("Content-Type", "application/json")
-	response := httptest.NewRecorder()
-	server.handleDeviceProxyBinding(response, request, "ec20")
-	if response.Code != http.StatusOK {
-		t.Fatalf("PUT status = %d, body = %s", response.Code, response.Body.String())
-	}
-	binding, err := database.DeviceProxyBinding(context.Background(), "ec20")
-	if err != nil || binding.UpstreamProxyID != "route-1" {
-		t.Fatalf("binding = %+v, %v", binding, err)
-	}
-	if controller.reconnects != 1 {
-		t.Fatalf("reconnects = %d, want 1", controller.reconnects)
-	}
-
-	request = httptest.NewRequest(http.MethodDelete, "/api/upstream-proxy-device-bindings/ec20", nil)
-	response = httptest.NewRecorder()
-	server.handleDeviceProxyBinding(response, request, "ec20")
-	if response.Code != http.StatusOK {
-		t.Fatalf("DELETE status = %d, body = %s", response.Code, response.Body.String())
-	}
-	if _, err := database.DeviceProxyBinding(context.Background(), "ec20"); err != store.ErrNotFound {
-		t.Fatalf("binding after delete error = %v, want ErrNotFound", err)
-	}
-	if controller.reconnects != 2 {
-		t.Fatalf("reconnects = %d, want 2", controller.reconnects)
-	}
-}
-
-func TestDeviceProxyBindingRejectsRebindToDifferentUpstream(t *testing.T) {
-	database, err := store.Open(context.Background(), ":memory:")
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = database.Close() })
-	if err := database.UpsertDevice(context.Background(), store.Device{
-		ID: "ec20", Name: "EC20", VoWiFiEnabled: true,
-	}); err != nil {
-		t.Fatal(err)
-	}
-	for _, up := range []store.UpstreamProxy{
+	for _, upstream := range []store.UpstreamProxy{
 		{ID: "route-1", Name: "Route 1", Addr: "127.0.0.1:1080", Enabled: true},
 		{ID: "route-2", Name: "Route 2", Addr: "127.0.0.1:1081", Enabled: true},
 	} {
-		if err := database.UpsertUpstreamProxy(context.Background(), up); err != nil {
+		if err := database.UpsertUpstreamProxy(context.Background(), upstream); err != nil {
 			t.Fatal(err)
 		}
 	}
-	server := &Server{
-		store:               database,
-		vowifi:              &fakeVoWiFiController{},
-		logger:              slog.New(slog.NewTextHandler(io.Discard, nil)),
-		maxRequestBodyBytes: 4096,
+	controller := &fakeVoWiFiController{state: vowifi.State{DeviceID: "ec20", ICCID: testProfileICCID, Enabled: true}}
+	return &Server{store: database, vowifi: controller, logger: slog.New(slog.NewTextHandler(io.Discard, nil)), maxRequestBodyBytes: 16 << 10}, database, controller
+}
+
+func profileBindingRequest(t *testing.T, server *Server, method, body string) *httptest.ResponseRecorder {
+	t.Helper()
+	request := httptest.NewRequest(method, "/api/upstream-proxy-profile-bindings", bytes.NewBufferString(body))
+	request.Header.Set("Content-Type", "application/json")
+	response := httptest.NewRecorder()
+	server.handleProfileProxyBindings(response, request)
+	return response
+}
+
+func TestProfileProxyBindingPersistsAndReconnectsOnlyCurrentICCID(t *testing.T) {
+	server, database, controller := newProfileBindingTestServer(t)
+	response := profileBindingRequest(t, server, http.MethodPost, `{
+		"upstream_proxy_id":"route-1",
+		"bindings":[
+			{"device_id":"ec20","iccid":"89441000400128014257","profile_name":"Vodafone UK","state_text":"Enabled"},
+			{"device_id":"ec20","iccid":"89104100000028106378","profile_name":"TIM"}
+		]
+	}`)
+	if response.Code != http.StatusOK {
+		t.Fatalf("POST status = %d, body = %s", response.Code, response.Body.String())
+	}
+	binding, err := database.DeviceProxyBinding(context.Background(), testProfileICCID)
+	if err != nil || binding.UpstreamProxyID != "route-1" || binding.ProfileName != "Vodafone UK" {
+		t.Fatalf("binding = %+v, %v", binding, err)
+	}
+	if controller.reconnects != 1 {
+		t.Fatalf("reconnects = %d, want only the current ICCID to reconnect", controller.reconnects)
 	}
 
-	// First bind to route-1 succeeds.
-	put := func(proxyID string) *httptest.ResponseRecorder {
-		req := httptest.NewRequest(
-			http.MethodPut,
-			"/api/upstream-proxy-device-bindings/ec20",
-			bytes.NewBufferString(`{"upstream_proxy_id":"`+proxyID+`"}`),
-		)
-		req.Header.Set("Content-Type", "application/json")
-		rec := httptest.NewRecorder()
-		server.handleDeviceProxyBinding(rec, req, "ec20")
-		return rec
+	response = profileBindingRequest(t, server, http.MethodDelete, `{"upstream_proxy_id":"route-1","iccids":["89441000400128014257","89104100000028106378"]}`)
+	if response.Code != http.StatusOK {
+		t.Fatalf("DELETE status = %d, body = %s", response.Code, response.Body.String())
 	}
-	if rec := put("route-1"); rec.Code != http.StatusOK {
-		t.Fatalf("initial bind status = %d, body = %s", rec.Code, rec.Body.String())
+	if _, err := database.DeviceProxyBinding(context.Background(), testProfileICCID); err != store.ErrNotFound {
+		t.Fatalf("binding after delete error = %v, want ErrNotFound", err)
 	}
-
-	// Rebind to a different upstream must be rejected with 409.
-	rec := put("route-2")
-	if rec.Code != http.StatusConflict {
-		t.Fatalf("rebind status = %d, want 409, body = %s", rec.Code, rec.Body.String())
-	}
-	binding, err := database.DeviceProxyBinding(context.Background(), "ec20")
-	if err != nil || binding.UpstreamProxyID != "route-1" {
-		t.Fatalf("binding after rejected rebind = %+v, %v (want route-1 unchanged)", binding, err)
-	}
-
-	// Re-binding the SAME upstream stays idempotent (no 409).
-	if rec := put("route-1"); rec.Code != http.StatusOK {
-		t.Fatalf("idempotent rebind status = %d, want 200, body = %s", rec.Code, rec.Body.String())
+	if controller.reconnects != 2 {
+		t.Fatalf("reconnects after delete = %d, want 2", controller.reconnects)
 	}
 }
 
+func TestProfileProxyBindingRejectsSameICCIDOnDifferentProxy(t *testing.T) {
+	server, database, _ := newProfileBindingTestServer(t)
+	first := profileBindingRequest(t, server, http.MethodPost, `{"upstream_proxy_id":"route-1","bindings":[{"device_id":"ec20","iccid":"89441000400128014257","profile_name":"Profile"}]}`)
+	if first.Code != http.StatusOK {
+		t.Fatalf("initial bind status = %d, body = %s", first.Code, first.Body.String())
+	}
+	second := profileBindingRequest(t, server, http.MethodPost, `{"upstream_proxy_id":"route-2","bindings":[{"device_id":"ec20","iccid":"89441000400128014257","profile_name":"Profile"}]}`)
+	if second.Code != http.StatusConflict {
+		t.Fatalf("rebind status = %d, want 409, body = %s", second.Code, second.Body.String())
+	}
+	binding, err := database.DeviceProxyBinding(context.Background(), testProfileICCID)
+	if err != nil || binding.UpstreamProxyID != "route-1" {
+		t.Fatalf("binding after rejected rebind = %+v, %v", binding, err)
+	}
+}

internal/server/region_test.go

@@ -23,6 +23,7 @@ type fakeDeviceController struct {
 	entry      device.Device
 	atResponse modem.Response
 	atErr      error
+	atHandler  func(string) (modem.Response, error)
 	scanResult device.OperatorScanResult
 	scanErr    error
 	ussdResult device.USSDResult
@@ -44,7 +45,11 @@ func (f fakeDeviceController) Get(id string) (device.Device, error) {
 func (f fakeDeviceController) Refresh(context.Context, string) (device.Snapshot, error) {
 	return device.Snapshot{}, nil
 }
-func (f fakeDeviceController) ExecuteAT(context.Context, string, string) (modem.Response, error) {
+
+func (f fakeDeviceController) ExecuteAT(_ context.Context, _ string, command string) (modem.Response, error) {
+	if f.atHandler != nil {
+		return f.atHandler(command)
+	}
 	return f.atResponse, f.atErr
 }
 func (f fakeDeviceController) Reboot(context.Context, string) error { return nil }

internal/server/server.go

@@ -84,6 +84,7 @@ type Server struct {
 	netTraffic          *liveNetTracker
 	publicIPMu          sync.RWMutex
 	publicIPs           map[string]cachedPublicIP
+	automaticTasks      *automaticTaskScheduler
 }
 
 func New(options Options) (*Server, error) {
@@ -413,7 +414,10 @@ func (s *Server) decodeJSON(w http.ResponseWriter, r *http.Request, destination
 		}
 	}
 
-	r.Body = http.MaxBytesReader(w, r.Body, s.maxRequestBodyBytes)
+	// MaxBytesReader's ResponseWriter parameter is deprecated and unused by Go.
+	// Passing nil also makes the request body and response data flows explicitly
+	// separate for static analysis.
+	r.Body = http.MaxBytesReader(nil, r.Body, s.maxRequestBodyBytes)
 	decoder := json.NewDecoder(r.Body)
 	decoder.DisallowUnknownFields()
 	if err := decoder.Decode(destination); err != nil {

internal/server/settings_api.go

@@ -11,6 +11,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"mime"
 	"net"
 	"net/http"
 	"net/mail"
@@ -278,7 +279,7 @@ func validateNotificationField(
 			}
 		}
 		if name == "from_address" && value != "" {
-			if _, err := mail.ParseAddress(value); err != nil {
+			if _, err := parseMailAddress(value); err != nil {
 				return fmt.Errorf("%s is not a valid email address", field)
 			}
 		}
@@ -763,13 +764,13 @@ func sendEmailNotificationTest(ctx context.Context, config map[string]any) error
 			return fmt.Errorf("%w: SMTP authentication failed", errProviderRejected)
 		}
 	}
-	from, err := mail.ParseAddress(configString(config, "from_address"))
+	from, err := parseMailAddress(configString(config, "from_address"))
 	if err != nil {
 		return fmt.Errorf("parse sender address: %w", err)
 	}
 	recipients := make([]*mail.Address, 0)
 	for _, item := range configStrings(config, "to_addresses") {
-		address, err := mail.ParseAddress(item)
+		address, err := parseMailAddress(item)
 		if err != nil {
 			return fmt.Errorf("parse recipient address: %w", err)
 		}
@@ -789,7 +790,7 @@ func sendEmailNotificationTest(ctx context.Context, config map[string]any) error
 	}
 	message := strings.Join([]string{
 		"Date: " + time.Now().UTC().Format(time.RFC1123Z),
-		"From: " + from.String(),
+		"From: " + formatMailAddress(from),
 		"To: " + joinMailAddresses(recipients),
 		"Subject: vocat notification test",
 		"MIME-Version: 1.0",
@@ -814,11 +815,35 @@ func sendEmailNotificationTest(ctx context.Context, config map[string]any) error
 func joinMailAddresses(values []*mail.Address) string {
 	result := make([]string, 0, len(values))
 	for _, value := range values {
-		result = append(result, value.String())
+		result = append(result, formatMailAddress(value))
 	}
 	return strings.Join(result, ", ")
 }
 
+func parseMailAddress(value string) (*mail.Address, error) {
+	value = strings.TrimSpace(value)
+	if value == "" || strings.ContainsAny(value, "\r\n\x00") {
+		return nil, errors.New("email address contains a prohibited control character")
+	}
+	address, err := mail.ParseAddress(value)
+	if err != nil || address.Address == "" || strings.ContainsAny(address.Address, "\r\n\x00") {
+		return nil, errors.New("invalid email address")
+	}
+	for _, character := range address.Name {
+		if character < 0x20 || character == 0x7f {
+			return nil, errors.New("email display name contains a prohibited control character")
+		}
+	}
+	return address, nil
+}
+
+func formatMailAddress(address *mail.Address) string {
+	if address.Name == "" {
+		return address.Address
+	}
+	return mime.QEncoding.Encode("UTF-8", address.Name) + " <" + address.Address + ">"
+}
+
 func restrictedHTTPClient(
 	ctx context.Context,
 	timeout time.Duration,
@@ -1168,11 +1193,11 @@ func (s *Server) liveCardPolicyFlags(ctx context.Context, iccid string) (vowifi,
 		if !strings.EqualFold(strings.TrimSpace(entry.Snapshot.ICCID), clean) {
 			continue
 		}
-		// VoWiFi deliberately puts the modem into RF-off mode while the SWu/IMS
-		// path owns service. That physical CFUN state is not the user's separate
-		// airplane-mode policy; exposing both toggles as enabled is contradictory
-		// and makes the UI unable to represent the active policy correctly.
-		return config.VoWiFiEnabled, entry.Snapshot.FlightMode && !config.VoWiFiEnabled, true
+		// VoWiFi is an RF-off service mode. Surface that fact explicitly: while
+		// VoWiFi is selected both switches are on, but the airplane switch is
+		// read-only in the UI. Once VoWiFi is disabled, airplane remains on until
+		// the user explicitly turns it off.
+		return config.VoWiFiEnabled, config.VoWiFiEnabled || entry.Snapshot.FlightMode, true
 	}
 	return false, false, false
 }
@@ -1193,9 +1218,11 @@ func (s *Server) handleCardPolicy(w http.ResponseWriter, r *http.Request, iccid
 		policy, err := s.store.CardPolicy(r.Context(), iccid)
 		if errors.Is(err, store.ErrNotFound) {
 			policy = store.CardPolicy{
-				ICCID:     iccid,
-				IPVersion: "IPV4V6",
-				Source:    "default",
+				ICCID:           iccid,
+				VoWiFiEnabled:   true,
+				AirplaneEnabled: true,
+				IPVersion:       "IPV4V6",
+				Source:          "default",
 			}
 		} else if err != nil {
 			s.writeStoreError(w, err)
@@ -1250,14 +1277,11 @@ func (s *Server) handleCardPolicy(w http.ResponseWriter, r *http.Request, iccid
 			)
 			return
 		}
-		if *request.VoWiFiEnabled && *request.AirplaneEnabled {
-			writeError(
-				w,
-				http.StatusBadRequest,
-				"invalid_card_policy",
-				"VoWiFi and airplane mode cannot both be enabled",
-			)
-			return
+		// VoWiFi always owns an RF-off modem. Store airplane=true even when an
+		// older client omits that implication, so disabling VoWiFi cannot expose a
+		// brief cellular attach window.
+		if *request.VoWiFiEnabled {
+			*request.AirplaneEnabled = true
 		}
 		policy := store.CardPolicy{
 			ICCID:           iccid,

internal/server/settings_api_test.go

@@ -424,7 +424,8 @@ func TestCardPolicyDefaultValidationAndPersistence(t *testing.T) {
 	response := decodeSettingsResponse(t, recorder)
 	policy := response["data"].(map[string]any)
 	if policy["iccid"] != iccid || policy["source"] != "default" ||
-		policy["ip_version"] != "IPV4V6" {
+		policy["ip_version"] != "IPV4V6" || policy["vowifi_enabled"] != true ||
+		policy["airplane_enabled"] != true {
 		t.Fatalf("default policy = %#v", policy)
 	}
 
@@ -434,8 +435,8 @@ func TestCardPolicyDefaultValidationAndPersistence(t *testing.T) {
 		"/api/cards/"+iccid+"/policy",
 		`{"vowifi_enabled":true,"airplane_enabled":true,"apn":"ims","ip_version":"IPV4V6"}`,
 	)
-	if recorder.Code != http.StatusBadRequest {
-		t.Fatalf("conflicting policy status = %d, body = %s", recorder.Code, recorder.Body)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("RF-safe policy status = %d, body = %s", recorder.Code, recorder.Body)
 	}
 
 	recorder = test.request(
@@ -450,11 +451,11 @@ func TestCardPolicyDefaultValidationAndPersistence(t *testing.T) {
 	response = decodeSettingsResponse(t, recorder)
 	policy = response["data"].(map[string]any)
 	if policy["source"] != "manual" || policy["vowifi_enabled"] != true ||
-		policy["ip_version"] != "IPV4V6" {
+		policy["airplane_enabled"] != true || policy["ip_version"] != "IPV4V6" {
 		t.Fatalf("saved policy = %#v", policy)
 	}
 	stored, err := test.database.CardPolicy(context.Background(), iccid)
-	if err != nil || !stored.VoWiFiEnabled || stored.APN != "ims" {
+	if err != nil || !stored.VoWiFiEnabled || !stored.AirplaneEnabled || stored.APN != "ims" {
 		t.Fatalf("stored policy = %+v, %v", stored, err)
 	}
 
@@ -582,3 +583,23 @@ func TestRouteSettingsAPIReturnsFalseForUnknownPath(t *testing.T) {
 		t.Fatal("unknown path was claimed by settings router")
 	}
 }
+
+func TestParseMailAddressRejectsHeaderInjection(t *testing.T) {
+	for _, value := range []string{
+		"[email protected]\r\nBcc: [email protected]",
+		"[email protected]\nX-Test: injected",
+		"display\x00name <[email protected]>",
+	} {
+		if _, err := parseMailAddress(value); err == nil {
+			t.Errorf("parseMailAddress(%q) accepted header injection", value)
+		}
+	}
+	address, err := parseMailAddress("Vocat Alerts <[email protected]>")
+	if err != nil {
+		t.Fatal(err)
+	}
+	header := formatMailAddress(address)
+	if strings.ContainsAny(header, "\r\n") {
+		t.Fatalf("formatted address contains a line break: %q", header)
+	}
+}

internal/server/sms_api.go

@@ -12,6 +12,7 @@ import (
 	"strings"
 	"time"
 
+	"vocat/internal/developer"
 	"vocat/internal/device"
 	"vocat/internal/store"
 	"vocat/internal/vowifi"
@@ -224,6 +225,12 @@ func (s *Server) handleSMSSend(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, "blocked_destination", reason)
 		return
 	}
+	// Validate the logical message before consuming a global send slot. Both
+	// cellular AT and VoWiFi IMS use this same encoder/validator.
+	if _, err := device.PrepareSMSSubmitTPDUs(request.Phone, request.Message); err != nil {
+		s.writeDeviceError(w, err)
+		return
+	}
 	config, err := s.store.Device(r.Context(), request.DeviceID)
 	if err != nil {
 		s.writeStoreError(w, err)
@@ -233,6 +240,33 @@ func (s *Server) handleSMSSend(w http.ResponseWriter, r *http.Request) {
 	if !s.requirePhysicalDevice(w, present) {
 		return
 	}
+	limit := developer.SMSHourlyLimit(r.Context(), s.store)
+	reservation, err := s.store.ReserveSMSSend(r.Context(), request.DeviceID, limit, time.Now().UTC())
+	if err != nil {
+		s.writeStoreError(w, err)
+		return
+	}
+	if !reservation.Allowed {
+		retryAfter := time.Until(reservation.ResetAt)
+		if retryAfter < time.Second {
+			retryAfter = time.Second
+		}
+		w.Header().Set("Retry-After", strconv.FormatInt(int64((retryAfter+time.Second-1)/time.Second), 10))
+		writeJSON(w, http.StatusTooManyRequests, map[string]any{
+			"error": apiError{
+				Code:    "sms_rate_limited",
+				Message: fmt.Sprintf("Global SMS limit reached: at most %d messages may be submitted in a rolling one-hour window.", reservation.Limit),
+			},
+			"data": map[string]any{
+				"limit":       reservation.Limit,
+				"used":        reservation.Used,
+				"remaining":   reservation.Remaining,
+				"reset_at":    reservation.ResetAt,
+				"retry_after": int64((retryAfter + time.Second - 1) / time.Second),
+			},
+		})
+		return
+	}
 	if config.VoWiFiEnabled && s.vowifi != nil {
 		state, stateErr := s.vowifi.State(request.DeviceID)
 		sender, canSendIMS := s.vowifi.(imsSMSController)

internal/server/sms_api_test.go

@@ -5,9 +5,12 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 	"time"
 
+	"vocat/internal/developer"
+	"vocat/internal/device"
 	"vocat/internal/store"
 )
 
@@ -155,3 +158,52 @@ func TestBlockedSMSDestination(t *testing.T) {
 		})
 	}
 }
+
+func TestHandleSMSSendEnforcesGlobalHourlyLimit(t *testing.T) {
+	ctx := context.Background()
+	database, err := store.Open(ctx, ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	if err := developer.SetSMSHourlyLimit(ctx, database, 1); err != nil {
+		t.Fatal(err)
+	}
+	if err := database.UpsertDevice(ctx, store.Device{ID: "ec20_1", Name: "EC20"}); err != nil {
+		t.Fatal(err)
+	}
+	if reservation, err := database.ReserveSMSSend(ctx, "another-device", 1, time.Now().UTC()); err != nil || !reservation.Allowed {
+		t.Fatalf("seed global SMS reservation = %+v, %v", reservation, err)
+	}
+	server := &Server{
+		store:               database,
+		logger:              regionTestLogger(),
+		maxRequestBodyBytes: 4096,
+		devices: fakeDeviceController{entry: device.Device{
+			ID:         "ec20_1",
+			Discovered: true,
+			Snapshot:   &device.Snapshot{DeviceID: "ec20_1"},
+		}},
+	}
+	request := httptest.NewRequest(
+		http.MethodPost,
+		"/api/sms/send",
+		strings.NewReader(`{"device_id":"ec20_1","phone":"+447700900123","message":"hello"}`),
+	)
+	request.Header.Set("Content-Type", "application/json")
+	response := httptest.NewRecorder()
+	server.handleSMSSend(response, request)
+	if response.Code != http.StatusTooManyRequests {
+		t.Fatalf("status = %d, want 429; body=%s", response.Code, response.Body.String())
+	}
+	if response.Header().Get("Retry-After") == "" {
+		t.Fatal("Retry-After header is missing")
+	}
+	var envelope errorEnvelope
+	if err := json.Unmarshal(response.Body.Bytes(), &envelope); err != nil {
+		t.Fatal(err)
+	}
+	if envelope.Error.Code != "sms_rate_limited" {
+		t.Fatalf("error code = %q, want sms_rate_limited", envelope.Error.Code)
+	}
+}

internal/server/sms_notifications.go

@@ -402,13 +402,13 @@ func sendEmailSMSNotification(ctx context.Context, config map[string]any, messag
 			return fmt.Errorf("%w: SMTP authentication failed", errProviderRejected)
 		}
 	}
-	from, err := mail.ParseAddress(configString(config, "from_address"))
+	from, err := parseMailAddress(configString(config, "from_address"))
 	if err != nil {
 		return fmt.Errorf("parse sender address: %w", err)
 	}
 	recipients := make([]*mail.Address, 0)
 	for _, item := range configStrings(config, "to_addresses") {
-		address, err := mail.ParseAddress(item)
+		address, err := parseMailAddress(item)
 		if err != nil {
 			return fmt.Errorf("parse recipient address: %w", err)
 		}
@@ -428,7 +428,7 @@ func sendEmailSMSNotification(ctx context.Context, config map[string]any, messag
 	}
 	email := strings.Join([]string{
 		"Date: " + time.Now().UTC().Format(time.RFC1123Z),
-		"From: " + from.String(),
+		"From: " + formatMailAddress(from),
 		"To: " + joinMailAddresses(recipients),
 		"Subject: " + mime.QEncoding.Encode("UTF-8", "收到新短信 - "+message.DeviceLabel),
 		"MIME-Version: 1.0",

internal/server/telegram_bot_test.go

@@ -10,6 +10,7 @@ import (
 	"vocat/internal/device"
 	"vocat/internal/modem"
 	"vocat/internal/store"
+	"vocat/internal/vowifi"
 )
 
 func TestTelegramAPIURLSupportsBaseAndTemplate(t *testing.T) {
@@ -86,6 +87,59 @@ func TestValidTelegramDialNumber(t *testing.T) {
 	}
 }
 
+func TestResolveTelegramPhoneNumberPrefersCurrentSIMAssociation(t *testing.T) {
+	snapshot := &device.Snapshot{
+		ICCID: "89441000400128013903",
+		Phone: device.PhoneNumber{Number: "00000000000"},
+	}
+	state := &vowifi.State{
+		ICCID:       snapshot.ICCID,
+		PhoneNumber: "+447386125520",
+	}
+	if got := resolveTelegramPhoneNumber("+447700900123", state, snapshot); got != "+447700900123" {
+		t.Fatalf("resolved association number = %q", got)
+	}
+	if got := resolveTelegramPhoneNumber("", state, snapshot); got != "+447386125520" {
+		t.Fatalf("resolved IMS number = %q", got)
+	}
+}
+
+func TestResolveTelegramPhoneNumberRejectsPlaceholderAndStaleRuntime(t *testing.T) {
+	snapshot := &device.Snapshot{
+		ICCID: "current-card",
+		Phone: device.PhoneNumber{Number: "00000000000"},
+	}
+	state := &vowifi.State{
+		ICCID:       "previous-card",
+		PhoneNumber: "+447386083638",
+	}
+	if got := resolveTelegramPhoneNumber("", state, snapshot); got != "--" {
+		t.Fatalf("stale or placeholder number leaked as %q", got)
+	}
+	for _, placeholder := range []string{"00000000000", "1111111111", "+0000000000", "not-a-number"} {
+		if usableTelegramPhoneNumber(placeholder) {
+			t.Errorf("placeholder %q was accepted", placeholder)
+		}
+	}
+}
+
+func TestTelegramCarrierPresentationSeparatesHomeAndServingNetworks(t *testing.T) {
+	if got := telegramHomeCarrier("234336570710174"); !strings.Contains(got, "🇬🇧") || !strings.Contains(got, "23433") {
+		t.Fatalf("home carrier = %q", got)
+	}
+	if got := telegramHomeCarrier("204040123456789", "Lebara"); !strings.Contains(got, "Lebara") || !strings.Contains(got, "20404") || !strings.Contains(got, "🇬🇧") || strings.Contains(got, "🇳🇱") {
+		t.Fatalf("branded foreign-core carrier = %q", got)
+	}
+	flight := &device.Snapshot{FlightMode: true, OperatorName: "stale network", RegistrationStatus: 1}
+	if got := telegramCurrentNetwork(flight); got != "--（飞行模式）" {
+		t.Fatalf("flight-mode serving network = %q", got)
+	}
+	serving := &device.Snapshot{OperatorCode: "46001", RegistrationStatus: 5, AccessTech: "LTE", Band: "B3"}
+	if got := telegramCurrentNetwork(serving); !strings.Contains(got, "🇨🇳") || !strings.Contains(got, "已驻网（漫游）") {
+		t.Fatalf("serving network = %q", got)
+	}
+}
+
 func TestTelegramPendingActionIsAuthorizedOneShot(t *testing.T) {
 	bot := &telegramBot{pending: make(map[string]telegramPendingAction)}
 	action := telegramPendingAction{Kind: "call", ChatID: -1001, AdminID: 42, CreatedAt: time.Now()}
@@ -101,6 +155,61 @@ func TestTelegramPendingActionIsAuthorizedOneShot(t *testing.T) {
 	}
 }
 
+func TestTelegramMenuCallbackParsing(t *testing.T) {
+	prefix, token, operation, ok := parseTelegramMenuCallback("call:0123456789abcdef:answer")
+	if !ok || prefix != "call" || token != "0123456789abcdef" || operation != "answer" {
+		t.Fatalf("parsed callback = %q %q %q %t", prefix, token, operation, ok)
+	}
+	for _, invalid := range []string{"", "call:token", "unknown:token:op", "d::status"} {
+		if _, _, _, ok := parseTelegramMenuCallback(invalid); ok {
+			t.Fatalf("invalid callback %q was accepted", invalid)
+		}
+	}
+}
+
+func TestTelegramMenuPendingCanBeReusedButConfirmationCannot(t *testing.T) {
+	bot := &telegramBot{pending: make(map[string]telegramPendingAction)}
+	menuToken, err := bot.putPending(telegramPendingAction{
+		Kind: "menu_device", DeviceID: "EC20", ChatID: 1, AdminID: 2, CreatedAt: time.Now(),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := bot.getPending(menuToken, 1, 2); !ok {
+		t.Fatal("first menu lookup failed")
+	}
+	if _, ok := bot.getPending(menuToken, 1, 2); !ok {
+		t.Fatal("menu token was unexpectedly consumed")
+	}
+	confirmToken, err := bot.putPending(telegramPendingAction{
+		Kind: "sms", ChatID: 1, AdminID: 2, CreatedAt: time.Now(),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := bot.takePending(confirmToken, 1, 2); !ok {
+		t.Fatal("confirmation token lookup failed")
+	}
+	if _, ok := bot.takePending(confirmToken, 1, 2); ok {
+		t.Fatal("confirmation token was reusable")
+	}
+}
+
+func TestTelegramInputStateIsScopedAndCancelable(t *testing.T) {
+	bot := &telegramBot{inputs: make(map[string]telegramInputState)}
+	bot.setInput(telegramInputState{Kind: "sms_phone", DeviceID: "EC20", ChatID: 10, AdminID: 20})
+	if state, ok := bot.input(10, 20); !ok || state.DeviceID != "EC20" || state.Kind != "sms_phone" {
+		t.Fatalf("input state = %#v, %t", state, ok)
+	}
+	if _, ok := bot.input(10, 21); ok {
+		t.Fatal("another administrator read the input state")
+	}
+	bot.clearInput(10, 20)
+	if _, ok := bot.input(10, 20); ok {
+		t.Fatal("cleared input state remained available")
+	}
+}
+
 func TestFormatTelegramATIncludesFinalResult(t *testing.T) {
 	if got := formatTelegramAT(modem.Response{Final: "OK"}); got != "OK" {
 		t.Fatalf("formatTelegramAT(OK) = %q", got)
@@ -165,7 +274,7 @@ func TestTelegramExecutesInteractiveUSSDForConfiguredDevice(t *testing.T) {
 	}
 	formatted := formatTelegramUSSD("EC20", result)
 	for _, expected := range []string{
-		"设备：EC20", "状态：awaiting_input", "1. Balance", "/ussd_reply 0123456789abcdef", "/ussd_cancel 0123456789abcdef",
+		"设备：EC20", "状态：awaiting_input", "1. Balance", "请直接发送回复内容",
 	} {
 		if !strings.Contains(formatted, expected) {
 			t.Fatalf("USSD result %q does not contain %q", formatted, expected)
@@ -181,3 +290,145 @@ func TestTelegramErrorsRedactBotTokens(t *testing.T) {
 		t.Fatalf("redacted error = %q", redacted)
 	}
 }
+
+func TestTelegramCallTransportFollowsConfiguredCardMode(t *testing.T) {
+	controller := &telegramTestCallController{state: vowifi.State{IMSReady: true, Phase: vowifi.PhaseIMSReady}}
+	bot := &telegramBot{server: &Server{vowifi: controller}}
+
+	transport, gotController, err := bot.telegramCallTransport(
+		store.Device{ID: "EC20", VoWiFiEnabled: true},
+		device.Device{Snapshot: &device.Snapshot{FlightMode: true}},
+	)
+	if err != nil || transport != "vowifi" || gotController == nil {
+		t.Fatalf("VoWiFi route = %q, %#v, %v", transport, gotController, err)
+	}
+
+	transport, gotController, err = bot.telegramCallTransport(
+		store.Device{ID: "EC20", VoWiFiEnabled: false},
+		device.Device{Snapshot: &device.Snapshot{FlightMode: false}},
+	)
+	if err != nil || transport != "cellular" || gotController != nil {
+		t.Fatalf("cellular route = %q, %#v, %v", transport, gotController, err)
+	}
+}
+
+func TestTelegramCallTransportDoesNotFallBackFromUnreadyVoWiFi(t *testing.T) {
+	controller := &telegramTestCallController{state: vowifi.State{
+		Phase: vowifi.PhaseFailed, LastError: "SIP registration was rejected: SIP 403",
+	}}
+	bot := &telegramBot{server: &Server{vowifi: controller}}
+	_, _, err := bot.telegramCallTransport(
+		store.Device{ID: "EC20", VoWiFiEnabled: true},
+		device.Device{Snapshot: &device.Snapshot{FlightMode: true}},
+	)
+	if err == nil || !strings.Contains(err.Error(), "SIP 403") {
+		t.Fatalf("unready VoWiFi route error = %v", err)
+	}
+}
+
+func TestTelegramTimedVoWiFiCallUsesIMSAndHangsUpByCallID(t *testing.T) {
+	controller := &telegramTestCallController{state: vowifi.State{IMSReady: true}}
+	controller.dialResult = vowifi.Call{ID: "ims-call-1", Number: "+447700900123", Direction: "outgoing", State: "dialing"}
+	controller.calls = []vowifi.Call{{ID: "ims-call-1", Number: "+447700900123", Direction: "outgoing", State: "active"}}
+	bot := &telegramBot{server: &Server{vowifi: controller}}
+	result, err := bot.executeTimedVoWiFiCall(context.Background(), telegramRuntimeConfig{}, telegramPendingAction{
+		DeviceID: "EC20", Argument: "+447700900123", Duration: 20 * time.Millisecond,
+	}, controller)
+	if err != nil || !strings.Contains(result, "已接通") {
+		t.Fatalf("timed VoWiFi result = %q, %v", result, err)
+	}
+	if controller.dialed != "+447700900123" || len(controller.hungUp) != 1 || controller.hungUp[0] != "ims-call-1" {
+		t.Fatalf("IMS actions dial=%q hangup=%#v", controller.dialed, controller.hungUp)
+	}
+}
+
+func TestTelegramTimedCellularCallUsesATDCLCCAndATH(t *testing.T) {
+	commands := make([]string, 0, 3)
+	devices := fakeDeviceController{atHandler: func(command string) (modem.Response, error) {
+		commands = append(commands, command)
+		switch {
+		case strings.HasPrefix(command, "ATD"):
+			return modem.Response{Final: "OK"}, nil
+		case command == "AT+CLCC":
+			return modem.Response{Lines: []string{`+CLCC: 1,0,2,0,0,"+447700900123",145`}, Final: "OK"}, nil
+		case command == "ATH":
+			return modem.Response{Final: "OK"}, nil
+		default:
+			return modem.Response{}, errors.New("unexpected command")
+		}
+	}}
+	bot := &telegramBot{server: &Server{devices: devices}}
+	result, err := bot.executeTimedCellularCall(context.Background(), telegramRuntimeConfig{}, telegramPendingAction{
+		DeviceID: "EC20", Argument: "+447700900123", Duration: 20 * time.Millisecond,
+	}, "physical")
+	if err != nil || !strings.Contains(result, "正在拨号") {
+		t.Fatalf("timed cellular result = %q, %v", result, err)
+	}
+	joined := strings.Join(commands, ",")
+	for _, expected := range []string{"ATD+447700900123;", "AT+CLCC", "ATH"} {
+		if !strings.Contains(joined, expected) {
+			t.Fatalf("commands %q omit %q", joined, expected)
+		}
+	}
+}
+
+func TestTelegramVoWiFiFailureIncludesSIPDiagnostic(t *testing.T) {
+	err := telegramVoWiFiCallFailure(vowifi.Call{State: "failed", SIPCode: 403, Reason: "Forbidden"})
+	if !strings.Contains(err.Error(), "SIP 403") || !strings.Contains(err.Error(), "Forbidden") {
+		t.Fatalf("VoWiFi diagnostic = %q", err)
+	}
+}
+
+func TestTelegramVoWiFi487IsReportedAsCancelledOutcome(t *testing.T) {
+	result, err := telegramVoWiFiCallOutcome("888", vowifi.Call{
+		State: "failed", SIPCode: 487, Reason: "Request Terminated",
+	})
+	if err != nil || !strings.Contains(result, "取消或终止") || !strings.Contains(result, "SIP 487") {
+		t.Fatalf("487 outcome = %q, %v", result, err)
+	}
+}
+
+type telegramTestCallController struct {
+	state      vowifi.State
+	calls      []vowifi.Call
+	dialResult vowifi.Call
+	dialErr    error
+	dialed     string
+	hungUp     []string
+}
+
+func (controller *telegramTestCallController) State(string) (vowifi.State, error) {
+	return controller.state, nil
+}
+
+func (controller *telegramTestCallController) RequestEnabled(string, bool) (vowifi.State, error) {
+	return controller.state, nil
+}
+
+func (controller *telegramTestCallController) RequestReconnect(string) (vowifi.State, error) {
+	return controller.state, nil
+}
+
+func (controller *telegramTestCallController) Calls(string) ([]vowifi.Call, error) {
+	return append([]vowifi.Call(nil), controller.calls...), nil
+}
+
+func (controller *telegramTestCallController) DialCall(_ context.Context, _ string, number string) (vowifi.Call, error) {
+	controller.dialed = number
+	return controller.dialResult, controller.dialErr
+}
+
+func (controller *telegramTestCallController) AnswerCall(_ context.Context, _ string, id string) (vowifi.Call, error) {
+	for _, call := range controller.calls {
+		if call.ID == id {
+			call.State = "active"
+			return call, nil
+		}
+	}
+	return vowifi.Call{}, errors.New("call not found")
+}
+
+func (controller *telegramTestCallController) HangupCall(_ context.Context, _ string, id string) error {
+	controller.hungUp = append(controller.hungUp, id)
+	return nil
+}

internal/store/automatic_tasks.go

@@ -0,0 +1,276 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+)
+
+const automaticTaskSelect = `
+	SELECT id, name, enabled, device_id, profile_iccid, profile_aid,
+		task_type, environment, interval_days, start_date, run_time,
+		timezone, payload_json, retry_count, notify, next_run_at, last_run_at,
+		last_status, last_error, created_at, updated_at
+	FROM automatic_tasks`
+
+func (s *Store) SaveAutomaticTask(ctx context.Context, value AutomaticTask) (AutomaticTask, error) {
+	now := time.Now().UTC()
+	if strings.TrimSpace(value.Timezone) == "" {
+		value.Timezone = time.Local.String()
+	}
+	if value.CreatedAt.IsZero() {
+		value.CreatedAt = now
+	}
+	value.UpdatedAt = now
+	if len(value.Payload) == 0 {
+		value.Payload = []byte(`{}`)
+	}
+	if value.ID == 0 {
+		result, err := s.db.ExecContext(ctx, `INSERT INTO automatic_tasks (
+			name, enabled, device_id, profile_iccid, profile_aid, task_type,
+			environment, interval_days, start_date, run_time, timezone, payload_json,
+			retry_count, notify, next_run_at, last_run_at, last_status,
+			last_error, created_at, updated_at
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+			strings.TrimSpace(value.Name), value.Enabled, strings.TrimSpace(value.DeviceID),
+			strings.TrimSpace(value.ProfileICCID), strings.TrimSpace(value.ProfileAID),
+			value.TaskType, value.Environment, value.IntervalDays, value.StartDate,
+			value.RunTime, value.Timezone, string(value.Payload), value.RetryCount, value.Notify,
+			value.NextRunAt.Unix(), unixOrZero(value.LastRunAt), value.LastStatus,
+			value.LastError, value.CreatedAt.Unix(), value.UpdatedAt.Unix())
+		if err != nil {
+			return AutomaticTask{}, fmt.Errorf("create automatic task: %w", err)
+		}
+		value.ID, _ = result.LastInsertId()
+	} else {
+		result, err := s.db.ExecContext(ctx, `UPDATE automatic_tasks SET
+			name = ?, enabled = ?, device_id = ?, profile_iccid = ?, profile_aid = ?,
+			task_type = ?, environment = ?, interval_days = ?, start_date = ?,
+			run_time = ?, timezone = ?, payload_json = ?, retry_count = ?, notify = ?,
+			next_run_at = ?, updated_at = ? WHERE id = ?`,
+			strings.TrimSpace(value.Name), value.Enabled, strings.TrimSpace(value.DeviceID),
+			strings.TrimSpace(value.ProfileICCID), strings.TrimSpace(value.ProfileAID),
+			value.TaskType, value.Environment, value.IntervalDays, value.StartDate,
+			value.RunTime, value.Timezone, string(value.Payload), value.RetryCount, value.Notify,
+			value.NextRunAt.Unix(), value.UpdatedAt.Unix(), value.ID)
+		if err != nil {
+			return AutomaticTask{}, fmt.Errorf("update automatic task %d: %w", value.ID, err)
+		}
+		if count, _ := result.RowsAffected(); count == 0 {
+			return AutomaticTask{}, ErrNotFound
+		}
+	}
+	return s.AutomaticTask(ctx, value.ID)
+}
+
+func (s *Store) AutomaticTask(ctx context.Context, id int64) (AutomaticTask, error) {
+	return scanAutomaticTask(s.db.QueryRowContext(ctx, automaticTaskSelect+` WHERE id = ?`, id))
+}
+
+func (s *Store) ListAutomaticTasks(ctx context.Context) ([]AutomaticTask, error) {
+	rows, err := s.db.QueryContext(ctx, automaticTaskSelect+` ORDER BY created_at DESC, id DESC`)
+	if err != nil {
+		return nil, fmt.Errorf("list automatic tasks: %w", err)
+	}
+	defer rows.Close()
+	var result []AutomaticTask
+	for rows.Next() {
+		value, scanErr := scanAutomaticTask(rows)
+		if scanErr != nil {
+			return nil, scanErr
+		}
+		result = append(result, value)
+	}
+	return result, rows.Err()
+}
+
+func (s *Store) DeleteAutomaticTask(ctx context.Context, id int64) error {
+	result, err := s.db.ExecContext(ctx, `DELETE FROM automatic_tasks WHERE id = ?`, id)
+	if err != nil {
+		return fmt.Errorf("delete automatic task %d: %w", id, err)
+	}
+	if count, _ := result.RowsAffected(); count == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
+func (s *Store) ClaimDueAutomaticTasks(ctx context.Context, now time.Time, limit int) ([]AutomaticTaskRun, error) {
+	if limit <= 0 || limit > 100 {
+		limit = 50
+	}
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer tx.Rollback()
+	rows, err := tx.QueryContext(ctx, automaticTaskSelect+`
+		WHERE enabled = 1 AND next_run_at <= ? ORDER BY next_run_at, id LIMIT ?`, now.Unix(), limit)
+	if err != nil {
+		return nil, err
+	}
+	var tasks []AutomaticTask
+	for rows.Next() {
+		task, scanErr := scanAutomaticTask(rows)
+		if scanErr != nil {
+			rows.Close()
+			return nil, scanErr
+		}
+		tasks = append(tasks, task)
+	}
+	rows.Close()
+	result := make([]AutomaticTaskRun, 0, len(tasks))
+	for _, task := range tasks {
+		next := task.NextRunAt
+		location := time.Local
+		if loaded, loadErr := time.LoadLocation(task.Timezone); loadErr == nil {
+			location = loaded
+		}
+		for !next.After(now) {
+			next = next.In(location).AddDate(0, 0, task.IntervalDays).UTC()
+		}
+		if _, err = tx.ExecContext(ctx, `UPDATE automatic_tasks SET next_run_at = ?, updated_at = ? WHERE id = ?`, next.Unix(), now.Unix(), task.ID); err != nil {
+			return nil, err
+		}
+		created, createErr := tx.ExecContext(ctx, `INSERT INTO automatic_task_runs (
+			task_id, device_id, scheduled_at, status, created_at, updated_at
+		) VALUES (?, ?, ?, 'queued', ?, ?)`, task.ID, task.DeviceID, task.NextRunAt.Unix(), now.Unix(), now.Unix())
+		if createErr != nil {
+			return nil, createErr
+		}
+		runID, _ := created.LastInsertId()
+		result = append(result, AutomaticTaskRun{ID: runID, TaskID: task.ID, DeviceID: task.DeviceID, ScheduledAt: task.NextRunAt, Status: "queued", CreatedAt: now, UpdatedAt: now})
+	}
+	if err := tx.Commit(); err != nil {
+		return nil, err
+	}
+	return result, nil
+}
+
+func (s *Store) QueueAutomaticTaskNow(ctx context.Context, task AutomaticTask) (AutomaticTaskRun, error) {
+	now := time.Now().UTC()
+	result, err := s.db.ExecContext(ctx, `INSERT INTO automatic_task_runs (
+		task_id, device_id, scheduled_at, status, created_at, updated_at
+	) VALUES (?, ?, ?, 'queued', ?, ?)`, task.ID, task.DeviceID, now.Unix(), now.Unix(), now.Unix())
+	if err != nil {
+		return AutomaticTaskRun{}, fmt.Errorf("queue automatic task: %w", err)
+	}
+	id, _ := result.LastInsertId()
+	return AutomaticTaskRun{ID: id, TaskID: task.ID, DeviceID: task.DeviceID, ScheduledAt: now, Status: "queued", CreatedAt: now, UpdatedAt: now}, nil
+}
+
+func (s *Store) UpdateAutomaticTaskRun(ctx context.Context, run AutomaticTaskRun) error {
+	now := time.Now().UTC()
+	_, err := s.db.ExecContext(ctx, `UPDATE automatic_task_runs SET
+		started_at = ?, finished_at = ?, status = ?, attempts = ?, output = ?, error = ?, updated_at = ?
+		WHERE id = ?`, unixOrZero(run.StartedAt), unixOrZero(run.FinishedAt), run.Status,
+		run.Attempts, run.Output, run.Error, now.Unix(), run.ID)
+	if err != nil {
+		return fmt.Errorf("update automatic task run %d: %w", run.ID, err)
+	}
+	if run.Status == "success" || run.Status == "failed" {
+		_, err = s.db.ExecContext(ctx, `UPDATE automatic_tasks SET
+			last_run_at = ?, last_status = ?, last_error = ?, updated_at = ? WHERE id = ?`,
+			run.FinishedAt.Unix(), run.Status, run.Error, now.Unix(), run.TaskID)
+	}
+	return err
+}
+
+const automaticTaskRunSelect = `
+	SELECT id, task_id, device_id, scheduled_at, started_at, finished_at,
+		status, attempts, output, error, created_at, updated_at
+	FROM automatic_task_runs`
+
+func (s *Store) ListAutomaticTaskRuns(ctx context.Context, limit int) ([]AutomaticTaskRun, error) {
+	if limit <= 0 || limit > 500 {
+		limit = 100
+	}
+	rows, err := s.db.QueryContext(ctx, automaticTaskRunSelect+` ORDER BY id DESC LIMIT ?`, limit)
+	if err != nil {
+		return nil, err
+	}
+	return scanAutomaticTaskRuns(rows)
+}
+
+// ListAutomaticTaskRunsPaginated returns one page of runs (newest first) plus
+// the total run count, so the UI can page through the full history instead of
+// a fixed recent window.
+func (s *Store) ListAutomaticTaskRunsPaginated(ctx context.Context, limit, offset int) ([]AutomaticTaskRun, int, error) {
+	if limit <= 0 {
+		limit = 20
+	}
+	if limit > 100 {
+		limit = 100
+	}
+	if offset < 0 {
+		offset = 0
+	}
+	total := 0
+	if err := s.db.QueryRowContext(ctx, `SELECT COUNT(*) FROM automatic_task_runs`).Scan(&total); err != nil {
+		return nil, 0, fmt.Errorf("count automatic task runs: %w", err)
+	}
+	rows, err := s.db.QueryContext(ctx, automaticTaskRunSelect+` ORDER BY id DESC LIMIT ? OFFSET ?`, limit, offset)
+	if err != nil {
+		return nil, 0, err
+	}
+	runs, err := scanAutomaticTaskRuns(rows)
+	if err != nil {
+		return nil, 0, err
+	}
+	return runs, total, nil
+}
+
+func scanAutomaticTaskRuns(rows *sql.Rows) ([]AutomaticTaskRun, error) {
+	defer rows.Close()
+	var result []AutomaticTaskRun
+	for rows.Next() {
+		var value AutomaticTaskRun
+		var scheduled, started, finished, created, updated int64
+		if err := rows.Scan(&value.ID, &value.TaskID, &value.DeviceID, &scheduled, &started,
+			&finished, &value.Status, &value.Attempts, &value.Output, &value.Error, &created, &updated); err != nil {
+			return nil, err
+		}
+		value.ScheduledAt, value.StartedAt, value.FinishedAt = time.Unix(scheduled, 0).UTC(), timeFromUnix(started), timeFromUnix(finished)
+		value.CreatedAt, value.UpdatedAt = time.Unix(created, 0).UTC(), time.Unix(updated, 0).UTC()
+		result = append(result, value)
+	}
+	return result, rows.Err()
+}
+
+func scanAutomaticTask(row rowScanner) (AutomaticTask, error) {
+	var value AutomaticTask
+	var enabled, notify bool
+	var payload string
+	var nextRun, lastRun, created, updated int64
+	if err := row.Scan(&value.ID, &value.Name, &enabled, &value.DeviceID, &value.ProfileICCID,
+		&value.ProfileAID, &value.TaskType, &value.Environment, &value.IntervalDays,
+		&value.StartDate, &value.RunTime, &value.Timezone, &payload, &value.RetryCount, &notify,
+		&nextRun, &lastRun, &value.LastStatus, &value.LastError, &created, &updated); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return AutomaticTask{}, ErrNotFound
+		}
+		return AutomaticTask{}, err
+	}
+	value.Enabled, value.Notify = enabled, notify
+	value.Payload = []byte(payload)
+	value.NextRunAt, value.LastRunAt = time.Unix(nextRun, 0).UTC(), timeFromUnix(lastRun)
+	value.CreatedAt, value.UpdatedAt = time.Unix(created, 0).UTC(), time.Unix(updated, 0).UTC()
+	return value, nil
+}
+
+func unixOrZero(value time.Time) int64 {
+	if value.IsZero() {
+		return 0
+	}
+	return value.Unix()
+}
+
+func timeFromUnix(value int64) time.Time {
+	if value <= 0 {
+		return time.Time{}
+	}
+	return time.Unix(value, 0).UTC()
+}

internal/store/automatic_tasks_test.go

@@ -0,0 +1,120 @@
+package store
+
+import (
+	"context"
+	"encoding/json"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+func TestAutomaticTasksAreClaimedInDeviceQueueOrderAndAdvanceSchedule(t *testing.T) {
+	ctx := context.Background()
+	database := openTestStore(t, filepath.Join(t.TempDir(), "automatic-tasks.db"))
+	mustSaveDevice(t, database, "ec20", "EC20")
+	now := time.Now().UTC().Truncate(time.Second)
+	for index := 0; index < 2; index++ {
+		payload, _ := json.Marshal(map[string]any{"phone": "10086", "message": "test"})
+		if _, err := database.SaveAutomaticTask(ctx, AutomaticTask{
+			Name: "task", Enabled: true, DeviceID: "ec20", ProfileICCID: "8944100000000000000",
+			TaskType: "sms", Environment: "vowifi", IntervalDays: 2,
+			StartDate: "2026-08-10", RunTime: "12:00", Timezone: "Asia/Shanghai", Payload: payload,
+			NextRunAt: now.Add(time.Duration(index-2) * time.Minute),
+		}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	runs, err := database.ClaimDueAutomaticTasks(ctx, now, 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(runs) != 2 || runs[0].DeviceID != "ec20" || runs[1].DeviceID != "ec20" || runs[0].TaskID >= runs[1].TaskID {
+		t.Fatalf("claimed runs = %+v", runs)
+	}
+	tasks, err := database.ListAutomaticTasks(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, task := range tasks {
+		if !task.NextRunAt.After(now) {
+			t.Fatalf("task %d next run was not advanced: %v", task.ID, task.NextRunAt)
+		}
+	}
+	second, err := database.ClaimDueAutomaticTasks(ctx, now, 10)
+	if err != nil || len(second) != 0 {
+		t.Fatalf("same schedule claimed twice: %+v, %v", second, err)
+	}
+}
+
+func TestDeletingAutomaticTaskRemovesRunHistory(t *testing.T) {
+	ctx := context.Background()
+	database := openTestStore(t, filepath.Join(t.TempDir(), "automatic-task-delete.db"))
+	mustSaveDevice(t, database, "ec20", "EC20")
+	task, err := database.SaveAutomaticTask(ctx, AutomaticTask{
+		Name: "task", Enabled: true, DeviceID: "ec20", ProfileICCID: "one",
+		TaskType: "call", Environment: "cellular", IntervalDays: 1,
+		StartDate: "2026-08-10", RunTime: "12:00", Timezone: "Asia/Shanghai", Payload: []byte(`{"phone":"10086","duration_seconds":10}`),
+		NextRunAt: time.Now().Add(time.Hour),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := database.QueueAutomaticTaskNow(ctx, task); err != nil {
+		t.Fatal(err)
+	}
+	if err := database.DeleteAutomaticTask(ctx, task.ID); err != nil {
+		t.Fatal(err)
+	}
+	runs, err := database.ListAutomaticTaskRuns(ctx, 10)
+	if err != nil || len(runs) != 0 {
+		t.Fatalf("orphan runs = %+v, %v", runs, err)
+	}
+}
+
+func TestListAutomaticTaskRunsPaginated(t *testing.T) {
+	ctx := context.Background()
+	database := openTestStore(t, filepath.Join(t.TempDir(), "automatic-task-runs-page.db"))
+	mustSaveDevice(t, database, "ec20", "EC20")
+	task, err := database.SaveAutomaticTask(ctx, AutomaticTask{
+		Name: "task", Enabled: true, DeviceID: "ec20", ProfileICCID: "one",
+		TaskType: "call", Environment: "cellular", IntervalDays: 1,
+		StartDate: "2026-08-10", RunTime: "12:00", Timezone: "Asia/Shanghai", Payload: []byte(`{"phone":"10086","duration_seconds":10}`),
+		NextRunAt: time.Now().Add(time.Hour),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for index := 0; index < 5; index++ {
+		if _, err := database.QueueAutomaticTaskNow(ctx, task); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	first, total, err := database.ListAutomaticTaskRunsPaginated(ctx, 2, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if total != 5 || len(first) != 2 {
+		t.Fatalf("first page: total = %d, runs = %+v", total, first)
+	}
+	if first[0].ID <= first[1].ID {
+		t.Fatalf("runs not newest-first: %+v", first)
+	}
+
+	last, total, err := database.ListAutomaticTaskRunsPaginated(ctx, 2, 4)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if total != 5 || len(last) != 1 {
+		t.Fatalf("last page: total = %d, runs = %+v", total, last)
+	}
+
+	// Out-of-range paging inputs are clamped to defaults, not errors.
+	all, total, err := database.ListAutomaticTaskRunsPaginated(ctx, 0, -5)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if total != 5 || len(all) != 5 {
+		t.Fatalf("clamped page: total = %d, runs = %+v", total, all)
+	}
+}

internal/store/domain_test.go

@@ -59,6 +59,7 @@ func TestMigrationFromAuthenticationSchema(t *testing.T) {
 		"device_proxy_bindings",
 		"notification_settings", "app_settings", "audit_events",
 		"log_events", "card_policies", "traffic_buckets",
+		"sms_send_attempts",
 	} {
 		var found string
 		err := database.db.QueryRowContext(ctx, `
@@ -105,6 +106,85 @@ func TestMigration7BackfillsSMSModemIMEI(t *testing.T) {
 	}
 }
 
+func TestMigration12ConvertsOnlyKnownActiveDeviceBindingToICCID(t *testing.T) {
+	ctx := context.Background()
+	path := filepath.Join(t.TempDir(), "profile-proxy-binding.db")
+	raw, err := sql.Open("sqlite", path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for version := 1; version <= 11; version++ {
+		for _, statement := range migrationStatements(version) {
+			if _, err := raw.ExecContext(ctx, statement); err != nil {
+				t.Fatalf("create v%d schema: %v", version, err)
+			}
+		}
+	}
+	if _, err := raw.ExecContext(ctx, `
+		INSERT INTO devices (id, name, created_at, updated_at) VALUES
+			('known', 'Known', 100, 100), ('unknown', 'Unknown', 100, 100);
+		INSERT INTO upstream_proxies (id, name, addr, created_at, updated_at)
+			VALUES ('route', 'Route', '127.0.0.1:1080', 100, 100);
+		INSERT INTO device_proxy_bindings (device_id, upstream_proxy_id, created_at, updated_at) VALUES
+			('known', 'route', 100, 100), ('unknown', 'route', 100, 100);
+		INSERT INTO vowifi_runtime (device_id, iccid, updated_at)
+			VALUES ('known', '89441000400128014257', 100);
+		PRAGMA user_version = 11;
+	`); err != nil {
+		t.Fatal(err)
+	}
+	if err := raw.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	database := openTestStore(t, path)
+	binding, err := database.DeviceProxyBinding(ctx, "89441000400128014257")
+	if err != nil || binding.DeviceID != "known" || binding.UpstreamProxyID != "route" {
+		t.Fatalf("migrated binding = %+v, %v", binding, err)
+	}
+	bindings, err := database.ListDeviceProxyBindings(ctx)
+	if err != nil || len(bindings) != 1 {
+		t.Fatalf("migrated bindings = %+v, %v; unknown ICCID binding must be dropped", bindings, err)
+	}
+}
+
+func TestMigration9NormalizesVoWiFiAirplanePolicy(t *testing.T) {
+	ctx := context.Background()
+	path := filepath.Join(t.TempDir(), "rf-safe-policy.db")
+	raw, err := sql.Open("sqlite", path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for version := 1; version <= 8; version++ {
+		for _, statement := range migrationStatements(version) {
+			if _, err := raw.ExecContext(ctx, statement); err != nil {
+				t.Fatalf("create v%d schema: %v", version, err)
+			}
+		}
+	}
+	if _, err := raw.ExecContext(ctx, `
+		INSERT INTO card_policies (
+			iccid, network_enabled, vowifi_enabled, airplane_enabled,
+			created_at, updated_at
+		) VALUES ('8900000000000000001', 0, 1, 0, 100, 100);
+		PRAGMA user_version = 8;
+	`); err != nil {
+		t.Fatal(err)
+	}
+	if err := raw.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	database := openTestStore(t, path)
+	policy, err := database.CardPolicy(ctx, "8900000000000000001")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !policy.VoWiFiEnabled || !policy.AirplaneEnabled || policy.NetworkEnabled {
+		t.Fatalf("migrated policy = %#v, want VoWiFi+airplane with data off", policy)
+	}
+}
+
 func TestMigration8DefaultsExistingDevicesToPCIeType(t *testing.T) {
 	ctx := context.Background()
 	path := filepath.Join(t.TempDir(), "device-type.db")
@@ -566,12 +646,12 @@ func TestProxyCredentialsAndCountryRules(t *testing.T) {
 		t.Fatalf("CountryRule() = %+v, %v", rule, err)
 	}
 	if err := database.UpsertDeviceProxyBinding(ctx, DeviceProxyBinding{
-		DeviceID: "ec20-1", UpstreamProxyID: "up-1",
+		DeviceID: "ec20-1", ICCID: "89441000400128014257", ProfileName: "Vodafone", UpstreamProxyID: "up-1",
 	}); err != nil {
 		t.Fatal(err)
 	}
-	binding, err := database.DeviceProxyBinding(ctx, "ec20-1")
-	if err != nil || binding.UpstreamProxyID != "up-1" {
+	binding, err := database.DeviceProxyBinding(ctx, "89441000400128014257")
+	if err != nil || binding.UpstreamProxyID != "up-1" || binding.DeviceID != "ec20-1" || binding.ProfileName != "Vodafone" {
 		t.Fatalf("DeviceProxyBinding() = %+v, %v", binding, err)
 	}
 	if err := database.DeleteUpstreamProxy(ctx, "up-1"); err != nil {
@@ -580,7 +660,7 @@ func TestProxyCredentialsAndCountryRules(t *testing.T) {
 	if _, err := database.CountryRule(ctx, "CN"); !errors.Is(err, ErrNotFound) {
 		t.Fatalf("country rule should cascade with upstream deletion, got %v", err)
 	}
-	if _, err := database.DeviceProxyBinding(ctx, "ec20-1"); !errors.Is(err, ErrNotFound) {
+	if _, err := database.DeviceProxyBinding(ctx, "89441000400128014257"); !errors.Is(err, ErrNotFound) {
 		t.Fatalf("device binding should cascade with upstream deletion, got %v", err)
 	}
 }
@@ -709,14 +789,18 @@ func TestEventsPoliciesAndTraffic(t *testing.T) {
 		t.Fatal(err)
 	}
 	if err := database.UpsertCardPolicy(ctx, CardPolicy{
-		ICCID: "invalid", VoWiFiEnabled: true, AirplaneEnabled: true,
-	}); err == nil {
-		t.Fatal("invalid mutually exclusive card policy was accepted")
+		ICCID: "89860002", VoWiFiEnabled: true, AirplaneEnabled: true,
+	}); err != nil {
+		t.Fatalf("RF-safe VoWiFi policy was rejected: %v", err)
 	}
 	policy, err := database.CardPolicy(ctx, "89860001")
 	if err != nil || !policy.VoWiFiEnabled {
 		t.Fatalf("CardPolicy() = %+v, %v", policy, err)
 	}
+	safePolicy, err := database.CardPolicy(ctx, "89860002")
+	if err != nil || !safePolicy.VoWiFiEnabled || !safePolicy.AirplaneEnabled {
+		t.Fatalf("safe CardPolicy() = %+v, %v", safePolicy, err)
+	}
 
 	period := old.Truncate(time.Hour)
 	if err := database.UpsertTrafficBucket(ctx, TrafficBucket{

internal/store/migrations.go

@@ -111,6 +111,122 @@ func migrationStatements(version int) []string {
 			`ALTER TABLE devices
 				ADD COLUMN device_type TEXT NOT NULL DEFAULT 'pcie_ec20_ec25'`,
 		}
+	case 9:
+		return []string{
+			// VoWiFi deliberately owns airplane mode. Earlier schemas treated
+			// these flags as mutually exclusive, which made the RF-safe state
+			// impossible to persist. Rebuild the table without changing rows.
+			`ALTER TABLE card_policies RENAME TO card_policies_v8`,
+			`CREATE TABLE card_policies (
+				iccid TEXT PRIMARY KEY,
+				network_enabled INTEGER NOT NULL DEFAULT 0 CHECK (network_enabled IN (0, 1)),
+				vowifi_enabled INTEGER NOT NULL DEFAULT 0 CHECK (vowifi_enabled IN (0, 1)),
+				airplane_enabled INTEGER NOT NULL DEFAULT 0 CHECK (airplane_enabled IN (0, 1)),
+				apn TEXT NOT NULL DEFAULT '',
+				ip_version TEXT NOT NULL DEFAULT '',
+				source TEXT NOT NULL DEFAULT '',
+				created_at INTEGER NOT NULL,
+				updated_at INTEGER NOT NULL
+			)`,
+			`INSERT INTO card_policies (
+				iccid, network_enabled, vowifi_enabled, airplane_enabled,
+				apn, ip_version, source, created_at, updated_at
+			) SELECT
+				iccid, network_enabled, vowifi_enabled, airplane_enabled,
+				apn, ip_version, source, created_at, updated_at
+			FROM card_policies_v8`,
+			`UPDATE card_policies
+			SET airplane_enabled = 1, network_enabled = 0
+			WHERE vowifi_enabled = 1`,
+			`DROP TABLE card_policies_v8`,
+		}
+	case 10:
+		return []string{
+			`CREATE TABLE IF NOT EXISTS automatic_tasks (
+				id INTEGER PRIMARY KEY AUTOINCREMENT,
+				name TEXT NOT NULL,
+				enabled INTEGER NOT NULL DEFAULT 1 CHECK (enabled IN (0, 1)),
+				device_id TEXT NOT NULL,
+				profile_iccid TEXT NOT NULL,
+				profile_aid TEXT NOT NULL DEFAULT '',
+				task_type TEXT NOT NULL CHECK (task_type IN ('sms', 'call', 'public_ip')),
+				environment TEXT NOT NULL CHECK (environment IN ('vowifi', 'cellular')),
+				interval_days INTEGER NOT NULL CHECK (interval_days BETWEEN 1 AND 365),
+				start_date TEXT NOT NULL,
+				run_time TEXT NOT NULL,
+				timezone TEXT NOT NULL DEFAULT 'Local',
+				payload_json TEXT NOT NULL DEFAULT '{}',
+				retry_count INTEGER NOT NULL DEFAULT 0 CHECK (retry_count BETWEEN 0 AND 10),
+				notify INTEGER NOT NULL DEFAULT 0 CHECK (notify IN (0, 1)),
+				next_run_at INTEGER NOT NULL,
+				last_run_at INTEGER NOT NULL DEFAULT 0,
+				last_status TEXT NOT NULL DEFAULT '',
+				last_error TEXT NOT NULL DEFAULT '',
+				created_at INTEGER NOT NULL,
+				updated_at INTEGER NOT NULL,
+				FOREIGN KEY (device_id) REFERENCES devices(id) ON DELETE CASCADE
+			)`,
+			`CREATE INDEX IF NOT EXISTS automatic_tasks_due_idx ON automatic_tasks(enabled, next_run_at, id)`,
+			`CREATE INDEX IF NOT EXISTS automatic_tasks_device_idx ON automatic_tasks(device_id, next_run_at, id)`,
+			`CREATE TABLE IF NOT EXISTS automatic_task_runs (
+				id INTEGER PRIMARY KEY AUTOINCREMENT,
+				task_id INTEGER NOT NULL,
+				device_id TEXT NOT NULL,
+				scheduled_at INTEGER NOT NULL,
+				started_at INTEGER NOT NULL DEFAULT 0,
+				finished_at INTEGER NOT NULL DEFAULT 0,
+				status TEXT NOT NULL CHECK (status IN ('queued', 'running', 'success', 'failed')),
+				attempts INTEGER NOT NULL DEFAULT 0,
+				output TEXT NOT NULL DEFAULT '',
+				error TEXT NOT NULL DEFAULT '',
+				created_at INTEGER NOT NULL,
+				updated_at INTEGER NOT NULL,
+				FOREIGN KEY (task_id) REFERENCES automatic_tasks(id) ON DELETE CASCADE
+			)`,
+			`CREATE INDEX IF NOT EXISTS automatic_task_runs_task_idx ON automatic_task_runs(task_id, id DESC)`,
+			`CREATE INDEX IF NOT EXISTS automatic_task_runs_status_idx ON automatic_task_runs(status, id)`,
+		}
+	case 11:
+		return []string{
+			`CREATE TABLE IF NOT EXISTS sms_send_attempts (
+				id INTEGER PRIMARY KEY AUTOINCREMENT,
+				device_id TEXT NOT NULL DEFAULT '',
+				created_at INTEGER NOT NULL
+			)`,
+			`CREATE INDEX IF NOT EXISTS sms_send_attempts_created_idx
+				ON sms_send_attempts(created_at, id)`,
+		}
+	case 12:
+		return []string{
+			`ALTER TABLE device_proxy_bindings RENAME TO device_proxy_bindings_v11`,
+			`CREATE TABLE device_proxy_bindings (
+				iccid TEXT PRIMARY KEY,
+				device_id TEXT NOT NULL,
+				profile_name TEXT NOT NULL DEFAULT '',
+				upstream_proxy_id TEXT NOT NULL,
+				created_at INTEGER NOT NULL,
+				updated_at INTEGER NOT NULL,
+				FOREIGN KEY (device_id) REFERENCES devices(id) ON DELETE CASCADE,
+				FOREIGN KEY (upstream_proxy_id) REFERENCES upstream_proxies(id) ON DELETE CASCADE
+			)`,
+			// A legacy device-wide binding is safe to preserve only when the
+			// currently observed ICCID is known. It then becomes one profile binding
+			// instead of leaking onto every future profile used by that device.
+			`INSERT OR IGNORE INTO device_proxy_bindings (
+				iccid, device_id, profile_name, upstream_proxy_id, created_at, updated_at
+			)
+			SELECT COALESCE(NULLIF(v.iccid, ''), NULLIF(d.iccid, '')),
+				b.device_id, '', b.upstream_proxy_id, b.created_at, b.updated_at
+			FROM device_proxy_bindings_v11 b
+			LEFT JOIN vowifi_runtime v ON v.device_id = b.device_id
+			LEFT JOIN device_runtime d ON d.device_id = b.device_id
+			WHERE COALESCE(NULLIF(v.iccid, ''), NULLIF(d.iccid, '')) IS NOT NULL`,
+			`DROP TABLE device_proxy_bindings_v11`,
+			`CREATE INDEX device_proxy_bindings_proxy_idx
+				ON device_proxy_bindings(upstream_proxy_id)`,
+			`CREATE INDEX device_proxy_bindings_device_idx
+				ON device_proxy_bindings(device_id, iccid)`,
+		}
 	default:
 		return nil
 	}

internal/store/models.go

@@ -124,6 +124,45 @@ type PhoneAssociation struct {
 	UpdatedAt time.Time
 }
 
+type AutomaticTask struct {
+	ID           int64           `json:"id"`
+	Name         string          `json:"name"`
+	Enabled      bool            `json:"enabled"`
+	DeviceID     string          `json:"device_id"`
+	ProfileICCID string          `json:"profile_iccid"`
+	ProfileAID   string          `json:"profile_aid"`
+	TaskType     string          `json:"task_type"`
+	Environment  string          `json:"environment"`
+	IntervalDays int             `json:"interval_days"`
+	StartDate    string          `json:"start_date"`
+	RunTime      string          `json:"run_time"`
+	Timezone     string          `json:"timezone"`
+	Payload      json.RawMessage `json:"payload"`
+	RetryCount   int             `json:"retry_count"`
+	Notify       bool            `json:"notify"`
+	NextRunAt    time.Time       `json:"next_run_at"`
+	LastRunAt    time.Time       `json:"last_run_at,omitempty"`
+	LastStatus   string          `json:"last_status"`
+	LastError    string          `json:"last_error"`
+	CreatedAt    time.Time       `json:"created_at"`
+	UpdatedAt    time.Time       `json:"updated_at"`
+}
+
+type AutomaticTaskRun struct {
+	ID          int64     `json:"id"`
+	TaskID      int64     `json:"task_id"`
+	DeviceID    string    `json:"device_id"`
+	ScheduledAt time.Time `json:"scheduled_at"`
+	StartedAt   time.Time `json:"started_at,omitempty"`
+	FinishedAt  time.Time `json:"finished_at,omitempty"`
+	Status      string    `json:"status"`
+	Attempts    int       `json:"attempts"`
+	Output      string    `json:"output"`
+	Error       string    `json:"error"`
+	CreatedAt   time.Time `json:"created_at"`
+	UpdatedAt   time.Time `json:"updated_at"`
+}
+
 type SMSMessage struct {
 	ID            int64
 	MessageID     string
@@ -263,11 +302,12 @@ type CountryRule struct {
 	UpdatedAt       time.Time
 }
 
-// DeviceProxyBinding selects the SOCKS5 upstream used by one device's whole
-// VoWiFi runtime. The IKE/IPsec transport uses this route and IMS/SMS then
-// travel inside that tunnel.
+// DeviceProxyBinding selects the SOCKS5 upstream for exactly one eSIM profile.
+// ICCID is globally unique, while one proxy may serve profiles on many devices.
 type DeviceProxyBinding struct {
 	DeviceID        string
+	ICCID           string
+	ProfileName     string
 	UpstreamProxyID string
 	CreatedAt       time.Time
 	UpdatedAt       time.Time

internal/store/proxy.go

@@ -358,9 +358,11 @@ func upstreamProxy(row rowScanner) (UpstreamProxy, error) {
 
 func (s *Store) UpsertDeviceProxyBinding(ctx context.Context, value DeviceProxyBinding) error {
 	value.DeviceID = strings.TrimSpace(value.DeviceID)
+	value.ICCID = strings.TrimSpace(value.ICCID)
+	value.ProfileName = strings.TrimSpace(value.ProfileName)
 	value.UpstreamProxyID = strings.TrimSpace(value.UpstreamProxyID)
-	if value.DeviceID == "" || value.UpstreamProxyID == "" {
-		return errors.New("device proxy binding requires device and upstream proxy IDs")
+	if value.DeviceID == "" || value.ICCID == "" || value.UpstreamProxyID == "" {
+		return errors.New("profile proxy binding requires device ID, ICCID, and upstream proxy ID")
 	}
 	now := time.Now().UTC()
 	createdAt := value.CreatedAt
@@ -373,28 +375,30 @@ func (s *Store) UpsertDeviceProxyBinding(ctx context.Context, value DeviceProxyB
 	}
 	_, err := s.db.ExecContext(ctx, `
 		INSERT INTO device_proxy_bindings (
-			device_id, upstream_proxy_id, created_at, updated_at
-		) VALUES (?, ?, ?, ?)
-		ON CONFLICT(device_id) DO UPDATE SET
+			iccid, device_id, profile_name, upstream_proxy_id, created_at, updated_at
+		) VALUES (?, ?, ?, ?, ?, ?)
+		ON CONFLICT(iccid) DO UPDATE SET
+			device_id = excluded.device_id,
+			profile_name = excluded.profile_name,
 			upstream_proxy_id = excluded.upstream_proxy_id,
 			updated_at = excluded.updated_at
-	`, value.DeviceID, value.UpstreamProxyID, createdAt.Unix(), updatedAt.Unix())
+	`, value.ICCID, value.DeviceID, value.ProfileName, value.UpstreamProxyID, createdAt.Unix(), updatedAt.Unix())
 	if err != nil {
-		return fmt.Errorf("upsert proxy binding for device %q: %w", value.DeviceID, err)
+		return fmt.Errorf("upsert proxy binding for ICCID %q: %w", value.ICCID, err)
 	}
 	return nil
 }
 
-func (s *Store) DeviceProxyBinding(ctx context.Context, deviceID string) (DeviceProxyBinding, error) {
+func (s *Store) DeviceProxyBinding(ctx context.Context, iccid string) (DeviceProxyBinding, error) {
 	return deviceProxyBinding(s.db.QueryRowContext(
 		ctx,
-		deviceProxyBindingSelect+` WHERE device_id = ?`,
-		strings.TrimSpace(deviceID),
+		deviceProxyBindingSelect+` WHERE iccid = ?`,
+		strings.TrimSpace(iccid),
 	))
 }
 
 func (s *Store) ListDeviceProxyBindings(ctx context.Context) ([]DeviceProxyBinding, error) {
-	rows, err := s.db.QueryContext(ctx, deviceProxyBindingSelect+` ORDER BY device_id`)
+	rows, err := s.db.QueryContext(ctx, deviceProxyBindingSelect+` ORDER BY device_id, profile_name COLLATE NOCASE, iccid`)
 	if err != nil {
 		return nil, fmt.Errorf("list device proxy bindings: %w", err)
 	}
@@ -413,26 +417,26 @@ func (s *Store) ListDeviceProxyBindings(ctx context.Context) ([]DeviceProxyBindi
 	return values, nil
 }
 
-func (s *Store) DeleteDeviceProxyBinding(ctx context.Context, deviceID string) error {
+func (s *Store) DeleteDeviceProxyBinding(ctx context.Context, iccid string) error {
 	result, err := s.db.ExecContext(
 		ctx,
-		`DELETE FROM device_proxy_bindings WHERE device_id = ?`,
-		strings.TrimSpace(deviceID),
+		`DELETE FROM device_proxy_bindings WHERE iccid = ?`,
+		strings.TrimSpace(iccid),
 	)
 	if err != nil {
-		return fmt.Errorf("delete proxy binding for device %q: %w", deviceID, err)
+		return fmt.Errorf("delete proxy binding for ICCID %q: %w", iccid, err)
 	}
 	return requireAffected(result)
 }
 
 const deviceProxyBindingSelect = `
-	SELECT device_id, upstream_proxy_id, created_at, updated_at
+	SELECT device_id, iccid, profile_name, upstream_proxy_id, created_at, updated_at
 	FROM device_proxy_bindings`
 
 func deviceProxyBinding(row rowScanner) (DeviceProxyBinding, error) {
 	var value DeviceProxyBinding
 	var createdAt, updatedAt int64
-	err := row.Scan(&value.DeviceID, &value.UpstreamProxyID, &createdAt, &updatedAt)
+	err := row.Scan(&value.DeviceID, &value.ICCID, &value.ProfileName, &value.UpstreamProxyID, &createdAt, &updatedAt)
 	if errors.Is(err, sql.ErrNoRows) {
 		return DeviceProxyBinding{}, ErrNotFound
 	}

internal/store/settings.go

@@ -369,9 +369,6 @@ func (s *Store) UpsertCardPolicy(ctx context.Context, value CardPolicy) error {
 	default:
 		return fmt.Errorf("unsupported card policy IP version %q", value.IPVersion)
 	}
-	if value.VoWiFiEnabled && value.AirplaneEnabled {
-		return errors.New("VoWiFi and airplane mode cannot both be enabled")
-	}
 	now := time.Now().UTC()
 	createdAt := value.CreatedAt
 	if createdAt.IsZero() {

internal/store/sms_rate.go

@@ -0,0 +1,88 @@
+package store
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+)
+
+const SMSRateWindow = time.Hour
+
+// SMSRateReservation is the durable result of claiming one global outbound
+// SMS slot. The quota is shared by every device, SIM, transport, and caller.
+type SMSRateReservation struct {
+	Allowed   bool
+	Limit     int
+	Used      int
+	Remaining int
+	ResetAt   time.Time
+}
+
+// ReserveSMSSend atomically claims one slot in the rolling one-hour window.
+// It intentionally records submission attempts separately from SMS history so
+// deleting a conversation cannot reset the global safety limit.
+func (s *Store) ReserveSMSSend(
+	ctx context.Context,
+	deviceID string,
+	limit int,
+	now time.Time,
+) (SMSRateReservation, error) {
+	if limit < 1 {
+		return SMSRateReservation{}, errors.New("SMS hourly limit must be positive")
+	}
+	if now.IsZero() {
+		now = time.Now().UTC()
+	} else {
+		now = now.UTC()
+	}
+	cutoff := now.Add(-SMSRateWindow).Unix()
+	result, err := s.db.ExecContext(ctx, `
+		INSERT INTO sms_send_attempts (device_id, created_at)
+		SELECT ?, ?
+		WHERE (
+			SELECT COUNT(*) FROM sms_send_attempts WHERE created_at > ?
+		) < ?
+	`, strings.TrimSpace(deviceID), now.Unix(), cutoff, limit)
+	if err != nil {
+		return SMSRateReservation{}, fmt.Errorf("reserve global SMS send slot: %w", err)
+	}
+	affected, err := result.RowsAffected()
+	if err != nil {
+		return SMSRateReservation{}, fmt.Errorf("read global SMS reservation result: %w", err)
+	}
+
+	status, err := s.smsRateStatus(ctx, limit, cutoff)
+	if err != nil {
+		return SMSRateReservation{}, err
+	}
+	status.Allowed = affected == 1
+	if status.Allowed {
+		// Old rows are irrelevant to enforcement. Pruning after the atomic claim
+		// keeps the hot index compact without creating a delete-before-insert race.
+		_, _ = s.db.ExecContext(ctx, `DELETE FROM sms_send_attempts WHERE created_at <= ?`, now.Add(-7*24*time.Hour).Unix())
+	}
+	return status, nil
+}
+
+func (s *Store) smsRateStatus(ctx context.Context, limit int, cutoff int64) (SMSRateReservation, error) {
+	var used int
+	var earliest *int64
+	if err := s.db.QueryRowContext(ctx, `
+		SELECT COUNT(*), MIN(created_at)
+		FROM sms_send_attempts
+		WHERE created_at > ?
+	`, cutoff).Scan(&used, &earliest); err != nil {
+		return SMSRateReservation{}, fmt.Errorf("read global SMS rate status: %w", err)
+	}
+	remaining := limit - used
+	if remaining < 0 {
+		remaining = 0
+	}
+	status := SMSRateReservation{Limit: limit, Used: used, Remaining: remaining}
+	if earliest != nil {
+		status.ResetAt = time.Unix(*earliest, 0).UTC().Add(SMSRateWindow)
+	}
+	return status, nil
+}

internal/store/sms_rate_test.go

@@ -0,0 +1,58 @@
+package store
+
+import (
+	"context"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func TestReserveSMSSendIsGlobalAndRolling(t *testing.T) {
+	database := openTestStore(t, ":memory:")
+	now := time.Unix(1_800_000_000, 0).UTC()
+
+	first, err := database.ReserveSMSSend(context.Background(), "ec20_1", 2, now)
+	if err != nil || !first.Allowed || first.Used != 1 || first.Remaining != 1 {
+		t.Fatalf("first reservation = %+v, %v", first, err)
+	}
+	second, err := database.ReserveSMSSend(context.Background(), "ec20_2", 2, now.Add(time.Second))
+	if err != nil || !second.Allowed || second.Used != 2 || second.Remaining != 0 {
+		t.Fatalf("second reservation = %+v, %v", second, err)
+	}
+	blocked, err := database.ReserveSMSSend(context.Background(), "another-device", 2, now.Add(2*time.Second))
+	if err != nil || blocked.Allowed || blocked.Used != 2 || !blocked.ResetAt.Equal(now.Add(SMSRateWindow)) {
+		t.Fatalf("blocked reservation = %+v, %v", blocked, err)
+	}
+	afterWindow, err := database.ReserveSMSSend(context.Background(), "ec20_1", 2, now.Add(SMSRateWindow+time.Second))
+	if err != nil || !afterWindow.Allowed || afterWindow.Used != 1 {
+		t.Fatalf("reservation after rolling window = %+v, %v", afterWindow, err)
+	}
+}
+
+func TestReserveSMSSendCannotExceedLimitConcurrently(t *testing.T) {
+	database := openTestStore(t, ":memory:")
+	now := time.Unix(1_800_000_000, 0).UTC()
+	const limit = 10
+	const callers = 40
+	var allowed atomic.Int32
+	var wait sync.WaitGroup
+	for index := 0; index < callers; index++ {
+		wait.Add(1)
+		go func(index int) {
+			defer wait.Done()
+			result, err := database.ReserveSMSSend(context.Background(), "device", limit, now)
+			if err != nil {
+				t.Errorf("reservation %d: %v", index, err)
+				return
+			}
+			if result.Allowed {
+				allowed.Add(1)
+			}
+		}(index)
+	}
+	wait.Wait()
+	if got := allowed.Load(); got != limit {
+		t.Fatalf("allowed reservations = %d, want %d", got, limit)
+	}
+}

internal/store/store.go

@@ -13,7 +13,7 @@ import (
 	_ "modernc.org/sqlite"
 )
 
-const schemaVersion = 8
+const schemaVersion = 12
 
 var ErrNotFound = errors.New("store: not found")
 

internal/vowifi/ec20_adapter.go

@@ -222,14 +222,29 @@ func (adapter *EC20Adapter) readHomePLMN(
 	}
 	// Exact assigned HPLMN prefixes are data, not an MNC-length heuristic. The
 	// target Vodafone UK SIM is 234/15. Unknown assignments remain fail-closed.
-	for prefix, mncLength := range map[string]int{"23415": 2} {
-		if strings.HasPrefix(imsi, prefix) {
-			return imsi[:3], imsi[3 : 3+mncLength], nil
-		}
+	if mcc, mnc, ok := assignedHomePLMN(imsi); ok {
+		return mcc, mnc, nil
 	}
 	return "", "", efErr
 }
 
+func assignedHomePLMN(imsi string) (mcc, mnc string, ok bool) {
+	assignments := []struct {
+		prefix    string
+		mncLength int
+	}{
+		{prefix: "20404", mncLength: 2}, // Vodafone NL core; some Lebara subscriptions.
+		{prefix: "23415", mncLength: 2}, // Vodafone UK.
+		{prefix: "23487", mncLength: 2}, // Lebara Mobile UK.
+	}
+	for _, assignment := range assignments {
+		if strings.HasPrefix(imsi, assignment.prefix) {
+			return imsi[:3], imsi[3 : 3+assignment.mncLength], true
+		}
+	}
+	return "", "", false
+}
+
 func validConfiguredHomePLMN(imsi, mcc, mnc string) bool {
 	if !validDigits(mcc, 3, 3) || !validDigits(mnc, 2, 3) {
 		return false
@@ -658,15 +673,22 @@ func (adapter *EC20Adapter) Restore(
 	if snapshot.OperatingMode < 0 {
 		return errors.New("vocat: invalid EC20 radio snapshot")
 	}
+	targetMode := snapshot.OperatingMode
+	if snapshot.PureAirplanePolicy {
+		// VoWiFi teardown is intentionally fail-closed. Even if the modem was in
+		// CFUN=1 before setup, disabling VoWiFi must leave RF off until the user
+		// explicitly turns airplane mode off through the separate control.
+		targetMode = 4
+	}
 	currentMode, err := adapter.readOperatingMode(ctx, deviceID)
 	if err != nil {
 		return err
 	}
-	if currentMode != snapshot.OperatingMode {
+	if currentMode != targetMode {
 		if _, err := adapter.execute(
 			ctx,
 			deviceID,
-			fmt.Sprintf("AT+CFUN=%d", snapshot.OperatingMode),
+			fmt.Sprintf("AT+CFUN=%d", targetMode),
 		); err != nil {
 			return fmt.Errorf("restore EC20 operating mode: %w", err)
 		}
@@ -675,11 +697,11 @@ func (adapter *EC20Adapter) Restore(
 	if err != nil {
 		return err
 	}
-	if currentMode != snapshot.OperatingMode {
+	if currentMode != targetMode {
 		return fmt.Errorf(
 			"vocat: EC20 restore reported CFUN=%d, expected %d",
 			currentMode,
-			snapshot.OperatingMode,
+			targetMode,
 		)
 	}
 
@@ -697,7 +719,7 @@ func (adapter *EC20Adapter) Restore(
 		return errors.New("vocat: EC20 snapshot has active data in RF-off mode")
 	}
 	desiredCIDs := checkpoint.activeCIDs
-	if !adapter.options.RestoreCellularData {
+	if !adapter.options.RestoreCellularData || targetMode == 0 || targetMode == 4 {
 		desiredCIDs = nil
 	}
 	if err := adapter.reconcileActiveCIDs(

internal/vowifi/ec20_adapter_test.go

@@ -416,6 +416,20 @@ func TestEC20AdapterReadsExplicitHomePLMNAndKnownAssignmentFallback(
 	}
 }
 
+func TestAssignedHomePLMNIncludesLebaraUKCores(t *testing.T) {
+	tests := map[string]string{
+		"204040123456789": "204/04",
+		"234150123456789": "234/15",
+		"234870123456789": "234/87",
+	}
+	for imsi, want := range tests {
+		mcc, mnc, ok := assignedHomePLMN(imsi)
+		if got := mcc + "/" + mnc; !ok || got != want {
+			t.Errorf("assignedHomePLMN(%q) = %q, %v; want %q", imsi, got, ok, want)
+		}
+	}
+}
+
 func TestEC20AdapterRadioTransactionRestoresCFUNAndPDPContexts(
 	t *testing.T,
 ) {
@@ -440,16 +454,14 @@ func TestEC20AdapterRadioTransactionRestoresCFUNAndPDPContexts(
 				lines:   []string{"+CGACT: 1,0", "+CGACT: 2,0"},
 			},
 			{command: "AT+CFUN?", lines: []string{"+CFUN: 4"}},
-			{command: "AT+CFUN=1"},
-			{command: "AT+CFUN?", lines: []string{"+CFUN: 1"}},
+			{command: "AT+CFUN?", lines: []string{"+CFUN: 4"}},
 			{
 				command: "AT+CGACT?",
 				lines:   []string{"+CGACT: 1,0", "+CGACT: 2,0"},
 			},
-			{command: "AT+CGACT=1,1"},
 			{
 				command: "AT+CGACT?",
-				lines:   []string{"+CGACT: 1,1", "+CGACT: 2,0"},
+				lines:   []string{"+CGACT: 1,0", "+CGACT: 2,0"},
 			},
 		},
 	}

internal/vowifi/ike/provider.go

@@ -110,7 +110,7 @@ func (provider *Provider) Start(ctx context.Context, request vowifi.TunnelReques
 	}()
 
 	group := uint16(dhMODP2048)
-	legacyFirst := request.Identity.HomeMCC == "234" && request.Identity.HomeMNC == "15"
+	legacyFirst := legacyIKEProfile(request.Identity.HomeMCC, request.Identity.HomeMNC)
 	if legacyFirst {
 		group = dhMODP1024
 	}
@@ -544,6 +544,15 @@ func (provider *Provider) Start(ctx context.Context, request vowifi.TunnelReques
 	return session, nil
 }
 
+func legacyIKEProfile(mcc, mnc string) bool {
+	// Vodafone's UK and Netherlands ePDGs use the legacy group-2/SHA-1-first
+	// proposal ordering. Some Lebara UK subscriptions carry a 204-04 IMSI from
+	// that Vodafone NL core; treating them as a generic modern network causes
+	// IKE_SA_INIT to fail before EAP-AKA even begins.
+	plmn := strings.TrimSpace(mcc) + strings.TrimLeft(strings.TrimSpace(mnc), "0")
+	return plmn == "23415" || plmn == "2044"
+}
+
 func buildInitialEAPOnlyAuth(
 	idi payload,
 	requestedIDr payload,

internal/vowifi/ike/provider_test.go

@@ -16,6 +16,24 @@ var errFirstAuthObserved = errors.New("test: first IKE_AUTH observed")
 
 type constantReader struct{ value byte }
 
+func TestLegacyIKEProfileIncludesVodafoneHostedLebaraCore(t *testing.T) {
+	for _, item := range []struct {
+		mcc string
+		mnc string
+	}{
+		{mcc: "234", mnc: "15"},
+		{mcc: "204", mnc: "04"},
+		{mcc: "204", mnc: "004"},
+	} {
+		if !legacyIKEProfile(item.mcc, item.mnc) {
+			t.Errorf("legacyIKEProfile(%q, %q) = false", item.mcc, item.mnc)
+		}
+	}
+	if legacyIKEProfile("234", "87") {
+		t.Fatal("Lebara's 234-87 core must use the modern IKE profile")
+	}
+}
+
 func (reader constantReader) Read(destination []byte) (int, error) {
 	for index := range destination {
 		destination[index] = reader.value

internal/vowifi/ike/relay.go

@@ -205,8 +205,13 @@ func (relay *sessionRelay) terminalError() error {
 
 func (relay *sessionRelay) Close() error {
 	relay.cancel()
+	// ReceiveSessionPacket implementations normally observe the canceled
+	// context through a short read deadline. Close the transport as an explicit
+	// wake-up as well: a socket implementation that is stuck in Read must not
+	// hold teardown (and the associated TUN interface) indefinitely.
+	transportErr := relay.transport.Close()
 	<-relay.done
-	return relay.terminalErrorIfFailure()
+	return errors.Join(relay.terminalErrorIfFailure(), transportErr)
 }
 
 func (relay *sessionRelay) terminalErrorIfFailure() error {

internal/vowifi/ike/relay_test.go

@@ -22,12 +22,13 @@ type fakeSentPacket struct {
 }
 
 type fakeSessionTransport struct {
-	incoming chan fakeSessionPacket
-	sent     chan fakeSentPacket
-	closed   chan struct{}
-	once     sync.Once
-	readers  atomic.Int32
-	maxReads atomic.Int32
+	incoming      chan fakeSessionPacket
+	sent          chan fakeSentPacket
+	closed        chan struct{}
+	ignoreContext bool
+	once          sync.Once
+	readers       atomic.Int32
+	maxReads      atomic.Int32
 }
 
 func newFakeSessionTransport() *fakeSessionTransport {
@@ -81,6 +82,18 @@ func (transport *fakeSessionTransport) ReceiveSessionPacket(
 		}
 	}
 	defer transport.readers.Add(-1)
+	if transport.ignoreContext {
+		select {
+		case packet := <-transport.incoming:
+			if packet.err != nil {
+				return 0, false, packet.err
+			}
+			copy(buffer, packet.data)
+			return len(packet.data), packet.ike, nil
+		case <-transport.closed:
+			return 0, false, net.ErrClosed
+		}
+	}
 	select {
 	case packet := <-transport.incoming:
 		if packet.err != nil {
@@ -96,6 +109,37 @@ func (transport *fakeSessionTransport) ReceiveSessionPacket(
 		return 0, false, net.ErrClosed
 	}
 }
+
+func TestSessionRelayCloseInterruptsStuckTransportRead(t *testing.T) {
+	transport := newFakeSessionTransport()
+	transport.ignoreContext = true
+	relay := newSessionRelay(
+		transport,
+		legacyTestSuite(),
+		ikeKeys{},
+		[8]byte{1},
+		[8]byte{2},
+		true,
+		time.Hour,
+	)
+	deadline := time.Now().Add(time.Second)
+	for transport.readers.Load() == 0 && time.Now().Before(deadline) {
+		time.Sleep(time.Millisecond)
+	}
+	if transport.readers.Load() == 0 {
+		t.Fatal("relay did not enter the transport read")
+	}
+	done := make(chan error, 1)
+	go func() { done <- relay.Close() }()
+	select {
+	case err := <-done:
+		if err != nil {
+			t.Fatalf("close relay: %v", err)
+		}
+	case <-time.After(time.Second):
+		t.Fatal("relay Close did not interrupt the transport read")
+	}
+}
 func (transport *fakeSessionTransport) Close() error {
 	transport.once.Do(func() { close(transport.closed) })
 	return nil

internal/vowifi/ike/userspace_linux.go

@@ -7,7 +7,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"io"
 	"net"
 	"os"
 	"os/exec"
@@ -21,6 +20,8 @@ import (
 
 const userspaceTunnelMTU = 1380
 
+const userspaceTunnelPollInterval = 100 * time.Millisecond
+
 type linuxUserspaceInstaller struct {
 	ipCommand string
 }
@@ -30,6 +31,7 @@ type linuxUserspaceHandle struct {
 	config    ChildSAConfig
 	tunnel    *espTunnel
 	tun       *os.File
+	tunFD     int
 	relay     NATTPacketRelay
 
 	runContext context.Context
@@ -93,6 +95,7 @@ func (installer linuxUserspaceInstaller) Install(
 		config:     cloneChildSAConfig(config),
 		tunnel:     tunnel,
 		tun:        tun,
+		tunFD:      int(tun.Fd()),
 		relay:      config.Relay,
 		runContext: runContext,
 		cancel:     cancel,
@@ -128,6 +131,15 @@ func openLinuxTUN(name string) (*os.File, string, error) {
 		_ = unix.Close(descriptor)
 		return nil, "", fmt.Errorf("ike: create TUN interface: %w", err)
 	}
+	// A blocking TUN read is not guaranteed to wake when another goroutine
+	// closes the descriptor on Linux. Keep the descriptor non-blocking and use
+	// poll below so cancellation can always drain the data-plane workers before
+	// the interface is released. Without this, a failed session can retain the
+	// TUN forever and every automatic reconnect fails with EBUSY.
+	if err := unix.SetNonblock(descriptor, true); err != nil {
+		_ = unix.Close(descriptor)
+		return nil, "", fmt.Errorf("ike: make TUN interface cancellable: %w", err)
+	}
 	file := os.NewFile(uintptr(descriptor), "/dev/net/tun:"+request.Name())
 	if file == nil {
 		_ = unix.Close(descriptor)
@@ -475,7 +487,7 @@ func (handle *linuxUserspaceHandle) copyTUNToRelay() {
 	defer handle.wait.Done()
 	buffer := make([]byte, 65535)
 	for {
-		count, err := handle.tun.Read(buffer)
+		count, err := readTUNPacket(handle.runContext, handle.tunFD, buffer)
 		if err != nil {
 			if handle.runContext.Err() == nil && !errors.Is(err, os.ErrClosed) {
 				handle.fail(fmt.Errorf("ike: read TUN packet: %w", err))
@@ -520,7 +532,7 @@ func (handle *linuxUserspaceHandle) copyRelayToTUN() {
 			// without allowing a forged datagram to tear down the CHILD_SA.
 			continue
 		}
-		if err := writeFull(handle.tun, cleartext); err != nil {
+		if err := writeTUNPacket(handle.runContext, handle.tunFD, cleartext); err != nil {
 			if handle.runContext.Err() == nil && !errors.Is(err, os.ErrClosed) {
 				handle.fail(fmt.Errorf("ike: write TUN packet: %w", err))
 			}
@@ -529,17 +541,74 @@ func (handle *linuxUserspaceHandle) copyRelayToTUN() {
 	}
 }
 
-func writeFull(destination io.Writer, packet []byte) error {
-	count, err := destination.Write(packet)
-	if err != nil {
-		return err
+func readTUNPacket(ctx context.Context, descriptor int, buffer []byte) (int, error) {
+	for {
+		if err := ctx.Err(); err != nil {
+			return 0, err
+		}
+		ready, err := pollTUN(ctx, descriptor, unix.POLLIN)
+		if err != nil {
+			return 0, err
+		}
+		if !ready {
+			continue
+		}
+		count, err := unix.Read(descriptor, buffer)
+		if errors.Is(err, unix.EINTR) || errors.Is(err, unix.EAGAIN) || errors.Is(err, unix.EWOULDBLOCK) {
+			continue
+		}
+		return count, err
 	}
-	if count != len(packet) {
-		return io.ErrShortWrite
+}
+
+func writeTUNPacket(ctx context.Context, descriptor int, packet []byte) error {
+	for written := 0; written < len(packet); {
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		ready, err := pollTUN(ctx, descriptor, unix.POLLOUT)
+		if err != nil {
+			return err
+		}
+		if !ready {
+			continue
+		}
+		count, err := unix.Write(descriptor, packet[written:])
+		if errors.Is(err, unix.EINTR) || errors.Is(err, unix.EAGAIN) || errors.Is(err, unix.EWOULDBLOCK) {
+			continue
+		}
+		if err != nil {
+			return err
+		}
+		if count == 0 {
+			return errors.New("ike: zero-length TUN write")
+		}
+		written += count
 	}
 	return nil
 }
 
+func pollTUN(ctx context.Context, descriptor int, events int16) (bool, error) {
+	if err := ctx.Err(); err != nil {
+		return false, err
+	}
+	poll := []unix.PollFd{{Fd: int32(descriptor), Events: events}}
+	count, err := unix.Poll(poll, int(userspaceTunnelPollInterval/time.Millisecond))
+	if errors.Is(err, unix.EINTR) {
+		return false, nil
+	}
+	if err != nil {
+		return false, err
+	}
+	if count == 0 {
+		return false, nil
+	}
+	if poll[0].Revents&(unix.POLLERR|unix.POLLHUP|unix.POLLNVAL) != 0 {
+		return false, os.ErrClosed
+	}
+	return poll[0].Revents&events != 0, nil
+}
+
 func (handle *linuxUserspaceHandle) fail(err error) {
 	handle.mu.Lock()
 	notify := false
@@ -583,9 +652,12 @@ func (handle *linuxUserspaceHandle) Close(ctx context.Context) error {
 	handle.mu.Unlock()
 
 	handle.cancelRun()
+	// Workers use a non-blocking, polled TUN descriptor and therefore leave on
+	// cancellation without requiring a cross-goroutine close. Wait first so no
+	// blocked syscall can retain the interface after Close returns.
+	handle.wait.Wait()
 	cleanupErr := handle.cleanupNetwork(ctx)
 	handle.closeTUN()
-	handle.wait.Wait()
 	// A terminal data-plane error is delivered exactly once through Failures.
 	// Close reports only teardown errors so the orchestrator does not record
 	// the same runtime cause again as a cleanup failure.

internal/vowifi/ims/call_runtime.go

@@ -156,6 +156,10 @@ func (session *Session) watchOutgoingCall(call *imsCall, key sipTransactionKey)
 		case <-session.refreshContext.Done():
 			return
 		case <-timer.C:
+			if session.callWasTerminated(call.callID) {
+				session.finishCall(call.callID, "ended", 0, "")
+				return
+			}
 			session.finishCall(call.callID, "failed", 0, "SIP INVITE transaction timed out")
 			return
 		case response := <-call.responses:
@@ -193,6 +197,11 @@ func (session *Session) watchOutgoingCall(call *imsCall, key sipTransactionKey)
 				}
 				session.setCallMediaReady(call.callID)
 				session.setCallState(call.callID, "active")
+			} else if session.callWasTerminated(call.callID) {
+				// CANCEL normally causes the pending INVITE transaction to finish
+				// with 487 Request Terminated.  It is the expected response to our
+				// local hang-up, not a new network rejection.
+				session.finishCall(call.callID, "ended", response.StatusCode, response.Reason)
 			} else {
 				session.finishCall(call.callID, "failed", response.StatusCode, response.Reason)
 			}
@@ -241,6 +250,7 @@ func (session *Session) HangupCall(ctx context.Context, id string) error {
 	state := call.public.State
 	direction := call.public.Direction
 	request, respond := call.invite, call.respond
+	call.terminated = true
 	session.callMu.Unlock()
 	if direction == "incoming" && state == "ringing" && request != nil && respond != nil {
 		response, err := buildSIPResponseWithBody(request, 486, session.fromTag, nil)
@@ -264,6 +274,13 @@ func (session *Session) HangupCall(ctx context.Context, id string) error {
 	return err
 }
 
+func (session *Session) callWasTerminated(id string) bool {
+	session.callMu.Lock()
+	defer session.callMu.Unlock()
+	call := session.calls[id]
+	return call != nil && call.terminated
+}
+
 func (session *Session) handleCallRequest(request *sipRequest, respond func([]byte) error) bool {
 	switch request.Method {
 	case "INVITE":

internal/vowifi/ims/call_runtime_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"strings"
 	"testing"
+	"time"
 
 	"vocat/internal/vowifi"
 )
@@ -80,6 +81,36 @@ func TestRejectedOutgoingCallRetainsSIPReason(t *testing.T) {
 	}
 }
 
+func TestCancelledOutgoingInviteDoesNotBecomeFailedOn487(t *testing.T) {
+	call := &imsCall{
+		public:     vowifi.Call{ID: "cancelled", State: "dialing"},
+		callID:     "cancelled",
+		responses:  make(chan *sipResponse, 1),
+		terminated: true,
+	}
+	session := &Session{
+		calls:          map[string]*imsCall{call.callID: call},
+		transactions:   make(map[sipTransactionKey]chan *sipResponse),
+		refreshContext: context.Background(),
+	}
+	key := sipTransactionKey{callID: call.callID, cseq: 1, method: "INVITE"}
+	go session.watchOutgoingCall(call, key)
+	call.responses <- &sipResponse{StatusCode: 487, Reason: "Request Terminated"}
+
+	deadline := time.Now().Add(time.Second)
+	for time.Now().Before(deadline) {
+		calls := session.Calls()
+		if len(calls) == 1 && calls[0].EndedAt != nil {
+			if calls[0].State != "ended" || calls[0].SIPCode != 487 {
+				t.Fatalf("cancelled INVITE = %#v", calls[0])
+			}
+			return
+		}
+		time.Sleep(time.Millisecond)
+	}
+	t.Fatal("cancelled INVITE did not reach a terminal state")
+}
+
 func TestValidCallNumber(t *testing.T) {
 	if !validCallNumber("+447700900000") || validCallNumber("12\r\nBYE") {
 		t.Fatal("call number validation mismatch")

internal/vowifi/ims/digest.go

@@ -24,13 +24,13 @@ type digestChallenge struct {
 }
 
 type digestCredentials struct {
-	Username string
-	Password []byte
-	AUTS     string
-	URI      string
-	Method   string
-	CNonce   string
-	NC       uint32
+	Username    string
+	AKAResponse []byte
+	AUTS        string
+	URI         string
+	Method      string
+	CNonce      string
+	NC          uint32
 }
 
 func parseDigestChallenge(value string, proxy bool) (digestChallenge, error) {
@@ -146,7 +146,7 @@ func parseAuthDirectives(value string) (map[string]string, error) {
 }
 
 type akaMaterial struct {
-	password []byte
+	response []byte
 	auts     []byte
 	ck       []byte
 	ik       []byte
@@ -156,7 +156,7 @@ func clearAKAMaterial(material *akaMaterial) {
 	if material == nil {
 		return
 	}
-	zeroBytes(material.password)
+	zeroBytes(material.response)
 	zeroBytes(material.auts)
 	zeroBytes(material.ck)
 	zeroBytes(material.ik)
@@ -193,7 +193,7 @@ func authenticateAKA(
 		return akaMaterial{}, err
 	}
 	return akaMaterial{
-		password: res,
+		response: res,
 		ck:       append([]byte(nil), result.CK...),
 		ik:       append([]byte(nil), result.IK...),
 	}, nil
@@ -231,7 +231,7 @@ func extractRES(result vowifi.AKAResult) ([]byte, error) {
 
 func newDigestCredentials(
 	username string,
-	password []byte,
+	akaResponse []byte,
 	uri string,
 	method string,
 	nc uint32,
@@ -241,12 +241,12 @@ func newDigestCredentials(
 		return digestCredentials{}, fmt.Errorf("ims: create digest cnonce: %w", err)
 	}
 	return digestCredentials{
-		Username: username,
-		Password: password,
-		URI:      uri,
-		Method:   method,
-		CNonce:   hex.EncodeToString(cnonceBytes),
-		NC:       nc,
+		Username:    username,
+		AKAResponse: akaResponse,
+		URI:         uri,
+		Method:      method,
+		CNonce:      hex.EncodeToString(cnonceBytes),
+		NC:          nc,
 	}, nil
 }
 
@@ -255,7 +255,7 @@ func buildDigestAuthorization(challenge digestChallenge, credentials digestCrede
 	response := digestResponse(
 		credentials.Username,
 		challenge.Realm,
-		credentials.Password,
+		credentials.AKAResponse,
 		credentials.Method,
 		credentials.URI,
 		challenge.Nonce,
@@ -290,7 +290,7 @@ func buildDigestAuthorization(challenge digestChallenge, credentials digestCrede
 func digestResponse(
 	username string,
 	realm string,
-	password []byte,
+	akaResponse []byte,
 	method string,
 	uri string,
 	nonce string,
@@ -300,7 +300,9 @@ func digestResponse(
 ) string {
 	ha1Hash := md5.New()
 	_, _ = ha1Hash.Write([]byte(username + ":" + realm + ":"))
-	_, _ = ha1Hash.Write(password)
+	// AKAv1-MD5 is mandated by the IMS server challenge (3GPP TS 33.203).
+	// akaResponse is the short-lived USIM RES value, not a stored password.
+	_, _ = ha1Hash.Write(akaResponse)
 	ha1 := hex.EncodeToString(ha1Hash.Sum(nil))
 	ha2 := md5Hex(method + ":" + uri)
 	if qop == "" {

internal/vowifi/ims/digest_test.go

@@ -64,8 +64,8 @@ func TestAuthenticateAKAMapsNonceToTypedChallenge(t *testing.T) {
 	if err != nil {
 		t.Fatalf("authenticateAKA() error = %v", err)
 	}
-	if !reflect.DeepEqual(material.password, []byte{0xde, 0xad, 0xbe, 0xef}) {
-		t.Fatalf("password = %x, want deadbeef", material.password)
+	if !reflect.DeepEqual(material.response, []byte{0xde, 0xad, 0xbe, 0xef}) {
+		t.Fatalf("response = %x, want deadbeef", material.response)
 	}
 	if len(aka.challenges) != 1 {
 		t.Fatalf("challenge count = %d, want 1", len(aka.challenges))
@@ -97,12 +97,12 @@ func TestAuthenticateAKAReturnsSynchronizationEvidence(t *testing.T) {
 	if err != nil {
 		t.Fatalf("authenticateAKA() error = %v", err)
 	}
-	if !reflect.DeepEqual(material.auts, auts) || len(material.password) != 0 {
+	if !reflect.DeepEqual(material.auts, auts) || len(material.response) != 0 {
 		t.Fatalf("material = %#v", material)
 	}
 }
 
-func TestBuildDigestAuthorizationCarriesAUTSWithEmptyPassword(t *testing.T) {
+func TestBuildDigestAuthorizationCarriesAUTSWithEmptyResponse(t *testing.T) {
 	authorization := buildDigestAuthorization(
 		digestChallenge{
 			Realm:     "ims.example",
@@ -111,13 +111,13 @@ func TestBuildDigestAuthorizationCarriesAUTSWithEmptyPassword(t *testing.T) {
 			QOP:       "auth",
 		},
 		digestCredentials{
-			Username: "[email protected]",
-			Password: nil,
-			AUTS:     "AAECAwQFBgcICQoLDA0=",
-			URI:      "sip:ims.example",
-			Method:   "REGISTER",
-			CNonce:   "cnonce",
-			NC:       1,
+			Username:    "[email protected]",
+			AKAResponse: nil,
+			AUTS:        "AAECAwQFBgcICQoLDA0=",
+			URI:         "sip:ims.example",
+			Method:      "REGISTER",
+			CNonce:      "cnonce",
+			NC:          1,
 		},
 	)
 	directives, err := parseAuthDirectives(strings.TrimPrefix(authorization, "Digest "))

internal/vowifi/ims/provider.go

@@ -405,7 +405,7 @@ func dialSIP(
 
 type authenticationState struct {
 	challenge digestChallenge
-	password  []byte
+	response  []byte
 	auts      string
 	cnonce    string
 	nc        uint32
@@ -633,13 +633,13 @@ func (session *Session) register(ctx context.Context, expires int) (*sipResponse
 		if session.auth != nil {
 			session.auth.nc++
 			credentials := digestCredentials{
-				Username: session.identity.private,
-				Password: session.auth.password,
-				AUTS:     session.auth.auts,
-				URI:      "sip:" + session.identity.domain,
-				Method:   "REGISTER",
-				CNonce:   session.auth.cnonce,
-				NC:       session.auth.nc,
+				Username:    session.identity.private,
+				AKAResponse: session.auth.response,
+				AUTS:        session.auth.auts,
+				URI:         "sip:" + session.identity.domain,
+				Method:      "REGISTER",
+				CNonce:      session.auth.cnonce,
+				NC:          session.auth.nc,
 			}
 			authorization = buildDigestAuthorization(session.auth.challenge, credentials)
 			if session.auth.challenge.Proxy {
@@ -686,7 +686,7 @@ func (session *Session) register(ctx context.Context, expires int) (*sipResponse
 		}
 		credentials, err := newDigestCredentials(
 			session.identity.private,
-			material.password,
+			material.response,
 			"sip:"+session.identity.domain,
 			"REGISTER",
 			1,
@@ -698,7 +698,7 @@ func (session *Session) register(ctx context.Context, expires int) (*sipResponse
 		auts := base64.StdEncoding.EncodeToString(material.auts)
 		session.auth = &authenticationState{
 			challenge: challenge,
-			password:  append([]byte(nil), material.password...),
+			response:  append([]byte(nil), material.response...),
 			auts:      auts,
 			cnonce:    credentials.CNonce,
 		}
@@ -1021,8 +1021,8 @@ func (session *Session) clearAuthentication() {
 	if session.auth == nil {
 		return
 	}
-	for index := range session.auth.password {
-		session.auth.password[index] = 0
+	for index := range session.auth.response {
+		session.auth.response[index] = 0
 	}
 	session.auth = nil
 }

internal/vowifi/integration/at.go

@@ -63,33 +63,57 @@ func (mapper ATMapper) resolve(
 	if mapper.Store == nil || mapper.Devices == nil {
 		return "", errors.New("vowifi AT mapper is not configured")
 	}
-	if entry, err := mapper.Devices.Get(configuredID); err == nil && entry.Discovered {
-		return entry.ID, nil
-	}
 	config, err := mapper.Store.Device(ctx, configuredID)
 	if err != nil {
 		return "", err
 	}
+	// Score every physical candidate before choosing one. Returning the first
+	// partial match made two EC20s on the same hub vulnerable to iteration order:
+	// a stale USB path on one configured row could win before the other
+	// candidate's AT port, QMI node, or live IMEI was considered. The result was
+	// two logical devices issuing APDUs to the same SIM.
+	bestID := ""
+	bestScore := 0
 	for _, entry := range mapper.Devices.List() {
 		if !entry.Discovered {
 			continue
 		}
-		candidate := entry.Candidate
-		switch {
-		case config.ATPort != "" &&
-			(config.ATPort == candidate.ATPort.Path ||
-				config.ATPort == candidate.ATPort.OpenPath()):
-			return entry.ID, nil
-		case config.USBPath != "" && config.USBPath == candidate.USBPath:
-			return entry.ID, nil
-		case config.ControlDevice != "" &&
-			(config.ControlDevice == candidate.QMIControl ||
-				config.ControlDevice == candidate.ATPort.OpenPath()):
-			return entry.ID, nil
-		case config.ModemIMEI != "" && entry.Snapshot != nil &&
-			config.ModemIMEI == strings.TrimSpace(entry.Snapshot.IMEI):
-			return entry.ID, nil
+		score := physicalMatchScore(configuredID, config, entry)
+		if score > bestScore {
+			bestID = entry.ID
+			bestScore = score
 		}
 	}
+	if bestID != "" {
+		return bestID, nil
+	}
 	return "", device.ErrNotFound
 }
+
+func physicalMatchScore(configuredID string, config store.Device, entry device.Device) int {
+	candidate := entry.Candidate
+	score := 0
+	// A live modem identity is the strongest evidence and must override stale
+	// Linux node names or a USB topology saved before devices were rearranged.
+	if config.ModemIMEI != "" && entry.Snapshot != nil &&
+		strings.EqualFold(strings.TrimSpace(config.ModemIMEI), strings.TrimSpace(entry.Snapshot.IMEI)) {
+		score += 10000
+	}
+	if config.ATPort != "" &&
+		(config.ATPort == candidate.ATPort.Path || config.ATPort == candidate.ATPort.OpenPath()) {
+		score += 300
+	}
+	if config.ControlDevice != "" &&
+		(config.ControlDevice == candidate.QMIControl || config.ControlDevice == candidate.ATPort.OpenPath()) {
+		score += 300
+	}
+	if config.USBPath != "" && config.USBPath == candidate.USBPath {
+		score += 100
+	}
+	// Discovery IDs are not persistent user IDs. Treat an exact text match only
+	// as a weak hint so it cannot override physical identity evidence.
+	if entry.ID == configuredID {
+		score += 25
+	}
+	return score
+}

internal/vowifi/integration/at_test.go

@@ -87,3 +87,88 @@ func TestATMapperResolvesConfiguredIDByStableATPath(t *testing.T) {
 		t.Fatalf("ExecuteSensitiveAT physical ID = %q", devices.sensitiveID)
 	}
 }
+
+func TestATMapperScoresAllCandidatesBeforeUsingStaleUSBPath(t *testing.T) {
+	database := testStore(t)
+	if err := database.UpsertDevice(context.Background(), store.Device{
+		ID:            "ec20_1",
+		Name:          "EC20 1",
+		ATPort:        "/dev/ttyUSB2",
+		ControlDevice: "/dev/cdc-wdm0",
+		// Simulate metadata left from a formerly swapped hub mapping.
+		USBPath:   "/sys/bus/usb/devices/1-6",
+		ModemIMEI: "111111111111111",
+	}); err != nil {
+		t.Fatal(err)
+	}
+	devices := &fakeATDevices{entries: []device.Device{
+		{
+			ID:         "quectel-0125-1-6",
+			Discovered: true,
+			Candidate: modem.Candidate{
+				USBPath:    "/sys/bus/usb/devices/1-6",
+				QMIControl: "/dev/cdc-wdm1",
+				ATPort:     modem.Port{Path: "/dev/ttyUSB6"},
+			},
+		},
+		{
+			ID:         "quectel-0306-1-5",
+			Discovered: true,
+			Candidate: modem.Candidate{
+				USBPath:    "/sys/bus/usb/devices/1-5",
+				QMIControl: "/dev/cdc-wdm0",
+				ATPort:     modem.Port{Path: "/dev/ttyUSB2"},
+			},
+		},
+	}}
+	mapper := ATMapper{Store: database, Devices: devices}
+	if _, err := mapper.ExecuteAT(context.Background(), "ec20_1", "AT+CIMI"); err != nil {
+		t.Fatal(err)
+	}
+	if devices.executedID != "quectel-0306-1-5" {
+		t.Fatalf("ExecuteAT physical ID = %q, want coherent AT/QMI candidate", devices.executedID)
+	}
+}
+
+func TestATMapperPrefersLiveIMEIOverAllStalePaths(t *testing.T) {
+	database := testStore(t)
+	if err := database.UpsertDevice(context.Background(), store.Device{
+		ID:            "ec20_1",
+		Name:          "EC20 1",
+		ATPort:        "/dev/ttyUSB2",
+		ControlDevice: "/dev/cdc-wdm0",
+		USBPath:       "/sys/bus/usb/devices/1-5",
+		ModemIMEI:     "222222222222222",
+	}); err != nil {
+		t.Fatal(err)
+	}
+	devices := &fakeATDevices{entries: []device.Device{
+		{
+			ID:         "old-paths",
+			Discovered: true,
+			Candidate: modem.Candidate{
+				USBPath:    "/sys/bus/usb/devices/1-5",
+				QMIControl: "/dev/cdc-wdm0",
+				ATPort:     modem.Port{Path: "/dev/ttyUSB2"},
+			},
+			Snapshot: &device.Snapshot{IMEI: "111111111111111"},
+		},
+		{
+			ID:         "live-imei",
+			Discovered: true,
+			Candidate: modem.Candidate{
+				USBPath:    "/sys/bus/usb/devices/2-3",
+				QMIControl: "/dev/cdc-wdm4",
+				ATPort:     modem.Port{Path: "/dev/ttyUSB10"},
+			},
+			Snapshot: &device.Snapshot{IMEI: "222222222222222"},
+		},
+	}}
+	mapper := ATMapper{Store: database, Devices: devices}
+	if _, err := mapper.ExecuteAT(context.Background(), "ec20_1", "AT+CIMI"); err != nil {
+		t.Fatal(err)
+	}
+	if devices.executedID != "live-imei" {
+		t.Fatalf("ExecuteAT physical ID = %q, want live IMEI candidate", devices.executedID)
+	}
+}

internal/vowifi/integration/store.go

@@ -27,15 +27,16 @@ func (resolver ProxyResolver) Resolve(
 		return vowifi.ProxyRoute{}, errors.New("vowifi proxy resolver: store is nil")
 	}
 	deviceID := strings.TrimSpace(request.DeviceID)
-	if deviceID == "" {
+	iccid := strings.TrimSpace(request.ICCID)
+	if deviceID == "" || iccid == "" {
 		return vowifi.ProxyRoute{Mode: vowifi.ProxyModeDirect}, nil
 	}
-	binding, err := resolver.Store.DeviceProxyBinding(ctx, deviceID)
+	binding, err := resolver.Store.DeviceProxyBinding(ctx, iccid)
 	if errors.Is(err, store.ErrNotFound) {
 		return vowifi.ProxyRoute{Mode: vowifi.ProxyModeDirect}, nil
 	}
 	if err != nil {
-		return vowifi.ProxyRoute{}, fmt.Errorf("resolve proxy binding for device %s: %w", deviceID, err)
+		return vowifi.ProxyRoute{}, fmt.Errorf("resolve proxy binding for ICCID %s: %w", iccid, err)
 	}
 	upstream, err := resolver.Store.UpstreamProxy(ctx, binding.UpstreamProxyID)
 	if err != nil {

internal/vowifi/integration/store_test.go

@@ -21,7 +21,7 @@ func testStore(t *testing.T) *store.Store {
 	return database
 }
 
-func TestProxyResolverUsesDeviceBinding(t *testing.T) {
+func TestProxyResolverUsesICCIDProfileBinding(t *testing.T) {
 	database := testStore(t)
 	if err := database.UpsertDevice(context.Background(), store.Device{ID: "ec20", Name: "EC20"}); err != nil {
 		t.Fatal(err)
@@ -38,13 +38,15 @@ func TestProxyResolverUsesDeviceBinding(t *testing.T) {
 	}
 	if err := database.UpsertDeviceProxyBinding(context.Background(), store.DeviceProxyBinding{
 		DeviceID:        "ec20",
+		ICCID:           "89441000400128014257",
+		ProfileName:     "Vodafone UK",
 		UpstreamProxyID: "clash",
 	}); err != nil {
 		t.Fatal(err)
 	}
 	route, err := (ProxyResolver{Store: database}).Resolve(
 		context.Background(),
-		vowifi.ProxyRequest{DeviceID: "ec20", HomeMCC: "234", HomeMNC: "15"},
+		vowifi.ProxyRequest{DeviceID: "ec20", ICCID: "89441000400128014257", HomeMCC: "234", HomeMNC: "15"},
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -57,6 +59,26 @@ func TestProxyResolverUsesDeviceBinding(t *testing.T) {
 	}
 }
 
+func TestProxyResolverDoesNotLeakBindingToAnotherProfileOnSameDevice(t *testing.T) {
+	database := testStore(t)
+	if err := database.UpsertDevice(context.Background(), store.Device{ID: "ec20", Name: "EC20"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := database.UpsertUpstreamProxy(context.Background(), store.UpstreamProxy{ID: "proxy", Name: "Proxy", Addr: "127.0.0.1:1080", Enabled: true}); err != nil {
+		t.Fatal(err)
+	}
+	if err := database.UpsertDeviceProxyBinding(context.Background(), store.DeviceProxyBinding{DeviceID: "ec20", ICCID: "89441000400128014257", ProfileName: "A", UpstreamProxyID: "proxy"}); err != nil {
+		t.Fatal(err)
+	}
+	route, err := (ProxyResolver{Store: database}).Resolve(context.Background(), vowifi.ProxyRequest{DeviceID: "ec20", ICCID: "89104100000028106378"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if route.Mode != vowifi.ProxyModeDirect {
+		t.Fatalf("route = %#v, want direct for unbound ICCID", route)
+	}
+}
+
 func TestProxyResolverDoesNotUseCountryRuleWithoutDeviceBinding(t *testing.T) {
 	database := testStore(t)
 	if err := database.UpsertUpstreamProxy(context.Background(), store.UpstreamProxy{

internal/vowifi/orchestrator.go

@@ -106,8 +106,8 @@ func (orchestrator *Orchestrator) Subscribe(buffer int) (<-chan State, func()) {
 }
 
 // Enable executes one evidence-backed transaction. The order intentionally
-// follows the working Linux/QMI path: live identity and home PLMN, AKA
-// availability, ePDG derivation, runtime-owned RF off, cellular-data stop,
+// follows the working Linux/QMI path: snapshot and disable cellular RF first,
+// then read the live identity/home PLMN, verify AKA availability, derive ePDG,
 // country proxy resolution, SWu tunnel, IMS registration, and SMS readiness.
 func (orchestrator *Orchestrator) Enable(ctx context.Context) (State, error) {
 	if ctx == nil {
@@ -143,20 +143,37 @@ func (orchestrator *Orchestrator) Enable(ctx context.Context) (State, error) {
 		}
 	})
 
+	// A failed attempt deliberately retains the original radio checkpoint and
+	// keeps CFUN=4. Automatic retries must rebuild only the Wi-Fi/IKE/IMS layers;
+	// restoring CFUN=1 between attempts can briefly register on a visited network
+	// and trigger roaming/welcome SMS messages. Explicit Disable is the only path
+	// that restores the pre-VoWiFi radio mode.
+	orchestrator.mu.Lock()
+	retained := orchestrator.resources
+	orchestrator.mu.Unlock()
 	runtimeContext, runtimeCancel := context.WithCancel(context.Background())
 	resources := &runtimeResources{cancel: runtimeCancel}
+	if current.Phase == PhaseFailed && retained != nil && retained.radioChanged {
+		resources.radio = retained.radio
+		resources.radioChanged = true
+	}
 	orchestrator.mu.Lock()
 	orchestrator.resources = resources
 	orchestrator.mu.Unlock()
 
 	setupContext, stopSetup := mergedContext(ctx, runtimeContext)
 	defer stopSetup()
+	var err error
 
 	fail := func(stage Phase, cause error) (State, error) {
 		runtimeCancel()
-		cleanupErrors := orchestrator.cleanup(resources)
+		cleanupErrors := orchestrator.cleanupSessions(resources)
 		orchestrator.mu.Lock()
-		orchestrator.resources = nil
+		if resources.radioChanged {
+			orchestrator.resources = resources
+		} else {
+			orchestrator.resources = nil
+		}
 		orchestrator.mu.Unlock()
 
 		orchestrator.mutate(func(state *State) {
@@ -181,6 +198,28 @@ func (orchestrator *Orchestrator) Enable(ctx context.Context) (State, error) {
 		return orchestrator.State(), stageError
 	}
 
+	if !resources.radioChanged {
+		resources.radio, err = orchestrator.deps.Radio.Snapshot(setupContext, orchestrator.options.DeviceID)
+		if err != nil {
+			return fail(PhaseAccessReady, err)
+		}
+		orchestrator.mutate(func(state *State) {
+			state.PureAirplanePolicy = resources.radio.PureAirplanePolicy
+		})
+		// Mark the transaction before the mutating call: a provider may return
+		// an error after partially changing the modem.
+		resources.radioChanged = true
+	}
+	// RF-off is established before any SIM/AKA probing. Those operations are
+	// local UICC APDUs and remain available in CFUN=4; no serving-cell attach is
+	// required or permitted during VoWiFi setup.
+	if err := orchestrator.deps.Radio.EnterVoWiFiRFOff(setupContext, orchestrator.options.DeviceID); err != nil {
+		return fail(PhaseAccessReady, err)
+	}
+	if err := orchestrator.deps.Radio.StopCellularData(setupContext, orchestrator.options.DeviceID); err != nil {
+		return fail(PhaseAccessReady, err)
+	}
+
 	identity, err := orchestrator.deps.SIM.ReadIdentity(setupContext, orchestrator.options.DeviceID)
 	if err != nil {
 		return fail(PhaseSIMReady, err)
@@ -216,31 +255,9 @@ func (orchestrator *Orchestrator) Enable(ctx context.Context) (State, error) {
 	if err != nil {
 		return fail(PhaseAccessReady, err)
 	}
-	resources.radio, err = orchestrator.deps.Radio.Snapshot(setupContext, orchestrator.options.DeviceID)
-	if err != nil {
-		return fail(PhaseAccessReady, err)
-	}
-	orchestrator.mutate(func(state *State) {
-		state.PureAirplanePolicy = resources.radio.PureAirplanePolicy
-	})
-	// Mark the radio transaction before the first mutating call: a provider
-	// may return an error after partially changing the modem.
-	resources.radioChanged = true
-	// Enter RF-off before reconciling PDP contexts. Some QMI-capable EC20
-	// firmware automatically owns CID 1 while CFUN=1 and rejects a direct
-	// CGACT=0 command even though the Linux data interface is down. CFUN=4
-	// tears down packet service at the baseband; StopCellularData then acts as
-	// a fail-closed verification and removes any context that unexpectedly
-	// survived RF-off.
-	if err := orchestrator.deps.Radio.EnterVoWiFiRFOff(setupContext, orchestrator.options.DeviceID); err != nil {
-		return fail(PhaseAccessReady, err)
-	}
-	if err := orchestrator.deps.Radio.StopCellularData(setupContext, orchestrator.options.DeviceID); err != nil {
-		return fail(PhaseAccessReady, err)
-	}
-
 	proxy, err := orchestrator.deps.Proxy.Resolve(setupContext, ProxyRequest{
 		DeviceID:    orchestrator.options.DeviceID,
+		ICCID:       strings.TrimSpace(identity.ICCID),
 		HomeMCC:     strings.TrimSpace(identity.HomeMCC),
 		HomeMNC:     strings.TrimSpace(identity.HomeMNC),
 		CountryCode: strings.ToUpper(strings.TrimSpace(identity.HomeCountryCode)),
@@ -484,14 +501,32 @@ func (orchestrator *Orchestrator) Reconnect(ctx context.Context) (State, error)
 	if !current.Enabled && current.Phase == PhaseIdle {
 		return current, ErrNotRunning
 	}
-	// Teardown during a reconnect is best-effort. Disable already releases the
-	// local IMS, tunnel, and radio resources, so a non-fatal cleanup error
-	// (e.g. the network rejecting SIP deregistration) must not block the
-	// rebuild — otherwise the device wedges in PhaseFailed. Only propagate
-	// errors that prevented the teardown itself (e.g. the operation lock).
-	if _, err := orchestrator.Disable(ctx); err != nil && !errors.Is(err, ErrCleanupIncomplete) {
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	if err := orchestrator.lockOperation(ctx); err != nil {
 		return orchestrator.State(), err
 	}
+	orchestrator.mu.Lock()
+	resources := orchestrator.resources
+	orchestrator.mu.Unlock()
+	if resources != nil && resources.cancel != nil {
+		resources.cancel()
+	}
+	cleanupErrors := orchestrator.cleanupSessions(resources)
+	orchestrator.mutate(func(state *State) {
+		state.Phase = PhaseFailed
+		state.Enabled = true
+		state.Active = false
+		state.TunnelReady = false
+		state.IMSReady = false
+		state.SMSReady = false
+		state.LastReason = "reconnect_requested"
+		state.CleanupErrors = append([]string(nil), cleanupErrors...)
+	})
+	orchestrator.unlockOperation()
+	// Keep the radio checkpoint and CFUN=4 across a reconnect. Re-enabling RF
+	// for even a short window defeats airplane-first VoWiFi behavior.
 	return orchestrator.Enable(ctx)
 }
 
@@ -679,6 +714,25 @@ func securityAuditFromEvidence(evidence TunnelEvidence) SecurityAudit {
 }
 
 func (orchestrator *Orchestrator) cleanup(resources *runtimeResources) []string {
+	if resources == nil {
+		return nil
+	}
+	cleanupErrors := orchestrator.cleanupSessions(resources)
+	if resources.radioChanged {
+		if err := orchestrator.cleanupCall(func(ctx context.Context) error {
+			return orchestrator.deps.Radio.Restore(ctx, orchestrator.options.DeviceID, resources.radio)
+		}); err != nil {
+			cleanupErrors = append(cleanupErrors, "restore radio: "+err.Error())
+		}
+		resources.radioChanged = false
+	}
+	return cleanupErrors
+}
+
+// cleanupSessions releases network-layer resources without restoring cellular
+// RF. It is used while VoWiFi remains the desired policy, including failed
+// automatic retries and manual reconnects.
+func (orchestrator *Orchestrator) cleanupSessions(resources *runtimeResources) []string {
 	if resources == nil {
 		return nil
 	}
@@ -695,14 +749,6 @@ func (orchestrator *Orchestrator) cleanup(resources *runtimeResources) []string
 		}
 		resources.tunnel = nil
 	}
-	if resources.radioChanged {
-		if err := orchestrator.cleanupCall(func(ctx context.Context) error {
-			return orchestrator.deps.Radio.Restore(ctx, orchestrator.options.DeviceID, resources.radio)
-		}); err != nil {
-			cleanupErrors = append(cleanupErrors, "restore radio: "+err.Error())
-		}
-		resources.radioChanged = false
-	}
 	return cleanupErrors
 }
 
@@ -802,10 +848,14 @@ func (orchestrator *Orchestrator) watchRuntimeFailure(
 			if !current {
 				return
 			}
-			cleanupErrors := orchestrator.cleanup(resources)
+			cleanupErrors := orchestrator.cleanupSessions(resources)
 			orchestrator.mu.Lock()
 			if orchestrator.resources == resources {
-				orchestrator.resources = nil
+				if resources.radioChanged {
+					orchestrator.resources = resources
+				} else {
+					orchestrator.resources = nil
+				}
 			}
 			orchestrator.mu.Unlock()
 			orchestrator.mutate(func(state *State) {

internal/vowifi/orchestrator_test.go

@@ -366,11 +366,11 @@ func TestEnableUsesEvidenceBackedOrderAndDisableRollsBackInReverse(t *testing.T)
 	}
 
 	wantEnableCalls := []string{
-		"sim.identity",
-		"aka.ready",
 		"radio.snapshot",
 		"radio.rf_off",
 		"radio.stop_data",
+		"sim.identity",
+		"aka.ready",
 		"proxy.resolve",
 		"tunnel.start",
 		"tunnel.evidence",
@@ -422,26 +422,10 @@ func TestEnableFailuresCleanUpEveryAcquiredLayer(t *testing.T) {
 		{name: "identity", failCall: "sim.identity"},
 		{name: "aka", failCall: "aka.ready"},
 		{name: "radio snapshot", failCall: "radio.snapshot"},
-		{
-			name:            "stop data can partially mutate",
-			failCall:        "radio.stop_data",
-			wantCleanupTail: []string{"radio.restore"},
-		},
-		{
-			name:            "rf off",
-			failCall:        "radio.rf_off",
-			wantCleanupTail: []string{"radio.restore"},
-		},
-		{
-			name:            "proxy",
-			failCall:        "proxy.resolve",
-			wantCleanupTail: []string{"radio.restore"},
-		},
-		{
-			name:            "tunnel start",
-			failCall:        "tunnel.start",
-			wantCleanupTail: []string{"radio.restore"},
-		},
+		{name: "stop data can partially mutate", failCall: "radio.stop_data"},
+		{name: "rf off", failCall: "radio.rf_off"},
+		{name: "proxy", failCall: "proxy.resolve"},
+		{name: "tunnel start", failCall: "tunnel.start"},
 		{
 			name: "tunnel evidence",
 			mutate: func(environment *fakeEnvironment) {
@@ -449,12 +433,12 @@ func TestEnableFailuresCleanUpEveryAcquiredLayer(t *testing.T) {
 				environment.tunnelEvidence.ResponderAUTH = ResponderAUTHUnknown
 			},
 			wantError:       ErrTunnelNotEstablished,
-			wantCleanupTail: []string{"tunnel.close", "radio.restore"},
+			wantCleanupTail: []string{"tunnel.close"},
 		},
 		{
 			name:            "IMS start",
 			failCall:        "ims.start",
-			wantCleanupTail: []string{"tunnel.close", "radio.restore"},
+			wantCleanupTail: []string{"tunnel.close"},
 		},
 		{
 			name: "IMS registration evidence",
@@ -462,12 +446,12 @@ func TestEnableFailuresCleanUpEveryAcquiredLayer(t *testing.T) {
 				environment.imsEvidence.Registered = false
 			},
 			wantError:       ErrIMSNotRegistered,
-			wantCleanupTail: []string{"ims.close", "tunnel.close", "radio.restore"},
+			wantCleanupTail: []string{"ims.close", "tunnel.close"},
 		},
 		{
 			name:            "SMS activation",
 			failCall:        "ims.sms",
-			wantCleanupTail: []string{"ims.close", "tunnel.close", "radio.restore"},
+			wantCleanupTail: []string{"ims.close", "tunnel.close"},
 		},
 		{
 			name: "SMS evidence",
@@ -475,7 +459,7 @@ func TestEnableFailuresCleanUpEveryAcquiredLayer(t *testing.T) {
 				environment.smsEvidence.Ready = false
 			},
 			wantError:       ErrSMSNotReady,
-			wantCleanupTail: []string{"ims.close", "tunnel.close", "radio.restore"},
+			wantCleanupTail: []string{"ims.close", "tunnel.close"},
 		},
 	}
 
@@ -501,6 +485,9 @@ func TestEnableFailuresCleanUpEveryAcquiredLayer(t *testing.T) {
 				state.TunnelReady || state.IMSReady || state.SMSReady {
 				t.Fatalf("failed state = %+v", state)
 			}
+			if environment.callCount("radio.restore") != 0 {
+				t.Fatalf("failed VoWiFi attempt re-enabled cellular RF: %#v", environment.callsSnapshot())
+			}
 			if len(test.wantCleanupTail) > 0 {
 				calls := environment.callsSnapshot()
 				if len(calls) < len(test.wantCleanupTail) {
@@ -701,6 +688,34 @@ func TestRetryAfterFailureCreatesANewAttempt(t *testing.T) {
 	if environment.callCount("tunnel.start") != 2 {
 		t.Fatalf("tunnel.start count = %d", environment.callCount("tunnel.start"))
 	}
+	if environment.callCount("radio.snapshot") != 1 || environment.callCount("radio.restore") != 0 {
+		t.Fatalf("retry must retain RF-off checkpoint: %#v", environment.callsSnapshot())
+	}
+}
+
+func TestFailedEnableRestoresRadioOnlyOnExplicitDisable(t *testing.T) {
+	environment := newFakeEnvironment()
+	environment.setFailure("tunnel.start", 1)
+	orchestrator := newTestOrchestrator(t, environment, false)
+
+	state, err := orchestrator.Enable(context.Background())
+	if err == nil || state.Phase != PhaseFailed || !state.Enabled {
+		t.Fatalf("Enable() = (%+v, %v)", state, err)
+	}
+	if environment.callCount("radio.restore") != 0 {
+		t.Fatalf("failed enable restored cellular RF: %#v", environment.callsSnapshot())
+	}
+
+	state, err = orchestrator.Disable(context.Background())
+	if err != nil {
+		t.Fatalf("Disable() error = %v", err)
+	}
+	if state.Phase != PhaseIdle || state.Enabled {
+		t.Fatalf("Disable() state = %+v", state)
+	}
+	if environment.callCount("radio.restore") != 1 {
+		t.Fatalf("explicit disable did not restore cellular RF: %#v", environment.callsSnapshot())
+	}
 }
 
 func TestReconnectClosesThenRebuildsTheRuntime(t *testing.T) {
@@ -719,7 +734,8 @@ func TestReconnectClosesThenRebuildsTheRuntime(t *testing.T) {
 	}
 	if environment.callCount("tunnel.start") != 2 ||
 		environment.callCount("tunnel.close") != 1 ||
-		environment.callCount("radio.restore") != 1 {
+		environment.callCount("radio.restore") != 0 ||
+		environment.callCount("radio.snapshot") != 1 {
 		t.Fatalf("calls = %#v", environment.callsSnapshot())
 	}
 }
@@ -745,7 +761,8 @@ func TestReconnectToleratesCleanupFailureAndRebuilds(t *testing.T) {
 	}
 	if environment.callCount("ims.close") != 1 ||
 		environment.callCount("tunnel.close") != 1 ||
-		environment.callCount("radio.restore") != 1 ||
+		environment.callCount("radio.restore") != 0 ||
+		environment.callCount("radio.snapshot") != 1 ||
 		environment.callCount("tunnel.start") != 2 {
 		t.Fatalf("calls = %#v", environment.callsSnapshot())
 	}
@@ -781,7 +798,7 @@ func TestRuntimeTunnelFailureRevokesReadinessAndCleansEveryLayer(t *testing.T) {
 	}
 
 	calls := environment.callsSnapshot()
-	wantTail := []string{"ims.close", "tunnel.close", "radio.restore"}
+	wantTail := []string{"ims.close", "tunnel.close"}
 	if len(calls) < len(wantTail) ||
 		!reflect.DeepEqual(calls[len(calls)-len(wantTail):], wantTail) {
 		t.Fatalf("runtime failure cleanup tail = %#v", calls)
@@ -853,7 +870,7 @@ func TestSubscriptionPublishesOrderedEvidencePhases(t *testing.T) {
 	}
 }
 
-func TestCleanupAttemptsEveryLayerAndReportsAllErrors(t *testing.T) {
+func TestFailedAttemptKeepsRadioOffUntilExplicitDisable(t *testing.T) {
 	environment := newFakeEnvironment()
 	environment.setFailure("ims.sms", 1)
 	environment.setFailure("ims.close", 1)
@@ -865,19 +882,26 @@ func TestCleanupAttemptsEveryLayerAndReportsAllErrors(t *testing.T) {
 	if err == nil {
 		t.Fatal("Enable() unexpectedly succeeded")
 	}
-	if len(state.CleanupErrors) != 3 {
+	if len(state.CleanupErrors) != 2 {
 		t.Fatalf("cleanup errors = %#v", state.CleanupErrors)
 	}
 	calls := environment.callsSnapshot()
-	wantTail := []string{"ims.close", "tunnel.close", "radio.restore"}
-	if !reflect.DeepEqual(calls[len(calls)-3:], wantTail) {
-		t.Fatalf("cleanup tail = %#v", calls[len(calls)-3:])
+	wantTail := []string{"ims.close", "tunnel.close"}
+	if !reflect.DeepEqual(calls[len(calls)-2:], wantTail) {
+		t.Fatalf("cleanup tail = %#v", calls[len(calls)-2:])
 	}
-	for _, text := range []string{"close IMS", "close tunnel", "restore radio"} {
+	for _, text := range []string{"close IMS", "close tunnel"} {
 		if !strings.Contains(err.Error(), text) {
 			t.Fatalf("error %q does not contain %q", err, text)
 		}
 	}
+	if environment.callCount("radio.restore") != 0 {
+		t.Fatalf("failed attempt restored RF unexpectedly: %#v", calls)
+	}
+	if _, disableErr := orchestrator.Disable(context.Background()); disableErr == nil ||
+		!strings.Contains(disableErr.Error(), "restore radio") {
+		t.Fatalf("Disable() error = %v, want retained radio restore failure", disableErr)
+	}
 }
 
 func TestDisableCleanupWarningStillSettlesIdle(t *testing.T) {

internal/vowifi/runtime/manager.go

@@ -211,12 +211,26 @@ func (manager *Manager) RequestEnabled(deviceID string, enabled bool) (vowifi.St
 	manager.mu.Lock()
 	item := manager.entries[deviceID]
 	item.desiredEnabled = enabled
-	if !enabled && item.busy {
-		item.disablePending = true
+	if item.busy {
+		manager.logger.Info(
+			"VoWiFi desired state updated while lifecycle operation is active",
+			"device_id", deviceID,
+			"enabled", enabled,
+		)
+		// The switch is a desired-state control, not a one-shot command. A user
+		// can change it again while a slow IKE/IMS transaction is still winding
+		// down. Accept the newest value and let runOperations reconcile the
+		// runtime after the current operation completes. Returning busy here used
+		// to let the database and runtime diverge (configured on, runtime idle).
+		if enabled {
+			item.disablePending = false
+		} else {
+			item.disablePending = true
+		}
 		cancel := item.operationCancel
 		state := item.orchestrator.State()
 		manager.mu.Unlock()
-		if cancel != nil {
+		if !enabled && cancel != nil {
 			cancel()
 		}
 		return state, nil
@@ -366,6 +380,7 @@ func (manager *Manager) startOperation(
 	manager.wg.Add(1)
 	manager.mu.Unlock()
 
+	manager.logger.Debug("VoWiFi lifecycle operation queued", "device_id", deviceID)
 	go manager.runOperations(deviceID, item, operation)
 	return item.orchestrator.State(), nil
 }
@@ -376,6 +391,7 @@ func (manager *Manager) runOperations(
 	operation func(context.Context, *vowifi.Orchestrator) error,
 ) {
 	defer manager.wg.Done()
+	manager.logger.Debug("VoWiFi lifecycle worker started", "device_id", deviceID)
 	for {
 		ctx, cancel := context.WithTimeout(manager.ctx, manager.operationTimeout)
 		manager.mu.Lock()
@@ -389,6 +405,7 @@ func (manager *Manager) runOperations(
 		}
 		item.operationCancel = cancel
 		manager.mu.Unlock()
+		manager.logger.Debug("VoWiFi lifecycle operation executing", "device_id", deviceID)
 		err := operation(ctx, item.orchestrator)
 		cancel()
 		if err != nil &&
@@ -431,6 +448,25 @@ func (manager *Manager) runOperations(
 			}
 			continue
 		}
+		// Reconcile a switch change that arrived while the previous lifecycle
+		// operation was busy. Keep using the same worker so enable/disable can
+		// never overlap on the modem or tunnel resources.
+		if item.desiredEnabled && !state.Enabled {
+			manager.mu.Unlock()
+			operation = func(ctx context.Context, orchestrator *vowifi.Orchestrator) error {
+				_, err := orchestrator.Enable(ctx)
+				return err
+			}
+			continue
+		}
+		if !item.desiredEnabled && state.Enabled {
+			manager.mu.Unlock()
+			operation = func(ctx context.Context, orchestrator *vowifi.Orchestrator) error {
+				_, err := orchestrator.Disable(ctx)
+				return err
+			}
+			continue
+		}
 		item.busy = false
 		shouldRetry := item.desiredEnabled && state.Phase == vowifi.PhaseFailed
 		if !shouldRetry && state.Phase != vowifi.PhaseFailed {

internal/vowifi/runtime/manager_test.go

@@ -267,6 +267,89 @@ func TestManagerStopsAutomaticRetryWhenPolicyIsDisabled(t *testing.T) {
 	}
 }
 
+func TestManagerAcceptsRepeatedEnableWhileBusy(t *testing.T) {
+	manager := New(Options{OperationTimeout: time.Second})
+	t.Cleanup(func() { _ = manager.Close(context.Background()) })
+	if err := manager.Register(testOrchestrator(t, "ec20")); err != nil {
+		t.Fatal(err)
+	}
+
+	started := make(chan struct{})
+	release := make(chan struct{})
+	if _, err := manager.startOperation("ec20", false, func(context.Context, *vowifi.Orchestrator) error {
+		close(started)
+		<-release
+		return nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	<-started
+	if _, err := manager.RequestEnabled("ec20", true); err != nil {
+		t.Fatalf("repeated desired state was rejected: %v", err)
+	}
+	close(release)
+
+	deadline := time.Now().Add(time.Second)
+	for time.Now().Before(deadline) {
+		state, err := manager.State("ec20")
+		if err != nil {
+			t.Fatal(err)
+		}
+		if state.Phase == vowifi.PhaseSMSReady {
+			return
+		}
+		time.Sleep(time.Millisecond)
+	}
+	t.Fatal("desired enable was not reconciled after the active operation")
+}
+
+func TestManagerReEnablesWhenSwitchChangesDuringDisable(t *testing.T) {
+	manager := New(Options{OperationTimeout: time.Second})
+	t.Cleanup(func() { _ = manager.Close(context.Background()) })
+	if err := manager.Register(testOrchestrator(t, "ec20")); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := manager.RequestEnabled("ec20", true); err != nil {
+		t.Fatal(err)
+	}
+	waitForPhase := func(want vowifi.Phase) {
+		t.Helper()
+		deadline := time.Now().Add(time.Second)
+		for time.Now().Before(deadline) {
+			state, err := manager.State("ec20")
+			if err != nil {
+				t.Fatal(err)
+			}
+			if state.Phase == want {
+				return
+			}
+			time.Sleep(time.Millisecond)
+		}
+		t.Fatalf("phase did not become %s", want)
+	}
+	waitForPhase(vowifi.PhaseSMSReady)
+
+	started := make(chan struct{})
+	release := make(chan struct{})
+	if _, err := manager.startOperation("ec20", false, func(ctx context.Context, orchestrator *vowifi.Orchestrator) error {
+		close(started)
+		<-release
+		_, err := orchestrator.Disable(ctx)
+		return err
+	}); err != nil {
+		t.Fatal(err)
+	}
+	<-started
+	manager.mu.Lock()
+	manager.entries["ec20"].desiredEnabled = false
+	manager.mu.Unlock()
+	if _, err := manager.RequestEnabled("ec20", true); err != nil {
+		t.Fatalf("enable while disable is active: %v", err)
+	}
+	close(release)
+	waitForPhase(vowifi.PhaseSMSReady)
+}
+
 func TestManagerRejectsUnknownDevice(t *testing.T) {
 	manager := New(Options{})
 	t.Cleanup(func() {
@@ -348,8 +431,9 @@ func TestManagerCoalescesReconnectWhileLifecycleOperationIsBusy(t *testing.T) {
 	if _, err := manager.RequestReconnect("ec20"); err != nil {
 		t.Fatalf("second queued reconnect error = %v", err)
 	}
-	if _, err := manager.RequestEnabled("ec20", true); !errors.Is(err, ErrOperationInProgress) {
-		t.Fatalf("non-reconnect operation error = %v, want ErrOperationInProgress", err)
+	if _, err := manager.RequestEnabled("ec20", true); err != nil {
+		close(release)
+		t.Fatalf("repeated desired enable was rejected: %v", err)
 	}
 	manager.mu.Lock()
 	pending := manager.entries["ec20"].reconnectPending

internal/vowifi/types.go

@@ -203,6 +203,7 @@ type ProxyRoute struct {
 
 type ProxyRequest struct {
 	DeviceID    string
+	ICCID       string
 	HomeMCC     string
 	HomeMNC     string
 	CountryCode string

web/src/App.tsx

@@ -14,6 +14,7 @@ import DevicesPage from "./pages/DevicesPage";
 import ProxyPage from "./pages/ProxyPage";
 import ExportProxyPage from "./pages/ExportProxyPage";
 import SmsPage from "./pages/SmsPage";
+import AutomaticTasksPage from "./pages/AutomaticTasksPage";
 import LogsPage from "./pages/LogsPage";
 import SettingsPage from "./pages/SettingsPage";
 import ExtensionPage from "./pages/ExtensionPage";
@@ -113,6 +114,7 @@ function AppRoot() {
           <Route path="proxy" element={<ProxyPage />} />
           <Route path="export-proxy" element={<ExportProxyPage />} />
           <Route path="sms" element={<SmsPage />} />
+          <Route path="automatic-tasks" element={<AutomaticTasksPage />} />
           <Route path="extensions/:pluginId/:contributionId" element={<ExtensionPage />} />
           <Route path="logs" element={<LogsPage />} />
           <Route path="settings" element={<SettingsPage />} />

web/src/components/devices/CardPolicyPanel.tsx

@@ -61,7 +61,7 @@ export function CardPolicyPanel({ deviceId, iccid, policy, deviceOnline, onPolic
           <div className="grid grid-cols-1 gap-3 lg:grid-cols-2">
             <PolicySwitchCard
               title="VoWiFi"
-              subtitle={t("启用后进飞行模式，不支持国内运营商")}
+              subtitle={t("启用时强制关闭蜂窝射频；关闭 VoWiFi 后仍保持飞行模式")}
               tone="orange"
               checked={local.vowifiEnabled}
               disabled={!operable || toggles.vowifiPending}
@@ -71,7 +71,7 @@ export function CardPolicyPanel({ deviceId, iccid, policy, deviceOnline, onPolic
             />
             <PolicySwitchCard
               title={t("飞行模式")}
-              subtitle={t("射频关闭，断网；VoWiFi 开启时由其接管")}
+              subtitle={t("只有手动关闭此开关才允许设备连接基站")}
               tone="indigo"
               checked={local.airplaneEnabled}
               disabled={!operable || local.vowifiEnabled || toggles.airplanePending}

web/src/components/devices/DeviceConfigTab.tsx

@@ -111,7 +111,11 @@ export function DeviceConfigTab({ editConfig, deviceStatus, saving, deleting, on
               <div>
                 <div className="text-sm font-bold text-gray-800 dark:text-gray-100">{t("设备运行模式")}</div>
                 <div className="text-xs text-gray-500 dark:text-gray-400">
-                  {isQmi ? t("此类设备固定 QMI，AT 口仅用于终端") : isMbim ? t("此类设备固定 MBIM，AT 口仅用于终端") : t("AT=传统串口 / QMI=纯 QMI")}
+                  {isQmi
+                    ? t("QMI 负责驻网状态与数据会话；AT 负责 SIM/eSIM、射频、短信、通话和终端指令")
+                    : isMbim
+                      ? t("MBIM 负责数据会话；AT 负责 SIM/eSIM、射频、短信、通话和终端指令")
+                      : t("AT 模式通过串口管理驻网与 PDP 数据会话")}
                 </div>
               </div>
               <Select

web/src/components/devices/DeviceDetailHeader.tsx

@@ -3,6 +3,7 @@ import { Button, Switch } from "../ui";
 import type { DeviceDetail } from "./types";
 import { useI18n } from "../../lib/i18n";
 import { deviceTypeImage } from "../../lib/deviceTypes";
+import { isVoWiFiInUse } from "./shared";
 
 export interface DeviceDetailHeaderProps {
   device: DeviceDetail;
@@ -19,7 +20,7 @@ export interface DeviceDetailHeaderProps {
 export function DeviceDetailHeader(props: DeviceDetailHeaderProps) {
   const { t } = useI18n();
   const { device } = props;
-	const vowifiInUse = !!device.vowifiEnabled;
+	const vowifiInUse = isVoWiFiInUse(device);
   return (
     <div className="ui-card p-6">
       <div className="flex flex-col gap-4 lg:flex-row lg:items-center lg:justify-between">

web/src/components/devices/DeviceListPanel.tsx

@@ -1,6 +1,6 @@
 import type { DeviceListItem } from "../../types";
 import { Input, Select, Tag, ListSkeleton, EmptyState } from "../ui";
-import { isDeviceOnline, isRegistered, lifecycleLabel } from "./shared";
+import { isDeviceOnline, isRegistered, isVoWiFiInUse, lifecycleLabel } from "./shared";
 import { DeviceListItemCard } from "./DeviceListItemCard";
 import { tl, useI18n } from "../../lib/i18n";
 
@@ -40,7 +40,7 @@ function primaryLine(d: DeviceListItem): string {
 }
 
 function statusLine(d: DeviceListItem): string {
-  if (d?.vowifiEnabled) return "WiFi-Calling";
+  if (isVoWiFiInUse(d)) return "WiFi-Calling";
   return primaryLine(d);
 }
 

web/src/components/devices/DeviceOverviewTab.tsx

@@ -7,6 +7,7 @@ import { OverviewTrafficChart } from "./OverviewTrafficChart";
 import { OperatorSelectionDialog } from "./OperatorSelectionDialog";
 import type { DeviceDetail } from "./types";
 import { useI18n } from "../../lib/i18n";
+import { isVoWiFiInUse } from "./shared";
 
 export interface DeviceOverviewTabProps {
   device: DeviceDetail;
@@ -29,7 +30,7 @@ export function DeviceOverviewTab(props: DeviceOverviewTabProps) {
       <div className="grid grid-cols-1 gap-4 lg:grid-cols-3">
         <div className="ui-panel-muted p-4">
           <div className="mb-3 text-xs font-bold uppercase tracking-wider text-gray-500">{t("运行状态")}</div>
-          {device?.vowifiEnabled ? (
+          {isVoWiFiInUse(device) ? (
             <OverviewVowifiCard device={device} />
           ) : (
             <OverviewNetworkCard device={device} onOpenOperatorSelection={() => setOperatorOpen(true)} />

web/src/components/devices/OverviewSimPanel.tsx

@@ -4,7 +4,7 @@ import { FieldRow } from "./FieldRow";
 import { useShowSensitive } from "./shared";
 import type { DeviceDetail } from "./types";
 import { useI18n } from "../../lib/i18n";
-import { carrierIso, flagEmoji } from "../../lib/carrier";
+import { carrierBrandIso, flagEmoji } from "../../lib/carrier";
 
 export interface OverviewSimPanelProps {
   device: DeviceDetail;
@@ -20,7 +20,7 @@ export function OverviewSimPanel({ device, simOperatorDisplay, e911Starting, onS
   const sensitive = !showSensitive;
   const activeEsim = (device.activeEsimProfileName || "").trim();
   const flightOn = device.vowifiActive || modem?.operatingMode === 0 || modem?.operatingMode === 4;
-  const carrierFlag = flagEmoji(carrierIso(modem?.imsi));
+  const carrierFlag = flagEmoji(carrierBrandIso(modem?.nativeSpn, modem?.imsi));
   const operatorValue =
     carrierFlag && simOperatorDisplay !== "--" ? `${carrierFlag} ${simOperatorDisplay}` : simOperatorDisplay;
   const backendLabel =

web/src/components/devices/shared.ts

@@ -59,6 +59,17 @@ export function isRegistered(device?: { modem?: { regStatus?: number } } | null)
   return s === 1 || s === 5;
 }
 
+// The stored device flag is the desired policy, while runtime.enabled is the
+// live owner of RF/IKE/IMS. A stale desired flag must not replace a healthy
+// cellular overview with an all-red "disabled" VoWiFi pipeline.
+export function isVoWiFiInUse(device?: {
+  vowifiEnabled?: boolean;
+  vowifiRuntime?: { enabled?: boolean };
+} | null): boolean {
+  if (!device?.vowifiEnabled) return false;
+  return device.vowifiRuntime?.enabled !== false;
+}
+
 export interface StatusMeta {
   label: string;
   tag: "success" | "warning" | "danger";
@@ -248,7 +259,15 @@ export function simOperatorDisplay(device?: DeviceDetail | null): string {
   const spn = String(modem?.nativeSpn ?? "").trim();
   const name = oplPnnName(modem) || firstPnnName(modem?.pnn);
   const plmn = plmnOf(modem);
-  if (spn) return withPlmn(spn, plmn);
+  // EF_SPN is the SIM's customer-facing brand. Do not append the currently
+  // visited PLMN: a roaming Lebara UK SIM on a Chinese network would otherwise
+  // be mislabeled as "Lebara (460xx)". Append the home/authentication PLMN
+  // resolved from IMSI instead, so GigSky on 222-01 renders as
+  // "GigSky (22201)" even while roaming.
+  if (spn) {
+    const home = lookupCarrier(modem?.imsi);
+    return withPlmn(spn, home ? home.mcc + home.mnc : cardPlmnOf(modem));
+  }
   if (name) return withPlmn(name, plmn);
   // Home ("original") carrier resolved from the SIM's IMSI via the MCC/MNC table.
   // Readable even when the modem isn't camped (VoWiFi RF-off / flight mode).

web/src/components/devices/useCardPolicyToggles.ts

@@ -13,10 +13,13 @@ export interface PolicyToggleImpl {
 
 type Field = "vowifi" | "airplane";
 
-// mutual-exclusion merge: vowifi on clears airplane; airplane on clears vowifi.
+// RF-safe merge: VoWiFi always implies airplane mode. Turning VoWiFi off keeps
+// airplane mode on; only the separate airplane switch can explicitly restore RF.
 function mergePolicy(current: PolicyFlags, field: Field, value: boolean): PolicyFlags {
   if (field === "vowifi") {
-    return value ? { vowifiEnabled: true, airplaneEnabled: false } : { ...current, vowifiEnabled: false };
+    return value
+      ? { vowifiEnabled: true, airplaneEnabled: true }
+      : { vowifiEnabled: false, airplaneEnabled: true };
   }
   return value ? { vowifiEnabled: false, airplaneEnabled: true } : { ...current, airplaneEnabled: false };
 }

web/src/components/proxy/DeviceBindingsDialog.tsx

@@ -1,6 +1,8 @@
-import { DesktopRegular, LinkRegular } from "@fluentui/react-icons";
-import type { DeviceListItem, DeviceProxyBinding, UpstreamProxy } from "../../types";
-import { Button, EmptyState, Modal, Tag } from "../ui";
+import { AddRegular, DeleteRegular } from "@fluentui/react-icons";
+import { useEffect, useMemo, useState } from "react";
+import { api, apiMessage } from "../../api";
+import type { DeviceListItem, DeviceProxyBinding, EsimOverview, ProfileProxyCandidate, UpstreamProxy } from "../../types";
+import { Button, EmptyState, Modal, Tag, message } from "../ui";
 import { useI18n } from "../../lib/i18n";
 
 export interface DeviceBindingsDialogProps {
@@ -9,69 +11,152 @@ export interface DeviceBindingsDialogProps {
   proxies: UpstreamProxy[];
   devices: DeviceListItem[];
   bindings: DeviceProxyBinding[];
-  busyDevice: string;
-  onBind: (deviceId: string) => void;
-  onUnbind: (deviceId: string) => void;
+  busy: boolean;
+  onAdd: (profiles: ProfileProxyCandidate[]) => void;
+  onDelete: (iccids: string[]) => void;
   onClose: () => void;
 }
 
+function profileLabel(profile: { name?: string; serviceProviderName?: string; iccid: string }) {
+  return String(profile.name || profile.serviceProviderName || profile.iccid).trim();
+}
+
 export function DeviceBindingsDialog(props: DeviceBindingsDialogProps) {
   const { t } = useI18n();
-  const { open, proxy, proxies, devices, bindings, busyDevice, onBind, onUnbind, onClose } = props;
+  const { open, proxy, proxies, devices, bindings, busy, onAdd, onDelete, onClose } = props;
+  const [adding, setAdding] = useState(false);
+  const [loadingProfiles, setLoadingProfiles] = useState(false);
+  const [candidates, setCandidates] = useState<ProfileProxyCandidate[]>([]);
+  const [selected, setSelected] = useState<string[]>([]);
   const proxyName = proxy?.name || proxy?.id || "";
-  const bindingByDevice = new Map(bindings.map((item) => [item.deviceId, item]));
-  const proxyNameById = new Map(proxies.map((item) => [item.id, item.name || item.id]));
+  const deviceKey = devices.map((device) => device.id).sort().join("|");
+  const current = useMemo(
+    () => bindings.filter((item) => item.upstreamProxyId === proxy?.id),
+    [bindings, proxy?.id],
+  );
+  const bindingByICCID = useMemo(() => new Map(bindings.map((item) => [item.iccid, item])), [bindings]);
+  const proxyNameById = useMemo(() => new Map(proxies.map((item) => [item.id, item.name || item.id])), [proxies]);
+
+  useEffect(() => {
+    if (!open) {
+      setAdding(false);
+      setSelected([]);
+      setCandidates([]);
+    }
+  }, [open]);
+
+  useEffect(() => {
+    if (!adding || !open) return;
+    let active = true;
+    setLoadingProfiles(true);
+    Promise.allSettled(devices.map(async (device) => {
+      const data = await api<EsimOverview>(`/devices/${encodeURIComponent(device.id)}/esim`);
+      return (data.profiles || []).flatMap((group) => (group.profiles || []).map((profile) => ({
+        deviceId: device.id,
+        iccid: String(profile.iccid || "").trim(),
+        profileName: profileLabel(profile),
+        stateText: profile.stateText,
+      }))).filter((profile) => profile.iccid);
+    })).then((results) => {
+      if (!active) return;
+      const unique = new Map<string, ProfileProxyCandidate>();
+      for (const result of results) {
+        if (result.status !== "fulfilled") continue;
+        for (const profile of result.value) if (!unique.has(profile.iccid)) unique.set(profile.iccid, profile);
+      }
+      setCandidates(Array.from(unique.values()).sort((a, b) => a.deviceId.localeCompare(b.deviceId) || a.profileName.localeCompare(b.profileName)));
+    }).catch((error) => {
+      if (active) message.error(apiMessage(error) || t("读取 eSIM Profile 失败"));
+    }).finally(() => {
+      if (active) setLoadingProfiles(false);
+    });
+    return () => { active = false; };
+  }, [adding, open, deviceKey, t]);
+
+  useEffect(() => {
+    if (!adding || selected.length === 0) return;
+    if (selected.every((iccid) => bindingByICCID.get(iccid)?.upstreamProxyId === proxy?.id)) {
+      setAdding(false);
+      setSelected([]);
+    }
+  }, [adding, selected, bindingByICCID, proxy?.id]);
+
+  useEffect(() => {
+    if (adding) return;
+    const available = new Set(current.map((item) => item.iccid));
+    setSelected((items) => items.filter((iccid) => available.has(iccid)));
+  }, [adding, current]);
+
+  const rows = adding ? candidates : current;
+  const selectable = rows.filter((row) => adding ? !bindingByICCID.has(row.iccid) : true).map((row) => row.iccid);
+  const allSelected = selectable.length > 0 && selectable.every((iccid) => selected.includes(iccid));
+  const toggle = (iccid: string) => setSelected((values) => values.includes(iccid) ? values.filter((item) => item !== iccid) : [...values, iccid]);
+  const toggleAll = () => setSelected(allSelected ? [] : selectable);
 
   return (
-    <Modal open={open} onClose={onClose} title={`${t("设备绑定")} — ${proxyName}`} width="max-w-2xl">
+    <Modal open={open} onClose={onClose} title={`${adding ? t("添加 Profile 绑定") : t("Profile 绑定")} — ${proxyName}`} width="max-w-5xl">
       <div className="space-y-4 pb-2">
         <div className="rounded-lg border border-sky-200/70 bg-sky-50 px-3 py-2 text-xs text-sky-800 dark:border-sky-800/50 dark:bg-sky-900/20 dark:text-sky-200">
-          {t("绑定后，该设备的 VoWiFi 建链和通信都会使用此 SOCKS5 代理；解绑后恢复直连。配置变更会立即尝试重连 VoWiFi。")}
+          {t("VoWiFi 会按当前 ICCID 选择代理。同一 ICCID 只能绑定一个代理，一个代理可以绑定多台设备上的多个 Profile。")}
         </div>
-        {devices.length === 0 ? (
-          <EmptyState title={t("暂无可绑定设备")} subtitle={t("请先在设备管理中添加设备。")}/>
-        ) : (
-          <div className="space-y-2">
-            {devices.map((device) => {
-              const binding = bindingByDevice.get(device.id);
-              const boundHere = binding?.upstreamProxyId === proxy?.id;
-              const boundElsewhere = !!binding && !boundHere;
-              return (
-                <div key={device.id} className="ui-panel-muted flex items-center justify-between gap-3 rounded-lg p-3">
-                  <div className="flex min-w-0 items-center gap-3">
-                    <span className="flex h-9 w-9 shrink-0 items-center justify-center rounded-lg bg-white text-sky-600 shadow-sm dark:bg-white/10 dark:text-sky-300">
-                      <DesktopRegular className="text-[18px]" />
-                    </span>
-                    <div className="min-w-0">
-                      <div className="flex flex-wrap items-center gap-2">
-                        <span className="truncate text-sm font-semibold text-gray-900 dark:text-white">{device.name || device.id}</span>
-                        <span className="font-mono text-xs text-gray-400">{device.id}</span>
-                        {boundHere ? <Tag type="success">{t("已绑定")}</Tag> : null}
-                        {!device.vowifiEnabled ? <Tag type="info">{t("VoWiFi 未启用")}</Tag> : null}
-                      </div>
-                      <div className="mt-0.5 text-xs text-gray-500">
-                        {boundHere
-                          ? t("当前通过此代理通信")
-                          : boundElsewhere
-                            ? `${t("当前绑定")}: ${proxyNameById.get(binding.upstreamProxyId) || binding.upstreamProxyId}`
-                            : t("当前直连")}
-                      </div>
-                    </div>
-                  </div>
-                  {boundHere ? (
-                    <Button size="small" variant="danger" loading={busyDevice === device.id} onClick={() => onUnbind(device.id)}>
-                      {t("解绑")}
-                    </Button>
-                  ) : (
-                    <Button size="small" variant="primary" icon={<LinkRegular />} loading={busyDevice === device.id} onClick={() => onBind(device.id)}>
-                      {boundElsewhere ? t("切换绑定") : t("绑定设备")}
-                    </Button>
-                  )}
-                </div>
-              );
-            })}
+        <div className="flex flex-wrap items-center justify-between gap-2">
+          <div className="text-xs text-gray-500">{adding ? t("从设备已安装的 eSIM Profile 中选择") : `${current.length} ${t("个 Profile")}`}</div>
+          <div className="flex gap-2">
+            {adding ? (
+              <Button size="small" onClick={() => { setAdding(false); setSelected([]); }}>{t("返回绑定列表")}</Button>
+            ) : null}
+            {adding ? (
+              <Button
+                size="small"
+                variant="primary"
+                icon={<AddRegular />}
+                loading={busy}
+                disabled={selected.length === 0 || loadingProfiles}
+                onClick={() => onAdd(candidates.filter((item) => selected.includes(item.iccid)))}
+              >{t("添加所选")}</Button>
+            ) : (
+              <>
+                <Button size="small" variant="danger" plain icon={<DeleteRegular />} loading={busy} disabled={selected.length === 0} onClick={() => onDelete(selected)}>{t("删除所选")}</Button>
+                <Button size="small" variant="primary" icon={<AddRegular />} onClick={() => { setAdding(true); setSelected([]); }}>{t("添加")}</Button>
+              </>
+            )}
           </div>
-        )}
+        </div>
+
+        <div className="overflow-x-auto rounded-xl border border-gray-100 dark:border-white/10">
+          <table className="w-full min-w-[760px] text-left text-sm">
+            <thead className="bg-gray-50/80 text-xs uppercase tracking-wide text-gray-500 dark:bg-white/[0.025]">
+              <tr>
+                <th className="w-12 px-4 py-3"><input type="checkbox" checked={allSelected} onChange={toggleAll} disabled={selectable.length === 0 || busy} aria-label={t("全选")} /></th>
+                <th className="px-4 py-3">{t("设备 ID")}</th>
+                <th className="px-4 py-3">ICCID</th>
+                <th className="px-4 py-3">{t("Profile 名称")}</th>
+                {adding ? <th className="px-4 py-3">{t("状态")}</th> : null}
+              </tr>
+            </thead>
+            <tbody className="divide-y divide-gray-100 dark:divide-white/10">
+              {rows.map((row) => {
+                const existing = bindingByICCID.get(row.iccid);
+                const unavailable = adding && !!existing;
+                return (
+                  <tr key={`${row.deviceId}:${row.iccid}`} className={unavailable ? "opacity-60" : "hover:bg-sky-50/40 dark:hover:bg-sky-500/[0.04]"}>
+                    <td className="px-4 py-3"><input type="checkbox" checked={selected.includes(row.iccid)} onChange={() => toggle(row.iccid)} disabled={unavailable || busy} aria-label={row.iccid} /></td>
+                    <td className="px-4 py-3 font-mono text-xs">{row.deviceId}</td>
+                    <td className="px-4 py-3 font-mono text-xs">{row.iccid}</td>
+                    <td className="px-4 py-3 font-medium">{row.profileName || row.iccid}</td>
+                    {adding ? (
+                      <td className="px-4 py-3">
+                        {existing ? <Tag type={existing.upstreamProxyId === proxy?.id ? "success" : "info"}>{existing.upstreamProxyId === proxy?.id ? t("已绑定此代理") : `${t("已绑定")}: ${proxyNameById.get(existing.upstreamProxyId) || existing.upstreamProxyId}`}</Tag> : <Tag type="primary">{("stateText" in row && row.stateText) || t("可绑定")}</Tag>}
+                      </td>
+                    ) : null}
+                  </tr>
+                );
+              })}
+            </tbody>
+          </table>
+          {loadingProfiles ? <div className="px-6 py-12 text-center text-sm text-gray-400">{t("读取 Profile 中...")}</div> : null}
+          {!loadingProfiles && rows.length === 0 ? <EmptyState title={adding ? t("没有可显示的 eSIM Profile") : t("尚未绑定 Profile")} subtitle={adding ? t("请确认设备在线且支持 eSIM Profile 列表读取。") : t("点击添加，从设备 Profile 列表中选择。")}/>: null}
+        </div>
       </div>
     </Modal>
   );

web/src/components/proxy/UpstreamDialog.tsx

@@ -108,7 +108,7 @@ export function UpstreamDialog({ open, editing, form, testing, probe, onPatch, o
           </Field>
           <ToggleRow
             title={t("启用代理")}
-            subtitle={t("禁用后，已绑定设备的 VoWiFi 将停止使用该线路，不会泄漏到直连")}
+            subtitle={t("禁用后，已绑定 Profile 的 VoWiFi 将停止使用该线路，不会泄漏到直连")}
             checked={form.enabled}
             onChange={(v) => onPatch({ enabled: v })}
           />

web/src/components/proxy/UpstreamSection.tsx

@@ -1,6 +1,6 @@
-import { AddRegular, DeleteRegular, DesktopRegular, EditRegular, GlobeRegular } from "@fluentui/react-icons";
+import { DeleteRegular, DesktopRegular, EditRegular, GlobeRegular } from "@fluentui/react-icons";
 import type { UpstreamProxy } from "../../types";
-import { Button, EmptyState, ErrorState, ListSkeleton, Tag } from "../ui";
+import { Button, Tag } from "../ui";
 import type { LoadError, UpstreamRow } from "./shared";
 import { useI18n } from "../../lib/i18n";
 
@@ -9,90 +9,73 @@ export interface UpstreamSectionProps {
   loading: boolean;
   error: LoadError | null;
   onRetry: () => void;
-  onNew: () => void;
   onEdit: (proxy: UpstreamProxy) => void;
   onDelete: (proxy: UpstreamProxy) => void;
   onOpenBindings: (proxy: UpstreamProxy) => void;
 }
 
-function UpstreamRowCard({
-  row,
-  onEdit,
-  onDelete,
-  onOpenBindings,
-}: {
-  row: UpstreamRow;
-  onEdit: (proxy: UpstreamProxy) => void;
-  onDelete: (proxy: UpstreamProxy) => void;
-  onOpenBindings: (proxy: UpstreamProxy) => void;
-}) {
+export function UpstreamSection({ rows, loading, error, onRetry, onEdit, onDelete, onOpenBindings }: UpstreamSectionProps) {
   const { t } = useI18n();
   return (
-    <div className="ui-panel-muted flex flex-col gap-3 p-4 lg:flex-row lg:items-center lg:justify-between">
-      <div className="flex min-w-0 items-center gap-3">
-        <span className={`h-2.5 w-2.5 shrink-0 rounded-full ${row.enabled ? "bg-green-500" : "bg-gray-300"}`} />
-        <div className="min-w-0">
-          <div className="truncate font-bold text-gray-900 dark:text-white">{row.name || row.id}</div>
-          <div className="mt-0.5 truncate text-xs text-gray-500">
-            SOCKS5 · <span className="font-mono">{row.addr}</span>
-            {row.username ? <span> · {t("鉴权")}: {row.username}</span> : null}
-          </div>
-        </div>
-      </div>
-      <div className="flex shrink-0 flex-wrap items-center gap-2">
-        <Tag type={row.enabled ? "success" : "info"}>{row.enabled ? t("已启用") : t("已禁用")}</Tag>
-        <div className="inline-flex items-center gap-1 rounded border border-indigo-200/60 bg-indigo-50 px-2 py-0.5 text-[11px] font-medium text-indigo-600 dark:border-indigo-800/40 dark:bg-indigo-900/20 dark:text-indigo-400">
-          <DesktopRegular className="text-[14px]" />
-          <span>{row.bindingCount} {t("台设备")}</span>
-        </div>
-        <div className="mx-0.5 hidden h-3.5 w-px bg-gray-200 dark:bg-gray-700 sm:block" />
-        <Button size="small" icon={<DesktopRegular />} onClick={() => onOpenBindings(row)}>
-          <span className="hidden sm:inline">{t("设备绑定")}</span>
-        </Button>
-        <Button size="small" icon={<EditRegular />} onClick={() => onEdit(row)} />
-        <Button size="small" variant="danger" icon={<DeleteRegular />} onClick={() => onDelete(row)} />
-      </div>
-    </div>
-  );
-}
-
-export function UpstreamSection({ rows, loading, error, onRetry, onNew, onEdit, onDelete, onOpenBindings }: UpstreamSectionProps) {
-  const { t } = useI18n();
-  return (
-    <div>
+    <div className="ui-card overflow-hidden">
       {error ? (
-        <ErrorState className="mb-6" title={t("加载上游代理失败")} message={error.message} statusCode={error.status} retryText={t("重试")} onRetry={onRetry} />
-      ) : null}
-      <div className="ui-card p-6">
-        <div className="mb-4 flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
-          <div className="flex min-w-0 items-center gap-3">
-            <div className="flex h-10 w-10 items-center justify-center rounded-xl bg-gradient-to-br from-[#0ea5e9] to-[#0284c7] text-white shadow-lg shadow-indigo-500/25">
-              <GlobeRegular className="text-[20px]" />
-            </div>
-            <div>
-              <div className="text-lg font-bold text-gray-900 dark:text-white">{t("VoWiFi 上游代理")}</div>
-              <div className="text-xs text-gray-500">{t("将设备的 VoWiFi 建链、IMS 和短信通信通过支持 UDP Associate 的 SOCKS5 代理传输。")}</div>
-            </div>
-          </div>
-          <Button variant="primary" className="!border-0" icon={<AddRegular />} onClick={onNew}>
-            {t("新增代理")}
-          </Button>
+        <div className="flex items-center justify-between gap-3 border-b border-red-200 bg-red-50 p-3 text-sm text-red-600 dark:border-red-500/20 dark:bg-red-500/10 dark:text-red-300">
+          <span className="min-w-0 truncate">
+            {t("加载上游代理失败")}：{error.message}
+            {error.status ? `（${error.status}）` : ""}
+          </span>
+          <button type="button" className="shrink-0 font-medium underline underline-offset-2" onClick={onRetry}>
+            {t("重试")}
+          </button>
         </div>
-        {loading && rows.length === 0 ? (
-          <ListSkeleton rows={2} />
-        ) : rows.length === 0 ? (
-          <EmptyState
-            title={t("暂无上游代理")}
-            subtitle={t("点击“新增代理”创建 SOCKS5 上游代理，然后将需要使用它的设备直接绑定；未绑定设备默认直连。")}
-          />
-        ) : (
-          <div className="space-y-3">
+      ) : null}
+      <div className="overflow-x-auto">
+        <table className="w-full min-w-[900px] text-left text-sm">
+          <thead className="border-b border-gray-100 bg-gray-50/70 text-xs uppercase tracking-wide text-gray-500 dark:border-white/10 dark:bg-white/[0.025]">
+            <tr>
+              <th className="px-4 py-3">{t("名称")}</th>
+              <th className="px-4 py-3">{t("协议")}</th>
+              <th className="px-4 py-3">{t("地址")}</th>
+              <th className="px-4 py-3">{t("鉴权")}</th>
+              <th className="px-4 py-3">{t("状态")}</th>
+              <th className="px-4 py-3">{t("Profile 绑定")}</th>
+              <th className="px-4 py-3 text-right">{t("操作")}</th>
+            </tr>
+          </thead>
+          <tbody className="divide-y divide-gray-100 dark:divide-white/10">
             {rows.map((row) => (
-              <UpstreamRowCard key={row.id} row={row} onEdit={onEdit} onDelete={onDelete} onOpenBindings={onOpenBindings} />
+              <tr key={row.id} className="hover:bg-sky-50/40 dark:hover:bg-sky-500/[0.04]">
+                <td className="px-4 py-3 font-semibold">{row.name || row.id}</td>
+                <td className="px-4 py-3"><Tag type="primary">SOCKS5</Tag></td>
+                <td className="px-4 py-3 font-mono text-xs">{row.addr}</td>
+                <td className="px-4 py-3">{row.username || t("无")}</td>
+                <td className="px-4 py-3"><Tag type={row.enabled ? "success" : "info"}>{row.enabled ? t("已启用") : t("已禁用")}</Tag></td>
+                <td className="px-4 py-3">
+                  <div className="inline-flex items-center gap-1 rounded border border-indigo-200/60 bg-indigo-50 px-2 py-0.5 text-[11px] font-medium text-indigo-600 dark:border-indigo-800/40 dark:bg-indigo-900/20 dark:text-indigo-400">
+                    <DesktopRegular className="text-[14px]" />
+                    <span>{row.bindingCount} {t("个 Profile")}</span>
+                  </div>
+                </td>
+                <td className="px-4 py-3">
+                  <div className="flex justify-end gap-2">
+                    <Button size="small" icon={<DesktopRegular />} onClick={() => onOpenBindings(row)}>{t("Profile 绑定")}</Button>
+                    <Button size="small" icon={<EditRegular />} onClick={() => onEdit(row)}>{t("编辑")}</Button>
+                    <Button size="small" variant="danger" plain icon={<DeleteRegular />} onClick={() => onDelete(row)}>{t("删除")}</Button>
+                  </div>
+                </td>
+              </tr>
             ))}
-          </div>
-        )}
+          </tbody>
+        </table>
       </div>
+      {!loading && !rows.length ? (
+        <div className="flex flex-col items-center justify-center px-6 py-16 text-center text-gray-400">
+          <GlobeRegular className="mb-3 text-4xl" />
+          <div className="text-sm">{t("暂无上游代理")}</div>
+          <div className="mt-1 text-xs">{t("点击“新增代理”创建 SOCKS5 上游代理，再按 ICCID 绑定需要使用它的 eSIM Profile；未绑定 Profile 默认直连。")}</div>
+        </div>
+      ) : null}
+      {loading ? <div className="px-6 py-16 text-center text-sm text-gray-400">{t("加载中...")}</div> : null}
     </div>
   );
 }

web/src/components/settings/DeviceQuotaCard.tsx

@@ -31,7 +31,7 @@ export function DeviceQuotaCard({
         </CardIcon>
         <CardTitle
           title={zh ? "设备配额" : "Device quota"}
-          subtitle={zh ? "开发者模式下允许配置的设备数量" : "Configured device allowance in developer mode"}
+          subtitle={zh ? "最多允许配置的设备数量" : "Maximum number of configurable devices"}
         />
       </div>
       <div className="relative z-10 space-y-4">
@@ -46,8 +46,8 @@ export function DeviceQuotaCard({
         />
         <p className="text-xs text-gray-500 dark:text-gray-400">
           {zh
-            ? `关闭开发者模式后会自动恢复为 ${value?.defaultDeviceLimit ?? 5} 台，不会删除已经添加的设备。`
-            : `Disabling developer mode restores ${value?.defaultDeviceLimit ?? 5}; existing devices are not deleted.`}
+            ? `恢复默认配置后会自动恢复为 ${value?.defaultDeviceLimit ?? 5} 台，不会删除已经添加的设备。`
+            : `Restoring the default configuration resets the quota to ${value?.defaultDeviceLimit ?? 5}; existing devices are not deleted.`}
         </p>
         <Button variant="primary" loading={saving} disabled={loading} onClick={onSave} className="w-full !border-0">
           {zh ? "保存设备配额" : "Save device quota"}

web/src/components/settings/HTTPSCard.tsx

@@ -29,7 +29,7 @@ export function HTTPSCard({
           </CardIcon>
           <CardTitle
             title={zh ? "本机自签 HTTPS" : "Local self-signed HTTPS"}
-            subtitle={zh ? "为浏览器麦克风和安全连接提供 HTTPS" : "HTTPS for browser microphone and secure connections"}
+            subtitle={zh ? "为安全连接提供 HTTPS" : "HTTPS for secure connections"}
           />
         </div>
         <Switch checked={enabled} disabled={loading || saving} loading={saving} onChange={onToggle} />
@@ -48,8 +48,8 @@ export function HTTPSCard({
         ) : null}
         <p className="text-xs text-amber-600 dark:text-amber-400">
           {zh
-            ? "自签证书需要在系统或浏览器中信任；否则浏览器可能继续拒绝麦克风权限。"
-            : "Trust the self-signed certificate in the operating system or browser; otherwise microphone access may still be rejected."}
+            ? "自签证书需要在系统或浏览器中信任，否则浏览器可能继续提示连接不安全。"
+            : "Trust the self-signed certificate in the operating system or browser; otherwise the browser may keep warning that the connection is not secure."}
         </p>
         <Button onClick={() => window.open("/api/settings/https/certificate", "_blank")} disabled={loading}>
           {zh ? "下载自签证书" : "Download certificate"}

web/src/components/settings/SMSRateLimitCard.tsx

@@ -0,0 +1,58 @@
+import { SendRegular } from "@fluentui/react-icons";
+import type { DeveloperSettings } from "../../types";
+import { useI18n } from "../../lib/i18n";
+import { Button } from "../ui/Button";
+import { Input } from "../ui/Input";
+import { CardDecor, CardIcon, CardTitle } from "./Cards";
+
+export function SMSRateLimitCard({
+  value,
+  limit,
+  loading,
+  saving,
+  onLimitChange,
+  onSave,
+}: {
+  value: DeveloperSettings | null;
+  limit: number;
+  loading: boolean;
+  saving: boolean;
+  onLimitChange: (limit: number) => void;
+  onSave: () => void;
+}) {
+  const { lang } = useI18n();
+  const zh = lang === "zh";
+  return (
+    <div className="ui-card group relative overflow-hidden p-8">
+      <CardDecor />
+      <div className="relative z-10 mb-6 flex items-center gap-3">
+        <CardIcon>
+          <SendRegular className="text-[24px]" />
+        </CardIcon>
+        <CardTitle
+          title={zh ? "短信发送速率限制" : "SMS send rate limit"}
+          subtitle={zh ? "所有设备与 SIM 卡共享的全局发送额度" : "One global quota shared by every device and SIM"}
+        />
+      </div>
+      <div className="relative z-10 space-y-4">
+        <Input
+          type="number"
+          min={1}
+          max={value?.maxSmsHourlyLimit ?? 1000}
+          value={Number.isFinite(limit) ? limit : ""}
+          disabled={loading || saving}
+          onChange={(event) => onLimitChange(Number(event.target.value))}
+          suffix={zh ? "条 / 小时" : "messages / hour"}
+        />
+        <p className="text-xs leading-5 text-gray-500 dark:text-gray-400">
+          {zh
+            ? `采用滚动一小时窗口，网页、TG Bot、自动任务、API、VoWiFi 与基站发送全部计入；接收短信不受限制。关闭开发者模式后恢复为 ${value?.defaultSmsHourlyLimit ?? 10} 条/小时。`
+            : `Uses a rolling one-hour window across the web UI, Telegram bot, automatic tasks, API, VoWiFi, and cellular sending. Receiving is unlimited. Disabling developer mode restores ${value?.defaultSmsHourlyLimit ?? 10} messages/hour.`}
+        </p>
+        <Button variant="primary" loading={saving} disabled={loading} onClick={onSave} className="w-full !border-0">
+          {zh ? "保存短信速率限制" : "Save SMS rate limit"}
+        </Button>
+      </div>
+    </div>
+  );
+}

web/src/components/shell/AuthenticatedShell.tsx

@@ -5,6 +5,7 @@ import {
   DocumentTextRegular,
   GlobeRegular,
   MailRegular,
+  SendClockRegular,
   PanelLeftContractRegular,
   PanelLeftExpandRegular,
   RouterRegular,
@@ -30,6 +31,7 @@ const NAV = [
   { to: "/devices", label: "设备管理", icon: RouterRegular },
   { to: "/proxy", label: "代理管理", icon: GlobeRegular },
   { to: "/sms", label: "短信检测", icon: MailRegular },
+  { to: "/automatic-tasks", label: "自动任务", icon: SendClockRegular },
   { to: "/logs", label: "实时日志", icon: DocumentTextRegular },
   { to: "/settings", label: "系统设置", icon: SettingsRegular },
 ];

web/src/components/ui/Pagination.tsx

@@ -0,0 +1,113 @@
+import { ChevronLeftRegular, ChevronRightRegular } from "@fluentui/react-icons";
+import { cx } from "../../lib/utils";
+import { useI18n } from "../../lib/i18n";
+import { Button } from "./Button";
+import { Select } from "./Select";
+
+export interface PaginationProps {
+  /** Current page, 1-based. */
+  page: number;
+  pageSize: number;
+  total: number;
+  onPageChange: (page: number) => void;
+  onPageSizeChange?: (pageSize: number) => void;
+  pageSizeOptions?: number[];
+  className?: string;
+}
+
+type PageItem = number | "ellipsis";
+
+// Build the page-number strip: always show the first and last page, the pages
+// around the current one, and collapse longer gaps into a single ellipsis
+// (filling a gap of exactly one page with that page's number).
+function pageWindow(current: number, pages: number): PageItem[] {
+  if (pages <= 7) {
+    return Array.from({ length: pages }, (_, index) => index + 1);
+  }
+  const left = Math.max(2, current - 1);
+  const right = Math.min(pages - 1, current + 1);
+  const kept: number[] = [];
+  for (let i = 1; i <= pages; i++) {
+    if (i === 1 || i === pages || (i >= left && i <= right)) {
+      kept.push(i);
+    }
+  }
+  const items: PageItem[] = [];
+  let previous = 0;
+  for (const page of kept) {
+    if (previous !== 0) {
+      if (page - previous === 2) items.push(previous + 1);
+      else if (page - previous > 2) items.push("ellipsis");
+    }
+    items.push(page);
+    previous = page;
+  }
+  return items;
+}
+
+export function Pagination({
+  page,
+  pageSize,
+  total,
+  onPageChange,
+  onPageSizeChange,
+  pageSizeOptions = [10, 20, 50],
+  className,
+}: PaginationProps) {
+  const { t } = useI18n();
+  const pages = Math.max(1, Math.ceil(total / pageSize));
+  const current = Math.min(Math.max(1, page), pages);
+  const items = pageWindow(current, pages);
+
+  if (total <= 0) return null;
+
+  return (
+    <div className={cx("flex flex-wrap items-center gap-x-3 gap-y-2", className)}>
+      <span className="text-xs text-gray-400">{t("共 {total} 条").replace("{total}", String(total))}</span>
+      <div className="flex items-center gap-1 sm:ml-auto">
+        {onPageSizeChange ? (
+          <Select
+            value={String(pageSize)}
+            onChange={(value) => onPageSizeChange(Number(value))}
+            options={pageSizeOptions.map((count) => ({
+              value: String(count),
+              label: t("{count} 条/页").replace("{count}", String(count)),
+            }))}
+            className="mr-1 w-24"
+          />
+        ) : null}
+        <Button
+          size="small"
+          icon={<ChevronLeftRegular />}
+          disabled={current <= 1}
+          onClick={() => onPageChange(current - 1)}
+          aria-label={t("上一页")}
+        />
+        {items.map((item, index) =>
+          item === "ellipsis" ? (
+            <span key={`ellipsis-${index}`} className="px-1 text-xs text-gray-400">
+              …
+            </span>
+          ) : (
+            <Button
+              key={item}
+              size="small"
+              variant={item === current ? "primary" : "text"}
+              onClick={() => onPageChange(item)}
+              aria-current={item === current ? "page" : undefined}
+            >
+              {item}
+            </Button>
+          ),
+        )}
+        <Button
+          size="small"
+          icon={<ChevronRightRegular />}
+          disabled={current >= pages}
+          onClick={() => onPageChange(current + 1)}
+          aria-label={t("下一页")}
+        />
+      </div>
+    </div>
+  );
+}

web/src/components/ui/index.ts

@@ -8,6 +8,8 @@ export { Switch } from "./Switch";
 export { Input, Textarea } from "./Input";
 export { Select } from "./Select";
 export type { SelectOption } from "./Select";
+export { Pagination } from "./Pagination";
+export type { PaginationProps } from "./Pagination";
 export { Tabs } from "./Tabs";
 export type { TabItem } from "./Tabs";
 export { Tag } from "./Tag";

web/src/lib/carrier.ts

@@ -48,6 +48,16 @@ export function carrierIso(imsi?: string): string {
   return data.i[imsiDigits(imsi).slice(0, 3)] ?? "";
 }
 
+// carrierBrandIso keeps the normal IMSI country flag for branded/MVNO SIMs.
+// Lebara UK's Vodafone-NL-hosted 204-04 eSIM is the one known exception: its
+// customer-facing country is GB even though AKA must continue using 204-04.
+export function carrierBrandIso(spn?: string, imsi?: string): string {
+  const brand = String(spn ?? "").trim().toLowerCase();
+  const digits = imsiDigits(imsi);
+  if (brand.includes("lebara") && digits.startsWith("20404")) return "gb";
+  return carrierIso(imsi);
+}
+
 // flagEmoji converts an alpha-2 country code to its regional-indicator flag emoji.
 export function flagEmoji(iso?: string): string {
   const s = String(iso ?? "").trim().toUpperCase();

web/src/lib/i18n-en.ts

@@ -31,6 +31,36 @@ export const EN_DICT: Record<string, string> = {
   "插件可能已被禁用、卸载或没有注册此页面。": "The plugin may be disabled, uninstalled, or may not register this page.",
   // Device-bound VoWiFi upstream routing.
   "设备绑定": "Device Bindings",
+  "Profile 绑定": "Profile Bindings",
+  "添加 Profile 绑定": "Add Profile Bindings",
+  "VoWiFi 会按当前 ICCID 选择代理。同一 ICCID 只能绑定一个代理，一个代理可以绑定多台设备上的多个 Profile。":
+    "VoWiFi selects its proxy by the active ICCID. An ICCID can use only one proxy, while one proxy can serve profiles across multiple devices.",
+  "从设备已安装的 eSIM Profile 中选择": "Select from eSIM profiles installed on the devices",
+  "个 Profile": "profiles",
+  "返回绑定列表": "Back to bindings",
+  "添加所选": "Add selected",
+  添加: "Add",
+  全选: "Select all",
+  "删除所选": "Delete selected",
+  "设备 ID": "Device ID",
+  "Profile 名称": "Profile Name",
+  "已绑定此代理": "Bound to this proxy",
+  "可绑定": "Available",
+  "没有可显示的 eSIM Profile": "No eSIM profiles to display",
+  "尚未绑定 Profile": "No profiles bound",
+  "请确认设备在线且支持 eSIM Profile 列表读取。": "Make sure the device is online and supports eSIM profile listing.",
+  "点击添加，从设备 Profile 列表中选择。": "Click Add and select from the device profile list.",
+  "读取 eSIM Profile 失败": "Failed to read eSIM profiles",
+  "Profile 已绑定": "Profiles bound",
+  "所选 ICCID 已绑定其他代理，请先删除原绑定": "A selected ICCID is bound to another proxy; delete the existing binding first",
+  "所选 Profile 绑定已删除": "Selected profile bindings deleted",
+  "删除绑定失败": "Failed to delete bindings",
+  "绑定到该代理的 Profile 将自动解绑并恢复直连。": "Profiles bound to this proxy will be unbound and return to direct routing.",
+  "管理 VoWiFi 上游代理和 eSIM Profile 绑定": "Manage VoWiFi upstream proxies and eSIM profile bindings",
+  "禁用后，已绑定 Profile 的 VoWiFi 将停止使用该线路，不会泄漏到直连":
+    "When disabled, bound profiles stop using this VoWiFi route and do not leak traffic to a direct connection.",
+  "点击“新增代理”创建 SOCKS5 上游代理，再按 ICCID 绑定需要使用它的 eSIM Profile；未绑定 Profile 默认直连。":
+    "Create a SOCKS5 upstream proxy, then bind eSIM profiles by ICCID. Unbound profiles use a direct connection.",
   "绑定后，该设备的 VoWiFi 建链和通信都会使用此 SOCKS5 代理；解绑后恢复直连。配置变更会立即尝试重连 VoWiFi。":
     "Once bound, this device uses the SOCKS5 proxy for VoWiFi setup and communications. Unbinding restores direct routing. Route changes trigger an immediate VoWiFi reconnect.",
   "暂无可绑定设备": "No devices available",
@@ -45,10 +75,8 @@ export const EN_DICT: Record<string, string> = {
   "绑定设备": "Bind Device",
   "台设备": "devices",
   "鉴权": "Auth",
+  "无": "None",
   "加载上游代理失败": "Failed to load upstream proxies",
-  "VoWiFi 上游代理": "VoWiFi Upstream Proxies",
-  "将设备的 VoWiFi 建链、IMS 和短信通信通过支持 UDP Associate 的 SOCKS5 代理传输。":
-    "Route device VoWiFi setup, IMS, and SMS communications through a SOCKS5 proxy with UDP Associate support.",
   "暂无上游代理": "No upstream proxies",
   "点击“新增代理”创建 SOCKS5 上游代理，然后将需要使用它的设备直接绑定；未绑定设备默认直连。":
     "Create a SOCKS5 upstream proxy, then bind the devices that should use it. Unbound devices use a direct connection.",
@@ -77,6 +105,78 @@ export const EN_DICT: Record<string, string> = {
   设备管理: "Devices",
   代理管理: "Proxy",
   短信检测: "SMS Test",
+  自动任务: "Automatic Tasks",
+  "按周期切换指定 eSIM Profile，并在设备串行队列中执行短信、通话或漫游公网 IP 任务": "Switch to a selected eSIM profile on schedule, then run SMS, call, or roaming public-IP jobs in a per-device queue",
+  添加任务: "Add Task",
+  "设备 / Profile": "Device / Profile",
+  执行环境: "Environment",
+  周期: "Schedule",
+  下次执行: "Next Run",
+  上次结果: "Last Result",
+  完成后推送通知: "Notify on Completion",
+  不推送通知: "No Notifications",
+  "失败重试 {count} 次": "Retry {count} times on failure",
+  拨打电话并自动挂断: "Call and Auto Hang Up",
+  获取漫游公网IP: "Get Roaming Public IP",
+  基站直连: "Cellular",
+  "每 {days} 天": "Every {days} days",
+  立即执行: "Run Now",
+  暂无自动任务: "No automatic tasks",
+  "添加任务后，系统会按设备排队并在执行前校验目标 Profile": "Tasks are queued per device and the target profile is verified before execution",
+  最近执行记录: "Recent Runs",
+  排队时间: "Queued At",
+  尝试次数: "Attempts",
+  排队中: "Queued",
+  执行中: "Running",
+  暂无执行记录: "No run history",
+  "共 {total} 条": "{total} total",
+  "{count} 条/页": "{count} / page",
+  上一页: "Previous",
+  下一页: "Next",
+  编辑自动任务: "Edit Automatic Task",
+  添加自动任务: "Add Automatic Task",
+  任务名称: "Task Name",
+  "例如：每日短信保活": "For example: Daily SMS keepalive",
+  "eSIM Profile": "eSIM Profile",
+  读取Profile中: "Loading profiles...",
+  请选择Profile: "Select a profile",
+  任务类型: "Task Type",
+  开启漫游流量并获取一次公网IP: "Enable roaming data and get the public IP once",
+  "基站直连（自动选网）": "Cellular (automatic network selection)",
+  "该任务固定使用基站直连和自动选网；执行时会开启漫游数据，并通过模块接口访问 ipinfo.io。需要开启开发者模式。": "This task always uses cellular direct mode with automatic network selection. It enables roaming data and accesses ipinfo.io through the modem interface. Developer mode is required.",
+  首次执行日期: "First Run Date",
+  执行时间: "Run Time",
+  执行周期: "Interval",
+  任务失败重试次数: "Failure Retries",
+  "{count} 次": "{count}",
+  启用任务: "Enable Task",
+  停用后不会进入执行队列: "Disabled tasks are not queued",
+  发送到全部已配置并启用的通知渠道: "Send to every configured and enabled notification channel",
+  请输入任务名称: "Enter a task name",
+  请选择eSIMProfile: "Select an eSIM profile",
+  任务已加入设备队列: "Task added to the device queue",
+  确定删除这个自动任务吗: "Delete this automatic task?",
+  自动任务已删除: "Automatic task deleted",
+  自动任务已更新: "Automatic task updated",
+  自动任务已创建: "Automatic task created",
+  编辑: "Edit",
+  成功: "Success",
+  "读取 Profile 中...": "Loading profiles...",
+  号码: "Number",
+  "获取漫游公网 IP": "Get Roaming Public IP",
+  结果: "Result",
+  "开启漫游流量并获取一次公网 IP": "Enable roaming data and get the public IP once",
+  类型: "Type",
+  请输入短信内容: "Enter the message",
+  请输入号码: "Enter a number",
+  "请选择 eSIM Profile": "Select an eSIM profile",
+  "请选择 Profile": "Select a profile",
+  请选择设备: "Select a device",
+  "确定删除这个自动任务吗？": "Delete this automatic task?",
+  任务: "Task",
+  失败: "Failed",
+  状态: "Status",
+  自动挂断: "Auto Hang Up",
   实时日志: "Live Logs",
   系统设置: "Settings",
   主导航: "Main navigation",
@@ -530,6 +630,10 @@ export const EN_DICT: Record<string, string> = {
   "名称修改成功": "Name updated",
   "否": "No",
   "启用后进飞行模式，不支持国内运营商": "Once enabled it enters airplane mode; domestic carriers are not supported",
+  "启用时强制关闭蜂窝射频；关闭 VoWiFi 后仍保持飞行模式":
+    "Enabling forces cellular RF off; airplane mode remains on after VoWiFi is disabled.",
+  "只有手动关闭此开关才允许设备连接基站":
+    "The device may connect to a cellular base station only after you manually turn this switch off.",
   "命令": "Command",
   "命令 / 回复": "Command / Reply",
   "回复": "Reply",
@@ -627,6 +731,12 @@ export const EN_DICT: Record<string, string> = {
   "此类 WWAN QMI 设备运行后端固定为 QMI；AT 口仍会保留给 AT 终端。": "This WWAN QMI device is fixed to the QMI backend; the AT port remains available for the AT terminal.",
   "此类设备固定 MBIM，AT 口仅用于终端": "This device is fixed to MBIM; the AT port is for the terminal only",
   "此类设备固定 QMI，AT 口仅用于终端": "This device is fixed to QMI; the AT port is for the terminal only",
+  "QMI 负责驻网状态与数据会话；AT 负责 SIM/eSIM、射频、短信、通话和终端指令":
+    "QMI handles registration status and packet-data sessions; AT handles SIM/eSIM, RF, SMS, calls, and terminal commands.",
+  "MBIM 负责数据会话；AT 负责 SIM/eSIM、射频、短信、通话和终端指令":
+    "MBIM handles packet-data sessions; AT handles SIM/eSIM, RF, SMS, calls, and terminal commands.",
+  "AT 模式通过串口管理驻网与 PDP 数据会话":
+    "AT mode manages registration and PDP data sessions through the serial port.",
   "注册状态": "Registration",
   "浏览器限制，请手动复制": "Blocked by the browser; please copy manually",
   "添加失败": "Add failed",
@@ -753,7 +863,7 @@ export const EN_DICT: Record<string, string> = {
 	"国家/地区": "Country / Region",
 	"公网 IP 检测失败": "Public IP detection failed",
 	"导出代理": "Export Proxy",
-	"将模块漫游数据导出为主机 HTTP 或 SOCKS5 代理；仅在开发者模式下可用": "Export modem roaming data as host HTTP or SOCKS5 proxies; available only in developer mode",
+	"将模块漫游数据导出为主机 HTTP 或 SOCKS5 代理": "Export modem roaming data as host HTTP or SOCKS5 proxies",
 	"添加代理": "Add Proxy",
 	"网络接口": "Network Interface",
 	"协议": "Protocol",
@@ -762,7 +872,6 @@ export const EN_DICT: Record<string, string> = {
 	"已停用": "Stopped",
 	"暂无导出代理配置": "No export proxies configured",
 	"先在设备页面开启漫游数据，再创建代理": "Enable roaming data on the device page before creating a proxy",
-	"代理出口使用受保护的蜂窝路由和独立 DNS，不会把模块数据设为主机默认网络。关闭开发者模式会停止漫游数据并永久删除这里的全部配置。": "Proxy traffic uses protected cellular routing and isolated DNS without becoming the host default network. Disabling developer mode stops roaming data and permanently deletes every configuration here.",
 	"编辑导出代理": "Edit Export Proxy",
 	"添加导出代理": "Add Export Proxy",
 	"例如：EC20 漫游出口": "For example: EC20 roaming exit",