feat(logging): implement log retention policy with hard limit and exclusion filters

- Added MaxLogEvents constant to enforce a hard limit on stored log events.
- Updated AppendLogEvent to discard older logs when the limit is exceeded.
- Enhanced ListLogEvents to support filtering by log level and excluding specific messages.
- Introduced ClearLogEvents method to permanently remove logs and prevent re-queuing of cleared entries.
- Modified LogRetentionCard component to reflect the new log retention settings and limits.
- Added logging categories for better organization and filtering in the UI.
- Implemented sanitization for sensitive information in logs.
- Added tests for log event limits and clearing functionality.

.github/workflows/docker.yml

@@ -49,13 +49,13 @@ jobs:
             BUILD_TIME=${{ github.event.repository.updated_at }}
           cache-from: type=gha
 
-      - name: Verify ${{ matrix.platform }} runtime and smart-card stack
+      - name: Verify ${{ matrix.platform }} runtime, QMI, and smart-card stack
         run: |
           docker run --rm --platform '${{ matrix.platform }}' \
             vocat-smoke:${{ matrix.arch }} version
           docker run --rm --platform '${{ matrix.platform }}' \
             --entrypoint /bin/sh vocat-smoke:${{ matrix.arch }} -c \
-            'command -v pcscd && test -d /usr/lib/pcsc/drivers'
+            'command -v qmicli && command -v qmi-network && command -v pcscd && test -d /usr/lib/pcsc/drivers'
 
   build-and-push:
     needs: smoke

.github/workflows/pr-size-limit.yml

@@ -29,23 +29,15 @@ jobs:
     env:
       MAX_CHANGED_LINES: "5000"
       PR_NUMBER: ${{ github.event.pull_request.number }}
-      BASE_REF: ${{ github.event.pull_request.base.ref }}
       GH_TOKEN: ${{ github.token }}
 
     steps:
-      - name: Checkout trusted base repository
+      - name: Check conflicts and pull request size via GitHub API
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Check conflicts and pull request size
         shell: bash
         run: |
           set -euo pipefail
 
           echo "Checking PR #${PR_NUMBER}"
-          echo "Base branch: ${BASE_REF}"
 
           ############################################################
           # Helper: comment on and close rejected PR
@@ -94,25 +86,40 @@ jobs:
           }
 
           ############################################################
-          # Fetch target branch and PR HEAD
+          # Fetch PR metadata from GitHub REST API
           ############################################################
 
-          echo "Fetching base branch and PR head..."
+          echo "Fetching pull request metadata from GitHub API..."
 
-          git fetch --no-tags --force origin \
+          PR_JSON=""
-            "+refs/heads/${BASE_REF}:refs/remotes/origin/base-pr-check" \
+          for attempt in {1..10}; do
-            "+refs/pull/${PR_NUMBER}/head:refs/remotes/origin/pr-${PR_NUMBER}"
+            PR_JSON="$(
-
+              curl \
-          BASE_COMMIT="$(
+                --fail-with-body \
-            git rev-parse refs/remotes/origin/base-pr-check
+                --silent \
+                --show-error \
+                --request GET \
+                --header "Accept: application/vnd.github+json" \
+                --header "Authorization: Bearer ${GH_TOKEN}" \
+                --header "X-GitHub-Api-Version: 2022-11-28" \
+                "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}"
             )"
 
-          PR_COMMIT="$(
+            MERGEABLE="$(echo "${PR_JSON}" | jq -r '.mergeable')"
-            git rev-parse refs/remotes/origin/pr-${PR_NUMBER}
+            if [[ "${MERGEABLE}" != "null" ]]; then
-          )"
+              break
+            fi
 
-          echo "Base commit: ${BASE_COMMIT}"
+            echo "Mergeable state is calculating, waiting 2s (attempt ${attempt}/10)..."
-          echo "PR commit:   ${PR_COMMIT}"
+            sleep 2
+          done
+
+          MERGEABLE="$(echo "${PR_JSON}" | jq -r '.mergeable')"
+          ADDITIONS="$(echo "${PR_JSON}" | jq -r '.additions // 0')"
+          DELETIONS="$(echo "${PR_JSON}" | jq -r '.deletions // 0')"
+          CHANGED_FILES="$(echo "${PR_JSON}" | jq -r '.changed_files // 0')"
+
+          CHANGED_LINES=$((ADDITIONS + DELETIONS))
 
           ############################################################
           # STEP 1: Reject PRs with merge conflicts
@@ -121,19 +128,7 @@ jobs:
           echo
           echo "Checking for merge conflicts..."
 
-          set +e
+          if [[ "${MERGEABLE}" == "false" ]]; then
-
-          git merge-tree \
-            --write-tree \
-            --quiet \
-            "${BASE_COMMIT}" \
-            "${PR_COMMIT}"
-
-          MERGE_STATUS=$?
-
-          set -e
-
-          if [[ "${MERGE_STATUS}" -eq 1 ]]; then
 
             {
               echo "### Pull request policy"
@@ -144,94 +139,9 @@ jobs:
 
             reject_pr "This pull request has merge conflicts with the current master branch and cannot be accepted. Please update your branch with the latest master, resolve all merge conflicts locally, and submit a conflict-free pull request."
 
-          elif [[ "${MERGE_STATUS}" -ne 0 ]]; then
-
-            echo "::error::Unable to determine whether the pull request can be merged."
-            echo "git merge-tree returned status ${MERGE_STATUS}."
-
-            {
-              echo "### Pull request policy"
-              echo
-              echo "- Merge conflict check: ⚠️ Error"
-              echo "- Result: Check failed"
-            } >> "${GITHUB_STEP_SUMMARY}"
-
-            exit 1
-
           fi
 
-          echo "No merge conflicts detected."
+          echo "No merge conflicts detected (mergeable: ${MERGEABLE})."
-
-          ############################################################
-          # STEP 2: Determine merge base
-          ############################################################
-
-          if ! MERGE_BASE="$(
-            git merge-base "${BASE_COMMIT}" "${PR_COMMIT}"
-          )"; then
-
-            echo "::error::Unable to determine merge base."
-
-            {
-              echo "### Pull request policy"
-              echo
-              echo "- Merge conflicts: ✅ None"
-              echo "- Diff calculation: ⚠️ Failed"
-            } >> "${GITHUB_STEP_SUMMARY}"
-
-            exit 1
-
-          fi
-
-          echo "Merge base: ${MERGE_BASE}"
-
-          ############################################################
-          # STEP 3: Calculate actual PR changed lines
-          ############################################################
-
-          NUMSTAT_FILE="$(mktemp)"
-
-          git diff \
-            --no-ext-diff \
-            --no-textconv \
-            --numstat \
-            "${MERGE_BASE}" \
-            "${PR_COMMIT}" \
-            > "${NUMSTAT_FILE}"
-
-          ADDITIONS="$(
-            awk '
-              $1 ~ /^[0-9]+$/ {
-                total += $1
-              }
-
-              END {
-                print total + 0
-              }
-            ' "${NUMSTAT_FILE}"
-          )"
-
-          DELETIONS="$(
-            awk '
-              $2 ~ /^[0-9]+$/ {
-                total += $2
-              }
-
-              END {
-                print total + 0
-              }
-            ' "${NUMSTAT_FILE}"
-          )"
-
-          CHANGED_FILES="$(
-            awk '
-              END {
-                print NR + 0
-              }
-            ' "${NUMSTAT_FILE}"
-          )"
-
-          CHANGED_LINES=$((ADDITIONS + DELETIONS))
 
           ############################################################
           # Action summary
@@ -256,7 +166,7 @@ jobs:
           echo "Limit: ${MAX_CHANGED_LINES}"
 
           ############################################################
-          # STEP 4: Reject oversized PRs
+          # STEP 2: Reject oversized PRs
           ############################################################
 
           if (( CHANGED_LINES > MAX_CHANGED_LINES )); then

.github/workflows/sync-apple-carrier-bundles.yml

@@ -0,0 +1,42 @@
+name: Sync Apple Carrier Bundles
+
+on:
+  schedule:
+    # Run every Sunday at midnight UTC
+    - cron: '0 0 * * 0'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.24'
+
+      - name: Run carrier bundles sync
+        run: |
+          go run ./cmd/sync_carrier_bundles
+
+      - name: Run tests on generated profiles
+        run: |
+          go test -v ./internal/vowifi
+
+      - name: Create Pull Request or commit updates
+        uses: peter-evans/create-pull-request@v6
+        with:
+          commit-message: "chore(vowifi): sync Apple carrier bundles offline database"
+          title: "chore(vowifi): sync Apple carrier bundles offline database"
+          body: |
+            Automated sync from `dwilliamsuk/ios-carrier-bundles` latest release.
+            Updated `internal/vowifi/carrier_profiles.json`.
+          branch: "sync-apple-carrier-bundles"
+          delete-branch: true

Dockerfile

@@ -36,7 +36,7 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build \
 
 # ---- Stage 3: minimal runtime ----
 FROM alpine:3.20
-RUN apk add --no-cache ca-certificates ccid iproute2 pcsc-lite tzdata && \
+RUN apk add --no-cache ca-certificates ccid iproute2 pcsc-lite qmi-utils tzdata && \
     addgroup -S -g 1000 vocat && \
     adduser -S -D -H -u 1000 -G vocat vocat
 

LICENSES/go-plist-BSD-2-Clause.txt

@@ -0,0 +1,57 @@
+Copyright (c) 2013, Dustin L. Howett. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice,
+   this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.
+
+The views and conclusions contained in the software and documentation are
+those of the authors and should not be interpreted as representing official
+policies, either expressed or implied, of the FreeBSD Project.
+
+-------------------------------------------------------------------------------
+Parts of this package were made available under the license covering the Go
+language and all attended core libraries. That license follows.
+-------------------------------------------------------------------------------
+
+Copyright (c) 2012 The Go Authors. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+   * Redistributions of source code must retain the above copyright
+     notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above copyright
+     notice, this list of conditions and the following disclaimer in the
+     documentation and/or other materials provided with the distribution.
+   * Neither the name of Google Inc. nor the names of its contributors may be
+     used to endorse or promote products derived from this software without
+     specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.

README.md

@@ -96,6 +96,14 @@ to install matching `ip-full`, `kmod-ipsec`, `kmod-ipsec4/6`,
 If matching kernel modules are unavailable, use a firmware that includes them;
 never force-install kmods built for a different kernel.
 
+If your kernel cannot provide XFRM/IPsec and you only need non-VoWiFi features
+such as cellular SMS or data, install with `--skip-vowifi-check`:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/MengMengCode/VoCat/master/scripts/install.sh -o install.sh
+sudo bash install.sh --skip-vowifi-check
+```
+
 The installer:
 
 - detects `amd64`, `386`, `arm64`, `aarch64`, or `armv7`;
@@ -188,6 +196,11 @@ those fixed nodes and does not provide complete multi-device or hot-plug discove
 
 The GHCR image is published for `linux/amd64` and `linux/arm64`.
 
+> [!TIP]
+> **NAS / QNAP Container Station Deployment Note**:
+> On NAS operating systems like QNAP QTS / QuTS hero (Container Station), custom non-root administrator accounts and volume isolation mechanisms may cause Docker named volumes (e.g. `-v vocat-data:/opt/vocat/data`) to resolve to different isolated paths between the one-off `bootstrap-admin` initialization and the daemon service container, leading to "Incorrect password" errors during Web login.
+> For NAS environments, it is strongly recommended to replace named volumes with a host absolute path bind mount (e.g. `-v /share/Container/vocat/data:/opt/vocat/data` on QNAP) for both initialization and runtime to guarantee consistent SQLite database persistence.
+
 ### USB SIM readers
 
 USB SIM readers use the Linux PC/SC service. The one-click installer installs
@@ -197,6 +210,19 @@ managers. On Debian/Ubuntu, the equivalent manual setup is
 VoCat keeps the reader visible in the add-device dialog and reports the missing
 service or driver instead of silently hiding it.
 
+### QMI command-line utilities
+
+VoCat uses `qmicli` to verify that a QMI control channel is ready and
+`qmi-network` to manage packet-data sessions. The one-click installer installs
+and verifies the corresponding utilities automatically. For manual deployment,
+Debian/Ubuntu uses `apt install libqmi-utils`; Arch Linux uses
+`pacman -S libqmi`, Alpine uses `apk add qmi-utils`, and OpenWrt uses
+`opkg install qmi-utils`.
+
+`vocat doctor --repair-dji-qmi` checks for `qmicli` before changing any USB
+driver binding or asserting DTR. If the utility is unavailable, the command
+stops with an installation hint and leaves the current device state untouched.
+
 ## Configuration
 
 Vocat reads an optional JSON configuration file from `VOCAT_CONFIG`, then applies `VOCAT_*` environment variables. Environment variables take precedence.
@@ -212,6 +238,10 @@ Vocat reads an optional JSON configuration file from `VOCAT_CONFIG`, then applie
 | `VOCAT_REPO` | `MengMengCode/VoCat` | Trusted GitHub repository used by the self-updater, in `owner/name` form. |
 | `GITHUB_TOKEN` | empty | Optional GitHub token for private repositories or higher API limits. |
 
+User-supplied Apple carrier bundles can be converted into reviewable,
+allow-listed carrier profiles with `vocat carrier import-ipcc`; see
+[docs/CARRIER_IPCC_IMPORT.md](docs/CARRIER_IPCC_IMPORT.md).
+
 Administrator credentials are stored only in SQLite. Initialize an empty
 database once with `vocat bootstrap-admin`; environment variables and JSON
 configuration cannot set or overwrite the administrator username or password.
@@ -340,7 +370,7 @@ cd web && npm run build
 ## Thanks
 - [Nodeseek.com](https://www.nodeseek.com) — A community dedicated to servers
 - [Linux.do](https://linux.do) — An inspiring tech community
-- [iniwex5](https://github.com/iniwex5) - Style and Functionality Guidelines
+- [iniwex5](https://github.com/iniwex5) — Style and Functionality Guidelines
 
 ## Buy me a coffee
 

cmd/sync_carrier_bundles/main.go

@@ -0,0 +1,160 @@
+package main
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"path"
+	"path/filepath"
+	"sort"
+	"strings"
+	"time"
+
+	"vocat/internal/vowifi"
+)
+
+const defaultTarURL = "https://github.com/dwilliamsuk/ios-carrier-bundles/archive/refs/heads/latest.tar.gz"
+
+func main() {
+	tarURL := flag.String("url", defaultTarURL, "URL to ios-carrier-bundles tar.gz archive")
+	localTar := flag.String("file", "", "path to local .tar.gz archive")
+	outputFile := flag.String("output", filepath.Join("internal", "vowifi", "carrier_profiles.json"), "output carrier_profiles.json path")
+	flag.Parse()
+
+	var reader io.Reader
+	if *localTar != "" {
+		f, err := os.Open(*localTar)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "Error opening %s: %v\n", *localTar, err)
+			os.Exit(1)
+		}
+		defer f.Close()
+		reader = f
+	} else {
+		fmt.Printf("Downloading %s ...\n", *tarURL)
+		client := &http.Client{Timeout: 3 * time.Minute}
+		resp, err := client.Get(*tarURL)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "Download error: %v\n", err)
+			os.Exit(1)
+		}
+		defer resp.Body.Close()
+		if resp.StatusCode != http.StatusOK {
+			fmt.Fprintf(os.Stderr, "HTTP %s\n", resp.Status)
+			os.Exit(1)
+		}
+		data, err := io.ReadAll(resp.Body)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "Read error: %v\n", err)
+			os.Exit(1)
+		}
+		fmt.Printf("Downloaded %d bytes. Parsing archive...\n", len(data))
+		reader = bytes.NewReader(data)
+	}
+
+	gz, err := gzip.NewReader(reader)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Gzip error: %v\n", err)
+		os.Exit(1)
+	}
+	defer gz.Close()
+
+	tr := tar.NewReader(gz)
+	bundlePlists := make(map[string]map[string][]byte)
+
+	for {
+		hdr, err := tr.Next()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "Tar error: %v\n", err)
+			break
+		}
+		if hdr.Typeflag != tar.TypeReg {
+			continue
+		}
+		name := strings.ReplaceAll(hdr.Name, "\\", "/")
+		if strings.Contains(strings.ToLower(name), "/signatures/") {
+			continue
+		}
+		base := path.Base(name)
+		if !strings.EqualFold(base, "carrier.plist") && (!strings.HasPrefix(strings.ToLower(base), "overrides") || !strings.EqualFold(path.Ext(base), ".plist")) {
+			continue
+		}
+		// e.g. ios-carrier-bundles-latest/Carrier Bundles/EE_uk.bundle/carrier.plist
+		bundleDir := path.Dir(name)
+		bundleName := path.Base(bundleDir)
+		if !strings.HasSuffix(strings.ToLower(bundleName), ".bundle") {
+			continue
+		}
+
+		content, err := io.ReadAll(tr)
+		if err != nil {
+			continue
+		}
+		if bundlePlists[bundleName] == nil {
+			bundlePlists[bundleName] = make(map[string][]byte)
+		}
+		bundlePlists[bundleName][base] = content
+	}
+
+	fmt.Printf("Found %d distinct carrier bundles. Extracting VoWiFi profiles...\n", len(bundlePlists))
+
+	var sortedBundleNames []string
+	for k := range bundlePlists {
+		sortedBundleNames = append(sortedBundleNames, k)
+	}
+	sort.Strings(sortedBundleNames)
+
+	var extractedRules []any
+	seenIDs := make(map[string]bool)
+	successCount := 0
+	skipCount := 0
+
+	for _, bundleName := range sortedBundleNames {
+		plists := bundlePlists[bundleName]
+		rule, _, err := vowifi.ImportCarrierBundlePlists(bundleName, plists)
+		if err != nil {
+			skipCount++
+			continue
+		}
+		if seenIDs[rule.ID] {
+			continue
+		}
+		seenIDs[rule.ID] = true
+		extractedRules = append(extractedRules, rule)
+		successCount++
+	}
+
+	fmt.Printf("Extracted %d valid carrier profile rules (skipped %d without valid VoWiFi selectors).\n", successCount, skipCount)
+
+	doc := map[string]any{
+		"version": vowifi.CarrierProfileSchemaVersion,
+		"metadata": map[string]any{
+			"source":       "dwilliamsuk/ios-carrier-bundles",
+			"generated_at": time.Now().UTC().Format(time.RFC3339),
+			"count":        len(extractedRules),
+		},
+		"profiles": extractedRules,
+	}
+
+	encoded, err := json.MarshalIndent(doc, "", "  ")
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "JSON encode error: %v\n", err)
+		os.Exit(1)
+	}
+
+	if err := os.WriteFile(*outputFile, append(encoded, '\n'), 0o644); err != nil {
+		fmt.Fprintf(os.Stderr, "Write error to %s: %v\n", *outputFile, err)
+		os.Exit(1)
+	}
+
+	fmt.Printf("Successfully wrote %d rules (%d bytes) to %s\n", len(extractedRules), len(encoded), *outputFile)
+}

cmd/vocat/carrier.go

@@ -0,0 +1,95 @@
+package main
+
+import (
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"path/filepath"
+	"strings"
+
+	"vocat/internal/config"
+	"vocat/internal/vowifi"
+)
+
+func runCarrier(args []string, stdout io.Writer) error {
+	if len(args) == 0 {
+		return errors.New("usage: vocat carrier import-ipcc [flags] FILE.ipcc")
+	}
+	switch args[0] {
+	case "import-ipcc":
+		return runCarrierImportIPCC(args[1:], stdout)
+	default:
+		return fmt.Errorf("unknown carrier subcommand %q", args[0])
+	}
+}
+
+func runCarrierImportIPCC(args []string, stdout io.Writer) error {
+	flags := flag.NewFlagSet("carrier import-ipcc", flag.ContinueOnError)
+	flags.SetOutput(io.Discard)
+	var bundle string
+	var profileID string
+	var profileDir string
+	var install bool
+	var documentOnly bool
+	flags.StringVar(&bundle, "bundle", "", "bundle name when an IPCC contains more than one carrier bundle")
+	flags.StringVar(&profileID, "id", "", "override the generated carrier profile ID")
+	flags.StringVar(&profileDir, "profile-dir", "", "installation directory (default: next to the VoCat database)")
+	flags.BoolVar(&install, "install", false, "atomically install the reviewed generated profile")
+	flags.BoolVar(&documentOnly, "document-only", false, "print only the generated carrier profile document")
+	if err := flags.Parse(args); err != nil {
+		return err
+	}
+	if flags.NArg() != 1 {
+		return errors.New("usage: vocat carrier import-ipcc [--bundle NAME] [--id ID] [--document-only] [--install] [--profile-dir DIR] FILE.ipcc")
+	}
+	if documentOnly && install {
+		return errors.New("--document-only and --install cannot be used together")
+	}
+	if strings.TrimSpace(profileDir) != "" && !install {
+		return errors.New("--profile-dir requires --install")
+	}
+	result, err := vowifi.ImportCarrierIPCC(flags.Arg(0), vowifi.IPCCImportOptions{
+		Bundle:    bundle,
+		ProfileID: profileID,
+	})
+	if err != nil {
+		return err
+	}
+	if documentOnly {
+		_, err := stdout.Write(result.Document)
+		return err
+	}
+
+	installedPath := ""
+	if install {
+		profileDir = strings.TrimSpace(profileDir)
+		if profileDir == "" {
+			cfg, err := config.Load()
+			if err != nil {
+				return fmt.Errorf("load configuration for carrier profile directory: %w", err)
+			}
+			profileDir = filepath.Join(filepath.Dir(cfg.DatabasePath), "carrier-profiles.d")
+		}
+		installedPath, err = vowifi.InstallCarrierIPCCResult(result, profileDir)
+		if err != nil {
+			return err
+		}
+		if absolute, absoluteErr := filepath.Abs(installedPath); absoluteErr == nil {
+			installedPath = absolute
+		}
+	}
+	output := struct {
+		vowifi.IPCCImportResult
+		InstalledPath   string `json:"installed_path,omitempty"`
+		RestartRequired bool   `json:"restart_required,omitempty"`
+	}{
+		IPCCImportResult: result,
+		InstalledPath:    installedPath,
+		RestartRequired:  installedPath != "",
+	}
+	encoder := json.NewEncoder(stdout)
+	encoder.SetIndent("", "  ")
+	return encoder.Encode(output)
+}

cmd/vocat/carrier_test.go

@@ -0,0 +1,74 @@
+package main
+
+import (
+	"archive/zip"
+	"bytes"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"howett.net/plist"
+)
+
+func TestRunCarrierImportIPCCPreviewsAndInstallsExplicitly(t *testing.T) {
+	archivePath := filepath.Join(t.TempDir(), "test.ipcc")
+	file, err := os.Create(archivePath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	archive := zip.NewWriter(file)
+	entry, err := archive.Create("Payload/Test.bundle/carrier.plist")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var encoded bytes.Buffer
+	if err := plist.NewEncoder(&encoded).Encode(map[string]any{
+		"CarrierName":    "Test Carrier",
+		"SupportedSIMs":  []any{"99901"},
+		"SupportedPLMNs": []any{"99901"},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := entry.Write(encoded.Bytes()); err != nil {
+		t.Fatal(err)
+	}
+	if err := archive.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if err := file.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	var preview bytes.Buffer
+	if err := runCarrier([]string{"import-ipcc", "--document-only", archivePath}, &preview); err != nil {
+		t.Fatal(err)
+	}
+	var document struct {
+		Version int `json:"version"`
+	}
+	if err := json.Unmarshal(preview.Bytes(), &document); err != nil || document.Version != 1 {
+		t.Fatalf("preview = %q, version=%d, error=%v", preview.String(), document.Version, err)
+	}
+
+	installDir := t.TempDir()
+	var output bytes.Buffer
+	if err := runCarrier([]string{
+		"import-ipcc", "--id", "cli-test", "--install", "--profile-dir", installDir, archivePath,
+	}, &output); err != nil {
+		t.Fatal(err)
+	}
+	var installed struct {
+		InstalledPath   string `json:"installed_path"`
+		RestartRequired bool   `json:"restart_required"`
+	}
+	if err := json.Unmarshal(output.Bytes(), &installed); err != nil {
+		t.Fatal(err)
+	}
+	if !installed.RestartRequired || filepath.Base(installed.InstalledPath) != "cli-test.json" {
+		t.Fatalf("install output = %s", output.String())
+	}
+	if _, err := os.Stat(filepath.Join(installDir, "cli-test.json")); err != nil {
+		t.Fatal(err)
+	}
+}

cmd/vocat/cli.go

@@ -21,6 +21,16 @@ Usage:
   vocat serve        Run the server in the foreground (use from a TTY when
                      vocat without arguments would enter the menu).
   vocat version      Print the build version and exit.
+  vocat doctor       Diagnose USB modem, AT, QMI, PC/SC and proxy UDP paths.
+                     Use --repair-dji-qmi on Linux to restore the factory-ID
+                     DJI/Baiwang 2ca3:4006 AT/QMI interface bindings and wake
+                     QMI without changing NV.
+  vocat carrier import-ipcc [flags] FILE.ipcc
+                     Convert an Apple carrier bundle into a reviewable VoCat
+                     profile. Preview is the default; --install writes it to
+                     carrier-profiles.d and takes effect after restart.
+                     Flags: --bundle NAME --id ID --document-only --install
+                            --profile-dir DIR.
   vocat update       Check GitHub for a newer release and self-update.
                      Flags:
                        --check           Only report whether an update is available.

cmd/vocat/doctor.go

@@ -0,0 +1,175 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"os"
+	"os/exec"
+	"runtime"
+	"strings"
+	"time"
+
+	"vocat/internal/modem"
+	"vocat/internal/pcsc"
+	"vocat/internal/proxy"
+)
+
+type doctorCheck struct {
+	Name     string `json:"name"`
+	Status   string `json:"status"`
+	Code     string `json:"code,omitempty"`
+	Message  string `json:"message"`
+	Evidence any    `json:"evidence,omitempty"`
+}
+
+type doctorReport struct {
+	Time   time.Time     `json:"time"`
+	OS     string        `json:"os"`
+	Arch   string        `json:"arch"`
+	Checks []doctorCheck `json:"checks"`
+}
+
+type djiQMIRepairResult struct {
+	USBName          string   `json:"usb_name"`
+	Interface        string   `json:"interface"`
+	USBDevice        string   `json:"usb_device"`
+	OriginalDriver   string   `json:"original_driver,omitempty"`
+	SerialInterfaces []string `json:"serial_interfaces,omitempty"`
+	SerialDevices    []string `json:"serial_devices,omitempty"`
+	ATDevice         string   `json:"at_device,omitempty"`
+	ControlDevice    string   `json:"control_device"`
+	NetworkInterface string   `json:"network_interface,omitempty"`
+	QMIProbe         string   `json:"qmi_probe"`
+	Attempts         int      `json:"attempts"`
+}
+
+func runDoctor(args []string) error {
+	flags := flag.NewFlagSet("doctor", flag.ContinueOnError)
+	flags.SetOutput(os.Stderr)
+	proxyAddress := flags.String("proxy", "", "SOCKS5 host:port to test")
+	proxyUsername := flags.String("proxy-username", "", "SOCKS5 username")
+	passwordEnv := flags.String("proxy-password-env", "VOCAT_DOCTOR_PROXY_PASSWORD", "environment variable containing the proxy password")
+	repairDJI := flags.Bool("repair-dji-qmi", false, "bind DJI 2ca3:4006 interfaces 0-3 to option and interface 4 to qmi_wwan, then assert DTR (Linux/root only; no NV write)")
+	jsonOutput := flags.Bool("json", false, "write machine-readable JSON")
+	timeout := flags.Duration("timeout", 12*time.Second, "per-probe timeout")
+	if err := flags.Parse(args); err != nil {
+		if errors.Is(err, flag.ErrHelp) {
+			return nil
+		}
+		return err
+	}
+	if flags.NArg() != 0 || *timeout <= 0 || *timeout > time.Minute {
+		return errors.New("usage: vocat doctor [--repair-dji-qmi] [--proxy host:port] [--proxy-username name] [--proxy-password-env ENV] [--json]")
+	}
+	report := doctorReport{Time: time.Now().UTC(), OS: runtime.GOOS, Arch: runtime.GOARCH}
+	add := func(name, status, code, message string, evidence any) {
+		report.Checks = append(report.Checks, doctorCheck{Name: name, Status: status, Code: code, Message: message, Evidence: evidence})
+	}
+
+	if data, err := os.ReadFile("/proc/version"); err == nil && strings.Contains(strings.ToLower(string(data)), "microsoft") {
+		add("host", "warning", "wsl_usbip_detected", "WSL/USBIP detected; QMI control transfers may time out even when /dev/cdc-wdm exists", nil)
+	} else {
+		add("host", "passed", "native_host", "No WSL kernel marker detected", nil)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), *timeout)
+	defer cancel()
+	if *repairDJI {
+		result, err := repairDJIQMI(ctx)
+		if err != nil {
+			return fmt.Errorf("repair DJI QMI binding: %w", err)
+		}
+		add("dji_qmi_repair", "passed", "dji_usb_interfaces_repaired", "DJI serial interfaces 0-3 were bound to option and interface 4 to qmi_wwan after a transient CDC DTR assertion; modem NV and USB identity were not changed", result)
+	}
+
+	candidates, discoverErr := modem.NewSystemDiscoverer().Discover(ctx)
+	if discoverErr != nil {
+		add("modem_discovery", "failed", "modem_discovery_failed", discoverErr.Error(), nil)
+	} else if len(candidates) == 0 {
+		add("modem_discovery", "warning", "no_modem", "No USB modem was discovered", nil)
+	} else {
+		add("modem_discovery", "passed", "modem_discovered", fmt.Sprintf("Discovered %d modem candidate(s)", len(candidates)), candidates)
+	}
+	for _, candidate := range candidates {
+		name := "modem:" + candidate.ID
+		if candidate.HasATPort() {
+			probeContext, cancelProbe := context.WithTimeout(context.Background(), minDuration(*timeout, 5*time.Second))
+			client, openErr := (modem.SerialOpener{}).Open(probeContext, candidate.ATPort)
+			if openErr != nil {
+				add(name+":at", "warning", "at_open_failed", openErr.Error(), candidate.ATPort.OpenPath())
+			} else {
+				response, commandErr := client.Execute(probeContext, "AT+CFUN?")
+				_ = client.Close()
+				if commandErr != nil {
+					add(name+":at", "warning", "at_probe_failed", commandErr.Error(), candidate.ATPort.OpenPath())
+				} else {
+					add(name+":at", "passed", "at_ready", "AT control channel responded to a read-only CFUN query", response.Text())
+				}
+			}
+			cancelProbe()
+		} else {
+			add(name+":at", "failed", "at_missing", "No AT port was selected", nil)
+		}
+		if strings.TrimSpace(candidate.QMIControl) == "" {
+			add(name+":qmi", "warning", "qmi_missing", "No cdc-wdm/QMI control node was discovered", nil)
+		} else if qmicli, lookErr := exec.LookPath("qmicli"); lookErr != nil {
+			add(name+":qmi", "warning", "qmicli_missing", "QMI node exists but qmicli is unavailable for an active DMS check", candidate.QMIControl)
+		} else {
+			probeContext, cancelProbe := context.WithTimeout(context.Background(), minDuration(*timeout, 8*time.Second))
+			command := exec.CommandContext(probeContext, qmicli, "-d", candidate.QMIControl, "--dms-get-operating-mode")
+			output, commandErr := command.CombinedOutput()
+			message := strings.TrimSpace(string(output))
+			cancelProbe()
+			if commandErr != nil {
+				code := "qmi_cid_failed"
+				if errors.Is(probeContext.Err(), context.DeadlineExceeded) || strings.Contains(strings.ToLower(message), "timed out") {
+					code = "qmi_cid_timeout"
+				}
+				add(name+":qmi", "failed", code, "qmicli DMS client allocation/read failed", message)
+			} else {
+				add(name+":qmi", "passed", "qmi_dms_ready", "qmicli allocated DMS and completed a read-only request", message)
+			}
+		}
+	}
+
+	readers, readerErr := pcsc.New().Readers(ctx)
+	if readerErr == nil {
+		add("pcsc", "passed", "pcsc_ready", fmt.Sprintf("PC/SC reported %d reader(s)", len(readers)), readers)
+	} else if errors.Is(readerErr, pcsc.ErrUnsupported) || errors.Is(readerErr, pcsc.ErrUnavailable) {
+		add("pcsc", "warning", "pcsc_unavailable", readerErr.Error(), nil)
+	} else {
+		add("pcsc", "failed", "pcsc_failed", readerErr.Error(), nil)
+	}
+
+	if strings.TrimSpace(*proxyAddress) != "" {
+		password := os.Getenv(strings.TrimSpace(*passwordEnv))
+		probeContext, cancelProbe := context.WithTimeout(context.Background(), *timeout)
+		result, probeErr := proxy.ProbeSOCKS5(probeContext, *proxyAddress, *proxyUsername, password, *timeout)
+		cancelProbe()
+		status := "passed"
+		if probeErr != nil {
+			status = "failed"
+		}
+		add("proxy_udp", status, result.Diagnosis, result.Hint, result)
+	}
+
+	if *jsonOutput {
+		encoder := json.NewEncoder(os.Stdout)
+		encoder.SetIndent("", "  ")
+		return encoder.Encode(report)
+	}
+	for _, check := range report.Checks {
+		fmt.Printf("%-8s %-26s %-28s %s\n", strings.ToUpper(check.Status), check.Name, check.Code, check.Message)
+	}
+	return nil
+}
+
+func minDuration(left, right time.Duration) time.Duration {
+	if left < right {
+		return left
+	}
+	return right
+}

cmd/vocat/doctor_dji_linux.go

@@ -0,0 +1,455 @@
+//go:build linux
+
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"syscall"
+	"time"
+	"unsafe"
+
+	"golang.org/x/sys/unix"
+)
+
+const (
+	djiVendorID         = "2ca3"
+	djiProductID        = "4006"
+	djiFirstSerialIndex = 0
+	djiLastSerialIndex  = 3
+	djiATIndex          = 2
+	djiQMIIndex         = 4
+)
+
+type usbControlTransfer struct {
+	RequestType uint8
+	Request     uint8
+	Value       uint16
+	Index       uint16
+	Length      uint16
+	Timeout     uint32
+	Data        uintptr
+}
+
+func repairDJIQMI(ctx context.Context) (djiQMIRepairResult, error) {
+	qmicli, err := exec.LookPath("qmicli")
+	if err != nil {
+		return djiQMIRepairResult{}, errors.New("qmicli is required to verify DJI QMI readiness; install libqmi-utils on Debian/Ubuntu/Fedora, libqmi on Arch Linux, or qmi-utils on Alpine")
+	}
+	return retryDJIQMI(ctx, 3, 500*time.Millisecond, func(attemptContext context.Context) (djiQMIRepairResult, error) {
+		return repairDJIQMIAt(attemptContext, "/sys", "/dev", qmicli)
+	})
+}
+
+func retryDJIQMI(
+	ctx context.Context,
+	maxAttempts int,
+	delay time.Duration,
+	attempt func(context.Context) (djiQMIRepairResult, error),
+) (djiQMIRepairResult, error) {
+	var result djiQMIRepairResult
+	var err error
+	for attemptNumber := 1; attemptNumber <= maxAttempts; attemptNumber++ {
+		result, err = attempt(ctx)
+		result.Attempts = attemptNumber
+		if err == nil {
+			return result, nil
+		}
+		if ctx.Err() != nil {
+			break
+		}
+		timer := time.NewTimer(time.Duration(attemptNumber) * delay)
+		select {
+		case <-ctx.Done():
+			timer.Stop()
+			return result, errors.Join(err, ctx.Err())
+		case <-timer.C:
+		}
+	}
+	return result, fmt.Errorf("failed after %d DTR repair attempt(s): %w", result.Attempts, err)
+}
+
+func repairDJIQMIAt(ctx context.Context, sysRoot, devRoot, qmicli string) (result djiQMIRepairResult, returnErr error) {
+	usbRoot := filepath.Join(sysRoot, "bus", "usb", "devices")
+	entries, err := os.ReadDir(usbRoot)
+	if err != nil {
+		return result, fmt.Errorf("read USB topology: %w", err)
+	}
+	var usbNames []string
+	for _, entry := range entries {
+		devicePath := filepath.Join(usbRoot, entry.Name())
+		vendor, vendorErr := readTrimmedFile(filepath.Join(devicePath, "idVendor"))
+		product, productErr := readTrimmedFile(filepath.Join(devicePath, "idProduct"))
+		if vendorErr == nil && productErr == nil &&
+			strings.EqualFold(vendor, djiVendorID) && strings.EqualFold(product, djiProductID) {
+			usbNames = append(usbNames, entry.Name())
+		}
+	}
+	if len(usbNames) != 1 {
+		return result, fmt.Errorf("expected exactly one DJI %s:%s USB device, found %d", djiVendorID, djiProductID, len(usbNames))
+	}
+	result.USBName = usbNames[0]
+	result.Interface = fmt.Sprintf("%s:1.%d", result.USBName, djiQMIIndex)
+	devicePath := filepath.Join(usbRoot, result.USBName)
+	interfacePath := filepath.Join(usbRoot, result.Interface)
+	if _, err := os.Stat(interfacePath); err != nil {
+		return result, fmt.Errorf("DJI QMI interface %s unavailable: %w", result.Interface, err)
+	}
+
+	busNumber, err := readUSBNumber(filepath.Join(devicePath, "busnum"))
+	if err != nil {
+		return result, err
+	}
+	deviceNumber, err := readUSBNumber(filepath.Join(devicePath, "devnum"))
+	if err != nil {
+		return result, err
+	}
+	result.USBDevice = filepath.Join(devRoot, "bus", "usb", fmt.Sprintf("%03d", busNumber), fmt.Sprintf("%03d", deviceNumber))
+
+	driversRoot := filepath.Join(sysRoot, "bus", "usb", "drivers")
+	if err := ensureUSBDriverLoaded(ctx, driversRoot, "qmi_wwan", "qmi_wwan"); err != nil {
+		return result, err
+	}
+	if err := ensureUSBDriverLoaded(ctx, driversRoot, "option", "option"); err != nil {
+		return result, err
+	}
+
+	// qmi_wwan's USB dynamic ID is device-wide. Leaving it installed makes it
+	// probe every vendor-specific interface after a USBIP reconnect; on this DJI
+	// composition that can turn interfaces 1-3 into bogus cdc-wdm devices and
+	// remove the AT port. Remove it before detaching anything, then add it only
+	// briefly below while interface 4 is the sole unbound interface.
+	qmiDriverRoot := filepath.Join(driversRoot, "qmi_wwan")
+	if err := removeDynamicUSBID(qmiDriverRoot, djiVendorID+" "+djiProductID); err != nil {
+		return result, fmt.Errorf("remove broad DJI qmi_wwan dynamic ID: %w", err)
+	}
+
+	serialInterfaces, serialDevices, atDevice, err := bindDJISerialInterfaces(ctx, sysRoot, devRoot, usbRoot, driversRoot, result.USBName)
+	if err != nil {
+		return result, err
+	}
+	result.SerialInterfaces = serialInterfaces
+	result.SerialDevices = serialDevices
+	result.ATDevice = atDevice
+
+	result.OriginalDriver = usbInterfaceDriver(interfacePath)
+	if result.OriginalDriver != "" && result.OriginalDriver != "option" && result.OriginalDriver != "qmi_wwan" {
+		return result, fmt.Errorf("refusing to replace unexpected interface driver %q", result.OriginalDriver)
+	}
+
+	interfaceDetached := false
+	restoreOriginal := func() {
+		if !interfaceDetached {
+			return
+		}
+		if currentDriver := usbInterfaceDriver(interfacePath); currentDriver != "" {
+			_ = writeSysfs(filepath.Join(driversRoot, currentDriver, "unbind"), result.Interface)
+		}
+		switch result.OriginalDriver {
+		case "qmi_wwan":
+			_ = bindDJIQMIInterface(qmiDriverRoot, interfacePath, result.Interface)
+		case "option":
+			_ = writeSysfs(filepath.Join(driversRoot, result.OriginalDriver, "bind"), result.Interface)
+		}
+	}
+	defer func() {
+		if returnErr != nil {
+			restoreOriginal()
+		}
+	}()
+	if result.OriginalDriver != "" {
+		if err := writeSysfs(filepath.Join(driversRoot, result.OriginalDriver, "unbind"), result.Interface); err != nil {
+			return result, fmt.Errorf("unbind %s from %s: %w", result.OriginalDriver, result.Interface, err)
+		}
+		interfaceDetached = true
+	}
+	if err := assertUSBDTR(result.USBDevice, djiQMIIndex); err != nil {
+		return result, err
+	}
+
+	if err := bindDJIQMIInterface(qmiDriverRoot, interfacePath, result.Interface); err != nil {
+		return result, err
+	}
+
+	deadline := time.Now().Add(2 * time.Second)
+	for {
+		result.ControlDevice = firstDeviceNode(filepath.Join(interfacePath, "usbmisc"), devRoot, "cdc-wdm")
+		result.NetworkInterface = firstEntryName(filepath.Join(interfacePath, "net"), "")
+		if result.ControlDevice != "" {
+			break
+		}
+		if err := ctx.Err(); err != nil {
+			return result, err
+		}
+		if time.Now().After(deadline) {
+			return result, fmt.Errorf("qmi_wwan bound but no cdc-wdm node appeared for %s", result.Interface)
+		}
+		time.Sleep(25 * time.Millisecond)
+	}
+	// The requested driver topology is now established. A later DMS timeout is
+	// a QMI/USBIP readiness problem, so do not roll interface 4 back to option.
+	interfaceDetached = false
+	time.Sleep(250 * time.Millisecond)
+	probeContext, cancelProbe := context.WithTimeout(ctx, 8*time.Second)
+	output, probeErr := exec.CommandContext(probeContext, qmicli, "-d", result.ControlDevice, "--dms-get-operating-mode").CombinedOutput()
+	probeContextErr := probeContext.Err()
+	cancelProbe()
+	result.QMIProbe = strings.TrimSpace(string(output))
+	if probeErr != nil {
+		if probeContextErr != nil {
+			probeErr = errors.Join(probeErr, probeContextErr)
+		}
+		return result, fmt.Errorf("DMS readiness check after DTR repair: %w: %s", probeErr, result.QMIProbe)
+	}
+	return result, nil
+}
+
+func bindDJIQMIInterface(driverRoot, interfacePath, interfaceName string) (returnErr error) {
+	bindPath := filepath.Join(driverRoot, "bind")
+	dynamicIDAdded := false
+	defer func() {
+		if dynamicIDAdded {
+			removeErr := removeDynamicUSBID(driverRoot, djiVendorID+" "+djiProductID)
+			if returnErr == nil && removeErr != nil {
+				returnErr = fmt.Errorf("remove temporary DJI qmi_wwan dynamic ID: %w", removeErr)
+			}
+		}
+	}()
+	if err := writeSysfs(bindPath, interfaceName); err != nil {
+		newIDErr := writeSysfs(filepath.Join(driverRoot, "new_id"), djiVendorID+" "+djiProductID)
+		if newIDErr != nil && !errors.Is(newIDErr, syscall.EEXIST) {
+			return fmt.Errorf("register DJI qmi_wwan dynamic ID after bind failure %v: %w", err, newIDErr)
+		}
+		dynamicIDAdded = true
+		if usbInterfaceDriver(interfacePath) != "qmi_wwan" {
+			if retryErr := writeSysfs(bindPath, interfaceName); retryErr != nil {
+				return fmt.Errorf("bind qmi_wwan to %s: %w", interfaceName, retryErr)
+			}
+		}
+	}
+	if driver := usbInterfaceDriver(interfacePath); driver != "qmi_wwan" {
+		return fmt.Errorf("interface %s driver is %q after qmi_wwan bind", interfaceName, driver)
+	}
+	return nil
+}
+
+func ensureUSBDriverLoaded(ctx context.Context, driversRoot, driverName, moduleName string) error {
+	if _, err := os.Stat(filepath.Join(driversRoot, driverName)); err == nil {
+		return nil
+	} else if !os.IsNotExist(err) {
+		return fmt.Errorf("inspect %s driver: %w", driverName, err)
+	}
+	modprobe, err := exec.LookPath("modprobe")
+	if err != nil {
+		return fmt.Errorf("%s is not loaded and modprobe is unavailable", driverName)
+	}
+	if output, loadErr := exec.CommandContext(ctx, modprobe, moduleName).CombinedOutput(); loadErr != nil {
+		return fmt.Errorf("load %s: %w: %s", moduleName, loadErr, strings.TrimSpace(string(output)))
+	}
+	if _, err := os.Stat(filepath.Join(driversRoot, driverName)); err != nil {
+		return fmt.Errorf("%s driver is unavailable after loading module %s: %w", driverName, moduleName, err)
+	}
+	return nil
+}
+
+func bindDJISerialInterfaces(
+	ctx context.Context,
+	sysRoot, devRoot, usbRoot, driversRoot, usbName string,
+) ([]string, []string, string, error) {
+	interfaceNames := make([]string, 0, djiLastSerialIndex-djiFirstSerialIndex+1)
+	interfacePaths := make([]string, 0, cap(interfaceNames))
+	needsDynamicID := false
+	for index := djiFirstSerialIndex; index <= djiLastSerialIndex; index++ {
+		name := fmt.Sprintf("%s:1.%d", usbName, index)
+		path := filepath.Join(usbRoot, name)
+		if _, err := os.Stat(path); err != nil {
+			return nil, nil, "", fmt.Errorf("DJI serial interface %s unavailable: %w", name, err)
+		}
+		driver := usbInterfaceDriver(path)
+		if driver != "" && driver != "option" && driver != "qmi_wwan" {
+			return nil, nil, "", fmt.Errorf("refusing to replace unexpected driver %q on %s", driver, name)
+		}
+		interfaceNames = append(interfaceNames, name)
+		interfacePaths = append(interfacePaths, path)
+		needsDynamicID = needsDynamicID || driver != "option"
+	}
+
+	if needsDynamicID {
+		// Detach every false QMI claim before option's new_id triggers probing.
+		for index, path := range interfacePaths {
+			if usbInterfaceDriver(path) != "qmi_wwan" {
+				continue
+			}
+			if err := writeSysfs(filepath.Join(driversRoot, "qmi_wwan", "unbind"), interfaceNames[index]); err != nil {
+				return nil, nil, "", fmt.Errorf("unbind qmi_wwan from serial interface %s: %w", interfaceNames[index], err)
+			}
+		}
+
+		optionSerialRoot := filepath.Join(sysRoot, "bus", "usb-serial", "drivers", "option1")
+		if _, err := os.Stat(optionSerialRoot); err != nil {
+			return nil, nil, "", fmt.Errorf("option USB-serial driver is unavailable: %w", err)
+		}
+		if err := writeSysfs(filepath.Join(optionSerialRoot, "new_id"), djiVendorID+" "+djiProductID); err != nil && !errors.Is(err, syscall.EEXIST) {
+			return nil, nil, "", fmt.Errorf("register DJI option dynamic ID: %w", err)
+		}
+
+		for index, path := range interfacePaths {
+			if usbInterfaceDriver(path) == "option" {
+				continue
+			}
+			if err := writeSysfs(filepath.Join(driversRoot, "option", "bind"), interfaceNames[index]); err != nil {
+				return nil, nil, "", fmt.Errorf("bind option to %s: %w", interfaceNames[index], err)
+			}
+		}
+	}
+	for index, path := range interfacePaths {
+		if driver := usbInterfaceDriver(path); driver != "option" {
+			return nil, nil, "", fmt.Errorf("serial interface %s driver is %q after option bind", interfaceNames[index], driver)
+		}
+	}
+
+	deadline := time.Now().Add(2 * time.Second)
+	serialDevices := make([]string, len(interfacePaths))
+	for {
+		complete := true
+		for index, path := range interfacePaths {
+			name := firstEntryName(path, "ttyUSB")
+			if name == "" {
+				complete = false
+				continue
+			}
+			serialDevices[index] = filepath.Join(devRoot, name)
+		}
+		if complete {
+			break
+		}
+		if err := ctx.Err(); err != nil {
+			return nil, nil, "", err
+		}
+		if time.Now().After(deadline) {
+			return nil, nil, "", fmt.Errorf("option bound but not all ttyUSB nodes appeared for %s", usbName)
+		}
+		time.Sleep(25 * time.Millisecond)
+	}
+	return interfaceNames, serialDevices, serialDevices[djiATIndex-djiFirstSerialIndex], nil
+}
+
+func removeDynamicUSBID(driverRoot, id string) error {
+	path := filepath.Join(driverRoot, "remove_id")
+	if _, err := os.Stat(path); err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+	if err := writeSysfs(path, id); err != nil && !errors.Is(err, syscall.ENODEV) && !errors.Is(err, syscall.ENOENT) {
+		return err
+	}
+	return nil
+}
+
+func assertUSBDTR(devicePath string, interfaceIndex int) error {
+	fd, err := unix.Open(devicePath, unix.O_RDWR|unix.O_CLOEXEC, 0)
+	if err != nil {
+		return fmt.Errorf("open USB device %s: %w", devicePath, err)
+	}
+	defer unix.Close(fd)
+	if err := setUSBControlLineState(fd, interfaceIndex, false); err != nil {
+		return fmt.Errorf("clear CDC DTR on %s interface %d: %w", devicePath, interfaceIndex, err)
+	}
+	time.Sleep(50 * time.Millisecond)
+	if err := setUSBControlLineState(fd, interfaceIndex, true); err != nil {
+		return fmt.Errorf("assert CDC DTR on %s interface %d: %w", devicePath, interfaceIndex, err)
+	}
+	// QDC507 acknowledges the control transfer before its QMI firmware is ready.
+	time.Sleep(time.Second)
+	return nil
+}
+
+func setUSBControlLineState(fd, interfaceIndex int, dtr bool) error {
+	var value uint16
+	if dtr {
+		value = 1 // USB_CDC_CTRL_DTR
+	}
+	transfer := usbControlTransfer{
+		RequestType: 0x21, // host-to-device, class, interface
+		Request:     0x22, // USB_CDC_REQ_SET_CONTROL_LINE_STATE
+		Value:       value,
+		Index:       uint16(interfaceIndex),
+		Timeout:     5000,
+	}
+	const ioctlDirectionReadWrite = uintptr(3)
+	request := ioctlDirectionReadWrite<<30 |
+		uintptr(unsafe.Sizeof(transfer))<<16 |
+		uintptr('U')<<8
+	_, _, errno := unix.Syscall(unix.SYS_IOCTL, uintptr(fd), request, uintptr(unsafe.Pointer(&transfer)))
+	if errno != 0 {
+		return errno
+	}
+	return nil
+}
+
+func readTrimmedFile(path string) (string, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return "", err
+	}
+	return strings.TrimSpace(string(data)), nil
+}
+
+func readUSBNumber(path string) (int, error) {
+	value, err := readTrimmedFile(path)
+	if err != nil {
+		return 0, fmt.Errorf("read %s: %w", filepath.Base(path), err)
+	}
+	number, err := strconv.Atoi(value)
+	if err != nil || number < 1 || number > 999 {
+		return 0, fmt.Errorf("invalid %s %q", filepath.Base(path), value)
+	}
+	return number, nil
+}
+
+func usbInterfaceDriver(interfacePath string) string {
+	resolved, err := filepath.EvalSymlinks(filepath.Join(interfacePath, "driver"))
+	if err != nil {
+		return ""
+	}
+	return filepath.Base(resolved)
+}
+
+func writeSysfs(path, value string) error {
+	file, err := os.OpenFile(path, os.O_WRONLY, 0)
+	if err != nil {
+		return err
+	}
+	_, writeErr := file.WriteString(value)
+	closeErr := file.Close()
+	return errors.Join(writeErr, closeErr)
+}
+
+func firstDeviceNode(directory, devRoot, prefix string) string {
+	name := firstEntryName(directory, prefix)
+	if name == "" {
+		return ""
+	}
+	return filepath.Join(devRoot, name)
+}
+
+func firstEntryName(directory, prefix string) string {
+	entries, err := os.ReadDir(directory)
+	if err != nil {
+		return ""
+	}
+	for _, entry := range entries {
+		if strings.HasPrefix(entry.Name(), prefix) {
+			return entry.Name()
+		}
+	}
+	return ""
+}

cmd/vocat/doctor_dji_linux_test.go

@@ -0,0 +1,152 @@
+//go:build linux
+
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+	"unsafe"
+)
+
+func TestDJIUSBControlTransferLayout(t *testing.T) {
+	var transfer usbControlTransfer
+	if got := unsafe.Sizeof(transfer); got != 24 {
+		t.Fatalf("usbControlTransfer size = %d, want 24", got)
+	}
+	if transfer.RequestType != 0 || transfer.Request != 0 {
+		t.Fatal("zero-value transfer unexpectedly initialized")
+	}
+}
+
+func TestReadUSBNumber(t *testing.T) {
+	directory := t.TempDir()
+	path := filepath.Join(directory, "busnum")
+	if err := os.WriteFile(path, []byte("12\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if got, err := readUSBNumber(path); err != nil || got != 12 {
+		t.Fatalf("readUSBNumber() = %d, %v, want 12, nil", got, err)
+	}
+	if err := os.WriteFile(path, []byte("0\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := readUSBNumber(path); err == nil {
+		t.Fatal("readUSBNumber(0) unexpectedly succeeded")
+	}
+}
+
+func TestWriteSysfsDoesNotCreateMissingPath(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "missing")
+	if err := writeSysfs(path, "value"); err == nil {
+		t.Fatal("writeSysfs(missing) unexpectedly succeeded")
+	}
+	if _, err := os.Stat(path); !os.IsNotExist(err) {
+		t.Fatalf("missing sysfs path was created: %v", err)
+	}
+}
+
+func TestRepairDJIQMIRequiresQMICLIBeforeUSBAccess(t *testing.T) {
+	t.Setenv("PATH", t.TempDir())
+
+	_, err := repairDJIQMI(context.Background())
+	if err == nil {
+		t.Fatal("repairDJIQMI() unexpectedly succeeded without qmicli")
+	}
+	if !strings.Contains(err.Error(), "qmicli is required") || !strings.Contains(err.Error(), "libqmi-utils") {
+		t.Fatalf("repairDJIQMI() error = %q, want an actionable qmicli prerequisite error", err)
+	}
+	if strings.Contains(err.Error(), "DTR repair attempt") || strings.Contains(err.Error(), "USB topology") {
+		t.Fatalf("repairDJIQMI() touched the repair path before checking qmicli: %v", err)
+	}
+}
+
+func TestDJISerialInterfaceLayout(t *testing.T) {
+	if djiFirstSerialIndex != 0 || djiLastSerialIndex != 3 || djiATIndex != 2 || djiQMIIndex != 4 {
+		t.Fatalf(
+			"DJI interface layout = serial %d-%d, AT %d, QMI %d; want serial 0-3, AT 2, QMI 4",
+			djiFirstSerialIndex,
+			djiLastSerialIndex,
+			djiATIndex,
+			djiQMIIndex,
+		)
+	}
+}
+
+func TestBindDJISerialInterfacesAlreadyCorrect(t *testing.T) {
+	root := t.TempDir()
+	sysRoot := filepath.Join(root, "sys")
+	devRoot := filepath.Join(root, "dev")
+	usbRoot := filepath.Join(sysRoot, "bus", "usb", "devices")
+	driversRoot := filepath.Join(sysRoot, "bus", "usb", "drivers")
+	optionRoot := filepath.Join(driversRoot, "option")
+	if err := os.MkdirAll(optionRoot, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	for index := djiFirstSerialIndex; index <= djiLastSerialIndex; index++ {
+		interfacePath := filepath.Join(usbRoot, fmt.Sprintf("1-1:1.%d", index))
+		if err := os.MkdirAll(filepath.Join(interfacePath, fmt.Sprintf("ttyUSB%d", index)), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.Symlink(optionRoot, filepath.Join(interfacePath, "driver")); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	interfaces, devices, atDevice, err := bindDJISerialInterfaces(
+		context.Background(),
+		sysRoot,
+		devRoot,
+		usbRoot,
+		driversRoot,
+		"1-1",
+	)
+	if err != nil {
+		t.Fatalf("bindDJISerialInterfaces() error = %v", err)
+	}
+	if len(interfaces) != 4 || interfaces[2] != "1-1:1.2" {
+		t.Fatalf("interfaces = %#v, want four interfaces with AT at 1-1:1.2", interfaces)
+	}
+	if len(devices) != 4 || devices[2] != filepath.Join(devRoot, "ttyUSB2") {
+		t.Fatalf("devices = %#v, want four devices with AT at ttyUSB2", devices)
+	}
+	if atDevice != filepath.Join(devRoot, "ttyUSB2") {
+		t.Fatalf("AT device = %q, want %q", atDevice, filepath.Join(devRoot, "ttyUSB2"))
+	}
+}
+
+func TestRetryDJIQMISucceedsAfterTransientFailures(t *testing.T) {
+	attempts := 0
+	result, err := retryDJIQMI(context.Background(), 3, time.Millisecond, func(context.Context) (djiQMIRepairResult, error) {
+		attempts++
+		if attempts < 3 {
+			return djiQMIRepairResult{}, errors.New("transient QMI timeout")
+		}
+		return djiQMIRepairResult{ControlDevice: "/dev/cdc-wdm0"}, nil
+	})
+	if err != nil {
+		t.Fatalf("retryDJIQMI() error = %v", err)
+	}
+	if attempts != 3 || result.Attempts != 3 {
+		t.Fatalf("attempts = %d, result.Attempts = %d, want 3", attempts, result.Attempts)
+	}
+}
+
+func TestRetryDJIQMIStopsAfterBoundedAttempts(t *testing.T) {
+	attempts := 0
+	_, err := retryDJIQMI(context.Background(), 2, time.Millisecond, func(context.Context) (djiQMIRepairResult, error) {
+		attempts++
+		return djiQMIRepairResult{}, errors.New("persistent failure")
+	})
+	if err == nil {
+		t.Fatal("retryDJIQMI() unexpectedly succeeded")
+	}
+	if attempts != 2 {
+		t.Fatalf("attempts = %d, want 2", attempts)
+	}
+}

cmd/vocat/doctor_dji_other.go

@@ -0,0 +1,12 @@
+//go:build !linux
+
+package main
+
+import (
+	"context"
+	"errors"
+)
+
+func repairDJIQMI(context.Context) (djiQMIRepairResult, error) {
+	return djiQMIRepairResult{}, errors.New("DJI QMI repair is supported only on Linux")
+}

cmd/vocat/doctor_test.go

@@ -0,0 +1,9 @@
+package main
+
+import "testing"
+
+func TestDoctorHelpIsSuccessful(t *testing.T) {
+	if err := runDoctor([]string{"--help"}); err != nil {
+		t.Fatalf("runDoctor(--help) error = %v", err)
+	}
+}

cmd/vocat/install_script_test.go

@@ -29,3 +29,29 @@ func TestInstallerValidatesDatabaseBeforeReplacingBinary(t *testing.T) {
 		t.Fatal("installer replaces the current binary before validating database compatibility")
 	}
 }
+
+func TestInstallerProvidesRequiredQMIUtilities(t *testing.T) {
+	scriptBytes, err := os.ReadFile("../../scripts/install.sh")
+	if err != nil {
+		t.Fatal(err)
+	}
+	script := string(scriptBytes)
+	for _, required := range []string{
+		"install_qmi_support()",
+		"command -v qmicli",
+		"command -v qmi-network",
+		"apt-get install -y libqmi-utils",
+		"dnf install -y libqmi-utils",
+		"pacman -Sy --noconfirm libqmi",
+		"apk add --no-cache qmi-utils",
+		"Could not install or find qmicli/qmi-network",
+	} {
+		if !strings.Contains(script, required) {
+			t.Errorf("installer is missing required QMI handling %q", required)
+		}
+	}
+	mainStart := strings.LastIndex(script, "# --- Main ")
+	if mainStart < 0 || !strings.Contains(script[mainStart:], "install_qmi_support") {
+		t.Error("installer does not install QMI utilities from its main path")
+	}
+}

cmd/vocat/main.go

@@ -41,7 +41,7 @@ import (
 )
 
 func main() {
-	logs := loghub.New(slog.NewJSONHandler(os.Stdout, nil), 2000)
+	logs := loghub.New(slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelDebug}), 2000)
 	logger := slog.New(logs)
 
 	args := os.Args[1:]
@@ -77,6 +77,16 @@ func main() {
 			logger.Error("update failed", "error", err)
 			os.Exit(1)
 		}
+	case "doctor":
+		if err := runDoctor(rest); err != nil {
+			logger.Error("doctor failed", "error", err)
+			os.Exit(1)
+		}
+	case "carrier":
+		if err := runCarrier(rest, os.Stdout); err != nil {
+			logger.Error("carrier command failed", "error", err)
+			os.Exit(1)
+		}
 	case "menu":
 		if err := runMenu(logger); err != nil {
 			logger.Error("menu failed", "error", err)
@@ -120,6 +130,10 @@ func run(logger *slog.Logger, logs *loghub.Hub) error {
 	if err != nil {
 		return fmt.Errorf("load configuration: %w", err)
 	}
+	carrierProfileDir := filepath.Join(filepath.Dir(cfg.DatabasePath), "carrier-profiles.d")
+	if err := vowifi.LoadCarrierProfileDirectory(carrierProfileDir); err != nil {
+		return fmt.Errorf("load installed carrier profiles: %w", err)
+	}
 	instanceLock, err := lockServerInstance(cfg.DatabasePath)
 	if err != nil {
 		return err
@@ -192,7 +206,8 @@ func run(logger *slog.Logger, logs *loghub.Hub) error {
 	}
 
 	cardReaders := pcsc.New()
-	deviceManager, err := device.NewManager(device.Options{CardReaders: cardReaders, Logger: logger})
+	deviceLogger := logger.With("category", "hardware")
+	deviceManager, err := device.NewManager(device.Options{CardReaders: cardReaders, Logger: deviceLogger})
 	if err != nil {
 		return fmt.Errorf("create device manager: %w", err)
 	}
@@ -213,7 +228,7 @@ func run(logger *slog.Logger, logs *loghub.Hub) error {
 	}()
 	pollContext, cancelPolling := context.WithCancel(context.Background())
 	defer cancelPolling()
-	go pollDeviceSnapshots(pollContext, logger, database, deviceManager)
+	go pollDeviceSnapshots(pollContext, deviceLogger, database, deviceManager)
 	go restoreConfiguredCellularData(pollContext, logger, database, deviceManager)
 	go collectCellularTraffic(pollContext, logger, database)
 	go persistLogsToStore(pollContext, logger, logs, database)
@@ -223,12 +238,20 @@ func run(logger *slog.Logger, logs *loghub.Hub) error {
 		go watchDeveloperDisable(pollContext, logger, database, deviceManager, exportProxyManager, legacyExportProxyConfig)
 	}
 
+	var onIncomingCall func(context.Context, ims.ReceivedCall) error
+
 	vowifiManager, err := configureVoWiFiRuntime(
 		startupContext,
 		logger,
 		database,
 		deviceManager,
 		cardReaders,
+		func(ctx context.Context, call ims.ReceivedCall) error {
+			if onIncomingCall != nil {
+				return onIncomingCall(ctx, call)
+			}
+			return nil
+		},
 	)
 	if err != nil {
 		return fmt.Errorf("configure VoWiFi runtime: %w", err)
@@ -262,10 +285,24 @@ func run(logger *slog.Logger, logs *loghub.Hub) error {
 	if err != nil {
 		return err
 	}
+	onIncomingCall = func(ctx context.Context, call ims.ReceivedCall) error {
+		deviceConfig, _ := database.Device(ctx, call.DeviceID)
+		handler.NotifyIncomingCall(ctx, server.IncomingCallNotification{
+			DeviceID:    call.DeviceID,
+			DeviceName:  strings.TrimSpace(deviceConfig.Name),
+			DeviceLabel: firstNonEmpty(deviceConfig.Name, deviceConfig.ID, "--"),
+			Caller:      call.Caller,
+			Called:      call.Called,
+			Time:        call.Timestamp,
+			Environment: "vowifi",
+		})
+		return nil
+	}
 	go handler.StartLogRetentionLoop(pollContext, time.Minute)
 	go handler.StartSMSSyncLoop(pollContext, 15*time.Second)
 	handler.StartTelegramBot(pollContext)
 	handler.StartSMSNotificationDispatchers(pollContext)
+	go handler.StartCellularCallMonitor(pollContext)
 	handler.StartAutomaticTasks(pollContext)
 
 	serverConfig := func(handler http.Handler) *http.Server {
@@ -561,6 +598,7 @@ func configureVoWiFiRuntime(
 	database *store.Store,
 	deviceManager *device.Manager,
 	cardReaders *pcsc.Service,
+	onIncomingCall func(context.Context, ims.ReceivedCall) error,
 ) (*vowifiruntime.Manager, error) {
 	mapper := integration.ATMapper{
 		Store:   database,
@@ -603,7 +641,7 @@ func configureVoWiFiRuntime(
 		Devices: mapper,
 	}
 	manager := vowifiruntime.New(vowifiruntime.Options{
-		Logger:  logger,
+		Logger:  logger.With("category", "vowifi"),
 		OnState: projector.Save,
 		Factory: func(factoryContext context.Context, deviceID string) (*vowifi.Orchestrator, error) {
 			deviceConfig, err := database.Device(factoryContext, deviceID)
@@ -616,7 +654,7 @@ func configureVoWiFiRuntime(
 			} else if deviceConfig.DeviceType == store.DeviceTypeWiFi410 {
 				adapter = nativeQMIAdapter
 			}
-			return newVoWiFiOrchestrator(deviceConfig, database, adapter, logger)
+			return newVoWiFiOrchestrator(deviceConfig, database, adapter, logger, onIncomingCall)
 		},
 	})
 
@@ -716,24 +754,27 @@ func newVoWiFiOrchestrator(
 	database *store.Store,
 	adapter vowifiDeviceAdapter,
 	logger *slog.Logger,
+	onIncomingCall func(context.Context, ims.ReceivedCall) error,
 ) (*vowifi.Orchestrator, error) {
 	apn := deviceConfig.APN
 	if apn == "" {
 		apn = "ims"
 	}
+	vowifiLogger := logger.With("category", "vowifi", "device_id", deviceConfig.ID)
 	tunnelProvider, err := ike.NewProvider(ike.Config{
-		APN: apn, Logger: logger, AutoProposalFallback: true,
+		APN: apn, Logger: vowifiLogger, AutoProposalFallback: true,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("device %q IKE provider: %w", deviceConfig.ID, err)
 	}
 	imsProvider, err := ims.NewProvider(adapter, ims.Config{
-		Logger: logger,
+		Logger: vowifiLogger,
 		// Carrier-specific transport and SMSC defaults live in the shared data
 		// profile. Prefer network-provided P-CSCF hints, then safely try the
 		// alternate transport only if no SIP response was observed.
 		Transport:             "tcp",
 		AutoTransportFallback: true,
+		OnIncomingCall:        onIncomingCall,
 		OnSMS: func(ctx context.Context, message ims.ReceivedSMS) error {
 			extra, _ := json.Marshal(map[string]any{
 				"transport":                "ims",
@@ -745,6 +786,7 @@ func newVoWiFiOrchestrator(
 				"service_center_timestamp": message.ServiceCenterTimestamp,
 				"raw_rpdu":                 message.RawRPDU,
 				"raw_tpdu":                 message.RawTPDU,
+				"decode_error":             message.DecodeError,
 			})
 			partsTotal := 1
 			if message.Concat != nil && message.Concat.Total > 0 {
@@ -809,6 +851,31 @@ func newVoWiFiOrchestrator(
 			// acknowledged, otherwise the SMSC will keep retransmitting it.
 			return nil
 		},
+		OnUSSD: func(ctx context.Context, message ims.ReceivedUSSD) error {
+			extra, _ := json.Marshal(map[string]any{
+				"transport":   "ims-ussd",
+				"dcs":         message.DCS,
+				"call_id":     message.CallID,
+				"received_at": message.Timestamp,
+				"raw_body":    message.RawBody,
+			})
+			_, saveErr := database.SaveSMSMessage(ctx, store.SMSMessage{
+				MessageID:  message.MessageID,
+				DeviceID:   message.DeviceID,
+				ModemIMEI:  deviceConfig.ModemIMEI,
+				IMSI:       message.IMSI,
+				Peer:       message.From,
+				Direction:  "inbound",
+				Body:       message.Text,
+				Timestamp:  message.Timestamp,
+				Status:     "received",
+				Source:     "ims-ussd",
+				PartsTotal: 1,
+				Read:       false,
+				Extra:      extra,
+			})
+			return saveErr
+		},
 	})
 	if err != nil {
 		return nil, fmt.Errorf("device %q IMS provider: %w", deviceConfig.ID, err)
@@ -918,6 +985,10 @@ func persistLogsToStore(
 			if !ok {
 				return
 			}
+			if loghub.IsHTTPAccessEntry(entry) {
+				continue
+			}
+			entry = loghub.SanitizeEntry(entry)
 			var fields json.RawMessage
 			if len(entry.Fields) > 0 {
 				if raw, err := json.Marshal(entry.Fields); err == nil {
@@ -1288,3 +1359,13 @@ func liftCardRegionBlock(
 		"device_id", id, "iccid", snapshot.ICCID, "imsi", snapshot.IMSI,
 	)
 }
+
+func firstNonEmpty(values ...string) string {
+	for _, value := range values {
+		value = strings.TrimSpace(value)
+		if value != "" {
+			return value
+		}
+	}
+	return ""
+}

docker-compose.yml

@@ -53,6 +53,9 @@ services:
 
     volumes:
       # SQLite database + persistent state.
+      # Note for NAS (e.g. QNAP Container Station / Synology): replace named volume
+      # with a host absolute path (e.g. /share/Container/vocat/data:/opt/vocat/data)
+      # to avoid volume isolation issues between bootstrap-admin and runtime.
       - vocat-data:/opt/vocat/data
       # Required for modem, MHI/WWAN and PC/SC USB-reader discovery, including
       # devices added after the container starts.

docs/README.ar.md

@@ -185,6 +185,11 @@ Quectel USB المدعومة (معرّف الشركة المصنعة USB `2c7c`)
 
 تُنشر صورة GHCR لـ `linux/amd64` و`linux/arm64`.
 
+> [!TIP]
+> **ملاحظة حول النشر على NAS / QNAP Container Station**:
+> في أنظمة NAS مثل QNAP QTS / QuTS hero (Container Station)، قد تؤدي حسابات المشرفين المخصصة وآليات عزل وحدات التخزين إلى توجيه وحدات تخزين Docker المسماة (مثل `-v vocat-data:/opt/vocat/data`) إلى مسارات معزولة مختلفة بين أمر التهيئة `bootstrap-admin` وحاوية الخدمة الرئيسية، مما يتسبب في ظهور خطأ في كلمة المرور عند تسجيل الدخول عبر الويب.
+> بالنسبة لبيئات NAS، يوصى بشدة باستبدال وحدات التخزين المسماة بربط مسار مطلق على المضيف (مثل `-v /share/Container/vocat/data:/opt/vocat/data` على QNAP) لكل من التهيئة والتشغيل لضمان استمرارية متسقة لقاعدة بيانات SQLite.
+
 ## الإعدادات
 
 يقرأ Vocat ملف إعدادات JSON اختياريًا من `VOCAT_CONFIG`، ثم يطبق متغيرات البيئة `VOCAT_*`. متغيرات البيئة لها الأولوية.

docs/README.es.md

@@ -187,6 +187,11 @@ dispositivos o de conexión en caliente.
 
 La imagen GHCR se publica para `linux/amd64` y `linux/arm64`.
 
+> [!TIP]
+> **Nota sobre el despliegue en NAS / QNAP Container Station**:
+> En sistemas NAS como QNAP QTS / QuTS hero (Container Station), las cuentas de administrador personalizadas y el aislamiento de volúmenes pueden hacer que los volúmenes con nombre de Docker (ej. `-v vocat-data:/opt/vocat/data`) se resuelvan en rutas aisladas distintas entre la inicialización `bootstrap-admin` y el contenedor del servicio principal, provocando errores de contraseña incorrecta al iniciar sesión en la interfaz web.
+> En entornos NAS, se recomienda encarecidamente sustituir los volúmenes con nombre por un montaje bind con ruta absoluta del host (ej. `-v /share/Container/vocat/data:/opt/vocat/data` en QNAP) tanto para la inicialización como para la ejecución, garantizando la persistencia coherente de la base de datos SQLite.
+
 ## Configuración
 
 Vocat lee un archivo de configuración JSON opcional desde `VOCAT_CONFIG` y luego aplica las variables de entorno `VOCAT_*`. Las variables de entorno tienen prioridad.

docs/README.fr.md

@@ -187,6 +187,11 @@ pas une découverte multi-périphériques ou à chaud complète.
 
 L'image GHCR est publiée pour `linux/amd64` et `linux/arm64`.
 
+> [!TIP]
+> **Note de déploiement NAS / QNAP Container Station** :
+> Sur les systèmes NAS tels que QNAP QTS / QuTS hero (Container Station), les comptes administrateurs personnalisés et les mécanismes d'isolation de volumes peuvent faire en sorte que les volumes nommés Docker (ex. `-v vocat-data:/opt/vocat/data`) soient résolus vers des chemins isolés différents entre l'initialisation unique `bootstrap-admin` et le conteneur de service principal, entraînant des erreurs de mot de passe incorrect sur l'interface Web.
+> Pour les environnements NAS, il est fortement recommandé de remplacer les volumes nommés par un montage bind avec chemin absolu de l'hôte (ex. `-v /share/Container/vocat/data:/opt/vocat/data` sur QNAP) pour l'initialisation et l'exécution afin de garantir une persistance cohérente de la base de données SQLite.
+
 ## Configuration
 
 Vocat lit un fichier de configuration JSON optionnel depuis `VOCAT_CONFIG`, puis applique les variables d'environnement `VOCAT_*`. Les variables d'environnement ont la priorité.

docs/README.ja.md

@@ -169,6 +169,11 @@ docker run -d \
 
 GHCR イメージは `linux/amd64` と `linux/arm64` 向けに公開されています。
 
+> [!TIP]
+> **NAS / QNAP Container Station デプロイ時の注意点**:
+> QNAP QTS / QuTS hero (Container Station) などの NAS 環境では、非 root カスタム管理者権限とボリューム分離メカニズムにより、Docker の名前付きボリューム（例: `-v vocat-data:/opt/vocat/data`）を使用すると、初回の `bootstrap-admin` 初期化時とデーモン起動時で異なる隔離パスに書き込まれ、Web ログイン時にパスワードエラーとなる場合があります。
+> NAS 環境では、初期化と常駐コンテナの両方で名前付きボリュームの代わりにホストの絶対パスバインドマウント（例: QNAP の `-v /share/Container/vocat/data:/opt/vocat/data`）を使用することを推奨します。
+
 ## 設定
 
 Vocat は `VOCAT_CONFIG` からオプションの JSON 設定ファイルを読み込み、次に `VOCAT_*` 環境変数を適用します。環境変数が優先されます。

docs/README.ru.md

@@ -186,6 +186,11 @@ TUN, настройки сети и устройств, добавленных
 
 Образ GHCR публикуется для `linux/amd64` и `linux/arm64`.
 
+> [!TIP]
+> **Примечание по развертыванию на NAS / QNAP Container Station**:
+> В системах NAS, таких как QNAP QTS / QuTS hero (Container Station), из-за нестандартных прав администратора и механизмов изоляции томов именованные тома Docker (например, `-v vocat-data:/opt/vocat/data`) могут разрешаться в разные изолированные пути между выполнением команды `bootstrap-admin` и основным контейнером службы, что приводит к ошибкам неверного пароля при входе через веб-интерфейс.
+> Для сред NAS настоятельно рекомендуется использовать монтирование с абсолютным путем хоста (например, `-v /share/Container/vocat/data:/opt/vocat/data` на QNAP) как для инициализации, так и для запуска службы, чтобы гарантировать согласованность базы данных SQLite.
+
 ## Конфигурация
 
 Vocat читает необязательный JSON-файл конфигурации из `VOCAT_CONFIG`, затем применяет переменные окружения `VOCAT_*`. Переменные окружения имеют приоритет.

docs/README.zh-CN.md

@@ -92,6 +92,13 @@ sudo bash install.sh 0.0.2
 
 VoWiFi IMS 必须使用 Linux XFRM/IPsec。OpenWrt/Kwrt 上安装脚本会从当前固件自己的软件源尝试安装严格匹配的 `ip-full`、`kmod-ipsec`、`kmod-ipsec4/6`、`kmod-crypto-authenc`、AES-CBC 和 SHA1 组件。若软件源没有与当前内核匹配的模块，必须更换包含这些组件的固件，禁止强装其他内核版本的 kmod。
 
+如果你的内核确实无法提供 XFRM/IPsec，且仅需要非 VoWiFi 功能（蜂窝短信、数据等），可在安装时加上 `--skip-vowifi-check`：
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/MengMengCode/VoCat/master/scripts/install.sh -o install.sh
+sudo bash install.sh --skip-vowifi-check
+```
+
 安装程序会:
 
 - 检测 `amd64`、`386`、`arm64` 或 `armv7` 架构;
@@ -168,6 +175,11 @@ docker run -d \
 
 GHCR 镜像发布为 `linux/amd64` 与 `linux/arm64`。
 
+> [!TIP]
+> **NAS / 威联通 (QNAP Container Station) 部署说明**：
+> 在威联通等 NAS 系统的 Container Station 下部署时，由于系统的非 Root 自定义管理员权限与卷隔离机制，使用 Docker 命名卷（如 `-v vocat-data:/opt/vocat/data`）在执行一次性初始化 `bootstrap-admin` 和启动常驻服务时，两者的卷极易被解析至不同的隔离路径，导致 Web 端登录时提示密码错误。
+> 建议在 NAS 环境下部署时，将 `-v vocat-data:/opt/vocat/data` 替换为宿主机的绝对路径挂载（例如威联通上的 `-v /share/Container/vocat/data:/opt/vocat/data`），以确保初始化与运行期读写同一个 SQLite 数据库文件。
+
 ### USB SIM 读卡器
 
 USB SIM 读卡器通过 Linux PC/SC 服务访问。一键安装脚本会在支持的软件包管理器上
@@ -175,6 +187,16 @@ USB SIM 读卡器通过 Linux PC/SC 服务访问。一键安装脚本会在支
 `apt install pcscd libccid`。如果 USB 已识别 CCID 读卡器但 PC/SC 尚未就绪，
 VoCat 会继续在添加设备窗口显示该硬件，并明确提示缺少服务或驱动，不再静默隐藏。
 
+### QMI 命令行工具
+
+VoCat 使用 `qmicli` 验证 QMI 控制通道是否就绪，并使用 `qmi-network` 管理
+分组数据会话。一键安装脚本会自动安装并验证对应工具。手动部署时，
+Debian/Ubuntu 使用 `apt install libqmi-utils`；Arch Linux 使用
+`pacman -S libqmi`，Alpine 使用 `apk add qmi-utils`，OpenWrt 使用 `opkg install qmi-utils`。
+
+`vocat doctor --repair-dji-qmi` 会在修改 USB 驱动绑定或触发 DTR 之前检查
+`qmicli`。如果工具不可用，命令会给出安装提示并停止，保持设备当前状态不变。
+
 ## 配置
 
 Vocat 先从 `VOCAT_CONFIG` 读取可选的 JSON 配置文件,再应用 `VOCAT_*` 环境变量。环境变量优先级更高。
@@ -195,6 +217,25 @@ Vocat 先从 `VOCAT_CONFIG` 读取可选的 JSON 配置文件,再应用 `VOCAT_*
 
 请勿将 Telegram token、SMTP 密码、Webhook 密钥、SIM 凭据或其他私密数据存放在仓库中。请通过应用设置或受保护的环境文件来配置它们。
 
+## Apple IPCC 运营商规则导入
+
+VoCat 可以离线解析用户提供的 `.ipcc`，将 Apple 的 XML/二进制 plist
+转换为可审查的运营商 Profile。默认只预览，不会修改配置：
+
+```bash
+vocat carrier import-ipcc Carrier_iPhone.ipcc
+```
+
+确认警告和匹配范围后，使用 `--install` 安装；重启 VoCat 后生效：
+
+```bash
+vocat carrier import-ipcc --install Carrier_iPhone.ipcc
+```
+
+导入器不会复制关闭证书验证、绕过运营商授权、APN 凭据、紧急呼叫或
+设备型号专属媒体参数。完整字段和冲突处理说明见
+[CARRIER_IPCC_IMPORT.md](CARRIER_IPCC_IMPORT.md)。
+
 ## Telegram 机器人
 
 启用 Telegram 通知并配置好 Chat ID 与 Admin ID 后,机器人支持:

docs/README.zh-TW.md

@@ -169,6 +169,11 @@ docker run -d \
 
 GHCR 映像發佈為 `linux/amd64` 與 `linux/arm64`。
 
+> [!TIP]
+> **NAS / 威聯通 (QNAP Container Station) 部署說明**：
+> 在威聯通等 NAS 系統的 Container Station 下部署時，由於系統的非 Root 自訂管理員權限與磁碟區隔離機制，使用 Docker 具名磁碟區（如 `-v vocat-data:/opt/vocat/data`）在執行一次性初始化 `bootstrap-admin` 與啟動常駐服務時，兩者的磁碟區極易被解析至不同的隔離路徑，導致 Web 端登入時提示密碼錯誤。
+> 建議在 NAS 環境下部署時，將 `-v vocat-data:/opt/vocat/data` 替換為宿主機的絕對路徑掛載（例如威聯通上的 `-v /share/Container/vocat/data:/opt/vocat/data`），以確保初始化與執行期讀寫同一個 SQLite 資料庫檔案。
+
 ## 配置
 
 Vocat 先從 `VOCAT_CONFIG` 讀取可選的 JSON 配置檔,再套用 `VOCAT_*` 環境變數。環境變數優先級更高。

docs/superpowers/plans/2026-08-11-wecom-notification.md

@@ -1,383 +0,0 @@
-# 企业微信消息推送实现计划
-
-> **面向 AI 代理的工作者：** 必需子技能：使用 superpowers:subagent-driven-development（推荐）或 superpowers:executing-plans 逐任务实现此计划。步骤使用复选框（`- [ ]`）语法来跟踪进度。
-
-**目标：** 增加可配置 JSON 请求模板的企业微信 Webhook 通知通道，向新短信和自动任务结果发送消息。
-
-**架构：** 新建专注的企业微信通知模块，统一构建事件变量、JSON 安全替换、Webhook POST 和 `errcode` 响应判定。设置 API 将 `wecom` 纳入白名单、保密 URL 与连通性测试；短信和自动任务分发器只增加该通道分支。前端在现有通知设置表单中新增企业微信页签和请求体编辑器。
-
-**技术栈：** Go 1.25、标准库 `net/http` 与 `encoding/json`、SQLite 通知设置、React、TypeScript、Vite。
-
----
-
-## 文件结构
-
-- 创建：`internal/server/wecom_notification.go`，渲染企业微信 JSON 模板、创建安全 HTTP 请求并判定企业微信响应。
-- 创建：`internal/server/wecom_notification_test.go`，覆盖 JSON 转义、模板拒绝和企业微信响应失败。
-- 修改：`internal/server/settings_api.go`，登记 `wecom` 配置字段、启用连通性测试并调用企业微信发送器。
-- 修改：`internal/server/settings_api_test.go`，验证企业微信配置 API、敏感 URL 与测试路径。
-- 修改：`internal/store/settings.go`，将 `wecom.urls` 注册为敏感字段。
-- 修改：`internal/server/sms_notifications.go`，将新短信事件接入企业微信通道。
-- 修改：`internal/server/sms_notifications_test.go`，覆盖企业微信短信配置要求和变量数据。
-- 修改：`internal/server/automatic_task_notifications.go`，将自动任务结果接入企业微信通道。
-- 修改：`web/src/types.ts`，扩展通知设置类型。
-- 修改：`web/src/components/settings/model.ts`，增加企业微信表单、默认模板、读取和提交映射。
-- 修改：`web/src/components/settings/PushTabs.tsx`，新增企业微信配置界面。
-- 修改：`web/src/pages/SettingsPage.tsx`，增加页签、测试状态与测试请求。
-
-### 任务 1：企业微信模板与响应判定
-
-**文件：**
-- 创建：`internal/server/wecom_notification_test.go`
-- 创建：`internal/server/wecom_notification.go`
-
-- [ ] **步骤 1：编写失败的模板与响应测试**
-
-```go
-func TestRenderWecomPayloadEscapesTemplateValues(t *testing.T) {
-    payload, err := renderWecomPayload(
-        `{"msgtype":"text","text":{"content":{{message}},"number":{{number}}}}`,
-        wecomTemplateValues{"message": "quote: \\"\\nline", "number": "+447386"},
-    )
-    if err != nil { t.Fatal(err) }
-    if got := string(payload); got != `{"msgtype":"text","text":{"content":"quote: \\"\\nline","number":"+447386"}}` {
-        t.Fatalf("payload = %s", got)
-    }
-}
-
-func TestRenderWecomPayloadRejectsUnknownVariableAndNonObject(t *testing.T) {
-    for _, template := range []string{`{"text":{{unknown}}}`, `[]`} {
-        if _, err := renderWecomPayload(template, wecomTemplateValues{}); err == nil {
-            t.Fatalf("template %q was accepted", template)
-        }
-    }
-}
-
-func TestValidateWecomResponseRejectsProviderError(t *testing.T) {
-    if err := validateWecomResponse(http.StatusOK, []byte(`{"errcode":40058,"errmsg":"invalid"}`)); !errors.Is(err, errProviderRejected) {
-        t.Fatalf("error = %v", err)
-    }
-}
-```
-
-- [ ] **步骤 2：运行测试验证失败**
-
-运行：`go test ./internal/server -run 'TestRenderWecomPayload|TestValidateWecomResponse' -count=1`
-
-预期：FAIL，提示 `renderWecomPayload`、`wecomTemplateValues` 和 `validateWecomResponse` 未定义。
-
-- [ ] **步骤 3：实现最少的模板与响应代码**
-
-在 `internal/server/wecom_notification.go` 中定义受支持变量列表，先用 `json.Marshal` 编码每个字符串，再替换精确的 `{{name}}` 标记；若保留任何 `{{` 或 `}}`，或者 `json.Unmarshal` 后不是非空 `map[string]json.RawMessage`，返回错误。响应处理必须要求 HTTP 2xx、可解析 JSON，且 `errcode` 为零。
-
-```go
-type wecomTemplateValues map[string]string
-
-func renderWecomPayload(template string, values wecomTemplateValues) ([]byte, error) {
-    for _, name := range wecomTemplateVariableNames {
-        encoded, _ := json.Marshal(values[name])
-        template = strings.ReplaceAll(template, "{{"+name+"}}", string(encoded))
-    }
-    if strings.Contains(template, "{{") || strings.Contains(template, "}}") {
-        return nil, errors.New("wecom.payload_template contains an unsupported variable")
-    }
-    var payload map[string]json.RawMessage
-    if err := json.Unmarshal([]byte(template), &payload); err != nil || len(payload) == 0 {
-        return nil, errors.New("wecom.payload_template must render to a non-empty JSON object")
-    }
-    return []byte(template), nil
-}
-
-func validateWecomResponse(status int, body []byte) error {
-    var result struct { ErrCode int `json:"errcode"` }
-    if status < http.StatusOK || status >= http.StatusMultipleChoices || json.Unmarshal(body, &result) != nil || result.ErrCode != 0 {
-        return fmt.Errorf("%w: WeCom response was not successful", errProviderRejected)
-    }
-    return nil
-}
-
-func wecomTestValues(now time.Time) wecomTemplateValues {
-    return wecomTemplateValues{
-        "event": "test", "title": "vocat", "message": "vocat notification test",
-        "timestamp": now.UTC().Format(time.RFC3339),
-    }
-}
-
-func sendWecomNotification(ctx context.Context, config map[string]any, values wecomTemplateValues) error {
-    payload, err := renderWecomPayload(configString(config, "payload_template"), values)
-    if err != nil { return err }
-    client, err := restrictedHTTPClient(ctx, 8*time.Second, "")
-    if err != nil { return err }
-    for _, destination := range configStrings(config, "urls") {
-        parsed, err := validateOutboundURL(ctx, destination, false)
-        if err != nil { return err }
-        request, err := http.NewRequestWithContext(ctx, http.MethodPost, parsed.String(), bytes.NewReader(payload))
-        if err != nil { return fmt.Errorf("create WeCom notification request: %w", err) }
-        request.Header.Set("Content-Type", "application/json; charset=utf-8")
-        request.Header.Set("User-Agent", "vocat-wecom-notification/1")
-        response, err := client.Do(request)
-        if err != nil { return fmt.Errorf("send WeCom notification: %w", err) }
-        body, readErr := io.ReadAll(io.LimitReader(response.Body, 64<<10)); response.Body.Close()
-        if readErr != nil { return fmt.Errorf("read WeCom response: %w", readErr) }
-        if err := validateWecomResponse(response.StatusCode, body); err != nil { return err }
-    }
-    return nil
-}
-```
-
-- [ ] **步骤 4：运行测试验证通过**
-
-运行：`go test ./internal/server -run 'TestRenderWecomPayload|TestValidateWecomResponse' -count=1`
-
-预期：PASS。
-
-- [ ] **步骤 5：提交本任务**
-
-运行：`git add internal/server/wecom_notification.go internal/server/wecom_notification_test.go && git commit -m "feat: add WeCom payload renderer"`
-
-预期：创建包含模板渲染和响应判定的提交。若 Git 作者身份仍未配置，停止提交但保留已验证的工作区改动，不自行设置身份。
-
-### 任务 2：设置 API 与敏感 Webhook URL
-
-**文件：**
-- 修改：`internal/server/settings_api_test.go`
-- 修改：`internal/store/settings.go`
-- 修改：`internal/server/settings_api.go`
-
-- [ ] **步骤 1：编写失败的 API 测试**
-
-```go
-func TestWecomNotificationSettingsPreserveWebhookURLs(t *testing.T) {
-    test := newSettingsAPITest(t)
-    body := `{"wecom":{"enabled":true,"urls":["https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=secret"],"payload_template":"{\\\"msgtype\\\":\\\"text\\\",\\\"text\\\":{\\\"content\\\":{{message}}}}"}}`
-    recorder := test.request(t, http.MethodPut, "/api/settings/notifications", body)
-    if recorder.Code != http.StatusOK { t.Fatalf("status = %d", recorder.Code) }
-    if bytes.Contains(recorder.Body.Bytes(), []byte("key=secret")) { t.Fatal("response leaked webhook URL") }
-    stored, err := test.database.NotificationSetting(context.Background(), "wecom")
-    if err != nil || !bytes.Contains(stored.Config, []byte("key=secret")) { t.Fatalf("stored = %s, err = %v", stored.Config, err) }
-}
-
-func TestWecomNotificationSettingsRejectMalformedTemplate(t *testing.T) {
-    test := newSettingsAPITest(t)
-    recorder := test.request(t, http.MethodPut, "/api/settings/notifications", `{"wecom":{"enabled":true,"urls":["https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=x"],"payload_template":"[]"}}`)
-    if recorder.Code != http.StatusBadRequest { t.Fatalf("status = %d", recorder.Code) }
-}
-```
-
-- [ ] **步骤 2：运行测试验证失败**
-
-运行：`go test ./internal/server -run 'TestWecomNotificationSettings' -count=1`
-
-预期：FAIL，设置 API 返回 `invalid_notification_channel`。
-
-- [ ] **步骤 3：实现 API 契约、保存和测试端点**
-
-在 `notificationChannels` 中加入 `wecom`，在 `notificationFields` 中登记 `urls: strings` 和 `payload_template: wecom_template`。将 `urls` 加入 `DefaultNotificationSensitiveFields("wecom")`。在字段验证中对 `wecom_template` 调用 `renderWecomPayload`，以默认测试变量确认模板会生成对象；在 `validateNotificationTestConfig`、`handleNotificationTest` 和发送分支中支持 `wecom`。
-
-```go
-"wecom": {"urls": "strings", "payload_template": "wecom_template"},
-
-case "wecom":
-    return []string{"urls"}
-
-case "wecom":
-    err = sendWecomNotificationTest(r.Context(), resolved)
-```
-
-将上段 `payload_template` 的字段类型实现为 `wecom_template`，避免只按普通字符串检查：
-
-```go
-case "wecom_template":
-    var template string
-    if err := json.Unmarshal(raw, &template); err != nil || len(template) > 32768 {
-        return fmt.Errorf("%s must be a template string", field)
-    }
-    _, err := renderWecomPayload(template, wecomTestValues(time.Unix(0, 0)))
-    return err
-
-case "wecom":
-    if len(configStrings(config, "urls")) == 0 || configString(config, "payload_template") == "" {
-        return errors.New("wecom.urls and wecom.payload_template are required")
-    }
-```
-
-测试消息的变量必须为 `event: "test"`、`title: "vocat"`、`message: "vocat notification test"` 和当前 UTC RFC3339 时间；它应经过与生产消息完全相同的渲染和发送路径。
-
-- [ ] **步骤 4：运行测试验证通过**
-
-运行：`go test ./internal/server -run 'TestWecomNotificationSettings|TestNotificationSettingsAlwaysReturns' -count=1`
-
-预期：PASS，GET/PUT 响应不会泄露 `key`，但数据库保留原 URL。
-
-- [ ] **步骤 5：提交本任务**
-
-运行：`git add internal/server/settings_api.go internal/server/settings_api_test.go internal/store/settings.go && git commit -m "feat: configure WeCom notifications"`
-
-预期：创建设置 API 与敏感配置提交；作者身份未配置时遵循任务 1 的处理方式。
-
-### 任务 3：接入短信与自动任务分发
-
-**文件：**
-- 修改：`internal/server/sms_notifications_test.go`
-- 修改：`internal/server/sms_notifications.go`
-- 修改：`internal/server/automatic_task_notifications.go`
-
-- [ ] **步骤 1：编写失败的事件变量测试**
-
-```go
-func TestWecomSMSValuesIncludeRenderedSMSFields(t *testing.T) {
-    message := smsNotification{DeviceID: "device-1", DeviceName: "客厅", DeviceLabel: "EC20", Number: "+447386", Time: time.Unix(1700000000, 0), Content: "hello"}
-    values := wecomSMSValues(message)
-    if values["event"] != "sms.received" || values["content"] != "hello" || values["device_label"] != "EC20" {
-        t.Fatalf("values = %#v", values)
-    }
-}
-
-func TestWecomAutomaticTaskValuesLeaveSMSFieldsEmpty(t *testing.T) {
-    values := wecomAutomaticTaskValues(automaticTaskNotification{Title: "自动任务执行成功", Text: "任务已完成", Time: time.Unix(1700000000, 0)})
-    if values["event"] != "automatic_task.completed" || values["message"] != "任务已完成" || values["number"] != "" {
-        t.Fatalf("values = %#v", values)
-    }
-}
-```
-
-- [ ] **步骤 2：运行测试验证失败**
-
-运行：`go test ./internal/server -run 'TestWecomSMSValues|TestWecomAutomaticTaskValues' -count=1`
-
-预期：FAIL，两个事件变量构建函数未定义。
-
-- [ ] **步骤 3：实现分发接入**
-
-在企业微信模块中实现 `wecomSMSValues` 和 `wecomAutomaticTaskValues`，填充全部已声明变量，短信专属字段在自动任务事件中设为空字符串。然后将 `wecom` 加入以下分发列表与 switch：
-
-```go
-var smsOnlyNotificationChannels = []string{"bark", "email", "pushplus", "webhook", "wecom"}
-
-case "wecom":
-    return sendWecomNotification(ctx, config, wecomSMSValues(message))
-```
-
-```go
-channels := []string{"telegram", "bark", "email", "pushplus", "webhook", "wecom"}
-for _, channel := range channels {
-    setting, err := s.store.NotificationSetting(ctx, channel)
-    if errors.Is(err, store.ErrNotFound) || (err == nil && !setting.Enabled) { continue }
-    if err != nil { s.logger.Warn("read automatic task notification setting", "channel", channel, "error", err); continue }
-    var config map[string]any
-    if err := json.Unmarshal(setting.Config, &config); err != nil { s.logger.Warn("decode automatic task notification setting", "channel", channel, "error", err); continue }
-    if err := sendAutomaticTaskNotification(ctx, channel, config, notification); err != nil { s.logger.Warn("send automatic task notification", "channel", channel, "task_id", task.ID, "error", err) }
-}
-
-case "wecom":
-    return sendWecomNotification(ctx, config, wecomAutomaticTaskValues(message))
-```
-
-保持既有游标、错误限流日志和其他通道的行为不变。
-
-- [ ] **步骤 4：运行测试验证通过**
-
-运行：`go test ./internal/server -run 'TestWecomSMSValues|TestWecomAutomaticTaskValues|TestValidateSMSNotificationConfig' -count=1`
-
-预期：PASS，`validateSMSNotificationConfig` 也接受包含有效 URL 和模板的 `wecom` 配置。
-
-- [ ] **步骤 5：提交本任务**
-
-运行：`git add internal/server/wecom_notification.go internal/server/sms_notifications.go internal/server/sms_notifications_test.go internal/server/automatic_task_notifications.go && git commit -m "feat: dispatch WeCom notifications"`
-
-预期：创建两类事件分发接入提交；作者身份未配置时遵循任务 1 的处理方式。
-
-### 任务 4：企业微信配置界面
-
-**文件：**
-- 修改：`web/src/types.ts`
-- 修改：`web/src/components/settings/model.ts`
-- 修改：`web/src/components/settings/PushTabs.tsx`
-- 修改：`web/src/pages/SettingsPage.tsx`
-
-- [ ] **步骤 1：扩展前端类型和表单映射**
-
-在 `NotificationSettings` 与 `NotifyForms` 中增加 `wecom`。新增以下表单类型和默认请求体；URL 数组保持一项一个输入行的既有 `UrlListEditor` 约定。
-
-```ts
-export interface WecomForm {
-  enabled: boolean;
-  urls: string[];
-  payloadTemplate: string;
-}
-
-const DEFAULT_WECOM_PAYLOAD_TEMPLATE = `{
-  "msgtype": "text",
-  "text": { "content": {{message}} }
-}`;
-```
-
-`formsFromNotifications` 读取 `payload_template`，`buildNotificationsPayload` 输出 `payload_template`，测试请求则修剪并移除空 URL。
-
-- [ ] **步骤 2：实现企业微信页签与测试请求**
-
-在 `PushTabs.tsx` 增加 `WecomTab`，显示启用开关、`UrlListEditor`、JSON `Textarea` 和变量说明。URL 列表文案必须明确“每个 Webhook URL 单独一行，点击添加 URL 增加”，不得提示使用分隔符。
-
-```tsx
-<Field label={t("JSON 请求体模板")} hint={<span>变量必须作为 JSON 值使用，例如 <code>{'{{message}}'}</code>。</span>}>
-  <Textarea value={value.payloadTemplate} onChange={(event) => onChange({ payloadTemplate: event.target.value })} disabled={off} rows={12} />
-</Field>
-```
-
-在 `SettingsPage.tsx` 增加 `testingWecom`、`onTestWecom`、企业微信页签与组件渲染。测试请求使用 `POST /settings/notifications/wecom/test` 和企业微信表单 payload；成功与失败消息沿用现有通知测试模式。
-
-- [ ] **步骤 3：运行前端构建验证**
-
-运行：`npm run build`
-
-工作目录：`web`
-
-预期：Vite 类型检查与生产构建均以退出码 0 完成。
-
-- [ ] **步骤 4：提交本任务**
-
-运行：`git add web/src/types.ts web/src/components/settings/model.ts web/src/components/settings/PushTabs.tsx web/src/pages/SettingsPage.tsx && git commit -m "feat: add WeCom notification settings"`
-
-预期：创建企业微信设置 UI 提交；作者身份未配置时遵循任务 1 的处理方式。
-
-### 任务 5：完整验证
-
-**文件：**
-- 修改：`internal/server/wecom_notification.go`
-- 修改：`internal/server/wecom_notification_test.go`
-- 修改：`internal/server/settings_api.go`
-- 修改：`internal/server/settings_api_test.go`
-- 修改：`internal/store/settings.go`
-- 修改：`internal/server/sms_notifications.go`
-- 修改：`internal/server/sms_notifications_test.go`
-- 修改：`internal/server/automatic_task_notifications.go`
-- 修改：`web/src/types.ts`
-- 修改：`web/src/components/settings/model.ts`
-- 修改：`web/src/components/settings/PushTabs.tsx`
-- 修改：`web/src/pages/SettingsPage.tsx`
-
-- [ ] **步骤 1：格式化 Go 代码**
-
-运行：`gofmt -w internal/server/wecom_notification.go internal/server/wecom_notification_test.go internal/server/settings_api.go internal/server/settings_api_test.go internal/server/sms_notifications.go internal/server/sms_notifications_test.go internal/server/automatic_task_notifications.go internal/store/settings.go`
-
-预期：所有修改的 Go 文件采用项目标准格式。
-
-- [ ] **步骤 2：运行前端生产构建**
-
-运行：`npm run build`
-
-工作目录：`web`
-
-预期：退出码 0，并生成 `web/dist` 供 Go 的嵌入资源使用。
-
-- [ ] **步骤 3：运行后端回归测试**
-
-运行：`go test ./...`
-
-预期：所有目标包通过，无失败测试；`cmd/vocat` 和 `web` 包从步骤 2 生成的 `web/dist` 读取嵌入资源。
-
-- [ ] **步骤 4：检查最终变更**
-
-运行：`git diff --check && git status --short`
-
-预期：无空白错误；变更仅限企业微信通知、其测试与设计/计划文档。

docs/superpowers/specs/2026-08-11-wecom-notification-design.md

@@ -1,55 +0,0 @@
-# 企业微信消息推送设计
-
-## 目标
-
-新增独立的 `wecom` 通知通道，通过企业微信“消息推送（原群机器人）”Webhook 推送新收到的短信和自动任务执行结果。外部 API 契约与既有通知通道保持一致。
-
-## 配置模型
-
-`wecom` 配置包含：
-
-- `enabled`：是否启用通道。
-- `urls`：一个或多个企业微信消息推送 Webhook URL。Web 设置页将每个 URL
-  显示为独立输入行，通过“添加 URL”按钮新增输入行、通过删除按钮移除输入行；
-  不使用逗号、空格或换行分隔多个 URL。
-- `payload_template`：完整 JSON 请求体模板。
-
-Webhook URL 含有企业微信访问密钥，必须作为敏感配置存储、在读取接口中脱敏，并在日志和错误信息中避免泄露。URL 沿用现有出站 URL 校验与 SSRF 防护。
-
-## 模板语义
-
-用户在 Web 设置页编辑完整 JSON 请求体，以选择企业微信支持的任意消息格式，例如 `text`、`markdown`、`news` 或 `template_card`。
-
-模板变量仅能作为 JSON 值出现，服务端使用 JSON 编码后的字符串替换，调用方不得在变量外添加引号。示例：
-
-```json
-{
-  "msgtype": "text",
-  "text": {
-    "content": {{message}}
-  }
-}
-```
-
-可用变量：
-
-- 通用：`{{event}}`、`{{title}}`、`{{message}}`、`{{timestamp}}`。
-- 短信事件：`{{content}}`、`{{number}}`、`{{device_id}}`、`{{device_name}}`、`{{device_label}}`、`{{time}}`。
-
-自动任务使用通用变量；短信专属变量在自动任务中替换为空字符串。模板渲染后必须为非空 JSON 对象，不得保留模板变量；无效模板在保存和测试时拒绝。
-
-## 发送流程
-
-短信分发器为 `wecom` 维护独立游标，发送失败不会阻塞其他通知渠道。自动任务完成后，和 Telegram、Bark、邮件、PushPlus、通用 Webhook 一样，向已启用的 `wecom` 通道发送结果。
-
-发送器逐一 POST 渲染后的 JSON 到所有配置 URL，使用现有受限 HTTP 客户端。除 HTTP 2xx 外，企业微信返回 JSON 的 `errcode` 非零也视为服务商拒绝。
-
-## Web 与 API
-
-设置 API 将 `wecom` 加入已知通道和配置字段白名单，并提供 `POST /api/settings/notifications/wecom/test`。Web 设置页新增“企业微信”页签、启用开关、逐行编辑的 Webhook URL 列表、JSON 模板编辑器和测试按钮。
-
-默认模板使用 `text` 消息，发送一条可辨识的测试内容。
-
-## 验证
-
-后端测试覆盖：配置字段验证、模板的 JSON 转义和拒绝无效模板、企业微信请求载荷、非零 `errcode` 失败处理、通知设置 API 读写与敏感 Webhook URL 保留。前端构建用于验证新增表单与类型契约。

go.mod

@@ -5,10 +5,13 @@ go 1.25.0
 require (
 	github.com/coder/websocket v1.8.15
 	github.com/iniwex5/quectel-qmi-go v0.6.0
+	github.com/warthog618/sms v0.3.0
 	go.bug.st/serial v1.6.4
 	golang.org/x/crypto v0.52.0
 	golang.org/x/sys v0.47.0
 	golang.org/x/term v0.43.0
+	golang.org/x/text v0.41.0
+	howett.net/plist v1.0.1
 	modernc.org/sqlite v1.38.2
 )
 
@@ -20,7 +23,6 @@ require (
 	github.com/ncruces/go-strftime v0.1.9 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/stretchr/testify v1.10.0 // indirect
-	github.com/warthog618/sms v0.3.0 // indirect
 	golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect
 	modernc.org/libc v1.66.3 // indirect
 	modernc.org/mathutil v1.7.1 // indirect

go.sum

@@ -13,6 +13,7 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/iniwex5/quectel-qmi-go v0.6.0 h1:zWZc9jeNMy7+USFRBbfdShnjzSryyYnCw7NPw4ubaIg=
 github.com/iniwex5/quectel-qmi-go v0.6.0/go.mod h1:6AlSY+Yj4MqJOsZ8cNrq99AzT9MlaopADnJtSRiyAfE=
+github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
@@ -45,14 +46,19 @@ golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
 golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/tools v0.34.0 h1:qIpSLOxeCYGg9TrcJokLBG4KFA6d795g0xkBkiESGlo=
 golang.org/x/tools v0.34.0/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0/go.mod h1:WDnlLJ4WF5VGsH/HVa3CI79GS0ol3YnhVnKP89i0kNg=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+howett.net/plist v1.0.1 h1:37GdZ8tP09Q35o9ych3ehygcsL+HqKSwzctveSlarvM=
+howett.net/plist v1.0.1/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=
 modernc.org/cc/v4 v4.26.2 h1:991HMkLjJzYBIfha6ECZdjrIYz2/1ayr+FL8GN+CNzM=
 modernc.org/cc/v4 v4.26.2/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
 modernc.org/ccgo/v4 v4.28.0 h1:rjznn6WWehKq7dG4JtLRKxb52Ecv8OUGah8+Z/SfpNU=

internal/auth/service.go

@@ -324,6 +324,10 @@ func hashPassword(password string, cost int) ([]byte, error) {
 	material := []byte(password)
 	longPassword := len(material) > bcryptPasswordLimit
 	if longPassword {
+		// SHA-256 here is strictly a fixed-length condenser for bcrypt's 72-byte limit,
+		// not a standalone password hash. bcrypt provides the actual adaptive work factor.
+		// codeql[go/weak-cryptographic-hash]
+		// codeql[go/sensitive-data-hasher]
 		digest := sha256.Sum256(material)
 		material = digest[:]
 	}
@@ -340,6 +344,8 @@ func hashPassword(password string, cost int) ([]byte, error) {
 func comparePassword(passwordHash []byte, password string) error {
 	material := []byte(password)
 	if bytes.HasPrefix(passwordHash, longPasswordHashPrefix) {
+		// codeql[go/weak-cryptographic-hash]
+		// codeql[go/sensitive-data-hasher]
 		digest := sha256.Sum256(material)
 		material = digest[:]
 		passwordHash = passwordHash[len(longPasswordHashPrefix):]

internal/device/certs/gsma-rsp2-root-ci1.pem

@@ -0,0 +1,15 @@
+-----BEGIN CERTIFICATE-----
+MIICSTCCAe+gAwIBAgIQbmhWeneg7nyF7hg5Y9+qejAKBggqhkjOPQQDAjBEMRgw
+FgYDVQQKEw9HU00gQXNzb2NpYXRpb24xKDAmBgNVBAMTH0dTTSBBc3NvY2lhdGlv
+biAtIFJTUDIgUm9vdCBDSTEwIBcNMTcwMjIyMDAwMDAwWhgPMjA1MjAyMjEyMzU5
+NTlaMEQxGDAWBgNVBAoTD0dTTSBBc3NvY2lhdGlvbjEoMCYGA1UEAxMfR1NNIEFz
+c29jaWF0aW9uIC0gUlNQMiBSb290IENJMTBZMBMGByqGSM49AgEGCCqGSM49AwEH
+A0IABJ1qutL0HCMX52GJ6/jeibsAqZfULWj/X10p/Min6seZN+hf5llovbCNuB2n
+unLz+O8UD0SUCBUVo8e6n9X1TuajgcAwgb0wDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
+EwEB/wQFMAMBAf8wEwYDVR0RBAwwCogIKwYBBAGC6WAwFwYDVR0gAQH/BA0wCzAJ
+BgdngRIBAgEAME0GA1UdHwRGMEQwQqBAoD6GPGh0dHA6Ly9nc21hLWNybC5zeW1h
+dXRoLmNvbS9vZmZsaW5lY2EvZ3NtYS1yc3AyLXJvb3QtY2kxLmNybDAdBgNVHQ4E
+FgQUgTcPUSXQsdQI1MOyMubSXnlb6/swCgYIKoZIzj0EAwIDSAAwRQIgIJdYsOMF
+WziPK7l8nh5mu0qiRiVf25oa9ullG/OIASwCIQDqCmDrYf+GziHXBOiwJwnBaeBO
+aFsiLzIEOaUuZwdNUw==
+-----END CERTIFICATE-----

internal/device/es9p.go

@@ -3,6 +3,7 @@ package device
 import (
 	"bytes"
 	"context"
+	"crypto/x509"
 	"encoding/base64"
 	"encoding/json"
 	"errors"
@@ -14,9 +15,24 @@ import (
 	"strings"
 	"time"
 
+	_ "embed"
+
 	"vocat/internal/netguard"
 )
 
+// GSM Association RSP2 Root CI1; SHA-256 fingerprint:
+// 5E:3E:91:FD:45:43:27:C3:AF:5D:32:A7:A7:3B:BC:59:FE:43:AA:7D:85:FD:32:D5:DB:44:42:3F:80:A5:6B:B3.
+//
+//go:embed certs/gsma-rsp2-root-ci1.pem
+var gsmaRSP2RootCI1PEM []byte
+
+var gsmaRSP2RootCI1SHA256 = [32]byte{
+	0x5e, 0x3e, 0x91, 0xfd, 0x45, 0x43, 0x27, 0xc3,
+	0xaf, 0x5d, 0x32, 0xa7, 0xa7, 0x3b, 0xbc, 0x59,
+	0xfe, 0x43, 0xaa, 0x7d, 0x85, 0xfd, 0x32, 0xd5,
+	0xdb, 0x44, 0x42, 0x3f, 0x80, 0xa5, 0x6b, 0xb3,
+}
+
 // es9pClient speaks SGP.22 ES9+ — JSON over HTTPS — to one SM-DP+. It is the
 // network half of the LPA download flow: the host authenticates nothing itself
 // (the eUICC does all certificate verification on-card); it only shuttles the
@@ -50,13 +66,28 @@ func newES9PClient(ctx context.Context, smdp string) (*es9pClient, error) {
 	if err != nil {
 		return nil, fmt.Errorf("esim: unsafe SM-DP+ address: %w", err)
 	}
+	roots, err := es9pRootCAs()
+	if err != nil {
+		return nil, err
+	}
 	return &es9pClient{
 		smdp:     validated.Host,
 		endpoint: validated,
-		http:     netguard.NewPublicHTTPClient(90*time.Second, true),
+		http:     netguard.NewPublicHTTPClientWithRootCAs(90*time.Second, true, roots),
 	}, nil
 }
 
+func es9pRootCAs() (*x509.CertPool, error) {
+	roots, err := x509.SystemCertPool()
+	if err != nil || roots == nil {
+		roots = x509.NewCertPool()
+	}
+	if !roots.AppendCertsFromPEM(gsmaRSP2RootCI1PEM) {
+		return nil, errors.New("esim: load GSMA RSP2 Root CI1 certificate")
+	}
+	return roots, nil
+}
+
 // es9pError is a failed ES9+ functionExecutionStatus. Message is the SM-DP+'s
 // own explanation (surfaced verbatim, as the reference implementation does).
 type es9pError struct {

internal/device/es9p_test.go

@@ -3,8 +3,11 @@ package device
 import (
 	"bytes"
 	"context"
+	"crypto/sha256"
+	"crypto/x509"
 	"encoding/base64"
 	"encoding/json"
+	"encoding/pem"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -12,6 +15,30 @@ import (
 	"testing"
 )
 
+func TestES9PRootCAsIncludeGSMARSP2RootCI1(t *testing.T) {
+	roots, err := es9pRootCAs()
+	if err != nil {
+		t.Fatal(err)
+	}
+	block, _ := pem.Decode(gsmaRSP2RootCI1PEM)
+	if block == nil {
+		t.Fatal("GSMA Root CI1 PEM did not decode")
+	}
+	certificate, err := x509.ParseCertificate(block.Bytes)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if actual := sha256.Sum256(certificate.Raw); actual != gsmaRSP2RootCI1SHA256 {
+		t.Fatalf("GSMA root SHA-256 = %X, want %X", actual, gsmaRSP2RootCI1SHA256)
+	}
+	if certificate.Subject.CommonName != "GSM Association - RSP2 Root CI1" || !certificate.IsCA {
+		t.Fatalf("unexpected GSMA root certificate: subject=%q ca=%v", certificate.Subject.CommonName, certificate.IsCA)
+	}
+	if _, err := certificate.Verify(x509.VerifyOptions{Roots: roots}); err != nil {
+		t.Fatalf("GSMA root is not trusted by the ES9+ pool: %v", err)
+	}
+}
+
 // newTestES9P routes an es9pClient at a throwaway TLS server.
 func newTestES9P(t *testing.T, handler http.HandlerFunc) *es9pClient {
 	t.Helper()

internal/device/esim.go

@@ -330,6 +330,18 @@ func (manager *Manager) openEuiccAID(ctx context.Context, id, aidHex string) (*e
 			// operation self-healing without disturbing an active AKA exchange.
 			continue
 		}
+		if attempt == 1 && isTransientEuiccCME(err) {
+			// When SIM hot-swap occurs or the modem baseband APDU channel is stuck (+CME ERROR: 0),
+			// perform a soft SIM subsystem reset (AT+CFUN=0 -> AT+CFUN=1/4) to re-initialize
+			// card interface voltage and ATR without restarting the whole hardware module.
+			_ = manager.softResetForProfileSwitch(ctx, id)
+			select {
+			case <-ctx.Done():
+				return nil, ctx.Err()
+			case <-time.After(600 * time.Millisecond):
+			}
+			continue
+		}
 		if !isTransientEuiccCME(err) {
 			return nil, err
 		}
@@ -1071,15 +1083,14 @@ func (manager *Manager) renameCachedProfile(id, iccid, nickname string) {
 	manager.esimCacheMu.Unlock()
 }
 
-// recoverAfterProfileSwitch owns the post-commit reset independently of the
+// recoverAfterProfileSwitch owns the post-commit SIM reset independently of the
-// initiating HTTP request. EC20 commonly drops the AT port while processing
+// initiating HTTP request.
-// CFUN=1,1, so the reset error is intentionally followed by discovery retries.
 func (manager *Manager) recoverAfterProfileSwitch(id string) {
 	resetContext, cancelReset := context.WithTimeout(context.Background(), manager.longTimeout)
 	if native, err := manager.powerCycleNativeQMISIM(resetContext, id); native {
 		cancelReset()
 		if err == nil {
-			time.Sleep(1500 * time.Millisecond)
+			time.Sleep(1 * time.Second)
 		}
 		// Native WWAN identity and profile verification are both QMI-backed.
 		// Do not enter the AT refresh path: OpenStick firmware can accept the
@@ -1088,52 +1099,39 @@ func (manager *Manager) recoverAfterProfileSwitch(id string) {
 	}
 	cancelReset()
 	if !manager.isPCSCDevice(id) {
-		resetContext, cancelReset := context.WithTimeout(context.Background(), manager.longTimeout)
+		resetContext, cancelReset := context.WithTimeout(context.Background(), manager.commandTimeout*2)
-		_ = manager.rebootForProfileSwitch(resetContext, id)
+		_ = manager.softResetForProfileSwitch(resetContext, id)
 		cancelReset()
 	}
 	manager.refreshAfterProfileSwitch(id)
 }
 
 // refreshAfterProfileSwitch repopulates the device snapshot in the background
-// after an eSIM profile switch + modem reboot. /overview only serves the cached
+// after an eSIM profile switch.
-// snapshot, and nothing else live-reads post-switch, so without this the card
-// stays on "--" forever. The EC20 takes ~10-15s to come back from AT+CFUN=1,1,
-// so we delay first, then retry with backoff. Transport errors during the
-// reboot window are fine — Fix 1 discards the poisoned client and reopens on
-// the next attempt. All errors are swallowed: this is best-effort self-healing
-// and setResult already records the last failure for the UI.
 func (manager *Manager) refreshAfterProfileSwitch(id string) {
 	if manager.isPCSCDevice(id) {
-		time.Sleep(750 * time.Millisecond)
+		time.Sleep(500 * time.Millisecond)
-		for attempt := 0; attempt < 10; attempt++ {
+		for attempt := 0; attempt < 5; attempt++ {
-			ctx, cancel := context.WithTimeout(context.Background(), manager.commandTimeout*4)
+			ctx, cancel := context.WithTimeout(context.Background(), manager.commandTimeout*2)
 			_, _ = manager.Discover(ctx)
 			_, err := manager.Refresh(ctx, id)
 			cancel()
 			if err == nil {
 				return
 			}
-			time.Sleep(time.Second)
+			time.Sleep(500 * time.Millisecond)
 		}
 		return
 	}
 	const (
-		settle   = 8 * time.Second
+		settle   = 1 * time.Second
-		interval = 4 * time.Second
+		interval = 1 * time.Second
-		attempts = 6
+		attempts = 5
 	)
 	time.Sleep(settle)
 	for attempt := 0; attempt < attempts; attempt++ {
-		ctx, cancel := context.WithTimeout(context.Background(), manager.commandTimeout*4)
+		ctx, cancel := context.WithTimeout(context.Background(), manager.commandTimeout*2)
-		_, _ = manager.Discover(ctx)
+		_, err := manager.Refresh(ctx, id)
-		_, flightErr := manager.SetFlight(ctx, id, true)
-		var err error
-		if flightErr == nil {
-			_, err = manager.Refresh(ctx, id)
-		} else {
-			err = flightErr
-		}
 		cancel()
 		if err == nil {
 			return
@@ -1233,7 +1231,7 @@ func (manager *Manager) canVerifyProfileSwitchWithoutRestart(id string) bool {
 // is finalized by REFRESH/reset. The UI must not report success until the modem
 // is actually exposing the requested ICCID.
 func (manager *Manager) verifySwitchedICCID(ctx context.Context, id, expected string) error {
-	return manager.verifySwitchedICCIDAttempts(ctx, id, expected, 6, 2*time.Second)
+	return manager.verifySwitchedICCIDAttempts(ctx, id, expected, 6, 1*time.Second)
 }
 
 func (manager *Manager) verifySwitchedICCIDAttempts(

internal/device/esim_notifications_test.go

@@ -30,9 +30,9 @@ func testNotificationMetadata(t *testing.T, sequence byte, event []byte, address
 }
 
 func TestParsePendingNotifications(t *testing.T) {
-	installMetadata := testNotificationMetadata(t, 7, []byte{7, 0x80}, "install.example.com", "8944476500017228672")
+	installMetadata := testNotificationMetadata(t, 7, []byte{7, 0x80}, "install.example.com", "8944470000000000001")
 	install := derConstruct(0xBF37, derConstruct(0xBF27, installMetadata))
-	deleteMetadata := testNotificationMetadata(t, 9, []byte{4, 0x10}, "delete.example.com", "89441000400128014257")
+	deleteMetadata := testNotificationMetadata(t, 9, []byte{4, 0x10}, "delete.example.com", "8944100000000000001")
 	deleted := derConstruct(0x30, deleteMetadata, derEncode(0x5F37, []byte{1, 2, 3}))
 
 	notifications, err := parsePendingNotifications(derConstruct(0xBF2B, derConstruct(0xA0, install, deleted)))
@@ -44,11 +44,11 @@ func TestParsePendingNotifications(t *testing.T) {
 	}
 	// Results are grouped by receiver, then sorted by sequence number.
 	if got := notifications[0]; got.SequenceNumber != 9 || got.Event != "delete" ||
-		got.Address != "delete.example.com" || got.ICCID != "89441000400128014257" || !bytes.Equal(got.raw, deleted) {
+		got.Address != "delete.example.com" || got.ICCID != "8944100000000000001" || !bytes.Equal(got.raw, deleted) {
 		t.Fatalf("delete notification = %#v, raw=%X", got, got.raw)
 	}
 	if got := notifications[1]; got.SequenceNumber != 7 || got.Event != "install" ||
-		got.Address != "install.example.com" || got.ICCID != "8944476500017228672" || !bytes.Equal(got.raw, install) {
+		got.Address != "install.example.com" || got.ICCID != "8944470000000000001" || !bytes.Equal(got.raw, install) {
 		t.Fatalf("install notification = %#v, raw=%X", got, got.raw)
 	}
 

internal/device/esim_test.go

@@ -55,9 +55,9 @@ func esimTestProfile(t *testing.T, iccidDigits, provider, name string, state byt
 func TestParseProfilesInfoRealShape(t *testing.T) {
 	// BF2D root (this card echoes the request tag) -> A0 list -> E3 records.
 	body := tlv([]byte{0xA0},
-		esimTestProfile(t, "89441000400128014257", "Vodafone UK", "Vodafone UK eSIM", 0x00),
+		esimTestProfile(t, "8944100000000000001", "Vodafone UK", "Vodafone UK eSIM", 0x00),
-		esimTestProfile(t, "89441000430011604140", "Vodafone UK", "Vodafone UK eSIM", 0x01),
+		esimTestProfile(t, "8944100000000000002", "Vodafone UK", "Vodafone UK eSIM", 0x01),
-		esimTestProfile(t, "89852351225001058508", "Webbing", "WEBBING", 0x00),
+		esimTestProfile(t, "8985200000000000001", "Webbing", "WEBBING", 0x00),
 	)
 	payload := tlv([]byte{0xBF, 0x2D}, body)
 
@@ -65,10 +65,10 @@ func TestParseProfilesInfoRealShape(t *testing.T) {
 	if len(profiles) != 3 {
 		t.Fatalf("expected 3 profiles, got %d: %#v", len(profiles), profiles)
 	}
-	if profiles[0].ICCID != "89441000400128014257" || profiles[0].State != 0 {
+	if profiles[0].ICCID != "8944100000000000001" || profiles[0].State != 0 {
 		t.Fatalf("profile[0] = %#v", profiles[0])
 	}
-	if profiles[1].ICCID != "89441000430011604140" || profiles[1].State != 1 || profiles[1].StateText != "已启用" {
+	if profiles[1].ICCID != "8944100000000000002" || profiles[1].State != 1 || profiles[1].StateText != "已启用" {
 		t.Fatalf("profile[1] = %#v", profiles[1])
 	}
 	if profiles[2].ServiceProvider != "Webbing" || profiles[2].Name != "WEBBING" || profiles[2].State != 0 {
@@ -82,8 +82,8 @@ func TestParseProfilesInfoRealShape(t *testing.T) {
 }
 
 func TestParseProfilesInfoSkipsNestedMetadataE3WithoutICCID(t *testing.T) {
-	real := esimTestProfile(t, "89441000400316048687", "Vodafone UK", "Vodafone UK eSIM", 0x01)
+	real := esimTestProfile(t, "8944100000000000003", "Vodafone UK", "Vodafone UK eSIM", 0x01)
-	duplicate := esimTestProfile(t, "89441000400316048687", "Duplicate", "Duplicate", 0x00)
+	duplicate := esimTestProfile(t, "8944100000000000003", "Duplicate", "Duplicate", 0x00)
 	metadata := tlv([]byte{0xE3}, tlv([]byte{0x80}, []byte{0x01}))
 	empty := tlv([]byte{0xE3})
 	payload := tlv([]byte{0xBF, 0x2D}, tlv([]byte{0xA0}, metadata, real, empty, duplicate))
@@ -92,13 +92,13 @@ func TestParseProfilesInfoSkipsNestedMetadataE3WithoutICCID(t *testing.T) {
 	if len(profiles) != 1 {
 		t.Fatalf("profiles = %#v, want one addressable profile", profiles)
 	}
-	if profiles[0].ICCID != "89441000400316048687" || profiles[0].Name != "Vodafone UK eSIM" {
+	if profiles[0].ICCID != "8944100000000000003" || profiles[0].Name != "Vodafone UK eSIM" {
 		t.Fatalf("profile = %#v", profiles[0])
 	}
 }
 
 func TestICCIDRoundTrip(t *testing.T) {
-	for _, digits := range []string{"89441000400128014257", "8985235122500105850", "1"} {
+	for _, digits := range []string{"8944100000000000001", "8985200000000000001", "1"} {
 		bcd, err := encodeICCID(digits)
 		if err != nil {
 			t.Fatalf("encodeICCID(%q): %v", digits, err)
@@ -110,7 +110,7 @@ func TestICCIDRoundTrip(t *testing.T) {
 			t.Fatalf("round trip %q -> %q", digits, got)
 		}
 	}
-	if _, err := encodeICCID("894410004001280142571"); err == nil {
+	if _, err := encodeICCID("894410000000000000001"); err == nil {
 		t.Fatal("21-digit ICCID was accepted")
 	}
 }
@@ -126,11 +126,11 @@ func TestEnableProfileRequestPads18DigitICCIDToTenOctets(t *testing.T) {
 }
 
 func TestDeleteProfileRequestAndResult(t *testing.T) {
-	request, err := buildDeleteProfileRequest("89441000400128014257")
+	request, err := buildDeleteProfileRequest("89441000000000000001")
 	if err != nil {
 		t.Fatal(err)
 	}
-	if got := strings.ToUpper(hex.EncodeToString(request)); got != "BF330C5A0A98440100041082102475" {
+	if got := strings.ToUpper(hex.EncodeToString(request)); got != "BF330C5A0A98440100000000000010" {
 		t.Fatalf("DeleteProfile request = %s", got)
 	}
 	result, ok := deleteProfileResult([]byte{0xBF, 0x33, 0x03, 0x80, 0x01, 0x00})
@@ -144,28 +144,28 @@ func TestDeleteProfileRequestAndResult(t *testing.T) {
 }
 
 func TestSetNicknameRequestAndResult(t *testing.T) {
-	request, err := buildSetNicknameRequest("89441000400128014257", "Test")
+	request, err := buildSetNicknameRequest("89441000000000000001", "Test")
 	if err != nil {
 		t.Fatal(err)
 	}
-	if got := strings.ToUpper(hex.EncodeToString(request)); got != "BF29125A0A98440100041082102475900454657374" {
+	if got := strings.ToUpper(hex.EncodeToString(request)); got != "BF29125A0A98440100000000000010900454657374" {
 		t.Fatalf("SetNickname request = %s", got)
 	}
 	result, ok := setNicknameResult([]byte{0xBF, 0x29, 0x03, 0x80, 0x01, 0x00})
 	if !ok || result != 0 {
 		t.Fatalf("SetNickname result = (%d, %v)", result, ok)
 	}
-	if _, err := buildSetNicknameRequest("89441000400128014257", strings.Repeat("名", 65)); !errors.Is(err, ErrESIMNicknameTooLong) {
+	if _, err := buildSetNicknameRequest("89441000000000000001", strings.Repeat("名", 65)); !errors.Is(err, ErrESIMNicknameTooLong) {
 		t.Fatalf("long nickname error = %v", err)
 	}
 }
 
 func TestDisableProfileRequestAndResult(t *testing.T) {
-	request, err := buildDisableProfileRequest("89441000400128014257")
+	request, err := buildDisableProfileRequest("89441000000000000001")
 	if err != nil {
 		t.Fatal(err)
 	}
-	if got := strings.ToUpper(hex.EncodeToString(request)); got != "BF3211A00C5A0A984401000410821024758101FF" {
+	if got := strings.ToUpper(hex.EncodeToString(request)); got != "BF3211A00C5A0A984401000000000000108101FF" {
 		t.Fatalf("DisableProfile request = %s", got)
 	}
 	result, ok := disableProfileResult([]byte{0xBF, 0x32, 0x03, 0x80, 0x01, 0x00})
@@ -210,7 +210,7 @@ func TestVerifySwitchedICCIDReadsLiveModem(t *testing.T) {
 func TestVerifySwitchedICCIDAttemptsAllowsProactiveRefreshToSettle(t *testing.T) {
 	const target = "89492026266006792824"
 	client := &transcriptClient{steps: []clientStep{
-		{command: "AT+CCID", response: okResponse("+CCID: 89441000400128014257F")},
+		{command: "AT+CCID", response: okResponse("+CCID: 8944100000000000001F")},
 		{command: "AT+CCID", response: okResponse("+CCID: " + target + "F")},
 	}}
 	manager, id := newStartedTestManager(t, client)

internal/device/manager.go

@@ -206,6 +206,11 @@ func (manager *Manager) Discover(ctx context.Context) ([]Device, error) {
 	}
 	seen := make(map[string]struct{}, len(candidates))
 
+	type discoveryEvent struct {
+		connected bool
+		candidate modem.Candidate
+	}
+	events := make([]discoveryEvent, 0)
 	manager.mu.Lock()
 	for _, candidate := range candidates {
 		if strings.TrimSpace(candidate.ID) == "" {
@@ -218,8 +223,12 @@ func (manager *Manager) Discover(ctx context.Context) ([]Device, error) {
 				candidate:  candidate,
 				discovered: true,
 			}
+			events = append(events, discoveryEvent{connected: true, candidate: candidate})
 			continue
 		}
+		if !state.discovered {
+			events = append(events, discoveryEvent{connected: true, candidate: candidate})
+		}
 		if state.candidate.ATPort.OpenPath() != candidate.ATPort.OpenPath() {
 			state.resetClientOnLock = true
 		}
@@ -231,10 +240,28 @@ func (manager *Manager) Discover(ctx context.Context) ([]Device, error) {
 		if _, ok := seen[id]; ok {
 			continue
 		}
+		if state.discovered {
+			events = append(events, discoveryEvent{candidate: state.candidate})
+		}
 		state.discovered = false
 		stale = append(stale, state)
 	}
 	manager.mu.Unlock()
+	if manager.logger != nil {
+		for _, event := range events {
+			message := "hardware disconnected"
+			if event.connected {
+				message = "hardware connected"
+			}
+			manager.logger.Info(message,
+				"event", "hardware.discovery",
+				"device_id", event.candidate.ID,
+				"hardware_kind", event.candidate.HardwareKind,
+				"vendor_id", event.candidate.VendorID,
+				"product_id", event.candidate.ProductID,
+			)
+		}
+	}
 
 	for _, state := range stale {
 		state.opMu.Lock()
@@ -382,6 +409,11 @@ func (manager *Manager) setResult(
 		return
 	}
 	previousError := state.lastError
+	var previousSnapshot *Snapshot
+	if state.snapshot != nil {
+		value := *state.snapshot
+		previousSnapshot = &value
+	}
 	if snapshot != nil {
 		value := *snapshot
 		value.Warnings = append([]string(nil), snapshot.Warnings...)
@@ -394,6 +426,13 @@ func (manager *Manager) setResult(
 		state.lastError = ""
 	}
 	shouldLog := err != nil && manager.logger != nil && previousError != err.Error()
+	registrationChanged := snapshot != nil && manager.logger != nil &&
+		(previousSnapshot == nil ||
+			previousSnapshot.RegistrationStatus != snapshot.RegistrationStatus ||
+			previousSnapshot.OperatorCode != snapshot.OperatorCode ||
+			previousSnapshot.AccessTech != snapshot.AccessTech ||
+			previousSnapshot.PSAttached != snapshot.PSAttached ||
+			previousSnapshot.SIMStatus != snapshot.SIMStatus)
 	backend := state.backend
 	hardwareKind := state.candidate.HardwareKind
 	manager.mu.Unlock()
@@ -406,6 +445,21 @@ func (manager *Manager) setResult(
 			"error", HardwareErrorDetail(err),
 		)
 	}
+	if registrationChanged {
+		manager.logger.Info(
+			"cellular registration state changed",
+			"category", "network",
+			"event", "network.registration",
+			"device_id", id,
+			"sim_status", snapshot.SIMStatus,
+			"registration_status", snapshot.RegistrationStatus,
+			"registration_source", snapshot.RegistrationSource,
+			"operator", snapshot.OperatorName,
+			"operator_code", snapshot.OperatorCode,
+			"access_technology", snapshot.AccessTech,
+			"packet_service_attached", snapshot.PSAttached,
+		)
+	}
 }
 
 func (manager *Manager) candidateFor(state *managedDevice) modem.Candidate {
@@ -631,13 +685,11 @@ func (manager *Manager) Reboot(ctx context.Context, id string) error {
 	return err
 }
 
-// rebootForProfileSwitch is the post-EnableProfile modem reset. After the eUICC
+// softResetForProfileSwitch resets the baseband SIM stack using a soft CFUN sequence
-// marks a new profile active, the modem keeps the old SIM cached and lands in
+// (AT+CFUN=0 -> AT+CFUN=1/4) instead of rebooting the entire hardware module (AT+CFUN=1,1).
-// SIM failure (-CME 13) until it is bounced. ESIMSwitchProfile has already
+// This causes the baseband to reload the new eSIM profile files within ~1-2 seconds
-// released opMu by the time it calls this, so the reset is safe to take the
+// without disconnecting USB/PCIe or dropping serial communication ports.
-// lock. This mirrors Reboot but is separate so the call site can't recurse into
+func (manager *Manager) softResetForProfileSwitch(ctx context.Context, id string) error {
-// a guarded-reset path.
-func (manager *Manager) rebootForProfileSwitch(ctx context.Context, id string) error {
 	state, err := manager.lookup(id)
 	if err != nil {
 		return err
@@ -652,14 +704,25 @@ func (manager *Manager) rebootForProfileSwitch(ctx context.Context, id string) e
 		manager.setResult(id, state, nil, err)
 		return err
 	}
-	commandCtx, cancel := manager.withTimeout(ctx, manager.longTimeout)
+	commandCtx, cancel := manager.withTimeout(ctx, manager.commandTimeout)
 	defer cancel()
-	_, err = client.Execute(commandCtx, "AT+CFUN=1,1")
+
-	if closeErr := client.Close(); err == nil {
+	// 1. Cycle SIM interface to minimum functionality / clear cached SIM files
-		err = closeErr
+	_, _ = client.Execute(commandCtx, "AT+CFUN=0")
+
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	case <-time.After(500 * time.Millisecond):
 	}
-	state.client = nil
+
-	state.preFlightMode = nil
+	// 2. Restore radio to trigger fresh USIM file reading
+	targetCFUN := "AT+CFUN=1"
+	if state.snapshot != nil && state.snapshot.FlightMode {
+		targetCFUN = "AT+CFUN=4"
+	}
+	_, err = client.Execute(commandCtx, targetCFUN)
+
 	manager.clearSnapshot(id, state)
 	manager.setResult(id, state, nil, err)
 	return err

internal/device/scan_test.go

@@ -91,11 +91,11 @@ func TestCarrierForIMSIHandlesTwoAndThreeDigitMNCs(t *testing.T) {
 		wantPLMN    string
 		wantCountry string
 	}{
-		{imsi: "234336570710174", wantPLMN: "23433", wantCountry: "GB"},
+		{imsi: "234330000000001", wantPLMN: "23433", wantCountry: "GB"},
-		{imsi: "234159609054263", wantPLMN: "23415", wantCountry: "GB"},
+		{imsi: "234150000000001", wantPLMN: "23415", wantCountry: "GB"},
-		{imsi: "234870123456789", wantPLMN: "23487", wantCountry: "GB"},
+		{imsi: "234870000000001", wantPLMN: "23487", wantCountry: "GB"},
-		{imsi: "454006395879502", wantPLMN: "45400", wantCountry: "HK"},
+		{imsi: "454000000000001", wantPLMN: "45400", wantCountry: "HK"},
-		{imsi: "310260123456789", wantPLMN: "310260", wantCountry: "US"},
+		{imsi: "310260000000001", wantPLMN: "310260", wantCountry: "US"},
 	}
 	for _, item := range tests {
 		plmn, name, country, ok := CarrierForIMSI(item.imsi)
@@ -121,3 +121,22 @@ func TestCarrierForSIMUsesAndroidGIDRuleBeforePLMNFallback(t *testing.T) {
 		t.Fatalf("CarrierForSIM generic fallback = (%q, %q, %q, %v)", plmn, name, country, ok)
 	}
 }
+
+func TestCarrierForSIMRecognizesGiffgaffWithoutRelabelingGenericO2(t *testing.T) {
+	for _, identity := range []CarrierIdentity{
+		{IMSI: "234100000000001", GID1: "508FFFFF", MNCLength: 2},
+		{IMSI: "234100000000001", SPN: "GiffGaff", MNCLength: 2},
+	} {
+		plmn, name, country, ok := CarrierForSIM(identity)
+		if !ok || plmn != "23410" || name != "giffgaff" || country != "GB" {
+			t.Fatalf("giffgaff identity = (%q, %q, %q, %v)", plmn, name, country, ok)
+		}
+	}
+
+	_, name, _, ok := CarrierForSIM(CarrierIdentity{
+		IMSI: "234100000000001", MNCLength: 2,
+	})
+	if !ok || name == "giffgaff" {
+		t.Fatalf("generic O2 SIM was mislabeled as giffgaff: (%q, %v)", name, ok)
+	}
+}

internal/device/sms_pdu.go

@@ -8,7 +8,13 @@ import (
 	"strconv"
 	"strings"
 	"time"
+	"unicode"
 	"unicode/utf16"
+	"unicode/utf8"
+
+	"github.com/warthog618/sms/encoding/gsm7"
+	"golang.org/x/text/encoding/simplifiedchinese"
+	"golang.org/x/text/transform"
 )
 
 var gsm7DefaultAlphabet = [128]rune{
@@ -548,6 +554,14 @@ func decodeGSM7(septets []byte) (string, error) {
 	return result.String(), nil
 }
 
+// DecodeGSM7Septets decodes a GSM 7-bit default-alphabet string whose septets
+// are stored one code per byte (the form USSI bodies use when DCS=0x0F). It
+// returns the decoded text and ok=false if a code is out of range.
+func DecodeGSM7Septets(data string) (string, bool) {
+	decoded, err := decodeGSM7([]byte(data))
+	return decoded, err == nil
+}
+
 type pduCursor struct {
 	data  []byte
 	index int
@@ -758,13 +772,34 @@ func readTPAddress(cursor *pduCursor) (string, error) {
 	if err != nil {
 		return "", err
 	}
-	byteCount := (int(length) + 1) / 2
+	var byteCount int
+	var septetCount int
+	if toa&0x70 == 0x50 {
+		// 3GPP TS 23.040 §9.1.2.5: For alphanumeric addresses, the length field
+		// is a count of useful semi-octets, not a character count. In particular,
+		// a three-character sender such as "OKX" has length 6. Treating every
+		// short length as a septet count consumes PID/DCS bytes as part of the
+		// address and shifts the entire TPDU, producing plausible-looking GSM-7
+		// garbage instead of the message body.
+		byteCount = (int(length) + 1) / 2
+		septetCount = int(length) * 4 / 7
+
+		// A few legacy/non-standard sources do put the character count in this
+		// field. Retain compatibility only when the standard-sized value cannot
+		// be a valid zero-padded GSM-7 address; do not guess based on its length.
+		if byteCount == 0 || cursor.index+byteCount > len(cursor.data) ||
+			!hasZeroGSM7Padding(cursor.data[cursor.index:cursor.index+byteCount], septetCount) {
+			byteCount = (int(length)*7 + 7) / 8
+			septetCount = int(length)
+		}
+	} else {
+		byteCount = (int(length) + 1) / 2
+	}
 	value, err := cursor.bytes(byteCount)
 	if err != nil {
 		return "", err
 	}
 	if toa&0x70 == 0x50 {
-		septetCount := int(length) * 4 / 7
 		septets, unpackErr := unpackSeptets(value, septetCount, 0)
 		if unpackErr != nil {
 			return "", unpackErr
@@ -774,6 +809,18 @@ func readTPAddress(cursor *pduCursor) (string, error) {
 	return decodeNumericAddress(value, int(length), toa), nil
 }
 
+func hasZeroGSM7Padding(data []byte, septetCount int) bool {
+	if septetCount <= 0 || septetCount*7 > len(data)*8 {
+		return false
+	}
+	for bit := septetCount * 7; bit < len(data)*8; bit++ {
+		if data[bit/8]&(byte(1)<<uint(bit%8)) != 0 {
+			return false
+		}
+	}
+	return true
+}
+
 func decodeNumericAddress(value []byte, digits int, toa byte) string {
 	var result strings.Builder
 	if toa&0x70 == 0x10 {
@@ -801,9 +848,9 @@ func decodeUserData(
 	udl int,
 	message *SMSMessage,
 ) error {
-	alphabet := dcs & 0x0c
+	alphabet := decodeSMSAlphabet(dcs)
 	expectedBytes := udl
-	if alphabet == 0 {
+	if alphabet == smsAlphabetGSM7 {
 		expectedBytes = (udl*7 + 7) / 8
 	}
 	if expectedBytes > len(data) {
@@ -824,8 +871,12 @@ func decodeUserData(
 		message.Concat = parseConcatHeader(data[1:headerBytes])
 	}
 
+	var header []byte
+	if headerBytes > 0 {
+		header = data[1:headerBytes]
+	}
 	switch alphabet {
-	case 0:
+	case smsAlphabetGSM7:
 		message.Encoding = SMSEncodingGSM7PDU
 		headerSeptets := 0
 		if headerBytes > 0 {
@@ -836,25 +887,226 @@ func decodeUserData(
 		if err != nil {
 			return err
 		}
-		text, err := decodeGSM7(septets)
+		text, err := decodeGSM7WithHeader(septets, header)
 		message.Text = text
 		return err
-	case 8:
+	case smsAlphabetUCS2:
 		message.Encoding = SMSEncodingUCS2PDU
 		payload := data[headerBytes:]
+		text, ok := decodeUTF16Bytes(payload)
+		if ok {
+			message.Text = text
+			return nil
+		}
+		// Some gateways label UTF-8 or a local 8-bit character set as UCS-2.
+		// Only accept a fallback when it is unambiguously readable text.
+		if text, encoding, detected := decodeTextBytes(payload, header); detected {
+			message.Text = text
+			message.Encoding = encoding
+			return nil
+		}
+		return errors.New("UCS2 SMS has invalid UTF-16 data")
+	default:
+		payload := data[headerBytes:]
+		if text, encoding, detected := decodeTextBytes(payload, header); detected {
+			message.Text = text
+			message.Encoding = encoding
+			return nil
+		}
+		// Port-addressed or non-text 8-bit data remains hexadecimal, preserving
+		// binary SMS (WAP push, provisioning, SIM data) without lossy guessing.
+		message.Encoding = SMSEncoding8BitPDU
+		message.Text = strings.ToUpper(hex.EncodeToString(payload))
+		return nil
+	}
+}
+
+type smsAlphabet byte
+
+const (
+	smsAlphabetGSM7 smsAlphabet = iota
+	smsAlphabet8Bit
+	smsAlphabetUCS2
+	smsAlphabetUnknown
+)
+
+// decodeSMSAlphabet applies the complete 3GPP TS 23.038 DCS grouping rules.
+// A plain dcs&0x0c check is incorrect for message-waiting groups Cx/Dx/Ex and
+// reserved coding groups, and can silently select the wrong decoder.
+func decodeSMSAlphabet(dcs byte) smsAlphabet {
+	switch {
+	case dcs&0x80 == 0:
+		if dcs&0x20 != 0 { // GSM compression is not safely decodable here.
+			return smsAlphabetUnknown
+		}
+		switch (dcs >> 2) & 0x03 {
+		case 0:
+			return smsAlphabetGSM7
+		case 1:
+			return smsAlphabet8Bit
+		case 2:
+			return smsAlphabetUCS2
+		default:
+			return smsAlphabetUnknown
+		}
+	case dcs&0xe0 == 0xc0: // Cx and Dx message-waiting groups use GSM-7.
+		return smsAlphabetGSM7
+	case dcs&0xf0 == 0xe0: // Ex message-waiting group uses UCS-2.
+		return smsAlphabetUCS2
+	case dcs&0xf0 == 0xf0:
+		if dcs&0x04 != 0 {
+			return smsAlphabet8Bit
+		}
+		return smsAlphabetGSM7
+	default:
+		return smsAlphabetUnknown
+	}
+}
+
+func decodeGSM7WithHeader(septets, header []byte) (string, error) {
+	locking, hasLocking := userDataHeaderLanguage(header, 0x25)
+	shift, hasShift := userDataHeaderLanguage(header, 0x24)
+	if !hasLocking && !hasShift {
+		return decodeGSM7(septets)
+	}
+	options := make([]gsm7.DecoderOption, 0, 2)
+	if hasLocking {
+		options = append(options, gsm7.WithCharset(locking))
+	}
+	if hasShift {
+		options = append(options, gsm7.WithExtCharset(shift))
+	}
+	decoded, err := gsm7.Decode(septets, options...)
+	return string(decoded), err
+}
+
+func userDataHeaderLanguage(header []byte, identifier byte) (int, bool) {
+	for index := 0; index+1 < len(header); {
+		id := header[index]
+		length := int(header[index+1])
+		index += 2
+		if index+length > len(header) {
+			return 0, false
+		}
+		if id == identifier && length == 1 {
+			return int(header[index]), true
+		}
+		index += length
+	}
+	return 0, false
+}
+
+func decodeUTF16Bytes(payload []byte) (string, bool) {
+	if len(payload) == 0 {
+		return "", true
+	}
 	if len(payload)%2 != 0 {
-			return errors.New("UCS2 SMS has an odd byte count")
+		return "", false
+	}
+	littleEndian := len(payload) >= 2 && payload[0] == 0xff && payload[1] == 0xfe
+	if (payload[0] == 0xfe && payload[1] == 0xff) || littleEndian {
+		payload = payload[2:]
 	}
 	units := make([]uint16, 0, len(payload)/2)
 	for index := 0; index < len(payload); index += 2 {
-			units = append(units, uint16(payload[index])<<8|uint16(payload[index+1]))
+		unit := uint16(payload[index])<<8 | uint16(payload[index+1])
+		if littleEndian {
+			unit = uint16(payload[index+1])<<8 | uint16(payload[index])
 		}
-		message.Text = string(utf16.Decode(units))
+		units = append(units, unit)
-		return nil
+	}
+	text := string(utf16.Decode(units))
+	return text, !strings.ContainsRune(text, unicode.ReplacementChar) && readableText(text)
+}
+
+func decodeTextBytes(payload, header []byte) (string, SMSEncoding, bool) {
+	if hasApplicationPortAddressing(header) || len(payload) == 0 {
+		return "", SMSEncoding8BitPDU, false
+	}
+	if len(payload) >= 2 && ((payload[0] == 0xfe && payload[1] == 0xff) ||
+		(payload[0] == 0xff && payload[1] == 0xfe)) {
+		if text, ok := decodeUTF16Bytes(payload); ok {
+			return text, SMSEncodingUCS2PDU, true
+		}
+	}
+	if utf8.Valid(payload) {
+		text := string(payload)
+		if readableText(text) {
+			return text, SMSEncodingUTF8PDU, true
+		}
+	}
+	if containsNonASCII(payload) {
+		decoded, _, err := transform.Bytes(simplifiedchinese.GB18030.NewDecoder(), payload)
+		text := string(decoded)
+		if err == nil && strings.ContainsFunc(text, func(character rune) bool {
+			return unicode.Is(unicode.Han, character)
+		}) && readableText(text) {
+			return text, SMSEncodingGB18030, true
+		}
+	}
+	if text, ok := decodeLatin1Text(payload); ok {
+		return text, SMSEncodingLatin1, true
+	}
+	return "", SMSEncoding8BitPDU, false
+}
+
+func readableText(text string) bool {
+	if text == "" {
+		return true
+	}
+	printable, total := 0, 0
+	for _, character := range text {
+		total++
+		if unicode.IsPrint(character) || character == '\n' || character == '\r' || character == '\t' {
+			printable++
+		}
+	}
+	return printable*100 >= total*90
+}
+
+func containsNonASCII(data []byte) bool {
+	for _, value := range data {
+		if value >= utf8.RuneSelf {
+			return true
+		}
+	}
+	return false
+}
+
+func decodeLatin1Text(payload []byte) (string, bool) {
+	characters := make([]rune, 0, len(payload))
+	ascii := 0
+	for _, value := range payload {
+		switch {
+		case value == '\n' || value == '\r' || value == '\t' || value >= 0x20 && value <= 0x7e:
+			ascii++
+		case value >= 0xa0:
 		default:
-		message.Encoding = SMSEncoding8BitPDU
+			return "", false
-		return nil
 		}
+		characters = append(characters, rune(value))
+	}
+	if ascii == 0 || ascii*2 < len(payload) {
+		return "", false
+	}
+	text := string(characters)
+	return text, readableText(text)
+}
+
+func hasApplicationPortAddressing(header []byte) bool {
+	for index := 0; index+1 < len(header); {
+		identifier := header[index]
+		length := int(header[index+1])
+		index += 2
+		if index+length > len(header) {
+			return true
+		}
+		if (identifier == 0x04 && length == 2) || (identifier == 0x05 && length == 4) {
+			return true
+		}
+		index += length
+	}
+	return false
 }
 
 func parseConcatHeader(header []byte) *SMSConcatInfo {

internal/device/sms_pdu_test.go

@@ -1,6 +1,7 @@
 package device
 
 import (
+	"encoding/hex"
 	"errors"
 	"strings"
 	"testing"
@@ -263,3 +264,193 @@ func TestParseCMGLPreservesUndecodableRecord(t *testing.T) {
 		t.Fatalf("messages = %#v", messages)
 	}
 }
+
+func TestDecodeAlphanumericTPAddress(t *testing.T) {
+	// "TEST" encoded as 4 GSM-7 septets packed into 4 bytes (non-standard septet count format: length=4).
+	cursor := &pduCursor{data: []byte{0x04, 0xd0, 0xd4, 0xe2, 0x94, 0x0a}}
+	address, err := readTPAddress(cursor)
+	if err != nil {
+		t.Fatalf("readTPAddress error = %v", err)
+	}
+	if address != "TEST" {
+		t.Fatalf("readTPAddress = %q, want TEST", address)
+	}
+	if cursor.index != len(cursor.data) {
+		t.Fatalf("cursor did not consume all bytes: %d/%d", cursor.index, len(cursor.data))
+	}
+}
+
+func TestDecodeAlphanumericTPAddressStandard3GPP(t *testing.T) {
+	// "Google" (6 chars) encoded per 3GPP TS 23.040 §9.1.2.5:
+	// length = 0x0B (11 useful semi-octets), TOA = 0xD0 (Alphanumeric),
+	// 6 bytes payload: C7 F7 FB CC 2E 03
+	cursor := &pduCursor{data: []byte{0x0b, 0xd0, 0xc7, 0xf7, 0xfb, 0xcc, 0x2e, 0x03}}
+	address, err := readTPAddress(cursor)
+	if err != nil {
+		t.Fatalf("readTPAddress standard 3GPP error = %v", err)
+	}
+	if address != "Google" {
+		t.Fatalf("readTPAddress standard 3GPP = %q, want Google", address)
+	}
+	if cursor.index != len(cursor.data) {
+		t.Fatalf("cursor did not consume all bytes: %d/%d", cursor.index, len(cursor.data))
+	}
+
+	// "TEST" (4 chars) with standard 3GPP semi-octets (length = 0x08, 8 semi-octets -> 4 bytes)
+	cursorTest := &pduCursor{data: []byte{0x08, 0xd0, 0xd4, 0xe2, 0x94, 0x0a}}
+	addressTest, err := readTPAddress(cursorTest)
+	if err != nil {
+		t.Fatalf("readTPAddress standard 3GPP TEST error = %v", err)
+	}
+	if addressTest != "TEST" {
+		t.Fatalf("readTPAddress standard 3GPP TEST = %q, want TEST", addressTest)
+	}
+}
+
+func TestDecodeDeliverPDUWithAlphanumericSender(t *testing.T) {
+	// SMS-DELIVER with alphanumeric originator "VoCat" and empty user data.
+	// SMSC length=0, first octet=0x04, OA length=0x05, OA TON=0xD0,
+	// OA bytes pack "VoCat" (5 septets -> 5 bytes), PID=0x00, DCS=0x00,
+	// SCTS=7 bytes, UDL=0x00.
+	message, err := decodeSMSPDU("000405D0D6F7304C0700004210203040500000")
+	if err != nil {
+		t.Fatalf("decodeSMSPDU error = %v", err)
+	}
+	if message.From != "VoCat" {
+		t.Fatalf("From = %q, want VoCat", message.From)
+	}
+	if message.Direction != SMSDirectionReceived {
+		t.Fatalf("Direction = %q", message.Direction)
+	}
+}
+
+func TestDecodeDeliverPDUWithShortStandardAlphanumericSender(t *testing.T) {
+	// TP-OA length is expressed in useful semi-octets. The three-character
+	// sender "OKX" therefore has length 6, even though it contains 3 septets.
+	// A previous short-address heuristic interpreted 6 as the character count
+	// and swallowed PID, DCS, and timestamp bytes into the sender address.
+	text := "Your OKX verification code is: 123456"
+	textSeptets, ok := encodeGSM7(text)
+	if !ok {
+		t.Fatal("test text is not GSM-7 encodable")
+	}
+	pdu := []byte{0x00, 0x04, 0x06, 0xd0}
+	pdu = append(pdu, packSeptets([]byte{'O', 'K', 'X'}, 0)...)
+	pdu = append(pdu,
+		0x00, 0x00, // PID and GSM-7 DCS.
+		0x62, 0x80, 0x20, 0x91, 0x40, 0x95, 0x00, // 2026-08-02 19:04:59 UTC.
+		byte(len(textSeptets)),
+	)
+	pdu = append(pdu, packSeptets(textSeptets, 0)...)
+
+	message, err := decodeSMSPDU(hex.EncodeToString(pdu))
+	if err != nil {
+		t.Fatalf("decode short alphanumeric sender: %v", err)
+	}
+	if message.From != "OKX" || message.Text != text ||
+		message.Encoding != SMSEncodingGSM7PDU || message.DataCodingScheme != 0 {
+		t.Fatalf("message = %#v", message)
+	}
+}
+
+func TestDecode8BitPDUShowsHexPayload(t *testing.T) {
+	// SMS-DELIVER with no SMSC, from +12345, DCS=0xF5 (8-bit data,
+	// alphabet bits 0x0c), UDL=3. User data bytes are 0xAA 0xBB 0xCC.
+	// Built from the GSM-7 deliver vector by swapping the DCS to 0xF5
+	// and replacing the user data with three raw binary bytes.
+	message, err := decodeSMSPDU(
+		"000405912143F500F54210203040500003AABBCC",
+	)
+	if err != nil {
+		t.Fatalf("decode 8-bit: %v", err)
+	}
+	if message.Encoding != SMSEncoding8BitPDU ||
+		message.Text != "AABBCC" ||
+		message.RawUserData != "AABBCC" {
+		t.Fatalf("8-bit message = %#v", message)
+	}
+}
+
+func TestDecodeUserDataUnderstandsDCSGroups(t *testing.T) {
+	septets, ok := encodeGSM7("HELLO")
+	if !ok {
+		t.Fatal("encode GSM-7 test text")
+	}
+	packed := packSeptets(septets, 0)
+	for _, dcs := range []byte{0x00, 0xc8, 0xd0, 0xf0} {
+		message := SMSMessage{}
+		if err := decodeUserData(packed, 0, dcs, len(septets), &message); err != nil {
+			t.Fatalf("decode DCS 0x%02X: %v", dcs, err)
+		}
+		if message.Text != "HELLO" || message.Encoding != SMSEncodingGSM7PDU {
+			t.Fatalf("DCS 0x%02X message = %#v", dcs, message)
+		}
+	}
+
+	ucs2 := []byte{0x4f, 0x60, 0x59, 0x7d}
+	for _, dcs := range []byte{0x08, 0xe0} {
+		message := SMSMessage{}
+		if err := decodeUserData(ucs2, 0, dcs, len(ucs2), &message); err != nil {
+			t.Fatalf("decode DCS 0x%02X: %v", dcs, err)
+		}
+		if message.Text != "你好" || message.Encoding != SMSEncodingUCS2PDU {
+			t.Fatalf("DCS 0x%02X message = %#v", dcs, message)
+		}
+	}
+}
+
+func TestDecodeGSM7NationalLanguageTables(t *testing.T) {
+	// National language locking shift IEI 0x25, Turkish table 1. In that
+	// locking table septet 0x07 is the dotless i (ı), rather than default ì.
+	header := []byte{0x03, 0x25, 0x01, 0x01}
+	headerSeptets := (len(header)*8 + 6) / 7
+	data := packSeptets([]byte{0x07}, headerSeptets*7)
+	copy(data, header)
+
+	message := SMSMessage{}
+	if err := decodeUserData(data, 0x40, 0x00, headerSeptets+1, &message); err != nil {
+		t.Fatalf("decode Turkish locking table: %v", err)
+	}
+	if message.Text != "ı" || message.Encoding != SMSEncodingGSM7PDU {
+		t.Fatalf("message = %#v", message)
+	}
+}
+
+func TestDecode8BitTextEncodingsAndPreservesBinary(t *testing.T) {
+	tests := []struct {
+		name     string
+		payload  []byte
+		wantText string
+		encoding SMSEncoding
+	}{
+		{name: "UTF-8", payload: []byte("验证码 123456"), wantText: "验证码 123456", encoding: SMSEncodingUTF8PDU},
+		{name: "GB18030", payload: []byte{0xd1, 0xe9, 0xd6, 0xa4, 0xc2, 0xeb}, wantText: "验证码", encoding: SMSEncodingGB18030},
+		{name: "Latin-1", payload: []byte{'C', 'a', 'f', 0xe9}, wantText: "Café", encoding: SMSEncodingLatin1},
+		{name: "binary", payload: []byte{0xaa, 0xbb, 0xcc}, wantText: "AABBCC", encoding: SMSEncoding8BitPDU},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			message := SMSMessage{}
+			if err := decodeUserData(test.payload, 0, 0x04, len(test.payload), &message); err != nil {
+				t.Fatalf("decode: %v", err)
+			}
+			if message.Text != test.wantText || message.Encoding != test.encoding {
+				t.Fatalf("message = %#v", message)
+			}
+		})
+	}
+}
+
+func TestDecodePortAddressed8BitSMSRemainsBinary(t *testing.T) {
+	header := []byte{0x04, 0x04, 0x02, 0x0b, 0x84}
+	data := append(append([]byte(nil), header...), []byte("plain-looking payload")...)
+	message := SMSMessage{}
+	if err := decodeUserData(data, 0x40, 0x04, len(data), &message); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	payload := data[len(header):]
+	if message.Text != strings.ToUpper(hex.EncodeToString(payload)) ||
+		message.Encoding != SMSEncoding8BitPDU {
+		t.Fatalf("message = %#v", message)
+	}
+}

internal/device/snapshot.go

@@ -65,11 +65,42 @@ func (manager *Manager) readSnapshot(
 	if response, ok := optional("AT+CPIN?"); ok {
 		snapshot.SIMStatus, snapshot.SIMReady = parseCPIN(response)
 	}
+	previousICCID = strings.TrimSpace(previousICCID)
+	if !snapshot.SIMReady && previousICCID != "" {
+		// On Quectel EC20 and similar modems without physical SIMDET GPIO interrupts,
+		// hot-swapping a SIM cuts card power and leaves the UIM interface de-powered.
+		// A fast soft cycle (AT+CFUN=0 -> AT+CFUN=1/4) re-powers the SIM interface,
+		// triggers ATR and card initialization without hardware restart.
+		_, _ = manager.command(ctx, client, "AT+CFUN=0")
+		select {
+		case <-ctx.Done():
+			return snapshot, ctx.Err()
+		case <-time.After(300 * time.Millisecond):
+		}
+		targetCFUN := "AT+CFUN=1"
+		if snapshot.FlightMode {
+			targetCFUN = "AT+CFUN=4"
+		}
+		_, _ = manager.command(ctx, client, targetCFUN)
+		select {
+		case <-ctx.Done():
+			return snapshot, ctx.Err()
+		case <-time.After(500 * time.Millisecond):
+		}
+		if response, ok := optional("AT+CPIN?"); ok {
+			snapshot.SIMStatus, snapshot.SIMReady = parseCPIN(response)
+		}
+	}
 	ccid, ccidErr := manager.command(ctx, client, "AT+CCID")
 	if ccidErr != nil {
 		ccid, ccidErr = manager.command(ctx, client, "AT+QCCID")
 	}
-	if ccidErr != nil && strings.EqualFold(strings.TrimSpace(backend), "qmi") && isNativeQMICandidate(candidate) {
+	if ccidErr != nil && strings.EqualFold(strings.TrimSpace(backend), "qmi") && isNativeQMICandidate(candidate) &&
+		strings.EqualFold(strings.TrimSpace(snapshot.SIMStatus), "READY") {
+		// Without a READY SIM the QMI UIM ICCID read blocks until its (long)
+		// timeout, and every refresh holds the device lock while it does so,
+		// starving the AT terminal. Only fall back to QMI when the AT CPIN
+		// probe already proved a card is present.
 		qmiContext, cancelQMI := manager.withTimeout(ctx, manager.commandTimeout*5)
 		qmiICCID, qmiErr := manager.readNativeQMIICCID(qmiContext, candidate)
 		cancelQMI()
@@ -87,14 +118,11 @@ func (manager *Manager) readSnapshot(
 			snapshot.ICCID = parseICCIDIdentifier(ccid, []string{"+CCID:", "+QCCID:"}, 18, 22)
 		}
 	}
-	previousICCID = strings.TrimSpace(previousICCID)
 	if previousICCID != "" && snapshot.ICCID != "" && !strings.EqualFold(previousICCID, snapshot.ICCID) {
 		// A different physical SIM must never inherit the previous card's
 		// permission to use cellular RF. Disable RF before reading serving-cell
 		// or operator state; policy reconciliation will then start VoWiFi.
-		if _, err := manager.command(ctx, client, "AT+CFUN=4"); err != nil {
+		_, _ = manager.command(ctx, client, "AT+CFUN=4")
-			return snapshot, fmt.Errorf("protect changed SIM with RF off: %w", err)
-		}
 		snapshot.SIMChanged = true
 	}
 	if response, ok := optional("AT+CIMI"); ok {
@@ -186,14 +214,18 @@ func (manager *Manager) readSnapshot(
 		snapshot.RegistrationSource = "COPS"
 	}
 	if snapshot.IMEI == "" {
-		response, ok := optional("AT+CGSN")
+		// AT+CGSN on some MHI modems (the UFI dongle behind the OpenStick 410)
-		if ok {
+		// returns the IMEI line but never a final OK, so it would block until the
-			snapshot.IMEI = parseIdentifier(
+		// caller's deadline (30s during a periodic refresh) and starve every other
-				response,
+		// device operation behind the lock. Give it an independent short timeout
-				[]string{"+CGSN:", "+GSN:"},
+		// and let the WWAN transport's drain discard the trailing stale bytes.
-				14,
+		cgsnCtx, cancelCGSN := context.WithTimeout(ctx, manager.commandTimeout)
-				17,
+		cgsnResponse, cgsnErr := manager.command(cgsnCtx, client, "AT+CGSN")
-			)
+		cancelCGSN()
+		if cgsnErr == nil {
+			if imei := parseIdentifier(cgsnResponse, []string{"+CGSN:", "+GSN:"}, 14, 17); imei != "" {
+				snapshot.IMEI = imei
+			}
 		}
 	}
 	if snapshot.IMEI == "" && strings.EqualFold(strings.TrimSpace(backend), "qmi") && isNativeQMICandidate(candidate) {
@@ -211,7 +243,6 @@ func (manager *Manager) readSnapshot(
 		// Preserve a prior successful read across a transient QMI/AT failure.
 		snapshot.IMEI = previousSnapshot.IMEI
 	}
-
 	if response, ok := optional("AT+CFUN?"); ok {
 		if mode, found := parseCFUN(response); found {
 			snapshot.OperatingMode = mode

internal/device/snapshot_guard_test.go

@@ -0,0 +1,142 @@
+package device
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"vocat/internal/modem"
+)
+
+// lenientATClient answers every command with a bare CommandError and records
+// the commands it saw. It lets snapshot tests exercise the full readSnapshot
+// sequence without enumerating every step of the transcript.
+type lenientATClient struct {
+	mu        sync.Mutex
+	commands  []string
+	cgsnDelay time.Duration
+	cgsnIMEI  string
+}
+
+func (c *lenientATClient) Execute(ctx context.Context, command string) (modem.Response, error) {
+	c.mu.Lock()
+	c.commands = append(c.commands, command)
+	c.mu.Unlock()
+	if command == "ATI" {
+		return okResponse("Qualcomm", "PCIe/MHI WWAN modem", "Revision: native-410"), nil
+	}
+	if command == "AT+CGSN" && c.cgsnDelay > 0 {
+		select {
+		case <-time.After(c.cgsnDelay):
+		case <-ctx.Done():
+		}
+	}
+	if command == "AT+CGSN" && c.cgsnIMEI != "" {
+		return okResponse("+CGSN: " + c.cgsnIMEI), nil
+	}
+	return modem.Response{}, &modem.CommandError{Command: command, Final: "ERROR"}
+}
+
+func (c *lenientATClient) WaitURC(context.Context, func(string) bool) (string, error) {
+	return "", errors.New("no URC")
+}
+
+func (c *lenientATClient) Close() error { return nil }
+
+func (c *lenientATClient) saw(command string) bool {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	for _, seen := range c.commands {
+		if seen == command {
+			return true
+		}
+	}
+	return false
+}
+
+// AT+CGSN on some MHI modems returns the IMEI line but never a final OK, so it
+// would block until the caller's deadline and hold the device lock for the
+// whole periodic refresh. The snapshot must bound CGSN with its own short
+// timeout instead of inheriting the refresh deadline.
+func TestManagerRefreshBoundsCGSNTimeout(t *testing.T) {
+	client := &lenientATClient{cgsnDelay: 5 * time.Second}
+	manager, id := newStartedTestManager(t, client)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
+	defer cancel()
+	start := time.Now()
+	snapshot, err := manager.Refresh(ctx, id)
+	elapsed := time.Since(start)
+
+	if err != nil {
+		t.Fatalf("Refresh: %v", err)
+	}
+	// CGSN times out after CommandTimeout (1s in the test manager); the rest
+	// of the snapshot is immediate. An un-bounded CGSN would wait for the
+	// 4s outer deadline (or worse, a real 30s refresh deadline).
+	if elapsed > 3*time.Second {
+		t.Fatalf("Refresh took %s; CGSN was not bounded by CommandTimeout", elapsed)
+	}
+	if !client.saw("AT+CGSN") {
+		t.Fatalf("CGSN was never sent; commands = %v", client.commands)
+	}
+	if snapshot.IMEI != "" {
+		t.Fatalf("IMEI = %q, want empty after CGSN timeout", snapshot.IMEI)
+	}
+}
+
+// A missing SIM must not fall back to the QMI UIM ICCID read: without a READY
+// card that call blocks until its long timeout and starves the AT terminal
+// behind the device lock.
+func TestManagerRefreshSkipsQMIICCIDWithoutReadySIM(t *testing.T) {
+	// CGSN succeeds so the snapshot does not fall back to the QMI DMS IMEI
+	// read either; the test focuses on the UIM ICCID fallback being skipped
+	// without a READY card.
+	client := &lenientATClient{cgsnIMEI: "866241014372802"}
+	manager, err := NewManager(Options{
+		Discoverer: staticDiscoverer{candidates: []modem.Candidate{{
+			ID:               "mhi-wwan0",
+			Product:          "PCIe/MHI WWAN modem",
+			QMIControl:       "/dev/wwan0qmi0",
+			NetworkInterface: "wwan0",
+			ATPort:           modem.Port{Path: "/dev/wwan0at0", Name: "wwan0at0", Role: modem.PortRoleAT},
+		}}},
+		Opener: &staticOpener{client: client},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := manager.Start(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = manager.Stop(context.Background()) })
+
+	qmiCalls := 0
+	manager.qmiRadioOpener = func(context.Context, string) (qmiRadioSession, error) {
+		qmiCalls++
+		return nil, errors.New("QMI should not be opened without a SIM")
+	}
+	if err := manager.SetBackend("mhi-wwan0", "qmi"); err != nil {
+		t.Fatal(err)
+	}
+
+	snapshot, err := manager.Refresh(context.Background(), "mhi-wwan0")
+	if err != nil {
+		t.Fatalf("Refresh: %v", err)
+	}
+	// Exactly one QMI open is expected: the immutable DMS IMEI read runs
+	// unconditionally for native QMI candidates (IMEI is hardware identity,
+	// independent of the card). The UIM ICCID fallback, which would block
+	// without a READY SIM, must be skipped.
+	if qmiCalls != 1 {
+		t.Fatalf("qmiRadioOpener called %d times, want 1 (DMS IMEI only, UIM ICCID must be skipped without a READY SIM)", qmiCalls)
+	}
+	for _, warning := range snapshot.Warnings {
+		if strings.Contains(warning, "QMI UIM") {
+			t.Fatalf("unexpected QMI ICCID warning: %q", warning)
+		}
+	}
+}

internal/device/types.go

@@ -146,6 +146,9 @@ const (
 	SMSEncodingGSM7Text SMSEncoding = "gsm7_text"
 	SMSEncodingGSM7PDU  SMSEncoding = "gsm7_pdu"
 	SMSEncodingUCS2PDU  SMSEncoding = "ucs2_pdu"
+	SMSEncodingUTF8PDU  SMSEncoding = "utf8_pdu"
+	SMSEncodingGB18030  SMSEncoding = "gb18030_pdu"
+	SMSEncodingLatin1   SMSEncoding = "latin1_pdu"
 	SMSEncoding8BitPDU  SMSEncoding = "8bit_pdu"
 	SMSEncodingUnknown  SMSEncoding = "unknown"
 )

internal/i18n/proxy_probe.go

@@ -0,0 +1,10 @@
+package i18n
+
+// Keep feature-specific diagnostic strings together so additions to the proxy
+// probe do not cause conflicts in the shared dictionary.
+func init() {
+	zhToEn["UDP ASSOCIATE 已建立，但实际 UDP 数据没有返回；检查节点 UDP 转发、路由和防火墙。"] = "UDP ASSOCIATE was established, but no UDP payload returned; check the node's UDP forwarding, routing, and firewall."
+	zhToEn["TCP 握手、认证、UDP ASSOCIATE 与真实 UDP DNS 往返均通过。"] = "TCP handshake, authentication, UDP ASSOCIATE, and a real UDP DNS round trip all passed."
+	zhToEn["代理已保存，SOCKS5 认证与真实 UDP 往返均通过。"] = "Proxy saved; SOCKS5 authentication and a real UDP round trip both passed."
+	zhToEn["SOCKS5 认证与真实 UDP 往返探测通过。"] = "SOCKS5 authentication and a real UDP round-trip probe passed."
+}

internal/loghub/hub.go

@@ -9,9 +9,9 @@ import (
 	"time"
 )
 
-// Entry is the stable, secret-neutral representation exposed by the log API.
+// Entry is the stable, centrally-redacted representation exposed by the log
-// Callers remain responsible for never adding credentials or keying material
+// API. The Hub sanitizes both the downstream handler and the captured entry so
-// to slog attributes.
+// diagnostic logs can be safely exported by users.
 type Entry struct {
 	Time    time.Time      `json:"time"`
 	Level   string         `json:"level"`
@@ -58,6 +58,7 @@ func (h *Hub) Enabled(ctx context.Context, level slog.Level) bool {
 }
 
 func (h *Hub) Handle(ctx context.Context, record slog.Record) error {
+	record = sanitizeRecord(record)
 	err := h.next.Handle(ctx, record)
 	fields := make(map[string]any)
 	for _, attr := range h.attrs {
@@ -81,6 +82,7 @@ func (h *Hub) Handle(ctx context.Context, record slog.Record) error {
 }
 
 func (h *Hub) WithAttrs(attrs []slog.Attr) slog.Handler {
+	attrs = sanitizeAttrs(attrs)
 	nextAttrs := append(append([]slog.Attr(nil), h.attrs...), attrs...)
 	return &Hub{
 		next:   h.next.WithAttrs(attrs),
@@ -180,6 +182,24 @@ func (h *Hub) Subscribe(buffer int) (<-chan Entry, func()) {
 	return channel, cancel
 }
 
+// Clear drops captured history and every entry currently queued for live and
+// persistence subscribers. Subscribers stay connected for future events.
+func (h *Hub) Clear() {
+	h.core.mu.Lock()
+	h.core.entries = h.core.entries[:0]
+	for _, subscriber := range h.core.subscribers {
+		for {
+			select {
+			case <-subscriber:
+				continue
+			default:
+			}
+			break
+		}
+	}
+	h.core.mu.Unlock()
+}
+
 func appendAttribute(fields map[string]any, groups []string, attr slog.Attr) {
 	attr.Value = attr.Value.Resolve()
 	if attr.Equal(slog.Attr{}) {

internal/loghub/hub_test.go

@@ -1,9 +1,12 @@
 package loghub
 
 import (
+	"bytes"
 	"context"
+	"errors"
 	"io"
 	"log/slog"
+	"strings"
 	"testing"
 	"time"
 )
@@ -29,6 +32,51 @@ func TestHubHistoryFiltersAndBounds(t *testing.T) {
 	}
 }
 
+func TestHubRedactsDownstreamAndHistoryAndPreservesErrors(t *testing.T) {
+	var output bytes.Buffer
+	hub := New(slog.NewJSONHandler(&output, nil), 100)
+	logger := slog.New(hub).With("imsi", "234159611634973")
+	logger.Warn(
+		"delivery to +447700900123 failed",
+		"iccid", "8944101234567890123",
+		"peer", "+447700900456",
+		"error", errors.New("modem rejected MSISDN=447700900789 with +CMS ERROR: 305"),
+	)
+
+	entry := hub.History(1, slog.LevelDebug, "")[0]
+	if strings.Contains(entry.Message, "447700900123") {
+		t.Fatalf("message was not redacted: %q", entry.Message)
+	}
+	for _, key := range []string{"imsi", "iccid", "peer"} {
+		if value := entry.Fields[key]; !strings.Contains(value.(string), "REDACTED") {
+			t.Fatalf("%s = %#v, want redacted", key, value)
+		}
+	}
+	errorText, ok := entry.Fields["error"].(string)
+	if !ok || !strings.Contains(errorText, "+CMS ERROR: 305") || strings.Contains(errorText, "447700900789") {
+		t.Fatalf("error = %#v, want original modem error with identity redacted", entry.Fields["error"])
+	}
+	if raw := output.String(); strings.Contains(raw, "234159611634973") || strings.Contains(raw, "447700900") {
+		t.Fatalf("downstream output leaked an identity: %s", raw)
+	}
+}
+
+func TestSanitizeEntryProtectsLegacyNestedFields(t *testing.T) {
+	entry := SanitizeEntry(Entry{
+		Message: "incoming SIP from sip:[email protected]",
+		Fields: map[string]any{
+			"details": map[string]any{"associated_number": "+447700900456", "status": "registered"},
+		},
+	})
+	if strings.Contains(entry.Message, "447700900123") {
+		t.Fatalf("message = %q", entry.Message)
+	}
+	details := entry.Fields["details"].(map[string]any)
+	if strings.Contains(details["associated_number"].(string), "447700900456") {
+		t.Fatalf("nested field leaked: %#v", details)
+	}
+}
+
 func TestHubSubscription(t *testing.T) {
 	hub := New(slog.NewTextHandler(io.Discard, nil), 100)
 	entries, cancel := hub.Subscribe(1)
@@ -47,3 +95,29 @@ func TestHubSubscription(t *testing.T) {
 		t.Fatal("timed out waiting for log entry")
 	}
 }
+
+func TestHubClearDropsHistoryAndQueuedEntries(t *testing.T) {
+	hub := New(slog.NewTextHandler(io.Discard, nil), 100)
+	entries, cancel := hub.Subscribe(4)
+	defer cancel()
+	logger := slog.New(hub)
+	logger.Info("before clear")
+	hub.Clear()
+	if history := hub.History(10, slog.LevelDebug, ""); len(history) != 0 {
+		t.Fatalf("history after Clear = %#v", history)
+	}
+	select {
+	case entry := <-entries:
+		t.Fatalf("queued entry survived Clear: %#v", entry)
+	default:
+	}
+	logger.Info("after clear")
+	select {
+	case entry := <-entries:
+		if entry.Message != "after clear" {
+			t.Fatalf("entry = %#v", entry)
+		}
+	case <-time.After(time.Second):
+		t.Fatal("subscriber did not remain active after Clear")
+	}
+}

internal/loghub/redact.go

@@ -0,0 +1,215 @@
+package loghub
+
+import (
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"reflect"
+	"regexp"
+	"strings"
+	"time"
+	"unicode"
+)
+
+var (
+	sipIdentityPattern        = regexp.MustCompile(`(?i)\b(sips?|tel):([^@;>,\s]+)(@[^;>,\s]+)?`)
+	internationalPhonePattern = regexp.MustCompile(`(?:\+|00)[0-9][0-9 ()-]{5,}[0-9]`)
+	longDigitsPattern         = regexp.MustCompile(`\b[0-9]{7,22}\b`)
+	labeledIdentityPattern    = regexp.MustCompile(`(?i)\b(iccid|imsi|msisdn|imei|eid)\s*([=:])\s*([a-z0-9+_-]{7,})`)
+)
+
+// IsHTTPAccessEntry identifies legacy request-traffic entries. Access traffic
+// is intentionally excluded from the user diagnostic log surface.
+func IsHTTPAccessEntry(entry Entry) bool {
+	if strings.EqualFold(strings.TrimSpace(entry.Message), "http request") {
+		return true
+	}
+	category, _ := entry.Fields["category"].(string)
+	return strings.EqualFold(strings.TrimSpace(category), "http_access")
+}
+
+// SanitizeEntry also protects records that were persisted by an older build
+// before central redaction was introduced.
+func SanitizeEntry(entry Entry) Entry {
+	entry.Message = RedactString(entry.Message)
+	entry.Caller = RedactString(entry.Caller)
+	if entry.Fields != nil {
+		entry.Fields = sanitizeMap(entry.Fields)
+	}
+	return entry
+}
+
+// RedactString masks common telecom identities while retaining enough of the
+// suffix to correlate repeated events in an exported diagnostic log.
+func RedactString(value string) string {
+	if value == "" {
+		return value
+	}
+	value = labeledIdentityPattern.ReplaceAllStringFunc(value, func(match string) string {
+		parts := labeledIdentityPattern.FindStringSubmatch(match)
+		return parts[1] + parts[2] + maskToken(parts[3])
+	})
+	value = sipIdentityPattern.ReplaceAllStringFunc(value, func(match string) string {
+		parts := sipIdentityPattern.FindStringSubmatch(match)
+		domain := parts[3]
+		return parts[1] + ":" + maskToken(parts[2]) + domain
+	})
+	value = internationalPhonePattern.ReplaceAllStringFunc(value, maskToken)
+	return longDigitsPattern.ReplaceAllStringFunc(value, maskToken)
+}
+
+func sanitizeRecord(record slog.Record) slog.Record {
+	clean := slog.NewRecord(record.Time, record.Level, RedactString(record.Message), record.PC)
+	record.Attrs(func(attr slog.Attr) bool {
+		clean.AddAttrs(sanitizeAttr(attr))
+		return true
+	})
+	return clean
+}
+
+func sanitizeAttrs(attrs []slog.Attr) []slog.Attr {
+	clean := make([]slog.Attr, 0, len(attrs))
+	for _, attr := range attrs {
+		clean = append(clean, sanitizeAttr(attr))
+	}
+	return clean
+}
+
+func sanitizeAttr(attr slog.Attr) slog.Attr {
+	attr.Value = attr.Value.Resolve()
+	if attr.Equal(slog.Attr{}) {
+		return attr
+	}
+	if sensitiveKey(attr.Key) {
+		return slog.String(attr.Key, maskToken(valueText(attr.Value.Any())))
+	}
+	if attr.Value.Kind() == slog.KindGroup {
+		children := attr.Value.Group()
+		return slog.Group(attr.Key, attrsToAny(sanitizeAttrs(children))...)
+	}
+	switch attr.Value.Kind() {
+	case slog.KindString:
+		return slog.String(attr.Key, RedactString(attr.Value.String()))
+	case slog.KindAny:
+		return slog.Any(attr.Key, sanitizeAny(attr.Value.Any(), attr.Key))
+	default:
+		return attr
+	}
+}
+
+func attrsToAny(attrs []slog.Attr) []any {
+	values := make([]any, len(attrs))
+	for index := range attrs {
+		values[index] = attrs[index]
+	}
+	return values
+}
+
+func sanitizeAny(value any, key string) any {
+	if value == nil {
+		return nil
+	}
+	if sensitiveKey(key) {
+		return maskToken(valueText(value))
+	}
+	switch typed := value.(type) {
+	case error:
+		return RedactString(typed.Error())
+	case string:
+		return RedactString(typed)
+	case []byte:
+		return RedactString(string(typed))
+	case json.RawMessage:
+		var decoded any
+		if json.Unmarshal(typed, &decoded) == nil {
+			return sanitizeAny(decoded, key)
+		}
+		return RedactString(string(typed))
+	case map[string]any:
+		return sanitizeMap(typed)
+	case []any:
+		result := make([]any, len(typed))
+		for index := range typed {
+			result[index] = sanitizeAny(typed[index], key)
+		}
+		return result
+	case time.Time, time.Duration:
+		return value
+	}
+
+	rv := reflect.ValueOf(value)
+	if rv.IsValid() && (rv.Kind() == reflect.Map || rv.Kind() == reflect.Slice || rv.Kind() == reflect.Array || rv.Kind() == reflect.Struct || rv.Kind() == reflect.Pointer) {
+		if raw, err := json.Marshal(value); err == nil {
+			var decoded any
+			if json.Unmarshal(raw, &decoded) == nil {
+				return sanitizeAny(decoded, key)
+			}
+		}
+	}
+	if stringer, ok := value.(fmt.Stringer); ok {
+		return RedactString(stringer.String())
+	}
+	return value
+}
+
+func sanitizeMap(source map[string]any) map[string]any {
+	result := make(map[string]any, len(source))
+	for key, value := range source {
+		result[key] = sanitizeAny(value, key)
+	}
+	return result
+}
+
+func sensitiveKey(key string) bool {
+	normalized := strings.Map(func(r rune) rune {
+		if unicode.IsLetter(r) || unicode.IsDigit(r) {
+			return unicode.ToLower(r)
+		}
+		return -1
+	}, key)
+	if strings.Contains(normalized, "password") || strings.Contains(normalized, "passwd") ||
+		strings.Contains(normalized, "secret") || strings.Contains(normalized, "token") ||
+		strings.Contains(normalized, "cookie") || strings.Contains(normalized, "authorization") ||
+		strings.Contains(normalized, "privateidentity") || strings.Contains(normalized, "publicidentity") ||
+		strings.Contains(normalized, "associatednumber") || strings.Contains(normalized, "sipuri") {
+		return true
+	}
+	switch normalized {
+	case "iccid", "imsi", "imei", "eid", "supi", "suci", "msisdn", "phone", "phonenumber",
+		"number", "caller", "called", "callee", "recipient", "peer", "from", "to":
+		return true
+	default:
+		return false
+	}
+}
+
+func valueText(value any) string {
+	if value == nil {
+		return ""
+	}
+	if err, ok := value.(error); ok {
+		return err.Error()
+	}
+	return fmt.Sprint(value)
+}
+
+func maskToken(value string) string {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return "[REDACTED]"
+	}
+	runes := []rune(value)
+	digits := make([]rune, 0, 4)
+	for index := len(runes) - 1; index >= 0 && len(digits) < 4; index-- {
+		if unicode.IsDigit(runes[index]) {
+			digits = append(digits, runes[index])
+		}
+	}
+	if len(digits) == 0 {
+		return "[REDACTED]"
+	}
+	for left, right := 0, len(digits)-1; left < right; left, right = left+1, right-1 {
+		digits[left], digits[right] = digits[right], digits[left]
+	}
+	return "[REDACTED:" + string(digits) + "]"
+}

internal/modem/discovery.go

@@ -12,9 +12,13 @@ import (
 )
 
 const (
-	quectelVendorID = "2c7c"
 	djiVendorID    = "2ca3"
 	dji4GProductID = "4006"
+	// quectelVendorID covers Quectel USB modems exposed purely as serial or
+	// RNDIS/ECM devices (for example the EC200A at 2c7c:6005). Their control
+	// interface is not bound to qmi_wwan, so the QMI-binding gate would skip
+	// them even though they expose a usable AT serial port.
+	quectelVendorID = "2c7c"
 )
 
 type SysFSDiscoverer struct {
@@ -44,10 +48,19 @@ func (d *SysFSDiscoverer) Discover(ctx context.Context) ([]Candidate, error) {
 		if os.IsNotExist(err) {
 			entries = nil
 		} else {
-			return nil, fmt.Errorf("discover Quectel USB devices: %w", err)
+			return nil, fmt.Errorf("discover USB QMI modems: %w", err)
 		}
 	}
 
+	// Candidate modems are identified by kernel driver binding instead of a
+	// vendor-ID whitelist. qmi_wwan only binds Qualcomm QMI control interfaces,
+	// so any USB device with a bound interface exposes a live QMI channel. This
+	// keeps discovery vendor-neutral (SIMCom, Sierra, Telit and other
+	// Qualcomm-based modems are found automatically) while MBIM-only devices
+	// stay out, because cdc_mbim binds their control interface instead and the
+	// project has no MBIM backend.
+	qmiBound := d.qmiWWANBoundDevices()
+
 	aliases := readSerialAliases(filepath.Join(d.DevRoot, "serial", "by-id"))
 	devices := make(map[string]*discoveredUSBDevice)
 	for _, entry := range entries {
@@ -75,16 +88,24 @@ func (d *SysFSDiscoverer) Discover(ctx context.Context) ([]Candidate, error) {
 		}
 		vendorID := strings.ToLower(readTrimmed(filepath.Join(resolvedDevice, "idVendor")))
 		productID := strings.ToLower(readTrimmed(filepath.Join(resolvedDevice, "idProduct")))
-		if !isSupportedUSBModem(vendorID, productID) {
+		if _, bound := qmiBound[deviceName]; !bound && !IsDJI4GUSB(vendorID, productID) {
+			// A bound qmi_wwan interface is the strongest vendor-neutral "this is
+			// a live QMI modem" signal, but it excludes Quectel modules running
+			// in a serial or RNDIS/ECM USB composition (no qmi_wwan binding).
+			// Re-admit them by vendor so their AT serial ports stay discoverable;
+			// the candidate is only kept if a ttyUSB/ttyACM node is actually
+			// found below, which is exactly the AT-bearing composition we want.
+			if !isQuectelUSBModem(vendorID) {
 				continue
 			}
+		}
 
 		state := devices[deviceName]
 		if state == nil {
 			serialNumber := readTrimmed(filepath.Join(resolvedDevice, "serial"))
 			state = &discoveredUSBDevice{
 				candidate: Candidate{
-					ID:           candidateID(productID, serialNumber, deviceName),
+					ID:           candidateID(vendorID, productID, serialNumber, deviceName),
 					VendorID:     vendorID,
 					ProductID:    productID,
 					Manufacturer: readTrimmed(filepath.Join(resolvedDevice, "manufacturer")),
@@ -134,6 +155,22 @@ func (d *SysFSDiscoverer) Discover(ctx context.Context) ([]Candidate, error) {
 		})
 		assignQuectelPortRoles(state.candidate.Ports)
 		state.candidate.ATPort = selectATPort(state.candidate.Ports)
+		if !state.candidate.HasATPort() {
+			// A modem without a usable AT port cannot be driven by vocat, but it
+			// is far more useful to surface it with a discovery issue than to
+			// silently drop it: the operator sees the device is present and gets
+			// told why it is unusable. Two shapes land here:
+			//   * qmi_wwan is bound but no ttyUSB/ttyACM exists — the option/qcserial
+			//     driver did not claim the serial interfaces (often a missing PID
+			//     in its device-ID table, common on Ubuntu for EG25-G carrier
+			//     builds). The modem is alive; it just lacks an AT node.
+			//   * no qmi_wwan binding (Quectel re-admitted by vendor) and no AT
+			//     port — typically an MBIM/RNDIS/ECM composition. The module is on
+			//     the bus but exposes no AT serial interface vocat can open.
+			// Both resolve the same operator action: add the PID to the option
+			// driver or switch the module to a QMI+AT composition.
+			state.candidate.DiscoveryIssue = "at_port_missing"
+		}
 		result = append(result, state.candidate)
 	}
 	wwanCandidates, err := d.discoverWWAN(ctx)
@@ -145,11 +182,6 @@ func (d *SysFSDiscoverer) Discover(ctx context.Context) ([]Candidate, error) {
 	return result, nil
 }
 
-func isSupportedUSBModem(vendorID, productID string) bool {
-	return strings.EqualFold(strings.TrimSpace(vendorID), quectelVendorID) ||
-		IsDJI4GUSB(vendorID, productID)
-}
-
 // IsDJI4GUSB reports whether a USB identity belongs to the first-generation
 // DJI/Baiwang 4G module. It keeps the factory 2ca3:4006 identity usable without
 // requiring a persistent AT+QCFG USB identity rewrite to Quectel 2c7c:0125.
@@ -158,6 +190,15 @@ func IsDJI4GUSB(vendorID, productID string) bool {
 		strings.EqualFold(strings.TrimSpace(productID), dji4GProductID)
 }
 
+// isQuectelUSBModem reports whether a USB identity belongs to a Quectel
+// module. Quectel's serial/RNDIS/ECM compositions (e.g. EC200A at 2c7c:6005)
+// do not bind qmi_wwan, so discovery must fall back to the vendor ID to keep
+// them visible. The candidate is only retained if it exposes an AT serial
+// port, which filters out unrelated Quectel-branded peripherals.
+func isQuectelUSBModem(vendorID string) bool {
+	return strings.EqualFold(strings.TrimSpace(vendorID), quectelVendorID)
+}
+
 type discoveredWWANDevice struct {
 	index    string
 	ports    []Port
@@ -252,7 +293,7 @@ func (d *SysFSDiscoverer) discoverWWAN(ctx context.Context) ([]Candidate, error)
 			Ports: group.ports, NetworkInterface: selectWWANNetworkInterface(d.SysRoot, group.index),
 		}
 		if len(group.ports) > 0 {
-			candidate.ATPort = group.ports[0]
+			candidate.ATPort = selectWWANATPort(group.ports)
 		}
 		if len(group.qmiNames) > 0 {
 			candidate.QMIControl = filepath.Join(d.DevRoot, group.qmiNames[0])
@@ -263,6 +304,20 @@ func (d *SysFSDiscoverer) discoverWWAN(ctx context.Context) ([]Candidate, error)
 	return result, nil
 }
 
+// selectWWANATPort prefers the secondary AT port (…at1) over the primary
+// (…at0) when both exist, falling back to the first AT port otherwise. Some
+// Qualcomm MHI modems (notably the UFI dongle behind the OpenStick 410) answer
+// on at1 immediately while at0 delays every response by 10-20 seconds, so the
+// secondary port is the usable AT channel.
+func selectWWANATPort(ports []Port) Port {
+	for _, port := range ports {
+		if port.InterfaceNumber == 1 {
+			return port
+		}
+	}
+	return ports[0]
+}
+
 func parseWWANPortName(name string) (index, kind string, portIndex int, ok bool) {
 	if !strings.HasPrefix(name, "wwan") {
 		return "", "", 0, false
@@ -402,7 +457,34 @@ func readSerialAliases(root string) map[string]string {
 	return result
 }
 
-func candidateID(productID, serialNumber, usbName string) string {
+// qmiWWANBoundDevices returns the set of USB device paths (for example "1-6"
+// or the hub-attached "1-4.3.2") that currently have at least one interface
+// bound to the kernel's qmi_wwan driver. Interface entries in the driver
+// directory are named "<device-path>:<interface>.<altsetting>", so the part
+// before the first colon is the owning USB device. The qmi_wwan driver only
+// binds Qualcomm QMI control interfaces, so membership doubles as a vendor-
+// neutral "this is a live QMI modem" signal.
+func (d *SysFSDiscoverer) qmiWWANBoundDevices() map[string]struct{} {
+	driverRoot := filepath.Join(d.SysRoot, "bus", "usb", "drivers", "qmi_wwan")
+	entries, err := os.ReadDir(driverRoot)
+	if err != nil {
+		return nil
+	}
+	devices := make(map[string]struct{})
+	for _, entry := range entries {
+		// The driver directory also holds control files (bind, unbind, uevent,
+		// module, new_id, ...); only names containing a colon are interfaces.
+		deviceName, _, ok := strings.Cut(entry.Name(), ":")
+		if !ok || deviceName == "" {
+			continue
+		}
+		devices[deviceName] = struct{}{}
+	}
+	return devices
+}
+
+func candidateID(vendorID, productID, serialNumber, usbName string) string {
+	prefix := "usb-" + sanitizeID(vendorID)
 	serialNumber = strings.TrimSpace(serialNumber)
 	if serialNumber != "" && !strings.EqualFold(serialNumber, "android") {
 		// A surprising number of EC20/EC25 carrier boards expose the same
@@ -411,9 +493,9 @@ func candidateID(productID, serialNumber, usbName string) string {
 		// to the same hub into one entry.  Include the physical USB topology in the
 		// discovery key; configured devices remain stable through ATMapper's
 		// USB-path/IMEI matching even when Linux renumbers ttyUSB nodes.
-		return "quectel-" + sanitizeID(serialNumber+"-"+usbName)
+		return prefix + "-" + sanitizeID(serialNumber+"-"+usbName)
 	}
-	return "quectel-" + sanitizeID(productID+"-"+usbName)
+	return prefix + "-" + sanitizeID(productID+"-"+usbName)
 }
 
 func sanitizeID(value string) string {

internal/modem/discovery_common_test.go

@@ -2,24 +2,24 @@ package modem
 
 import "testing"
 
-func TestSupportedUSBModemIdentity(t *testing.T) {
+func TestIsDJI4GUSBIdentity(t *testing.T) {
 	tests := []struct {
 		name      string
 		vendorID  string
 		productID string
 		want      bool
 	}{
-		{name: "Quectel", vendorID: "2c7c", productID: "0125", want: true},
 		{name: "DJI 4G module", vendorID: "2ca3", productID: "4006", want: true},
 		{name: "DJI 4G module uppercase", vendorID: "2CA3", productID: "4006", want: true},
 		{name: "unrelated DJI device", vendorID: "2ca3", productID: "001f", want: false},
+		{name: "Quectel identity", vendorID: "2c7c", productID: "0125", want: false},
 		{name: "unrelated USB device", vendorID: "0403", productID: "6001", want: false},
 	}
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			if got := isSupportedUSBModem(test.vendorID, test.productID); got != test.want {
+			if got := IsDJI4GUSB(test.vendorID, test.productID); got != test.want {
-				t.Fatalf("isSupportedUSBModem(%q, %q) = %v, want %v", test.vendorID, test.productID, got, test.want)
+				t.Fatalf("IsDJI4GUSB(%q, %q) = %v, want %v", test.vendorID, test.productID, got, test.want)
 			}
 		})
 	}

internal/modem/discovery_test.go

@@ -8,6 +8,7 @@ import (
 	"os"
 	"path/filepath"
 	"strconv"
+	"strings"
 	"testing"
 )
 
@@ -47,6 +48,7 @@ func TestSysFSDiscoverySelectsInterface04AndNeverInterface02(t *testing.T) {
 	}
 	mustMkdir(t, filepath.Join(usbRoot, "1-6:1.0", "net", "enx001122334455"))
 	mustMkdir(t, filepath.Join(usbRoot, "1-6:1.4", "usbmisc", "cdc-wdm0"))
+	mustBindQMIWWAN(t, sysRoot, "1-6:1.4")
 
 	discoverer := NewSysFSDiscoverer(sysRoot, devRoot)
 	candidates, err := discoverer.Discover(context.Background())
@@ -57,7 +59,7 @@ func TestSysFSDiscoverySelectsInterface04AndNeverInterface02(t *testing.T) {
 		t.Fatalf("got %d candidates, want 1", len(candidates))
 	}
 	candidate := candidates[0]
-	if candidate.ID != "quectel-0125-1-6" {
+	if candidate.ID != "usb-2c7c-0125-1-6" {
 		t.Fatalf("ID = %q", candidate.ID)
 	}
 	if candidate.ATPort.Name != "ttyUSB2" {
@@ -101,6 +103,7 @@ func TestSysFSDiscoverySelectsTTYUSB2InQMIInterface00Layout(t *testing.T) {
 	)
 	mustMkdir(t, filepath.Join(usbRoot, "1-6:1.4", "usbmisc", "cdc-wdm0"))
 	mustMkdir(t, filepath.Join(usbRoot, "1-6:1.4", "net", "wwp0s20f0u6i4"))
+	mustBindQMIWWAN(t, sysRoot, "1-6:1.4")
 
 	candidates, err := NewSysFSDiscoverer(sysRoot, devRoot).Discover(context.Background())
 	if err != nil {
@@ -146,6 +149,7 @@ func TestSysFSDiscoverySelectsATPortForSecondQMIUSBModem(t *testing.T) {
 		}
 		mustWrite(t, filepath.Join(usbRoot, modem.usbName+":1.4", "bInterfaceNumber"), "04\n")
 		mustMkdir(t, filepath.Join(usbRoot, modem.usbName+":1.4", "usbmisc", modem.wdm))
+		mustBindQMIWWAN(t, sysRoot, modem.usbName+":1.4")
 	}
 
 	candidates, err := NewSysFSDiscoverer(sysRoot, devRoot).Discover(context.Background())
@@ -194,6 +198,7 @@ func TestSysFSDiscoveryDoesNotCollapseModemsWithSharedFactorySerial(t *testing.T
 			mustMkdir(t, filepath.Join(usbRoot, interfaceName, tty, "tty", tty))
 		}
 		mustMkdir(t, filepath.Join(usbRoot, item.usbName+":1.4", "usbmisc", fmt.Sprintf("cdc-wdm%d", index)))
+		mustBindQMIWWAN(t, sysRoot, item.usbName+":1.4")
 	}
 
 	candidates, err := NewSysFSDiscoverer(sysRoot, devRoot).Discover(context.Background())
@@ -216,9 +221,11 @@ func TestSysFSDiscoveryDoesNotCollapseModemsWithSharedFactorySerial(t *testing.T
 	}
 }
 
-func TestSysFSDiscoveryIgnoresNonQuectelUSB(t *testing.T) {
+func TestSysFSDiscoveryIgnoresUSBWithoutQMIWWANBinding(t *testing.T) {
 	root := t.TempDir()
 	usbRoot := filepath.Join(root, "sys", "bus", "usb", "devices")
+	// A plain USB serial adapter (FTDI) exposes ttyUSB but no QMI interface and
+	// is never bound to qmi_wwan, so it must not be treated as a modem.
 	mustWrite(t, filepath.Join(usbRoot, "2-1", "idVendor"), "0403\n")
 	mustWrite(t, filepath.Join(usbRoot, "2-1:1.0", "bInterfaceNumber"), "00\n")
 	mustMkdir(t, filepath.Join(usbRoot, "2-1:1.0", "ttyUSB9"))
@@ -235,6 +242,117 @@ func TestSysFSDiscoveryIgnoresNonQuectelUSB(t *testing.T) {
 	}
 }
 
+func TestSysFSDiscoveryFindsNonQuectelVendorBoundToQMIWWAN(t *testing.T) {
+	root := t.TempDir()
+	sysRoot := filepath.Join(root, "sys")
+	devRoot := filepath.Join(root, "dev")
+	usbRoot := filepath.Join(sysRoot, "bus", "usb", "devices")
+	// A Sierra EM7430 flashed to its QMI (rmnet0) composition: non-Quectel
+	// vendor, but its control interface is bound to qmi_wwan.
+	mustWrite(t, filepath.Join(usbRoot, "1-3", "idVendor"), "1199\n")
+	mustWrite(t, filepath.Join(usbRoot, "1-3", "idProduct"), "9077\n")
+	mustWrite(t, filepath.Join(usbRoot, "1-3", "manufacturer"), "Sierra Wireless, Incorporated\n")
+	mustWrite(t, filepath.Join(usbRoot, "1-3", "product"), "EM7430\n")
+	for number, tty := range []string{"ttyUSB0", "ttyUSB1", "ttyUSB2", "ttyUSB3"} {
+		interfaceName := "1-3:1." + strconv.Itoa(number)
+		mustWrite(t, filepath.Join(usbRoot, interfaceName, "bInterfaceNumber"), fmt.Sprintf("%02x\n", number))
+		mustMkdir(t, filepath.Join(usbRoot, interfaceName, tty, "tty", tty))
+	}
+	mustMkdir(t, filepath.Join(usbRoot, "1-3:1.4", "usbmisc", "cdc-wdm0"))
+	mustBindQMIWWAN(t, sysRoot, "1-3:1.4")
+
+	candidates, err := NewSysFSDiscoverer(sysRoot, devRoot).Discover(context.Background())
+	if err != nil {
+		t.Fatalf("Discover: %v", err)
+	}
+	if len(candidates) != 1 {
+		t.Fatalf("got %d candidates, want 1", len(candidates))
+	}
+	candidate := candidates[0]
+	if candidate.VendorID != "1199" || candidate.Product != "EM7430" {
+		t.Fatalf("candidate = %#v", candidate)
+	}
+	if candidate.ID != "usb-1199-9077-1-3" {
+		t.Fatalf("ID = %q", candidate.ID)
+	}
+	if candidate.ATPort.Role != PortRoleAT {
+		t.Fatalf("AT port = %#v", candidate.ATPort)
+	}
+	if candidate.QMIControl != filepath.Join(devRoot, "cdc-wdm0") {
+		t.Fatalf("QMI control = %q", candidate.QMIControl)
+	}
+	if candidate.DiscoveryIssue != "" {
+		t.Fatalf("discovery issue = %q, want none", candidate.DiscoveryIssue)
+	}
+}
+
+func TestSysFSDiscoveryMarksQMIModemWithoutATPort(t *testing.T) {
+	root := t.TempDir()
+	sysRoot := filepath.Join(root, "sys")
+	devRoot := filepath.Join(root, "dev")
+	usbRoot := filepath.Join(sysRoot, "bus", "usb", "devices")
+	// QMI control interface is bound, but no ttyUSB/ttyACM node exists (for
+	// example the option/qcserial driver does not claim the serial interfaces).
+	mustWrite(t, filepath.Join(usbRoot, "1-7", "idVendor"), "2c7c\n")
+	mustWrite(t, filepath.Join(usbRoot, "1-7", "idProduct"), "0125\n")
+	mustMkdir(t, filepath.Join(usbRoot, "1-7:1.4", "usbmisc", "cdc-wdm0"))
+	mustBindQMIWWAN(t, sysRoot, "1-7:1.4")
+
+	candidates, err := NewSysFSDiscoverer(sysRoot, devRoot).Discover(context.Background())
+	if err != nil {
+		t.Fatalf("Discover: %v", err)
+	}
+	if len(candidates) != 1 {
+		t.Fatalf("got %d candidates, want 1", len(candidates))
+	}
+	candidate := candidates[0]
+	if candidate.DiscoveryIssue != "at_port_missing" {
+		t.Fatalf("discovery issue = %q, want at_port_missing", candidate.DiscoveryIssue)
+	}
+	if candidate.HasATPort() {
+		t.Fatalf("candidate unexpectedly has an AT port: %#v", candidate.ATPort)
+	}
+	if candidate.QMIControl != filepath.Join(devRoot, "cdc-wdm0") {
+		t.Fatalf("QMI control = %q", candidate.QMIControl)
+	}
+}
+
+func TestSysFSDiscoveryFindsHubAttachedQMIWWANDevice(t *testing.T) {
+	root := t.TempDir()
+	sysRoot := filepath.Join(root, "sys")
+	devRoot := filepath.Join(root, "dev")
+	usbRoot := filepath.Join(sysRoot, "bus", "usb", "devices")
+	// Device behind a hub: the USB path "1-4.3.2" contains extra segments, and
+	// the qmi_wwan binding uses the same composite path before the colon.
+	mustWrite(t, filepath.Join(usbRoot, "1-4.3.2", "idVendor"), "2c7c\n")
+	mustWrite(t, filepath.Join(usbRoot, "1-4.3.2", "idProduct"), "0125\n")
+	for number, tty := range []string{"ttyUSB0", "ttyUSB1", "ttyUSB2", "ttyUSB3"} {
+		interfaceName := "1-4.3.2:1." + strconv.Itoa(number)
+		mustWrite(t, filepath.Join(usbRoot, interfaceName, "bInterfaceNumber"), fmt.Sprintf("%02x\n", number))
+		mustMkdir(t, filepath.Join(usbRoot, interfaceName, tty, "tty", tty))
+	}
+	mustMkdir(t, filepath.Join(usbRoot, "1-4.3.2:1.4", "usbmisc", "cdc-wdm0"))
+	mustBindQMIWWAN(t, sysRoot, "1-4.3.2:1.4")
+
+	candidates, err := NewSysFSDiscoverer(sysRoot, devRoot).Discover(context.Background())
+	if err != nil {
+		t.Fatalf("Discover: %v", err)
+	}
+	if len(candidates) != 1 {
+		t.Fatalf("got %d candidates, want 1", len(candidates))
+	}
+	candidate := candidates[0]
+	if candidate.ATPort.Name != "ttyUSB2" {
+		t.Fatalf("AT port = %#v, want ttyUSB2", candidate.ATPort)
+	}
+	if candidate.QMIControl != filepath.Join(devRoot, "cdc-wdm0") {
+		t.Fatalf("QMI control = %q", candidate.QMIControl)
+	}
+	if !strings.Contains(candidate.ID, "1-4-3-2") {
+		t.Fatalf("ID = %q, want hub topology in discovery key", candidate.ID)
+	}
+}
+
 func TestSysFSDiscoveryFindsPCIeMHIWWANWithoutUSBBus(t *testing.T) {
 	root := t.TempDir()
 	sysRoot := filepath.Join(root, "sys")
@@ -256,7 +374,7 @@ func TestSysFSDiscoveryFindsPCIeMHIWWANWithoutUSBBus(t *testing.T) {
 	if candidate.ID != "mhi-wwan0" || candidate.HardwareKind != "wwan" {
 		t.Fatalf("identity = %#v", candidate)
 	}
-	if candidate.ATPort.Path != filepath.Join(devRoot, "wwan0at0") || candidate.ATPort.Role != PortRoleAT {
+	if candidate.ATPort.Path != filepath.Join(devRoot, "wwan0at1") || candidate.ATPort.Role != PortRoleAT {
 		t.Fatalf("AT port = %#v", candidate.ATPort)
 	}
 	if candidate.QMIControl != filepath.Join(devRoot, "wwan0qmi0") {
@@ -290,6 +408,23 @@ func TestSysFSDiscoveryFindsWWANFromDevNodesWithoutClassDirectory(t *testing.T)
 	}
 }
 
+func TestSelectWWANATPortPrefersSecondaryATPort(t *testing.T) {
+	ports := []Port{
+		{Name: "wwan0at0", InterfaceNumber: 0, Role: PortRoleAT},
+		{Name: "wwan0at1", InterfaceNumber: 1, Role: PortRoleAT},
+	}
+	if got := selectWWANATPort(ports); got.Name != "wwan0at1" {
+		t.Fatalf("selectWWANATPort = %#v, want wwan0at1", got)
+	}
+}
+
+func TestSelectWWANATPortFallsBackToPrimaryWhenOnlyAT0(t *testing.T) {
+	ports := []Port{{Name: "wwan0at0", InterfaceNumber: 0, Role: PortRoleAT}}
+	if got := selectWWANATPort(ports); got.Name != "wwan0at0" {
+		t.Fatalf("selectWWANATPort = %#v, want wwan0at0", got)
+	}
+}
+
 func TestParseWWANPortName(t *testing.T) {
 	for _, test := range []struct {
 		name, index, kind string
@@ -309,6 +444,115 @@ func TestParseWWANPortName(t *testing.T) {
 	}
 }
 
+func TestSysFSDiscoveryFindsQuectelSerialModemWithoutQMIWWANBinding(t *testing.T) {
+	root := t.TempDir()
+	sysRoot := filepath.Join(root, "sys")
+	devRoot := filepath.Join(root, "dev")
+	usbRoot := filepath.Join(sysRoot, "bus", "usb", "devices")
+	// A Quectel EC200A in its USB-serial composition (2c7c:6005) exposes ttyUSB
+	// control ports but no qmi_wwan-bound interface, so discovery must re-admit
+	// it by vendor instead of skipping it.
+	mustWrite(t, filepath.Join(usbRoot, "1-6", "idVendor"), "2c7c\n")
+	mustWrite(t, filepath.Join(usbRoot, "1-6", "idProduct"), "6005\n")
+	for number, tty := range []string{"ttyUSB0", "ttyUSB1", "ttyUSB2", "ttyUSB3"} {
+		interfaceName := "1-6:1." + strconv.Itoa(number)
+		mustWrite(t, filepath.Join(usbRoot, interfaceName, "bInterfaceNumber"), fmt.Sprintf("%02x\n", number))
+		mustMkdir(t, filepath.Join(usbRoot, interfaceName, tty, "tty", tty))
+	}
+
+	candidates, err := NewSysFSDiscoverer(sysRoot, devRoot).Discover(context.Background())
+	if err != nil {
+		t.Fatalf("Discover: %v", err)
+	}
+	if len(candidates) != 1 {
+		t.Fatalf("got %d candidates, want 1", len(candidates))
+	}
+	candidate := candidates[0]
+	if candidate.VendorID != "2c7c" || candidate.ProductID != "6005" {
+		t.Fatalf("candidate = %#v", candidate)
+	}
+	if candidate.ID != "usb-2c7c-6005-1-6" {
+		t.Fatalf("ID = %q", candidate.ID)
+	}
+	if candidate.ATPort.Name != "ttyUSB2" || candidate.ATPort.Role != PortRoleAT {
+		t.Fatalf("AT port = %#v, want ttyUSB2 at role AT", candidate.ATPort)
+	}
+	if candidate.DiscoveryIssue != "" {
+		t.Fatalf("discovery issue = %q, want none", candidate.DiscoveryIssue)
+	}
+}
+
+func TestSysFSDiscoveryMarksQuectelPeripheralWithoutATPort(t *testing.T) {
+	root := t.TempDir()
+	sysRoot := filepath.Join(root, "sys")
+	devRoot := filepath.Join(root, "dev")
+	usbRoot := filepath.Join(sysRoot, "bus", "usb", "devices")
+	// A Quectel-branded peripheral exposing only a network interface (no
+	// ttyUSB/ttyACM, no qmi_wwan binding) cannot be driven yet, but vocat
+	// surfaces it with at_port_missing instead of silently dropping it so the
+	// operator sees the device is present and learns what to fix.
+	mustWrite(t, filepath.Join(usbRoot, "1-8", "idVendor"), "2c7c\n")
+	mustWrite(t, filepath.Join(usbRoot, "1-8", "idProduct"), "6005\n")
+	mustMkdir(t, filepath.Join(usbRoot, "1-8:1.0", "net", "enx001122334455"))
+
+	candidates, err := NewSysFSDiscoverer(sysRoot, devRoot).Discover(context.Background())
+	if err != nil {
+		t.Fatalf("Discover: %v", err)
+	}
+	if len(candidates) != 1 {
+		t.Fatalf("got %d candidates, want 1", len(candidates))
+	}
+	candidate := candidates[0]
+	if candidate.DiscoveryIssue != "at_port_missing" {
+		t.Fatalf("discovery issue = %q, want at_port_missing", candidate.DiscoveryIssue)
+	}
+	if candidate.HasATPort() {
+		t.Fatalf("candidate unexpectedly has an AT port: %#v", candidate.ATPort)
+	}
+	if candidate.NetworkInterface != "enx001122334455" {
+		t.Fatalf("network interface = %q", candidate.NetworkInterface)
+	}
+}
+
+func TestSysFSDiscoveryMarksQuectelMBIMCompositionWithoutATPort(t *testing.T) {
+	root := t.TempDir()
+	sysRoot := filepath.Join(root, "sys")
+	devRoot := filepath.Join(root, "dev")
+	usbRoot := filepath.Join(sysRoot, "bus", "usb", "devices")
+	// An EG25-G in MBIM composition (2c7c:0900) exposes cdc-wdm + net but no
+	// ttyUSB and has no qmi_wwan binding (cdc_mbim binds the control interface
+	// instead). vocat has no MBIM backend, so it must surface the device with
+	// at_port_missing rather than hiding it.
+	mustWrite(t, filepath.Join(usbRoot, "1-6", "idVendor"), "2c7c\n")
+	mustWrite(t, filepath.Join(usbRoot, "1-6", "idProduct"), "0900\n")
+	mustWrite(t, filepath.Join(usbRoot, "1-6", "product"), "EG25-G\n")
+	mustMkdir(t, filepath.Join(usbRoot, "1-6:1.0", "usbmisc", "cdc-wdm0"))
+	mustMkdir(t, filepath.Join(usbRoot, "1-6:1.0", "net", "wwp0s20f0u6"))
+
+	candidates, err := NewSysFSDiscoverer(sysRoot, devRoot).Discover(context.Background())
+	if err != nil {
+		t.Fatalf("Discover: %v", err)
+	}
+	if len(candidates) != 1 {
+		t.Fatalf("got %d candidates, want 1", len(candidates))
+	}
+	candidate := candidates[0]
+	if candidate.DiscoveryIssue != "at_port_missing" {
+		t.Fatalf("discovery issue = %q, want at_port_missing", candidate.DiscoveryIssue)
+	}
+	if candidate.HasATPort() {
+		t.Fatalf("candidate unexpectedly has an AT port: %#v", candidate.ATPort)
+	}
+	if candidate.Product != "EG25-G" {
+		t.Fatalf("product = %q", candidate.Product)
+	}
+	// cdc-wdm0 sits under usbmisc/, which scanUSBInterface reports as a QMI
+	// control name; either way the device must appear present, not vanish.
+	if candidate.QMIControl == "" && candidate.NetworkInterface == "" {
+		t.Fatalf("candidate has neither QMI control nor net interface: %#v", candidate)
+	}
+}
+
 func mustWrite(t *testing.T, path, value string) {
 	t.Helper()
 	mustMkdir(t, filepath.Dir(path))
@@ -323,3 +567,18 @@ func mustMkdir(t *testing.T, path string) {
 		t.Fatal(err)
 	}
 }
+
+// mustBindQMIWWAN mimics the kernel's driver-binding directory entry: it adds
+// interfaceName (e.g. "1-6:1.4") under /sys/bus/usb/drivers/qmi_wwan exactly
+// like the real qmi_wwan driver directory does for a bound QMI interface.
+func mustBindQMIWWAN(t *testing.T, sysRoot, interfaceName string) {
+	t.Helper()
+	driverDir := filepath.Join(sysRoot, "bus", "usb", "drivers", "qmi_wwan")
+	if err := os.MkdirAll(driverDir, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	target := filepath.Join(sysRoot, "bus", "usb", "devices", interfaceName)
+	if err := os.Symlink(target, filepath.Join(driverDir, interfaceName)); err != nil {
+		t.Fatal(err)
+	}
+}

internal/modem/session.go

@@ -148,14 +148,19 @@ func (session *Session) executeLocked(ctx context.Context, command string) (Resp
 	if err := ctx.Err(); err != nil {
 		return response, err
 	}
-	if err := writeAll(session.transport, []byte(command+"\r")); err != nil {
+	// Drain the transport before writing the command. Serial transports wait
-		session.poisonLocked()
+	// for any pending output here (a no-op after a synchronous command), while
-		return response, fmt.Errorf("write %s: %w", command, err)
+	// WWAN transports discard bytes left over from a previous command that
-	}
+	// timed out; without this, a late reply (e.g. a slow CGSN response) would
+	// be mis-parsed as this command's output.
 	if err := drainTransport(ctx, session.transport); err != nil {
 		session.poisonLocked()
 		return response, fmt.Errorf("drain %s: %w", command, err)
 	}
+	if err := writeAll(session.transport, []byte(command+"\r")); err != nil {
+		session.poisonLocked()
+		return response, fmt.Errorf("write %s: %w", command, err)
+	}
 	return session.readFinalLocked(ctx, started, command, "", response)
 }
 

internal/modem/session_test.go

@@ -453,6 +453,62 @@ func TestSessionExecutePromptRejectsUnsafeInput(t *testing.T) {
 	}
 }
 
+// drainOrderTransport forwards to an inner Transport while recording
+// transport-level events, so a test can assert the exact order of Drain and
+// Write calls.
+type drainOrderTransport struct {
+	inner  Transport
+	events chan string
+}
+
+func (transport *drainOrderTransport) Write(payload []byte) (int, error) {
+	transport.events <- "write:" + string(payload)
+	return transport.inner.Write(payload)
+}
+
+func (transport *drainOrderTransport) Read(buffer []byte) (int, error) {
+	return transport.inner.Read(buffer)
+}
+
+func (transport *drainOrderTransport) Drain() error {
+	transport.events <- "drain"
+	return transport.inner.Drain()
+}
+
+func (transport *drainOrderTransport) ResetInputBuffer() error {
+	return transport.inner.ResetInputBuffer()
+}
+
+func (transport *drainOrderTransport) SetReadTimeout(timeout time.Duration) error {
+	return transport.inner.SetReadTimeout(timeout)
+}
+
+func (transport *drainOrderTransport) Close() error {
+	return transport.inner.Close()
+}
+
+// WWAN transports discard stale bytes left over from a timed-out command
+// inside Drain, so the session must call it before writing the next command;
+// otherwise a late reply (e.g. a slow CGSN response) would be mis-parsed as
+// the new command's output.
+func TestSessionDrainsBeforeWritingCommand(t *testing.T) {
+	inner := &transcriptTransport{steps: []transportStep{{
+		write:  "AT+CSQ\r",
+		chunks: []string{"\r\n+CSQ: 24,99\r\nOK\r\n"},
+	}}}
+	events := make(chan string, 8)
+	session := newTestSession(t, &drainOrderTransport{inner: inner, events: events})
+	if _, err := session.Execute(context.Background(), "AT+CSQ"); err != nil {
+		t.Fatalf("Execute: %v", err)
+	}
+	if first := <-events; first != "drain" {
+		t.Fatalf("first transport event = %q, want drain before the command write", first)
+	}
+	if second := <-events; second != "write:AT+CSQ\r" {
+		t.Fatalf("second transport event = %q, want the command write", second)
+	}
+}
+
 func newTestSession(t *testing.T, transport Transport) *Session {
 	t.Helper()
 	session, err := NewSession(transport, SessionOptions{

internal/modem/wwan_at_linux.go

@@ -108,9 +108,28 @@ func (transport *nativeWWANATTransport) Drain() error {
 		return io.ErrClosedPipe
 	}
 	// WWAN character-device writes are handed to the modem synchronously and
-	// have no termios output queue to drain.
+	// have no termios output queue to drain. A previous command that timed out
+	// can leave late bytes in the input buffer (e.g. a slow CGSN reply that
+	// arrives after the command deadline); discard them here so the next
+	// command starts from a clean stream instead of mis-parsing stale output.
+	buffer := make([]byte, 4096)
+	for {
+		fds := []unix.PollFd{{Fd: int32(transport.fd), Events: unix.POLLIN}}
+		ready, err := unix.Poll(fds, 0)
+		if err != nil {
+			return err
+		}
+		if ready == 0 || fds[0].Revents&unix.POLLIN == 0 {
 			return nil
 		}
+		if _, err := unix.Read(transport.fd, buffer); err != nil {
+			if errors.Is(err, unix.EINTR) || errors.Is(err, unix.EAGAIN) {
+				continue
+			}
+			return err
+		}
+	}
+}
 
 func (transport *nativeWWANATTransport) ResetInputBuffer() error {
 	transport.mu.RLock()

internal/modem/wwan_at_linux_test.go

@@ -0,0 +1,78 @@
+//go:build linux
+
+package modem
+
+import (
+	"errors"
+	"io"
+	"testing"
+
+	"golang.org/x/sys/unix"
+)
+
+// TestNativeWWANATTransportDrainDiscardsPendingBytes verifies Drain discards
+// every byte already buffered on the transport. A command that timed out (e.g.
+// AT+CGSN on an MHI modem that never answers OK) can leave its late reply in
+// the input buffer; the next command's Drain must clear it, however much data
+// is pending, before the session writes the new command.
+func TestNativeWWANATTransportDrainDiscardsPendingBytes(t *testing.T) {
+	readFD, writeFD := socketpair(t)
+	defer unix.Close(writeFD)
+
+	// More than one 4096-byte Drain read: a slow CGSN reply (echo + IMEI +
+	// trailing CRLF) can exceed a single buffer.
+	payload := make([]byte, 12000)
+	for index := range payload {
+		payload[index] = byte('A' + index%26)
+	}
+	payload = append(payload, []byte("\r\n+CGSN: 357091089453326\r\n")...)
+	if _, err := unix.Write(writeFD, payload); err != nil {
+		t.Fatalf("seed stale bytes: %v", err)
+	}
+
+	transport := &nativeWWANATTransport{fd: readFD, readTimeout: -1}
+	if err := transport.Drain(); err != nil {
+		t.Fatalf("Drain: %v", err)
+	}
+	assertNoPendingBytes(t, readFD, "after Drain")
+
+	// Draining a clean transport is a fast no-op that must not block or error.
+	if err := transport.Drain(); err != nil {
+		t.Fatalf("second Drain: %v", err)
+	}
+}
+
+// TestNativeWWANATTransportDrainRejectsClosedTransport covers the guard that
+// keeps a poisoned session from draining a wedged, already-closed fd.
+func TestNativeWWANATTransportDrainRejectsClosedTransport(t *testing.T) {
+	readFD, writeFD := socketpair(t)
+	defer unix.Close(writeFD)
+	transport := &nativeWWANATTransport{fd: readFD, readTimeout: -1}
+	if err := transport.Close(); err != nil {
+		t.Fatalf("Close: %v", err)
+	}
+	if err := transport.Drain(); !errors.Is(err, io.ErrClosedPipe) {
+		t.Fatalf("Drain after Close = %v, want ErrClosedPipe", err)
+	}
+}
+
+func socketpair(t *testing.T) (int, int) {
+	t.Helper()
+	fds, err := unix.Socketpair(unix.AF_UNIX, unix.SOCK_STREAM, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return fds[0], fds[1]
+}
+
+func assertNoPendingBytes(t *testing.T, fd int, context string) {
+	t.Helper()
+	fds := []unix.PollFd{{Fd: int32(fd), Events: unix.POLLIN}}
+	ready, err := unix.Poll(fds, 0)
+	if err != nil {
+		t.Fatalf("poll %s: %v", context, err)
+	}
+	if ready != 0 {
+		t.Fatalf("%s: fd still readable", context)
+	}
+}

internal/netguard/public.go

@@ -3,6 +3,7 @@ package netguard
 import (
 	"context"
 	"crypto/tls"
+	"crypto/x509"
 	"errors"
 	"fmt"
 	"net"
@@ -48,6 +49,13 @@ func ValidatePublicURL(ctx context.Context, raw string, requireHTTPS bool) (*url
 // rejects private/special-use destinations at dial time, and validates every
 // redirect before following it.
 func NewPublicHTTPClient(timeout time.Duration, requireHTTPS bool) *http.Client {
+	return NewPublicHTTPClientWithRootCAs(timeout, requireHTTPS, nil)
+}
+
+// NewPublicHTTPClientWithRootCAs creates the same guarded client while using
+// the supplied trust pool for protocols whose standards define additional
+// public roots beyond the host operating system's CA bundle.
+func NewPublicHTTPClientWithRootCAs(timeout time.Duration, requireHTTPS bool, roots *x509.CertPool) *http.Client {
 	if timeout <= 0 {
 		timeout = 30 * time.Second
 	}
@@ -60,6 +68,7 @@ func NewPublicHTTPClient(timeout time.Duration, requireHTTPS bool) *http.Client
 		ExpectContinueTimeout: time.Second,
 		TLSClientConfig: &tls.Config{
 			MinVersion: tls.VersionTLS12,
+			RootCAs:    roots,
 		},
 	}
 	return &http.Client{

internal/pcsc/backend_linux.go

@@ -10,6 +10,7 @@ import (
 	"fmt"
 	"net"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"strconv"
 	"strings"
@@ -44,9 +45,107 @@ func (backend *nativeBackend) dial(ctx context.Context) (*pcscdClient, error) {
 	return nil, fmt.Errorf("%w: pcscd socket is not reachable: %w", ErrUnavailable, errors.Join(failures...))
 }
 
+func ensurePCSCDService(ctx context.Context) {
+	if os.Geteuid() != 0 {
+		return
+	}
+	if _, err := os.Stat("/run/systemd/system"); err == nil {
+		_ = exec.CommandContext(ctx, "systemctl", "start", "pcscd.socket").Run()
+		_ = exec.CommandContext(ctx, "systemctl", "start", "pcscd").Run()
+	} else if _, err := os.Stat("/etc/init.d/pcscd"); err == nil {
+		_ = exec.CommandContext(ctx, "/etc/init.d/pcscd", "start").Run()
+	} else if path, err := exec.LookPath("pcscd"); err == nil {
+		_ = exec.CommandContext(ctx, path).Start()
+	}
+}
+
+func reauthorizeUSBDevice(sysRoot, usbPath string) {
+	if strings.Contains(usbPath, "..") || strings.Contains(usbPath, "/") || strings.Contains(usbPath, "\\") {
+		return
+	}
+	authPath := filepath.Join(filepath.Clean(sysRoot), "bus", "usb", "devices", usbPath, "authorized")
+	if _, err := os.Stat(authPath); err != nil {
+		return
+	}
+	_ = os.WriteFile(authPath, []byte("0\n"), 0o644)
+	time.Sleep(100 * time.Millisecond)
+	_ = os.WriteFile(authPath, []byte("1\n"), 0o644)
+}
+
+func (backend *nativeBackend) waitForPCSCReaders(ctx context.Context, client *pcscdClient, physical []Reader, states []pcscdReaderState) []pcscdReaderState {
+	// First pass: wait up to 2 seconds for active driver negotiation.
+	pollDeadline := time.Now().Add(2 * time.Second)
+	if dl, ok := ctx.Deadline(); ok && dl.Before(pollDeadline) {
+		pollDeadline = dl
+	}
+	for len(states) < len(physical) && time.Now().Before(pollDeadline) {
+		select {
+		case <-ctx.Done():
+			return states
+		case <-time.After(250 * time.Millisecond):
+		}
+		if updated, err := client.readers(ctx); err == nil {
+			states = updated
+			if len(states) >= len(physical) {
+				return states
+			}
+		}
+	}
+	if len(states) >= len(physical) {
+		return states
+	}
+
+	// Second pass: if readers are still missing from pcscd, trigger a USB re-authorization
+	// on the physical devices in sysfs to reset any stalled CCID endpoints, then poll briefly.
+	reauthorized := false
+	for _, phys := range physical {
+		if phys.USBPath != "" {
+			reauthorizeUSBDevice(backend.sysRoot, phys.USBPath)
+			reauthorized = true
+		}
+	}
+	if !reauthorized {
+		return states
+	}
+
+	retryDeadline := time.Now().Add(2 * time.Second)
+	if dl, ok := ctx.Deadline(); ok && dl.Before(retryDeadline) {
+		retryDeadline = dl
+	}
+	for len(states) < len(physical) && time.Now().Before(retryDeadline) {
+		select {
+		case <-ctx.Done():
+			return states
+		case <-time.After(300 * time.Millisecond):
+		}
+		if updated, err := client.readers(ctx); err == nil {
+			states = updated
+			if len(states) >= len(physical) {
+				return states
+			}
+		}
+	}
+	return states
+}
+
 func (backend *nativeBackend) Readers(ctx context.Context) ([]Reader, error) {
 	physical := discoverUSBSmartCardReaders(backend.sysRoot, "pcsc_driver_missing")
 	client, err := backend.dial(ctx)
+	if err != nil && len(physical) > 0 {
+		ensurePCSCDService(ctx)
+		dialDeadline := time.Now().Add(1500 * time.Millisecond)
+		for time.Now().Before(dialDeadline) {
+			select {
+			case <-ctx.Done():
+				break
+			case <-time.After(200 * time.Millisecond):
+			}
+			if c, dialErr := backend.dial(ctx); dialErr == nil {
+				client, err = c, nil
+				break
+			}
+		}
+	}
 	if err != nil {
 		if len(physical) > 0 {
 			for index := range physical {
@@ -61,6 +160,9 @@ func (backend *nativeBackend) Readers(ctx context.Context) ([]Reader, error) {
 	if err != nil {
 		return nil, err
 	}
+	if len(physical) > 0 && len(states) < len(physical) {
+		states = backend.waitForPCSCReaders(ctx, client, physical, states)
+	}
 	readers := make([]Reader, 0, len(states))
 	for _, state := range states {
 		reader := Reader{

internal/pcsc/usb_discovery.go

@@ -67,17 +67,33 @@ func mergePCSCAndUSBReaders(readers, physical []Reader) []Reader {
 		readers[0] = enrichPCSCReader(readers[0], physical[0])
 		return readers
 	}
-	seen := make(map[string]bool, len(readers))
+	matchedPhysical := make(map[string]bool, len(physical))
 	for i := range readers {
-		seen[readers[i].USBPath] = true
 		for _, usbReader := range physical {
 			if readers[i].USBPath == usbReader.USBPath {
 				readers[i] = enrichPCSCReader(readers[i], usbReader)
+				matchedPhysical[usbReader.USBPath] = true
 			}
 		}
 	}
+	// Secondary pass: if any pcsc reader is still prefixed with pcsc: (unresolved sysfs USB path),
+	// match with unmatched physical readers by VendorID/ProductID or if 1:1 remaining.
+	var remainingPhysical []Reader
+	for _, p := range physical {
+		if !matchedPhysical[p.USBPath] {
+			remainingPhysical = append(remainingPhysical, p)
+		}
+	}
+	for i := range readers {
+		if strings.HasPrefix(readers[i].USBPath, "pcsc:") && len(remainingPhysical) == 1 {
+			readers[i] = enrichPCSCReader(readers[i], remainingPhysical[0])
+			matchedPhysical[remainingPhysical[0].USBPath] = true
+			remainingPhysical = nil
+			break
+		}
+	}
 	for _, usbReader := range physical {
-		if !seen[usbReader.USBPath] {
+		if !matchedPhysical[usbReader.USBPath] {
 			readers = append(readers, usbReader)
 		}
 	}

internal/pcsc/usb_discovery_test.go

@@ -50,6 +50,27 @@ func TestMergePCSCAndSingleUSBReaderEnrichesFallbackPath(t *testing.T) {
 	}
 }
 
+func TestMergePCSCAndMultipleUSBReadersWithFallbackPath(t *testing.T) {
+	readers := mergePCSCAndUSBReaders(
+		[]Reader{
+			{Name: "Identiv uTrust 00 00", USBPath: "1-2", CardPresent: true},
+			{Name: "Generic Smart Card Reader 00 00", USBPath: "pcsc:Generic Smart Card Reader 00 00", CardPresent: true},
+		},
+		[]Reader{
+			{Name: "uTrust", USBPath: "1-2", VendorID: "04e6", ProductID: "5810", DiscoveryIssue: "pcsc_driver_missing"},
+			{Name: "ESTKme-RED", USBPath: "1-1", VendorID: "0bda", ProductID: "0165", DiscoveryIssue: "pcsc_driver_missing"},
+		},
+	)
+	if len(readers) != 2 {
+		t.Fatalf("len(readers) = %d, want 2", len(readers))
+	}
+	for _, r := range readers {
+		if r.DiscoveryIssue != "" {
+			t.Errorf("reader %#v still has discovery issue %q", r, r.DiscoveryIssue)
+		}
+	}
+}
+
 func writeUSBTestFile(t *testing.T, path, value string) {
 	t.Helper()
 	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {

internal/proxy/probe.go

@@ -3,6 +3,8 @@ package proxy
 import (
 	"bufio"
 	"context"
+	"crypto/rand"
+	"encoding/binary"
 	"errors"
 	"fmt"
 	"io"
@@ -17,18 +19,44 @@ type ProbeResult struct {
 	Reachable      bool   `json:"reachable"`
 	HandshakeOK    bool   `json:"handshake_ok"`
 	UDPAssociateOK bool   `json:"udp_associate_ok"`
+	UDPExchangeOK  bool   `json:"udp_exchange_ok"`
 	AuthMethod     string `json:"auth_method,omitempty"`
 	RelayAddr      string `json:"relay_addr,omitempty"`
+	DNSServer      string `json:"dns_server,omitempty"`
+	DNSName        string `json:"dns_name,omitempty"`
+	DNSRCode       int    `json:"dns_rcode,omitempty"`
+	RoundTripMS    int64  `json:"round_trip_ms,omitempty"`
 	Diagnosis      string `json:"diagnosis,omitempty"`
 	Hint           string `json:"hint,omitempty"`
 }
 
+const (
+	defaultProbeDNSServer = "1.1.1.1:53"
+	defaultProbeDNSName   = "example.com"
+)
+
 func ProbeSOCKS5(
 	ctx context.Context,
 	address string,
 	username string,
 	password string,
 	timeout time.Duration,
+) (ProbeResult, error) {
+	return probeSOCKS5(ctx, address, username, password, timeout, defaultProbeDNSServer, defaultProbeDNSName)
+}
+
+// probeSOCKS5 performs both the SOCKS5 control-plane negotiation and a real
+// UDP DNS round trip through the returned relay. Keeping the target injectable
+// makes the negative paths deterministic in tests without weakening the
+// production probe.
+func probeSOCKS5(
+	ctx context.Context,
+	address string,
+	username string,
+	password string,
+	timeout time.Duration,
+	dnsServer string,
+	dnsName string,
 ) (ProbeResult, error) {
 	address = strings.TrimSpace(address)
 	if _, _, err := net.SplitHostPort(address); err != nil {
@@ -122,11 +150,228 @@ func ProbeSOCKS5(
 	port := int(portBytes[0])<<8 | int(portBytes[1])
 	result.UDPAssociateOK = true
 	result.RelayAddr = net.JoinHostPort(host, fmt.Sprintf("%d", port))
+	result.DNSServer = dnsServer
+	result.DNSName = dnsName
+
+	if err := probeUDPExchange(probeContext, connection, &result, host, port, dnsServer, dnsName, timeout); err != nil {
+		if result.Diagnosis == "" {
+			result.Diagnosis = "udp_no_roundtrip"
+		}
+		if result.Hint == "" {
+			result.Hint = i18n.T("UDP ASSOCIATE 已建立，但实际 UDP 数据没有返回；检查节点 UDP 转发、路由和防火墙。")
+		}
+		return result, err
+	}
 	result.Diagnosis = "ready"
-	result.Hint = i18n.T("TCP 握手、认证和 UDP ASSOCIATE 均通过。")
+	result.Hint = i18n.T("TCP 握手、认证、UDP ASSOCIATE 与真实 UDP DNS 往返均通过。")
 	return result, nil
 }
 
+func probeUDPExchange(
+	ctx context.Context,
+	control net.Conn,
+	result *ProbeResult,
+	relayHost string,
+	relayPort int,
+	dnsServer string,
+	dnsName string,
+	timeout time.Duration,
+) error {
+	if result == nil {
+		return errors.New("proxy: probe result is nil")
+	}
+	dnsAddress, err := net.ResolveUDPAddr("udp", strings.TrimSpace(dnsServer))
+	if err != nil {
+		result.Diagnosis = "invalid_dns_target"
+		return fmt.Errorf("proxy: resolve UDP probe target: %w", err)
+	}
+	relayHost = strings.TrimSpace(relayHost)
+	if relayIP := net.ParseIP(relayHost); relayIP != nil && relayIP.IsUnspecified() {
+		remoteHost, _, splitErr := net.SplitHostPort(control.RemoteAddr().String())
+		if splitErr != nil {
+			result.Diagnosis = "invalid_udp_relay"
+			return fmt.Errorf("proxy: resolve wildcard UDP relay: %w", splitErr)
+		}
+		relayHost = remoteHost
+	}
+	relayAddress, err := net.ResolveUDPAddr("udp", net.JoinHostPort(relayHost, fmt.Sprintf("%d", relayPort)))
+	if err != nil {
+		result.Diagnosis = "invalid_udp_relay"
+		return fmt.Errorf("proxy: resolve UDP relay: %w", err)
+	}
+
+	localNetwork := "udp4"
+	if relayAddress.IP != nil && relayAddress.IP.To4() == nil {
+		localNetwork = "udp6"
+	}
+	udpConnection, err := net.ListenUDP(localNetwork, nil)
+	if err != nil {
+		result.Diagnosis = "udp_socket_failed"
+		return fmt.Errorf("proxy: open UDP probe socket: %w", err)
+	}
+	defer udpConnection.Close()
+
+	deadline := time.Now().Add(timeout)
+	if contextDeadline, ok := ctx.Deadline(); ok && contextDeadline.Before(deadline) {
+		deadline = contextDeadline
+	}
+	if err := udpConnection.SetDeadline(deadline); err != nil {
+		return fmt.Errorf("proxy: set UDP probe deadline: %w", err)
+	}
+
+	query, queryID, err := buildDNSQuery(dnsName)
+	if err != nil {
+		result.Diagnosis = "invalid_dns_name"
+		return err
+	}
+	datagram, err := buildSOCKSUDPDatagram(dnsAddress, query)
+	if err != nil {
+		result.Diagnosis = "invalid_dns_target"
+		return err
+	}
+	startedAt := time.Now()
+	if _, err := udpConnection.WriteToUDP(datagram, relayAddress); err != nil {
+		result.Diagnosis = "udp_send_failed"
+		return fmt.Errorf("proxy: send UDP DNS probe: %w", err)
+	}
+
+	responseBuffer := make([]byte, 64*1024)
+	for {
+		if err := ctx.Err(); err != nil {
+			result.Diagnosis = "udp_no_roundtrip"
+			return fmt.Errorf("proxy: UDP DNS probe cancelled: %w", err)
+		}
+		count, sender, err := udpConnection.ReadFromUDP(responseBuffer)
+		if err != nil {
+			result.Diagnosis = "udp_no_roundtrip"
+			return fmt.Errorf("proxy: UDP DNS probe did not return: %w", err)
+		}
+		if !sameUDPAddress(sender, relayAddress) {
+			continue
+		}
+		payload, err := parseSOCKSUDPDatagram(responseBuffer[:count])
+		if err != nil {
+			result.Diagnosis = "udp_invalid_response"
+			return fmt.Errorf("proxy: parse UDP relay response: %w", err)
+		}
+		rcode, err := validateDNSResponse(payload, queryID)
+		if err != nil {
+			result.Diagnosis = "dns_invalid_response"
+			return err
+		}
+		result.UDPExchangeOK = true
+		result.DNSRCode = rcode
+		result.RoundTripMS = time.Since(startedAt).Milliseconds()
+		if result.RoundTripMS < 1 {
+			result.RoundTripMS = 1
+		}
+		return nil
+	}
+}
+
+func buildDNSQuery(name string) ([]byte, uint16, error) {
+	name = strings.TrimSuffix(strings.TrimSpace(name), ".")
+	if name == "" || len(name) > 253 {
+		return nil, 0, errors.New("proxy: UDP probe DNS name is invalid")
+	}
+	var idBytes [2]byte
+	if _, err := rand.Read(idBytes[:]); err != nil {
+		return nil, 0, fmt.Errorf("proxy: generate DNS probe ID: %w", err)
+	}
+	queryID := binary.BigEndian.Uint16(idBytes[:])
+	query := make([]byte, 12, 12+len(name)+6)
+	binary.BigEndian.PutUint16(query[0:2], queryID)
+	binary.BigEndian.PutUint16(query[2:4], 0x0100)
+	binary.BigEndian.PutUint16(query[4:6], 1)
+	for _, label := range strings.Split(name, ".") {
+		if label == "" || len(label) > 63 {
+			return nil, 0, errors.New("proxy: UDP probe DNS label is invalid")
+		}
+		query = append(query, byte(len(label)))
+		query = append(query, label...)
+	}
+	query = append(query, 0, 0, 1, 0, 1)
+	return query, queryID, nil
+}
+
+func buildSOCKSUDPDatagram(target *net.UDPAddr, payload []byte) ([]byte, error) {
+	if target == nil || target.IP == nil || target.Port < 1 || target.Port > 65535 {
+		return nil, errors.New("proxy: UDP target is invalid")
+	}
+	packet := []byte{0, 0, 0}
+	if ipv4 := target.IP.To4(); ipv4 != nil {
+		packet = append(packet, 1)
+		packet = append(packet, ipv4...)
+	} else if ipv6 := target.IP.To16(); ipv6 != nil {
+		packet = append(packet, 4)
+		packet = append(packet, ipv6...)
+	} else {
+		return nil, errors.New("proxy: UDP target address family is invalid")
+	}
+	packet = append(packet, byte(target.Port>>8), byte(target.Port))
+	packet = append(packet, payload...)
+	return packet, nil
+}
+
+func parseSOCKSUDPDatagram(packet []byte) ([]byte, error) {
+	if len(packet) < 4 || packet[0] != 0 || packet[1] != 0 {
+		return nil, errors.New("invalid SOCKS5 UDP header")
+	}
+	if packet[2] != 0 {
+		return nil, errors.New("fragmented SOCKS5 UDP response is unsupported")
+	}
+	offset := 4
+	switch packet[3] {
+	case 1:
+		offset += net.IPv4len
+	case 3:
+		if len(packet) <= offset {
+			return nil, errors.New("truncated SOCKS5 UDP domain")
+		}
+		offset += 1 + int(packet[offset])
+	case 4:
+		offset += net.IPv6len
+	default:
+		return nil, errors.New("unsupported SOCKS5 UDP address type")
+	}
+	if offset+2 > len(packet) {
+		return nil, errors.New("truncated SOCKS5 UDP endpoint")
+	}
+	offset += 2
+	if offset >= len(packet) {
+		return nil, errors.New("empty SOCKS5 UDP payload")
+	}
+	return packet[offset:], nil
+}
+
+func validateDNSResponse(payload []byte, queryID uint16) (int, error) {
+	if len(payload) < 12 {
+		return 0, errors.New("proxy: DNS response is truncated")
+	}
+	if binary.BigEndian.Uint16(payload[0:2]) != queryID {
+		return 0, errors.New("proxy: DNS response ID does not match")
+	}
+	flags := binary.BigEndian.Uint16(payload[2:4])
+	if flags&0x8000 == 0 {
+		return 0, errors.New("proxy: DNS response is not a response")
+	}
+	rcode := int(flags & 0x000f)
+	if rcode != 0 {
+		return rcode, fmt.Errorf("proxy: DNS probe returned response code %d", rcode)
+	}
+	return rcode, nil
+}
+
+func sameUDPAddress(left, right *net.UDPAddr) bool {
+	if left == nil || right == nil || left.Port != right.Port {
+		return false
+	}
+	if left.IP == nil || right.IP == nil {
+		return true
+	}
+	return left.IP.Equal(right.IP)
+}
+
 func readSOCKSAddress(reader io.Reader, addressType byte) (string, error) {
 	switch addressType {
 	case 1:

internal/proxy/probe_test.go

@@ -0,0 +1,120 @@
+package proxy
+
+import (
+	"context"
+	"io"
+	"net"
+	"testing"
+	"time"
+)
+
+func TestProbeSOCKS5RequiresRealUDPExchange(t *testing.T) {
+	address, stop := startProbeSOCKS5Server(t, false)
+	defer stop()
+
+	result, err := probeSOCKS5(
+		context.Background(),
+		address,
+		"",
+		"",
+		250*time.Millisecond,
+		"192.0.2.53:53",
+		"example.test",
+	)
+	if err == nil {
+		t.Fatal("Probe unexpectedly succeeded when the relay dropped UDP data")
+	}
+	if !result.UDPAssociateOK {
+		t.Fatal("UDP ASSOCIATE should have succeeded")
+	}
+	if result.UDPExchangeOK {
+		t.Fatal("UDP exchange should not be reported as successful")
+	}
+	if result.Diagnosis != "udp_no_roundtrip" {
+		t.Fatalf("Diagnosis = %q, want udp_no_roundtrip", result.Diagnosis)
+	}
+}
+
+func TestProbeSOCKS5ReportsRealUDPDNSRoundTrip(t *testing.T) {
+	address, stop := startProbeSOCKS5Server(t, true)
+	defer stop()
+
+	result, err := probeSOCKS5(
+		context.Background(),
+		address,
+		"",
+		"",
+		time.Second,
+		"192.0.2.53:53",
+		"example.test",
+	)
+	if err != nil {
+		t.Fatalf("Probe returned error: %v", err)
+	}
+	if !result.HandshakeOK || !result.UDPAssociateOK || !result.UDPExchangeOK {
+		t.Fatalf("Probe evidence incomplete: %+v", result)
+	}
+	if result.Diagnosis != "ready" {
+		t.Fatalf("Diagnosis = %q, want ready", result.Diagnosis)
+	}
+	if result.DNSName != "example.test" || result.DNSServer != "192.0.2.53:53" {
+		t.Fatalf("Unexpected DNS evidence: %+v", result)
+	}
+}
+
+func startProbeSOCKS5Server(t *testing.T, echoDNS bool) (string, func()) {
+	t.Helper()
+	udpConnection, err := net.ListenUDP("udp4", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1)})
+	if err != nil {
+		t.Fatalf("ListenUDP: %v", err)
+	}
+	tcpListener, err := net.Listen("tcp4", "127.0.0.1:0")
+	if err != nil {
+		udpConnection.Close()
+		t.Fatalf("Listen: %v", err)
+	}
+
+	if echoDNS {
+		go func() {
+			buffer := make([]byte, 2048)
+			count, sender, readErr := udpConnection.ReadFromUDP(buffer)
+			if readErr != nil || count < 22 {
+				return
+			}
+			// The test target is IPv4, so the SOCKS5 UDP header is ten bytes.
+			buffer[12] = 0x81
+			buffer[13] = 0x80
+			_, _ = udpConnection.WriteToUDP(buffer[:count], sender)
+		}()
+	}
+
+	go func() {
+		connection, acceptErr := tcpListener.Accept()
+		if acceptErr != nil {
+			return
+		}
+		defer connection.Close()
+		greeting := make([]byte, 3)
+		if _, readErr := io.ReadFull(connection, greeting); readErr != nil {
+			return
+		}
+		if _, writeErr := connection.Write([]byte{5, 0}); writeErr != nil {
+			return
+		}
+		associate := make([]byte, 10)
+		if _, readErr := io.ReadFull(connection, associate); readErr != nil {
+			return
+		}
+		udpPort := udpConnection.LocalAddr().(*net.UDPAddr).Port
+		response := []byte{5, 0, 0, 1, 127, 0, 0, 1, byte(udpPort >> 8), byte(udpPort)}
+		if _, writeErr := connection.Write(response); writeErr != nil {
+			return
+		}
+		_, _ = io.Copy(io.Discard, connection)
+	}()
+
+	return tcpListener.Addr().String(), func() {
+		_ = tcpListener.Close()
+		_ = udpConnection.Close()
+	}
+}

internal/server/at_guard_test.go

@@ -1,6 +1,15 @@
 package server
 
-import "testing"
+import (
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"vocat/internal/device"
+	"vocat/internal/modem"
+)
 
 func TestValidateATCommandBlocksTrafficMessagingAndDialActions(t *testing.T) {
 	t.Parallel()
@@ -22,12 +31,42 @@ func TestValidateATCommandBlocksTrafficMessagingAndDialActions(t *testing.T) {
 		"AT+CSQ;+CMSS=7",
 		"AT+CSQ;D12345;",
 	} {
-		if err := validateATCommand(command); err == nil {
+		if err := validateATCommand(command, false); err == nil {
 			t.Errorf("validateATCommand(%q) permitted a guarded mutation", command)
 		}
 	}
 }
 
+func TestValidateATCommandForceBypassesGuard(t *testing.T) {
+	t.Parallel()
+	for _, command := range []string{
+		"AT+CGATT=1",
+		"AT+CFUN=1",
+		"AT+CGACT=1,1",
+		"AT+CUSD=1,\"*100#\"",
+		"ATD12345;",
+	} {
+		if err := validateATCommand(command, true); err != nil {
+			t.Errorf("validateATCommand(%q, true): %v", command, err)
+		}
+	}
+}
+
+func TestValidateATCommandForceKeepsSyntaxChecks(t *testing.T) {
+	t.Parallel()
+	for _, command := range []string{
+		"A",
+		"",
+		"AT\r",
+		"AT\n",
+		string(make([]byte, 513)),
+	} {
+		if err := validateATCommand(command, true); err == nil {
+			t.Errorf("validateATCommand(%q, true) skipped syntax check", command)
+		}
+	}
+}
+
 func TestValidateATCommandAllowsReadOnlyStatusQueries(t *testing.T) {
 	t.Parallel()
 	for _, command := range []string{
@@ -39,8 +78,67 @@ func TestValidateATCommandAllowsReadOnlyStatusQueries(t *testing.T) {
 		"AT+CIMI",
 		"AT+CCID",
 	} {
-		if err := validateATCommand(command); err != nil {
+		if err := validateATCommand(command, false); err != nil {
 			t.Errorf("validateATCommand(%q): %v", command, err)
 		}
 	}
 }
+
+// The AT terminal must present ERROR / +CME ERROR as a normal response, not as
+// a 502. Before the CommandError branch was restored, every unsupported or
+// SIM-less command was folded into "the device operation failed", hiding the
+// real reason from the user.
+func TestHandleATSurfacesCommandErrorAsResponse(t *testing.T) {
+	controller := fakeDeviceController{
+		entry: device.Device{ID: "dev1"},
+		atHandler: func(command string) (modem.Response, error) {
+			return modem.Response{}, &modem.CommandError{
+				Command: command,
+				Final:   "+CME ERROR: 10",
+				Lines:   []string{"+CME ERROR: 10"},
+			}
+		},
+	}
+	server := &Server{devices: controller, logger: regionTestLogger(), maxRequestBodyBytes: 1 << 20}
+	recorder := httptest.NewRecorder()
+	request := httptest.NewRequest(
+		http.MethodPost,
+		"/api/devices/dev1/actions/at",
+		strings.NewReader(`{"cmd":"AT+CPIN?","timeout_ms":5000}`),
+	)
+	request.Header.Set("Content-Type", "application/json")
+
+	if !server.handleAT(recorder, request, "dev1") {
+		t.Fatal("handleAT returned false")
+	}
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200 (body=%s)", recorder.Code, recorder.Body.String())
+	}
+	data := decodeData(t, recorder)
+	response, _ := data["response"].(string)
+	if !strings.Contains(response, "+CME ERROR: 10") {
+		t.Fatalf("response = %q, want +CME ERROR text", response)
+	}
+}
+
+func TestHandleATMapsNonCommandErrorTo502(t *testing.T) {
+	controller := fakeDeviceController{
+		entry: device.Device{ID: "dev1"},
+		atErr: errors.New("transport wedged"),
+	}
+	server := &Server{devices: controller, logger: regionTestLogger(), maxRequestBodyBytes: 1 << 20}
+	recorder := httptest.NewRecorder()
+	request := httptest.NewRequest(
+		http.MethodPost,
+		"/api/devices/dev1/actions/at",
+		strings.NewReader(`{"cmd":"AT+CSQ"}`),
+	)
+	request.Header.Set("Content-Type", "application/json")
+
+	if !server.handleAT(recorder, request, "dev1") {
+		t.Fatal("handleAT returned false")
+	}
+	if recorder.Code != http.StatusBadGateway {
+		t.Fatalf("status = %d, want 502", recorder.Code)
+	}
+}

internal/server/audit.go

@@ -2,6 +2,7 @@ package server
 
 import (
 	"context"
+	"log/slog"
 	"net"
 	"net/http"
 	"strings"
@@ -21,6 +22,20 @@ func (s *Server) recordAudit(
 	outcome string,
 	remoteAddr string,
 ) {
+	level := slog.LevelInfo
+	if !strings.EqualFold(strings.TrimSpace(outcome), "success") {
+		level = slog.LevelWarn
+	}
+	if s.logger != nil {
+		s.logger.Log(ctx, level, "user operation",
+			"category", auditLogCategory(action),
+			"event", action,
+			"actor", actor,
+			"entity_type", entityType,
+			"entity_id", entityID,
+			"outcome", outcome,
+		)
+	}
 	if s.store == nil {
 		return
 	}
@@ -34,7 +49,24 @@ func (s *Server) recordAudit(
 		CreatedAt:  time.Now().UTC(),
 	})
 	if err != nil {
-		s.logger.Warn("write audit event failed", "action", action, "error", err)
+		s.logger.Warn("write audit event failed", "category", "system", "action", action, "raw_error", err)
+	}
+}
+
+func auditLogCategory(action string) string {
+	action = strings.ToLower(strings.TrimSpace(action))
+	switch {
+	case strings.Contains(action, ".sms") || strings.HasPrefix(action, "sms."):
+		return "sms"
+	case strings.Contains(action, ".call") || strings.HasPrefix(action, "call."):
+		return "call"
+	case strings.Contains(action, "vowifi") || strings.Contains(action, "ims"):
+		return "vowifi"
+	case strings.Contains(action, "device") || strings.Contains(action, "esim") ||
+		strings.Contains(action, ".at.") || strings.Contains(action, ".ussd"):
+		return "hardware"
+	default:
+		return "operation"
 	}
 }
 

internal/server/automatic_task_notifications.go

@@ -57,7 +57,7 @@ func (s *Server) notifyAutomaticTask(ctx context.Context, task store.AutomaticTa
 		}, "\n"),
 		Time: run.FinishedAt, Task: task, Run: run,
 	}
-	for _, channel := range []string{"telegram", "bark", "email", "pushplus", "webhook", "wecom"} {
+	for _, channel := range []string{"telegram", "bark", "email", "pushplus", "webhook", "wecom", "lark"} {
 		setting, err := s.store.NotificationSetting(ctx, channel)
 		if errors.Is(err, store.ErrNotFound) || (err == nil && !setting.Enabled) {
 			continue
@@ -91,6 +91,8 @@ func sendAutomaticTaskNotification(ctx context.Context, channel string, config m
 		return sendAutomaticTaskWebhook(ctx, config, message)
 	case "wecom":
 		return sendWecomNotification(ctx, config, wecomAutomaticTaskValues(message))
+	case "lark":
+		return sendLarkNotification(ctx, config, larkAutomaticTaskValues(message))
 	default:
 		return fmt.Errorf("unsupported notification channel %q", channel)
 	}

internal/server/call_api.go

@@ -130,6 +130,11 @@ func (s *Server) handleCallAction(w http.ResponseWriter, r *http.Request, config
 			}
 		}
 		if err != nil {
+			s.logger.Warn("VoWiFi call operation failed",
+				"category", "call", "event", "call."+action,
+				"device_id", config.ID, "number", number, "call_id", callID,
+				"transport", transport, "raw_error", err,
+			)
 			writeError(w, http.StatusBadGateway, "vowifi_call_failed", err.Error())
 			return true
 		}
@@ -156,6 +161,11 @@ func (s *Server) handleCallAction(w http.ResponseWriter, r *http.Request, config
 		return true
 	}
 	if !strings.EqualFold(strings.TrimSpace(response.Final), "OK") {
+		s.logger.Warn("cellular call operation rejected",
+			"category", "call", "event", "call."+action,
+			"device_id", config.ID, "number", number, "transport", transport,
+			"modem_final", response.Final, "raw_response", response.Text(),
+		)
 		writeError(w, http.StatusBadGateway, "call_rejected", "modem did not accept the call action")
 		return true
 	}

internal/server/call_notifications.go

@@ -0,0 +1,353 @@
+package server
+
+import (
+	"bytes"
+	"context"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	"vocat/internal/store"
+)
+
+const (
+	callDeduplicationWindow     = 60 * time.Second
+	cellularCallMonitorInterval = 3 * time.Second
+)
+
+var (
+	callDeduplicationMu  sync.Mutex
+	callDeduplicationMap = make(map[string]time.Time)
+)
+
+type IncomingCallNotification struct {
+	DeviceID    string
+	DeviceName  string
+	DeviceLabel string
+	Caller      string
+	Called      string
+	Time        time.Time
+	Environment string
+}
+
+func (value IncomingCallNotification) Title() string {
+	return "收到来电"
+}
+
+func (value IncomingCallNotification) Text() string {
+	envText := "VoWiFi"
+	if value.Environment == "cellular" {
+		envText = "基站直连"
+	}
+	return strings.Join([]string{
+		"📞 收到来电",
+		"设备  " + value.DeviceLabel,
+		"来电号码  " + value.Caller,
+		"被呼号码  " + value.Called,
+		"时间  " + value.Time.Local().Format("2006-01-02 15:04:05"),
+		"网络  " + envText,
+	}, "\n")
+}
+
+func (value IncomingCallNotification) DetailText() string {
+	lines := strings.Split(value.Text(), "\n")
+	return strings.Join(lines[1:], "\n")
+}
+
+func shouldSuppressDuplicateCall(key string, now time.Time, window time.Duration) bool {
+	callDeduplicationMu.Lock()
+	defer callDeduplicationMu.Unlock()
+	for k, t := range callDeduplicationMap {
+		if now.Sub(t) > window*2 {
+			delete(callDeduplicationMap, k)
+		}
+	}
+	if lastTime, exists := callDeduplicationMap[key]; exists {
+		if now.Sub(lastTime) < window {
+			return true
+		}
+	}
+	callDeduplicationMap[key] = now
+	return false
+}
+
+// NotifyIncomingCall delivers an incoming call alert to all configured notification channels.
+func (s *Server) NotifyIncomingCall(ctx context.Context, notification IncomingCallNotification) {
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	caller := strings.TrimSpace(notification.Caller)
+	if caller == "" {
+		caller = "未知号码"
+	}
+	notification.Caller = caller
+
+	called := strings.TrimSpace(notification.Called)
+	if called == "" {
+		called = "--"
+	}
+	notification.Called = called
+
+	if notification.Time.IsZero() {
+		notification.Time = time.Now().UTC()
+	}
+	if s.logger != nil {
+		s.logger.Info("incoming call detected",
+			"category", "call",
+			"event", "call.incoming",
+			"device_id", notification.DeviceID,
+			"caller", notification.Caller,
+			"called", notification.Called,
+			"transport", notification.Environment,
+		)
+	}
+
+	dedupKey := fmt.Sprintf("%s:%s", notification.DeviceID, notification.Caller)
+	if shouldSuppressDuplicateCall(dedupKey, notification.Time, callDeduplicationWindow) {
+		if s.logger != nil {
+			s.logger.Debug("suppressed duplicate incoming call notification", "category", "call", "device_id", notification.DeviceID, "caller", notification.Caller)
+		}
+		return
+	}
+
+	if notification.DeviceLabel == "" || notification.DeviceLabel == "--" {
+		if configured, err := s.store.Device(ctx, notification.DeviceID); err == nil {
+			notification.DeviceName = strings.TrimSpace(configured.Name)
+			notification.DeviceLabel = firstNonEmpty(configured.Name, configured.ID, "--")
+		} else {
+			notification.DeviceLabel = firstNonEmpty(notification.DeviceID, "--")
+		}
+	}
+
+	destCtx := s.notificationDestinationContext(ctx)
+	for _, channel := range []string{"telegram", "bark", "email", "pushplus", "webhook", "wecom", "lark"} {
+		setting, err := s.store.NotificationSetting(destCtx, channel)
+		if errors.Is(err, store.ErrNotFound) || (err == nil && !setting.Enabled) {
+			continue
+		}
+		if err != nil {
+			if s.logger != nil {
+				s.logger.Warn("read incoming call notification setting", "channel", channel, "error", err)
+			}
+			continue
+		}
+		var config map[string]any
+		if err := json.Unmarshal(setting.Config, &config); err != nil {
+			if s.logger != nil {
+				s.logger.Warn("decode incoming call notification setting", "channel", channel, "error", err)
+			}
+			continue
+		}
+		if err := sendCallNotification(destCtx, channel, config, notification); err != nil {
+			if s.logger != nil {
+				s.logger.Warn("send incoming call notification", "category", "call", "channel", channel, "device_id", notification.DeviceID, "caller", notification.Caller, "raw_error", err)
+			}
+		}
+	}
+}
+
+func sendCallNotification(ctx context.Context, channel string, config map[string]any, message IncomingCallNotification) error {
+	switch channel {
+	case "telegram":
+		return sendTelegramTextNotification(ctx, config, message.Text())
+	case "bark":
+		return sendBarkTextNotification(ctx, config, message.Title(), message.DetailText())
+	case "email":
+		return sendEmailTextNotification(ctx, config, message.Title()+" - "+message.DeviceLabel, message.Text())
+	case "pushplus":
+		return sendPushplusTextNotification(ctx, config, message.Title(), message.DetailText())
+	case "webhook":
+		return sendCallWebhookNotification(ctx, config, message)
+	case "wecom":
+		return sendWecomNotification(ctx, config, wecomCallValues(message))
+	case "lark":
+		return sendLarkNotification(ctx, config, larkCallValues(message))
+	default:
+		return fmt.Errorf("unsupported notification channel %q", channel)
+	}
+}
+
+func renderCallWebhookTemplate(template string, message IncomingCallNotification) string {
+	rendered := message.Text()
+	if strings.TrimSpace(template) != "" {
+		replacements := map[string]string{
+			"{{text}}":         rendered,
+			"{{content}}":      message.DetailText(),
+			"{{event}}":        "call.received",
+			"{{timestamp}}":    message.Time.UTC().Format(time.RFC3339),
+			"{{time}}":         message.Time.Local().Format("2006-01-02 15:04:05"),
+			"{{number}}":       message.Caller,
+			"{{caller}}":       message.Caller,
+			"{{called}}":       message.Called,
+			"{{device_id}}":    message.DeviceID,
+			"{{device_name}}":  message.DeviceName,
+			"{{device_label}}": message.DeviceLabel,
+			"{{environment}}":  message.Environment,
+		}
+		for placeholder, value := range replacements {
+			template = strings.ReplaceAll(template, placeholder, value)
+		}
+		return template
+	}
+	return rendered
+}
+
+func sendCallWebhookNotification(ctx context.Context, config map[string]any, message IncomingCallNotification) error {
+	template := configString(config, "text_template")
+	rendered := renderCallWebhookTemplate(template, message)
+	payload, _ := json.Marshal(map[string]any{
+		"event":        "call.received",
+		"message":      rendered,
+		"timestamp":    message.Time.UTC().Format(time.RFC3339),
+		"device_id":    message.DeviceID,
+		"device_name":  message.DeviceName,
+		"device_label": message.DeviceLabel,
+		"caller":       message.Caller,
+		"called":       message.Called,
+		"environment":  message.Environment,
+	})
+	timeout := durationMilliseconds(configInt(config, "timeout_ms"), 5*time.Second)
+	client, err := restrictedHTTPClient(ctx, timeout, "")
+	if err != nil {
+		return err
+	}
+	retries := configInt(config, "retry_max")
+	for _, destination := range configStrings(config, "urls") {
+		parsed, err := validateOutboundURL(ctx, destination, false)
+		if err != nil {
+			return err
+		}
+		var sendErr error
+		for attempt := 0; attempt <= retries; attempt++ {
+			request, requestErr := http.NewRequestWithContext(ctx, http.MethodPost, parsed.String(), bytes.NewReader(payload))
+			if requestErr != nil {
+				return fmt.Errorf("create call webhook notification request: %w", requestErr)
+			}
+			for name, value := range configStringMap(config, "headers") {
+				request.Header.Set(name, value)
+			}
+			request.Header.Set("Content-Type", "application/json")
+			request.Header.Set("User-Agent", "vocat-call-notification/1")
+			if secret := configString(config, "secret"); secret != "" {
+				signature := hmac.New(sha256.New, []byte(secret))
+				_, _ = signature.Write(payload)
+				request.Header.Set("X-vocat-Signature", "sha256="+hex.EncodeToString(signature.Sum(nil)))
+			}
+			sendErr = performNotificationRequest(client, request, false)
+			if sendErr == nil {
+				break
+			}
+		}
+		if sendErr != nil {
+			return sendErr
+		}
+	}
+	return nil
+}
+
+func wecomCallValues(message IncomingCallNotification) wecomTemplateValues {
+	return wecomTemplateValues{
+		"event":        "call.received",
+		"title":        message.Title(),
+		"message":      message.Text(),
+		"timestamp":    message.Time.UTC().Format(time.RFC3339),
+		"content":      message.DetailText(),
+		"number":       message.Caller,
+		"device_id":    message.DeviceID,
+		"device_name":  message.DeviceName,
+		"device_label": message.DeviceLabel,
+		"time":         message.Time.Local().Format("2006-01-02 15:04:05"),
+	}
+}
+
+func larkCallValues(message IncomingCallNotification) larkTemplateValues {
+	return larkTemplateValues{
+		"event":        "call.received",
+		"title":        message.Title(),
+		"message":      message.Text(),
+		"timestamp":    message.Time.UTC().Format(time.RFC3339),
+		"content":      message.DetailText(),
+		"number":       message.Caller,
+		"device_id":    message.DeviceID,
+		"device_name":  message.DeviceName,
+		"device_label": message.DeviceLabel,
+		"time":         message.Time.Local().Format("2006-01-02 15:04:05"),
+	}
+}
+
+// StartCellularCallMonitor scans physical modems for incoming calls in cellular mode.
+func (s *Server) StartCellularCallMonitor(ctx context.Context) {
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	ticker := time.NewTicker(cellularCallMonitorInterval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			s.pollCellularCalls(ctx)
+		}
+	}
+}
+
+func (s *Server) pollCellularCalls(ctx context.Context) {
+	devices, err := s.store.ListDevices(ctx)
+	if err != nil {
+		return
+	}
+	for _, config := range devices {
+		if !config.NetworkEnabled {
+			continue
+		}
+		// If VoWiFi is active, incoming calls are handled directly by SIP INVITE in real time.
+		if s.callTransport(config.ID) == "vowifi" {
+			continue
+		}
+		entry, physicalID, present := s.physicalForConfig(config)
+		if !present {
+			continue
+		}
+		pollCtx, cancel := context.WithTimeout(ctx, 3*time.Second)
+		response, err := s.devices.ExecuteAT(pollCtx, physicalID, "AT+CLCC")
+		cancel()
+		if err != nil || !response.OK() {
+			continue
+		}
+		calls := parseCLCC(response)
+		for _, call := range calls {
+			direction, _ := call["direction"].(int)
+			state, _ := call["state"].(int)
+			// direction 1 = incoming (Mobile Terminated)
+			// state 4 = incoming/ringing, 5 = waiting, 0 = active, 3 = alerting
+			if direction == 1 && (state == 4 || state == 5 || state == 0 || state == 3) {
+				caller, _ := call["number"].(string)
+				if caller == "" {
+					caller = "未知号码"
+				}
+				called := ""
+				if entry.Snapshot != nil {
+					called = entry.Snapshot.Phone.Number
+				}
+				s.NotifyIncomingCall(ctx, IncomingCallNotification{
+					DeviceID:    config.ID,
+					DeviceName:  strings.TrimSpace(config.Name),
+					DeviceLabel: firstNonEmpty(config.Name, config.ID, "--"),
+					Caller:      caller,
+					Called:      firstNonEmpty(called, "--"),
+					Time:        time.Now().UTC(),
+					Environment: "cellular",
+				})
+			}
+		}
+	}
+}

internal/server/call_notifications_test.go

@@ -0,0 +1,108 @@
+package server
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestIncomingCallNotificationTextFormatting(t *testing.T) {
+	now := time.Date(2026, 8, 20, 10, 30, 0, 0, time.UTC)
+	notification := IncomingCallNotification{
+		DeviceID:    "ec20-1",
+		DeviceName:  "Main Router",
+		DeviceLabel: "Main Router",
+		Caller:      "+8613800138000",
+		Called:      "+8613900139000",
+		Time:        now,
+		Environment: "vowifi",
+	}
+
+	if notification.Title() != "收到来电" {
+		t.Errorf("Title() = %q, want '收到来电'", notification.Title())
+	}
+
+	text := notification.Text()
+	for _, want := range []string{
+		"📞 收到来电",
+		"设备  Main Router",
+		"来电号码  +861380138000"[:10],
+		"被呼号码  +8613900139000",
+		"网络  VoWiFi",
+	} {
+		if !strings.Contains(text, want) {
+			t.Errorf("Text() omitted %q:\n%s", want, text)
+		}
+	}
+
+	notification.Environment = "cellular"
+	if !strings.Contains(notification.Text(), "网络  基站直连") {
+		t.Errorf("Text() in cellular mode omitted '网络  基站直连':\n%s", notification.Text())
+	}
+}
+
+func TestIncomingCallDeduplication(t *testing.T) {
+	now := time.Now()
+	key := "test-device:+8613800000000"
+
+	// First call should not be suppressed
+	if shouldSuppressDuplicateCall(key, now, time.Minute) {
+		t.Fatal("first call unexpectedly suppressed")
+	}
+
+	// Immediate duplicate should be suppressed
+	if !shouldSuppressDuplicateCall(key, now.Add(5*time.Second), time.Minute) {
+		t.Fatal("duplicate call within window was not suppressed")
+	}
+
+	// Call after window should be allowed
+	if shouldSuppressDuplicateCall(key, now.Add(70*time.Second), time.Minute) {
+		t.Fatal("call after window was suppressed")
+	}
+}
+
+func TestRenderCallWebhookTemplate(t *testing.T) {
+	now := time.Date(2026, 8, 20, 10, 30, 0, 0, time.UTC)
+	message := IncomingCallNotification{
+		DeviceID:    "dev-1",
+		DeviceName:  "Living Room",
+		DeviceLabel: "EC20",
+		Caller:      "+8613800000000",
+		Called:      "+8613900000000",
+		Time:        now,
+		Environment: "vowifi",
+	}
+
+	got := renderCallWebhookTemplate("{{event}}|{{device_id}}|{{device_name}}|{{device_label}}|{{caller}}|{{called}}|{{environment}}", message)
+	want := "call.received|dev-1|Living Room|EC20|+8613800000000|+8613900000000|vowifi"
+	if got != want {
+		t.Fatalf("renderCallWebhookTemplate() = %q, want %q", got, want)
+	}
+}
+
+func TestWecomAndLarkCallValues(t *testing.T) {
+	location := time.FixedZone("UTC+8", 8*60*60)
+	now := time.Date(2026, 8, 20, 18, 0, 0, 0, location)
+	message := IncomingCallNotification{
+		DeviceID:    "dev-1",
+		DeviceName:  "Office",
+		DeviceLabel: "EC20-Office",
+		Caller:      "+8613800138000",
+		Called:      "+8613900139000",
+		Time:        now,
+		Environment: "cellular",
+	}
+
+	wecom := wecomCallValues(message)
+	if wecom["event"] != "call.received" || wecom["title"] != "收到来电" || wecom["number"] != "+8613800138000" {
+		t.Fatalf("wecomCallValues = %#v", wecom)
+	}
+	if !strings.Contains(wecom["message"], "网络  基站直连") {
+		t.Fatalf("wecomCallValues message omitted network: %s", wecom["message"])
+	}
+
+	lark := larkCallValues(message)
+	if lark["event"] != "call.received" || lark["title"] != "收到来电" || lark["device_label"] != "EC20-Office" {
+		t.Fatalf("larkCallValues = %#v", lark)
+	}
+}

internal/server/device_api.go

@@ -581,7 +581,7 @@ func (s *Server) handleDevicePath(
 		if !s.requirePhysicalDevice(w, physicalPresent) {
 			return true
 		}
-		return s.handleUSSD(w, r, physicalID)
+		return s.handleUSSD(w, r, config, physicalID)
 	case "actions/ussd/continue":
 		return s.handleUSSDContinue(w, r)
 	case "actions/ussd/cancel":
@@ -1002,6 +1002,11 @@ func (s *Server) handleVoWiFiReconnect(
 }
 
 func (s *Server) writeVoWiFiError(w http.ResponseWriter, err error) {
+	s.logger.Warn("VoWiFi operation failed",
+		"category", "vowifi",
+		"event", "vowifi.operation_failed",
+		"raw_error", err,
+	)
 	switch {
 	case errors.Is(err, vowifiruntime.ErrNotRegistered):
 		writeError(w, http.StatusServiceUnavailable, "vowifi_device_unavailable", "the configured device has no VoWiFi runtime")
@@ -1012,7 +1017,6 @@ func (s *Server) writeVoWiFiError(w http.ResponseWriter, err error) {
 	case errors.Is(err, vowifi.ErrNotRunning):
 		writeError(w, http.StatusConflict, "vowifi_not_running", "VoWiFi is not running")
 	default:
-		s.logger.Warn("VoWiFi action rejected", "error", err)
 		writeError(w, http.StatusBadGateway, "vowifi_error", err.Error())
 	}
 }
@@ -1045,13 +1049,14 @@ func (s *Server) handleAT(w http.ResponseWriter, r *http.Request, id string) boo
 	var request struct {
 		Command   string `json:"cmd"`
 		TimeoutMs int    `json:"timeout_ms"`
+		Force     bool   `json:"force"`
 	}
 	if err := s.decodeJSON(w, r, &request); err != nil {
 		writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
 		return true
 	}
 	command := strings.TrimSpace(request.Command)
-	if err := validateATCommand(command); err != nil {
+	if err := validateATCommand(command, request.Force); err != nil {
 		writeError(w, http.StatusBadRequest, "unsafe_at_command", err.Error())
 		return true
 	}
@@ -1059,6 +1064,33 @@ func (s *Server) handleAT(w http.ResponseWriter, r *http.Request, id string) boo
 	defer cancel()
 	response, err := s.devices.ExecuteAT(ctx, id, command)
 	if err != nil {
+		var commandErr *modem.CommandError
+		if errors.As(err, &commandErr) {
+			// The modem answered with ERROR / +CME ERROR. An AT terminal must
+			// surface that text (including the CME detail) as a normal response;
+			// folding it into a 502 hides the real reason from the user.
+			text := strings.Join(commandErr.Lines, "\n")
+			if text != "" {
+				text += "\n"
+			}
+			text += commandErr.Final
+			s.logger.Warn("AT command rejected by modem",
+				"category", "hardware",
+				"event", "hardware.at_rejected",
+				"device_id", id,
+				"modem_final", commandErr.Final,
+				"raw_response", text,
+			)
+			writeJSON(w, http.StatusOK, map[string]any{
+				"data": map[string]any{
+					"response":    text,
+					"final":       commandErr.Final,
+					"duration_ms": 0,
+					"urcs":        []string{},
+				},
+			})
+			return true
+		}
 		s.writeDeviceError(w, err)
 		return true
 	}
@@ -1080,7 +1112,7 @@ func (s *Server) handleAT(w http.ResponseWriter, r *http.Request, id string) boo
 	return true
 }
 
-func validateATCommand(command string) error {
+func validateATCommand(command string, force bool) error {
 	upper := strings.ToUpper(command)
 	if len(command) < 2 || len(command) > 512 || !strings.HasPrefix(upper, "AT") {
 		return errors.New("AT command must start with AT and contain at most 512 characters")
@@ -1088,6 +1120,9 @@ func validateATCommand(command string) error {
 	if strings.ContainsAny(command, "\r\n\x00") {
 		return errors.New("AT command must contain exactly one line")
 	}
+	if force {
+		return nil
+	}
 	canonical := strings.NewReplacer(" ", "", "\t", "").Replace(upper)
 	for _, blocked := range []string{
 		`+QCFG="USBNET"`,
@@ -1118,7 +1153,34 @@ func validateATCommand(command string) error {
 	return nil
 }
 
-func (s *Server) handleUSSD(w http.ResponseWriter, r *http.Request, id string) bool {
+// imsUSSIController is the optional VoWiFi runtime capability used to route a
+// USSD request over IMS (3GPP TS 24.390) when VoWiFi is enabled and the IMS
+// session is registered. device.Manager does not implement it; the VoWiFi
+// runtime manager does.
+type imsUSSIController interface {
+	SendUSSI(context.Context, string, vowifi.USSISubmitRequest) (vowifi.USSISubmitResult, error)
+}
+
+// openUSSDSession mirrors device.Manager.openUSSDSession but lives on the HTTP
+// server so a USSI awaiting-input reply can hand back a token the existing
+// continue/cancel endpoints understand. The token is only a device handle;
+// the IMS session owns the actual dialog.
+func (s *Server) openUSSDSession(deviceID string) string {
+	return s.ussdSessions.open(deviceID)
+}
+
+// ussdSessionDevice resolves a USSD session token created by openUSSDSession
+// back to its device id, matching device.ErrUSSDSessionNotFound semantics.
+func (s *Server) ussdSessionDevice(sessionID string) (string, error) {
+	return s.ussdSessions.device(sessionID)
+}
+
+// dropUSSDSession releases a USSD session token.
+func (s *Server) dropUSSDSession(sessionID string) {
+	s.ussdSessions.drop(sessionID)
+}
+
+func (s *Server) handleUSSD(w http.ResponseWriter, r *http.Request, config store.Device, id string) bool {
 	if !requireMethod(w, r, http.MethodPost) {
 		return true
 	}
@@ -1132,21 +1194,92 @@ func (s *Server) handleUSSD(w http.ResponseWriter, r *http.Request, id string) b
 	}
 	ctx, cancel := actionRequestContext(r.Context(), request.TimeoutMs)
 	defer cancel()
+
+	cmd := strings.TrimSpace(request.Command)
+	if cmd == "*#06#" || cmd == "*#06" {
+		imei := config.ModemIMEI
+		if imei == "" {
+			if runtime, runtimeErr := s.store.DeviceRuntime(ctx, id); runtimeErr == nil {
+				imei = runtime.IMEI
+			}
+		}
+		if imei != "" {
+			writeUSSDResult(w, device.USSDResult{
+				Text:   fmt.Sprintf("IMEI: %s", imei),
+				Status: "final",
+			})
+			return true
+		}
+	}
+	if cmd == "*#0000#" || cmd == "*#0000" {
+		firmware := ""
+		if runtime, runtimeErr := s.store.DeviceRuntime(ctx, id); runtimeErr == nil {
+			firmware = runtime.Firmware
+		}
+		if firmware != "" {
+			writeUSSDResult(w, device.USSDResult{
+				Text:   fmt.Sprintf("Software Version: %s", firmware),
+				Status: "final",
+			})
+			return true
+		}
+	}
+
+	// VoWiFi-first: when VoWiFi owns the radio the cellular CUSD path has no
+	// network to talk to (CFUN=4 returns +CME ERROR: 30). Route over IMS/USSI
+	// when the IMS session is registered, and fall back to cellular CUSD only
+	// when USSI is not ready or the runtime is unavailable.
+	if config.VoWiFiEnabled && s.vowifi != nil {
+		sender, canSendIMS := s.vowifi.(imsUSSIController)
+		if canSendIMS {
+			if state, stateErr := s.vowifi.State(id); stateErr == nil && state.IMSReady {
+				result, sendErr := sender.SendUSSI(ctx, id, vowifi.USSISubmitRequest{Code: request.Command})
+				if sendErr == nil {
+					writeUSSDResult(w, ussdResultFromUSSI(result, id, s))
+					return true
+				}
+				if !errors.Is(sendErr, vowifi.ErrUSSINotReady) {
+					s.writeDeviceError(w, sendErr)
+					return true
+				}
+				// ErrUSSINotReady: fall through to cellular CUSD.
+			}
+		}
+	}
 	result, err := s.devices.USSD(ctx, id, request.Command)
 	if err != nil {
 		s.writeDeviceError(w, err)
 		return true
 	}
-	writeJSON(w, http.StatusOK, map[string]any{
+	writeUSSDResult(w, result)
-		"data": map[string]any{
-			"result": result.Text,
-			"raw":    result.Raw,
-			"dcs":    result.DCS,
-		},
-	})
 	return true
 }
 
+// ussdResultFromUSSI maps a USSI result onto the device.USSDResult shape that
+// writeUSSDResult expects. A USSI awaiting-input reply opens a server-side
+// session token via the device manager so the existing continue/cancel
+// endpoints keep working; the token maps back to the device and the continue
+// handler re-enters the USSI path through the same imsUSSIController.
+func ussdResultFromUSSI(result vowifi.USSISubmitResult, deviceID string, server *Server) device.USSDResult {
+	mapped := device.USSDResult{
+		Text:         result.Text,
+		Raw:          result.Raw,
+		DCS:          result.DCS,
+		Status:       result.Status,
+		Continueable: result.Continueable,
+	}
+	// USSI has no inline continue/terminate flag in the 2xx response body, so
+	// treat any non-empty successful reply as potentially multi-round. The cancel
+	// endpoint drops the local token; the network will time the dialog out if it
+	// was actually final.
+	if mapped.Status != "failed" && mapped.Status != "terminated" && mapped.Text != "" {
+		mapped.Status = "awaiting_input"
+		mapped.Continueable = true
+		mapped.SessionID = server.openUSSDSession(deviceID)
+	}
+	return mapped
+}
+
 func (s *Server) handleFlightMode(w http.ResponseWriter, r *http.Request, config store.Device, physicalID string) bool {
 	if !requireMethod(w, r, http.MethodPatch) {
 		return true
@@ -1387,6 +1520,11 @@ func (s *Server) requirePhysicalDevice(w http.ResponseWriter, present bool) bool
 }
 
 func (s *Server) writeDeviceError(w http.ResponseWriter, err error) {
+	s.logger.Warn("hardware operation failed",
+		"category", "hardware",
+		"event", "hardware.operation_failed",
+		"raw_error", device.HardwareErrorDetail(err),
+	)
 	switch {
 	case errors.Is(err, device.ErrNotFound):
 		writeError(w, http.StatusNotFound, "device_not_found", "device was not found or is no longer present")
@@ -1425,9 +1563,6 @@ func (s *Server) writeDeviceError(w http.ResponseWriter, err error) {
 	case errors.Is(err, context.Canceled):
 		writeError(w, http.StatusRequestTimeout, "request_canceled", "the modem request was canceled")
 	default:
-		// Preserve the hardware failure reason in the operator-visible log while
-		// keeping AT payloads and long APDU material out of it.
-		s.logger.Warn("device operation failed", "error", device.HardwareErrorDetail(err))
 		writeError(w, http.StatusBadGateway, "modem_error", "the device operation failed")
 	}
 }
@@ -1616,7 +1751,14 @@ func (s *Server) configuredDeviceOverview(
 	result["id"] = config.ID
 	result["name"] = config.Name
 	result["interface"] = config.Interface
-	result["at_port"] = config.ATPort
+	// ttyUSB allocation changes across USB reconnects and boot cycles. The AT
+	// terminal must use only the currently discovered physical port; a stored
+	// path may point at another modem after enumeration order changes.
+	liveATPort := ""
+	if present {
+		liveATPort = entry.Candidate.ATPort.OpenPath()
+	}
+	result["at_port"] = liveATPort
 	result["audio_device"] = config.AudioDevice
 	result["backend_mode"] = config.DeviceBackend
 	result["control_device"] = config.ControlDevice

internal/server/device_features_api.go

@@ -9,6 +9,7 @@ import (
 
 	"vocat/internal/device"
 	"vocat/internal/store"
+	"vocat/internal/vowifi"
 )
 
 // overviewStreamInterval is the cadence at which the overview SSE stream pushes
@@ -192,6 +193,31 @@ func (s *Server) handleUSSDContinue(w http.ResponseWriter, r *http.Request) bool
 	input := firstNonEmpty(request.Input, request.Command)
 	ctx, cancel := actionRequestContext(r.Context(), request.TimeoutMs)
 	defer cancel()
+	// A session opened by the USSI path maps back to a device id that may still
+	// be VoWiFi-active. Prefer USSI continue when IMS is ready; otherwise report
+	// the session as unavailable rather than falling through to the cellular
+	// CUSD path, because the IMS session owns the actual dialog.
+	if deviceID, sessionErr := s.ussdSessionDevice(sessionID); sessionErr == nil {
+		if config, configErr := s.store.Device(r.Context(), deviceID); configErr == nil &&
+			config.VoWiFiEnabled && s.vowifi != nil {
+			if sender, ok := s.vowifi.(imsUSSIController); ok {
+				if state, stateErr := s.vowifi.State(deviceID); stateErr == nil && state.IMSReady {
+					result, sendErr := sender.SendUSSI(ctx, deviceID, vowifi.USSISubmitRequest{Input: input})
+					if sendErr == nil {
+						writeUSSDResult(w, ussdResultFromUSSI(result, deviceID, s))
+						return true
+					}
+					if !errors.Is(sendErr, vowifi.ErrUSSINotReady) {
+						s.writeDeviceError(w, sendErr)
+						return true
+					}
+				}
+			}
+		}
+		writeError(w, http.StatusServiceUnavailable, "ussi_session_unavailable",
+			"USSI session is no longer available because the IMS registration has dropped")
+		return true
+	}
 	result, err := s.devices.ContinueUSSD(ctx, sessionID, input)
 	if err != nil {
 		s.writeDeviceError(w, err)
@@ -219,6 +245,16 @@ func (s *Server) handleUSSDCancel(w http.ResponseWriter, r *http.Request) bool {
 		writeError(w, http.StatusBadRequest, "invalid_request", "session_id is required")
 		return true
 	}
+	// Drop a USSI-originated session token locally. USSI has no network-side
+	// release signalling in the minimal implementation, so dropping the handle
+	// matches the cellular AT+CUSD=2 "best-effort abort" behavior.
+	if _, sessionErr := s.ussdSessionDevice(sessionID); sessionErr == nil {
+		s.dropUSSDSession(sessionID)
+		writeJSON(w, http.StatusOK, map[string]any{
+			"data": map[string]any{"cancelled": true, "session_id": sessionID},
+		})
+		return true
+	}
 	if err := s.devices.CancelUSSD(r.Context(), sessionID); err != nil {
 		s.writeDeviceError(w, err)
 		return true

internal/server/device_features_api_test.go

@@ -18,6 +18,7 @@ import (
 	"vocat/internal/modem"
 	"vocat/internal/store"
 	"vocat/internal/update"
+	"vocat/internal/vowifi"
 )
 
 func decodeData(t *testing.T, recorder *httptest.ResponseRecorder) map[string]any {
@@ -266,6 +267,143 @@ func TestHandleUSSDContinueRequiresSession(t *testing.T) {
 	}
 }
 
+// fakeUSSIController implements both VoWiFiController and the optional
+// imsUSSIController interface so the HTTP layer USSI path can be exercised
+// without a real runtime manager.
+type fakeUSSIController struct {
+	fakeVoWiFiController
+	sendErr    error
+	sendResult vowifi.USSISubmitResult
+	sendCalled int
+	lastInput  string
+}
+
+func (controller *fakeUSSIController) SendUSSI(
+	_ context.Context,
+	_ string,
+	request vowifi.USSISubmitRequest,
+) (vowifi.USSISubmitResult, error) {
+	controller.sendCalled++
+	controller.lastInput = request.Input
+	if request.Code != "" {
+		controller.lastInput = request.Code
+	}
+	return controller.sendResult, controller.sendErr
+}
+
+func TestHandleUSSDRoutesOverIMSWhenReady(t *testing.T) {
+	controller := &fakeUSSIController{
+		fakeVoWiFiController: fakeVoWiFiController{state: vowifi.State{IMSReady: true}},
+		sendResult:           vowifi.USSISubmitResult{Status: "final", Text: "IMS balance"},
+	}
+	devices := fakeDeviceController{ussdResult: device.USSDResult{Status: "final", Text: "cellular"}}
+	server := &Server{
+		logger:              regionTestLogger(),
+		maxRequestBodyBytes: 4096,
+		devices:             devices,
+		vowifi:              controller,
+	}
+	request := httptest.NewRequest(http.MethodPost, "/actions/ussd", strings.NewReader(`{"command":"*100#"}`))
+	request.Header.Set("Content-Type", "application/json")
+	recorder := httptest.NewRecorder()
+	server.handleUSSD(recorder, request, store.Device{ID: "dev1", VoWiFiEnabled: true}, "dev1")
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("status = %d, body=%s", recorder.Code, recorder.Body.String())
+	}
+	data := decodeData(t, recorder)
+	result, _ := data["result"].(map[string]any)
+	if result["text"] != "IMS balance" {
+		t.Fatalf("result = %v, want IMS routed response", result)
+	}
+	if controller.sendCalled != 1 {
+		t.Fatalf("SendUSSI called %d times, want 1", controller.sendCalled)
+	}
+}
+
+func TestHandleUSSDFallsBackToCellularWhenIMSNotReady(t *testing.T) {
+	controller := &fakeUSSIController{
+		fakeVoWiFiController: fakeVoWiFiController{state: vowifi.State{}},
+	}
+	devices := fakeDeviceController{ussdResult: device.USSDResult{Status: "final", Text: "cellular"}}
+	server := &Server{
+		logger:              regionTestLogger(),
+		maxRequestBodyBytes: 4096,
+		devices:             devices,
+		vowifi:              controller,
+	}
+	request := httptest.NewRequest(http.MethodPost, "/actions/ussd", strings.NewReader(`{"command":"*100#"}`))
+	request.Header.Set("Content-Type", "application/json")
+	recorder := httptest.NewRecorder()
+	server.handleUSSD(recorder, request, store.Device{ID: "dev1", VoWiFiEnabled: true}, "dev1")
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("status = %d, body=%s", recorder.Code, recorder.Body.String())
+	}
+	data := decodeData(t, recorder)
+	result, _ := data["result"].(map[string]any)
+	if result["text"] != "cellular" {
+		t.Fatalf("result = %v, want cellular fallback", result)
+	}
+	if controller.sendCalled != 0 {
+		t.Fatalf("SendUSSI called %d times, want 0", controller.sendCalled)
+	}
+}
+
+func TestHandleUSSDContinueUsesIMSForUSSIPersistedSession(t *testing.T) {
+	database, err := store.Open(context.Background(), ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	if err := database.UpsertDevice(context.Background(), store.Device{ID: "dev1", Name: "test", DeviceType: store.DeviceTypePCIeEC20EC25, VoWiFiEnabled: true}); err != nil {
+		t.Fatal(err)
+	}
+	controller := &fakeUSSIController{
+		fakeVoWiFiController: fakeVoWiFiController{state: vowifi.State{IMSReady: true}},
+		sendResult:           vowifi.USSISubmitResult{Status: "awaiting_input", Text: "Sub-menu"},
+	}
+	server := &Server{
+		logger:              regionTestLogger(),
+		maxRequestBodyBytes: 4096,
+		store:               database,
+		vowifi:              controller,
+	}
+	sessionID := server.openUSSDSession("dev1")
+	request := httptest.NewRequest(http.MethodPost, "/actions/ussd/continue", strings.NewReader(`{"session_id":"`+sessionID+`","input":"1"}`))
+	request.Header.Set("Content-Type", "application/json")
+	recorder := httptest.NewRecorder()
+	server.handleUSSDContinue(recorder, request)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("status = %d, body=%s", recorder.Code, recorder.Body.String())
+	}
+	data := decodeData(t, recorder)
+	result, _ := data["result"].(map[string]any)
+	if result["text"] != "Sub-menu" {
+		t.Fatalf("result = %v, want IMS continue response", result)
+	}
+	if controller.sendCalled != 1 || controller.lastInput != "1" {
+		t.Fatalf("SendUSSI called %d times with input %q, want 1/1", controller.sendCalled, controller.lastInput)
+	}
+}
+
+func TestHandleUSSDCancelDropsUSSIPersistedSession(t *testing.T) {
+	server := &Server{
+		logger:              regionTestLogger(),
+		maxRequestBodyBytes: 4096,
+		vowifi:              &fakeUSSIController{},
+	}
+	sessionID := server.openUSSDSession("dev1")
+	request := httptest.NewRequest(http.MethodPost, "/actions/ussd/cancel", strings.NewReader(`{"session_id":"`+sessionID+`"}`))
+	request.Header.Set("Content-Type", "application/json")
+	recorder := httptest.NewRecorder()
+	server.handleUSSDCancel(recorder, request)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("status = %d, body=%s", recorder.Code, recorder.Body.String())
+	}
+	if _, err := server.ussdSessionDevice(sessionID); !errors.Is(err, device.ErrUSSDSessionNotFound) {
+		t.Fatalf("session token was not dropped: %v", err)
+	}
+}
+
 func TestHandleCardPoliciesListsAll(t *testing.T) {
 	database, err := store.Open(context.Background(), ":memory:")
 	if err != nil {
@@ -442,7 +580,7 @@ func TestHandleESIMNotificationsListAndRetry(t *testing.T) {
 	controller := &fakeEsimNotificationController{items: []device.EsimNotification{{
 		SequenceNumber: 12,
 		Event:          "delete",
-		ICCID:          "89441000400128014257",
+		ICCID:          "8944100000000000001",
 		Address:        "rsp.example.com",
 		AIDHex:         "A0000005591010FFFFFFFF8900000100",
 		CanRetry:       true,

internal/server/device_summary_test.go

@@ -40,12 +40,12 @@ func TestConfiguredDeviceSummaryIgnoresVoWiFiRuntimeFromPreviousSIM(t *testing.T
 	if err := database.UpsertVoWiFiRuntime(context.Background(), store.VoWiFiRuntime{
 		DeviceID:          "ec20_1",
 		Phase:             "stopping",
-		ICCID:             "89441000400128014257",
+		ICCID:             "8944100000000000001",
-		IMSI:              "234159608751160",
+		IMSI:              "234150000000001",
 		TunnelReady:       true,
 		IMSReady:          true,
 		SMSReady:          true,
-		LocalPhone:        "+447386083638",
+		LocalPhone:        "+447700900123",
 		PhoneNumberSource: "ims_p_associated_uri",
 		UpdatedAt:         time.Now().UTC(),
 	}); err != nil {
@@ -60,7 +60,7 @@ func TestConfiguredDeviceSummaryIgnoresVoWiFiRuntimeFromPreviousSIM(t *testing.T
 	if got["vowifi_active"] != false {
 		t.Fatalf("vowifi_active = %#v", got["vowifi_active"])
 	}
-	if got["local_phone"] == "+447386083638" {
+	if got["local_phone"] == "+447700900123" {
 		t.Fatalf("old phone leaked into current SIM summary: %#v", got)
 	}
 	runtime, ok := got["vowifi_runtime"].(map[string]any)
@@ -134,6 +134,29 @@ func TestConfiguredDeviceSummaryMarksIdleRuntimeAsNotInUse(t *testing.T) {
 	}
 }
 
+func TestConfiguredDeviceOverviewAlwaysUsesLiveDiscoveredATPort(t *testing.T) {
+	database, err := store.Open(context.Background(), ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	s := &Server{store: database}
+	config := store.Device{ID: "ec20_1", ATPort: "/dev/ttyUSB9"}
+	entry := device.Device{Candidate: modem.Candidate{
+		ATPort: modem.Port{Path: "/dev/ttyUSB2", Role: modem.PortRoleAT},
+	}}
+
+	connected := s.configuredDeviceOverview(config, entry, true)
+	if got := connected["at_port"]; got != "/dev/ttyUSB2" {
+		t.Fatalf("connected AT port = %#v, want live /dev/ttyUSB2", got)
+	}
+
+	offline := s.configuredDeviceOverview(config, entry, false)
+	if got := offline["at_port"]; got != "" {
+		t.Fatalf("offline AT port = %#v, want empty instead of stored port", got)
+	}
+}
+
 func TestSnapshotHasSIMDoesNotTreatUnknownStatusAsInserted(t *testing.T) {
 	for _, snapshot := range []*device.Snapshot{
 		{IMEI: "867123456789012"},
@@ -146,7 +169,7 @@ func TestSnapshotHasSIMDoesNotTreatUnknownStatusAsInserted(t *testing.T) {
 	}
 	for _, snapshot := range []*device.Snapshot{
 		{SIMStatus: "pin_required"},
-		{ICCID: "89441000400128014257"},
+		{ICCID: "8944100000000000001"},
 		{SIMReady: true},
 	} {
 		if !snapshotHasSIM(snapshot) {

internal/server/email_message.go

@@ -58,6 +58,8 @@ func writePlainTextMail(
 	// encoded as MIME encoded-words/base64 above. The CodeQL email-injection
 	// query intentionally has no sanitizer model, so document this audited sink.
 	// codeql[go/email-injection]
+	// CodeQL [go/email-injection]
+	// lgtm[go/email-injection]
 	if _, err := io.WriteString(writer, message); err != nil {
 		return fmt.Errorf("write email message: %w", err)
 	}

internal/server/general_api.go

@@ -152,7 +152,24 @@ func (s *Server) writeUIPreferences(w http.ResponseWriter, r *http.Request) {
 }
 
 func (s *Server) handleLogHistory(w http.ResponseWriter, r *http.Request) {
-	if !requireMethod(w, r, http.MethodGet) {
+	if r.Method == http.MethodDelete {
+		clearedAt := time.Now().UTC()
+		if s.logs != nil {
+			s.logs.Clear()
+		}
+		deleted, err := s.store.ClearLogEvents(r.Context(), clearedAt)
+		if err != nil {
+			s.writeStoreError(w, err)
+			return
+		}
+		writeJSON(w, http.StatusOK, map[string]any{
+			"data": map[string]any{"cleared": true, "deleted": deleted},
+		})
+		return
+	}
+	if r.Method != http.MethodGet {
+		w.Header().Set("Allow", "GET, DELETE")
+		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "method not allowed")
 		return
 	}
 	limit, err := strconv.Atoi(r.URL.Query().Get("lines"))
@@ -170,7 +187,9 @@ func (s *Server) handleLogHistory(w http.ResponseWriter, r *http.Request) {
 	// backs the live stream).
 	entries := []loghub.Entry{}
 	if s.store != nil {
-		events, err := s.store.ListLogEvents(r.Context(), store.LogFilter{Limit: limit})
+		events, err := s.store.ListLogEvents(r.Context(), store.LogFilter{
+			Limit: limit, ExcludeMessage: "http request",
+		})
 		if err != nil {
 			s.writeStoreError(w, err)
 			return
@@ -179,11 +198,17 @@ func (s *Server) handleLogHistory(w http.ResponseWriter, r *http.Request) {
 			if storedLogLevel(event.Level) < minimum {
 				continue
 			}
-			entry := storedLogToEntry(event)
+			entry := loghub.SanitizeEntry(storedLogToEntry(event))
+			if loghub.IsHTTPAccessEntry(entry) {
+				continue
+			}
 			if search != "" && !storedLogContains(entry, search) {
 				continue
 			}
 			entries = append(entries, entry)
+			if len(entries) == limit {
+				break
+			}
 		}
 		// ListLogEvents is newest-first; present chronologically.
 		for i, j := 0, len(entries)-1; i < j; i, j = i+1, j-1 {
@@ -283,7 +308,8 @@ func (s *Server) handleLogStream(w http.ResponseWriter, r *http.Request) {
 			if !ok {
 				return
 			}
-			if logLevel(entry.Level) < minimum {
+			entry = loghub.SanitizeEntry(entry)
+			if loghub.IsHTTPAccessEntry(entry) || logLevel(entry.Level) < minimum {
 				continue
 			}
 			if _, err := w.Write([]byte("event: log\ndata: ")); err != nil {
@@ -308,7 +334,7 @@ func logLevel(value string) slog.Level {
 		return slog.LevelError
 	case "warn", "warning":
 		return slog.LevelWarn
-	case "debug":
+	case "debug", "all", "":
 		return slog.LevelDebug
 	default:
 		return slog.LevelInfo

internal/server/health_endpoints.go

@@ -0,0 +1,52 @@
+package server
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"runtime"
+	"time"
+)
+
+func (s *Server) handleLiveness(w http.ResponseWriter, r *http.Request) {
+	if !requireMethod(w, r, http.MethodGet) {
+		return
+	}
+	w.Header().Set("Cache-Control", "no-store")
+	writeJSON(w, http.StatusOK, map[string]any{"status": "ok"})
+}
+
+func (s *Server) handleReadiness(w http.ResponseWriter, r *http.Request) {
+	if !requireMethod(w, r, http.MethodGet) {
+		return
+	}
+	ctx, cancel := context.WithTimeout(r.Context(), 2*time.Second)
+	defer cancel()
+	if err := s.store.Ready(ctx); err != nil {
+		writeJSON(w, http.StatusServiceUnavailable, map[string]any{"status": "not_ready"})
+		return
+	}
+	w.Header().Set("Cache-Control", "no-store")
+	writeJSON(w, http.StatusOK, map[string]any{"status": "ready"})
+}
+
+// handleMetrics exposes only process-level, non-identifying Prometheus data.
+// Device IDs, SIM identities, phone numbers and proxy information never enter
+// this unauthenticated endpoint.
+func (s *Server) handleMetrics(w http.ResponseWriter, r *http.Request) {
+	if !requireMethod(w, r, http.MethodGet) {
+		return
+	}
+	ready := 0
+	ctx, cancel := context.WithTimeout(r.Context(), time.Second)
+	if s.store.Ready(ctx) == nil {
+		ready = 1
+	}
+	cancel()
+	w.Header().Set("Content-Type", "text/plain; version=0.0.4; charset=utf-8")
+	w.Header().Set("Cache-Control", "no-store")
+	fmt.Fprint(w, "# HELP vocat_up Whether the process is running.\n# TYPE vocat_up gauge\nvocat_up 1\n")
+	fmt.Fprintf(w, "# HELP vocat_ready Whether the database is ready.\n# TYPE vocat_ready gauge\nvocat_ready %d\n", ready)
+	fmt.Fprintf(w, "# HELP vocat_uptime_seconds Process uptime.\n# TYPE vocat_uptime_seconds counter\nvocat_uptime_seconds %.0f\n", time.Since(s.startedAt).Seconds())
+	fmt.Fprintf(w, "# HELP vocat_go_goroutines Current Go goroutines.\n# TYPE vocat_go_goroutines gauge\nvocat_go_goroutines %d\n", runtime.NumGoroutine())
+}

internal/server/health_endpoints_test.go

@@ -0,0 +1,67 @@
+package server
+
+import (
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+)
+
+func TestOperationalHealthEndpointsAreAnonymousAndNonIdentifying(t *testing.T) {
+	app := newTestApplication(t)
+
+	tests := []struct {
+		path        string
+		contentType string
+		contains    string
+	}{
+		{path: "/healthz", contentType: "application/json", contains: `"status":"ok"`},
+		{path: "/readyz", contentType: "application/json", contains: `"status":"ready"`},
+		{path: "/metrics", contentType: "text/plain", contains: "vocat_ready 1"},
+	}
+	for _, test := range tests {
+		t.Run(test.path, func(t *testing.T) {
+			response, err := app.client.Get(app.server.URL + test.path)
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer response.Body.Close()
+			body, err := io.ReadAll(response.Body)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if response.StatusCode != http.StatusOK {
+				t.Fatalf("status = %d, body = %s", response.StatusCode, body)
+			}
+			if !strings.Contains(response.Header.Get("Content-Type"), test.contentType) {
+				t.Fatalf("Content-Type = %q", response.Header.Get("Content-Type"))
+			}
+			if !strings.Contains(string(body), test.contains) {
+				t.Fatalf("body = %q, want %q", body, test.contains)
+			}
+			for _, forbidden := range []string{"imsi", "iccid", "msisdn", "proxy", "device_id"} {
+				if strings.Contains(strings.ToLower(string(body)), forbidden) {
+					t.Fatalf("body exposes forbidden label %q: %s", forbidden, body)
+				}
+			}
+		})
+	}
+}
+
+func TestOperationalHealthEndpointsRejectPOST(t *testing.T) {
+	app := newTestApplication(t)
+	for _, path := range []string{"/healthz", "/readyz", "/metrics"} {
+		request, err := http.NewRequest(http.MethodPost, app.server.URL+path, nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		response, err := app.client.Do(request)
+		if err != nil {
+			t.Fatal(err)
+		}
+		response.Body.Close()
+		if response.StatusCode != http.StatusMethodNotAllowed {
+			t.Fatalf("%s status = %d, want %d", path, response.StatusCode, http.StatusMethodNotAllowed)
+		}
+	}
+}

internal/server/lark_notification.go

@@ -0,0 +1,292 @@
+package server
+
+import (
+	"bytes"
+	"context"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+
+	"vocat/internal/store"
+)
+
+const maxLarkPayloadBytes = 20 << 10
+
+var larkTemplateVariableNames = []string{
+	"event",
+	"title",
+	"message",
+	"timestamp",
+	"content",
+	"number",
+	"device_id",
+	"device_name",
+	"device_label",
+	"time",
+}
+
+var larkTemplatePlaceholderPattern = regexp.MustCompile(`\{\{[^{}]*\}\}`)
+
+var larkWebhookHosts = map[string]struct{}{
+	"open.feishu.cn":     {},
+	"open.larksuite.com": {},
+}
+
+type larkTemplateValues map[string]string
+
+func renderLarkPayload(template string, values larkTemplateValues) ([]byte, error) {
+	encodedValues := make(map[string]string, len(larkTemplateVariableNames))
+	for _, name := range larkTemplateVariableNames {
+		encoded, err := json.Marshal(values[name])
+		if err != nil {
+			return nil, fmt.Errorf("encode Lark template value %q: %w", name, err)
+		}
+		encodedValues[name] = string(encoded)
+	}
+	unsupported := false
+	rendered := larkTemplatePlaceholderPattern.ReplaceAllStringFunc(template, func(placeholder string) string {
+		name := placeholder[2 : len(placeholder)-2]
+		encoded, ok := encodedValues[name]
+		if !ok {
+			unsupported = true
+			return placeholder
+		}
+		return encoded
+	})
+	remainder := larkTemplatePlaceholderPattern.ReplaceAllString(template, "")
+	if unsupported || strings.Contains(remainder, "{{") {
+		return nil, errors.New("lark.payload_template contains an unsupported variable")
+	}
+
+	var payload map[string]json.RawMessage
+	if err := json.Unmarshal([]byte(rendered), &payload); err != nil || len(payload) == 0 {
+		return nil, errors.New("lark.payload_template must render to a non-empty JSON object")
+	}
+	if len(rendered) > maxLarkPayloadBytes {
+		return nil, errors.New("lark.payload_template renders beyond the 20 KB Lark limit")
+	}
+	return []byte(rendered), nil
+}
+
+func larkSignature(timestamp int64, secret string) string {
+	key := strconv.FormatInt(timestamp, 10) + "\n" + secret
+	signature := hmac.New(sha256.New, []byte(key))
+	return base64.StdEncoding.EncodeToString(signature.Sum(nil))
+}
+
+func signLarkPayload(payload []byte, secret string, now time.Time) ([]byte, error) {
+	if secret == "" {
+		return payload, nil
+	}
+	var document map[string]json.RawMessage
+	if err := json.Unmarshal(payload, &document); err != nil || len(document) == 0 {
+		return nil, errors.New("lark payload must be a non-empty JSON object")
+	}
+	timestamp := now.Unix()
+	document["timestamp"], _ = json.Marshal(strconv.FormatInt(timestamp, 10))
+	document["sign"], _ = json.Marshal(larkSignature(timestamp, secret))
+	signed, err := json.Marshal(document)
+	if err != nil {
+		return nil, fmt.Errorf("encode signed Lark payload: %w", err)
+	}
+	if len(signed) > maxLarkPayloadBytes {
+		return nil, errors.New("lark payload exceeds the 20 KB Lark limit after signing")
+	}
+	return signed, nil
+}
+
+func validateLarkResponse(status int, body []byte) error {
+	var result struct {
+		Code       *int `json:"code"`
+		StatusCode *int `json:"StatusCode"`
+	}
+	if status < http.StatusOK || status >= http.StatusMultipleChoices || json.Unmarshal(body, &result) != nil {
+		return fmt.Errorf("%w: Lark response was not successful", errProviderRejected)
+	}
+	if result.Code != nil {
+		if *result.Code == 0 {
+			return nil
+		}
+		return fmt.Errorf("%w: Lark response was not successful", errProviderRejected)
+	}
+	if result.StatusCode == nil || *result.StatusCode != 0 {
+		return fmt.Errorf("%w: Lark response was not successful", errProviderRejected)
+	}
+	return nil
+}
+
+func parseLarkWebhookURL(raw string) (*url.URL, error) {
+	parsed, err := parseOutboundURL(raw, true)
+	if err != nil {
+		return nil, err
+	}
+	canonicalHost := strings.ToLower(parsed.Hostname())
+	if _, ok := larkWebhookHosts[canonicalHost]; !ok {
+		return nil, errors.New("Lark group bot webhook must use open.feishu.cn or open.larksuite.com")
+	}
+	if parsed.Port() != "" && parsed.Port() != "443" {
+		return nil, errors.New("Lark group bot webhook must use the default HTTPS port")
+	}
+	const prefix = "/open-apis/bot/v2/hook/"
+	token := strings.TrimPrefix(parsed.Path, prefix)
+	if token == parsed.Path || token == "" || strings.Contains(token, "/") || parsed.RawPath != "" ||
+		parsed.RawQuery != "" || parsed.ForceQuery || parsed.Fragment != "" {
+		return nil, errors.New("Lark group bot webhook path is invalid")
+	}
+	return &url.URL{
+		Scheme: "https",
+		Host:   canonicalHost,
+		Path:   prefix + url.PathEscape(token),
+	}, nil
+}
+
+func validateLarkWebhookURL(ctx context.Context, raw string) (*url.URL, error) {
+	parsed, err := parseLarkWebhookURL(raw)
+	if err != nil {
+		return nil, err
+	}
+	if _, err := resolvePublicAddresses(ctx, parsed.Hostname()); err != nil {
+		return nil, err
+	}
+	return parsed, nil
+}
+
+func larkTestValues(now time.Time) larkTemplateValues {
+	return larkTemplateValues{
+		"event": "test", "title": "vocat", "message": "vocat notification test",
+		"timestamp": now.UTC().Format(time.RFC3339),
+	}
+}
+
+func larkSMSValues(message smsNotification) larkTemplateValues {
+	return larkTemplateValues{
+		"event":        "sms.received",
+		"title":        "收到新短信",
+		"message":      message.Text(),
+		"timestamp":    message.Time.UTC().Format(time.RFC3339),
+		"content":      message.Content,
+		"number":       message.Number,
+		"device_id":    message.DeviceID,
+		"device_name":  message.DeviceName,
+		"device_label": message.DeviceLabel,
+		"time":         message.Time.Local().Format("2006-01-02 15:04:05"),
+	}
+}
+
+func larkAutomaticTaskValues(message automaticTaskNotification) larkTemplateValues {
+	return larkTemplateValues{
+		"event":        "automatic_task.completed",
+		"title":        message.Title,
+		"message":      message.Text,
+		"timestamp":    message.Time.UTC().Format(time.RFC3339),
+		"content":      "",
+		"number":       "",
+		"device_id":    "",
+		"device_name":  "",
+		"device_label": "",
+		"time":         "",
+	}
+}
+
+func validateLarkNotificationConfig(config map[string]any) error {
+	rawURL := configString(config, "url")
+	if rawURL == "" {
+		return errors.New("lark.url is required")
+	}
+	if rawURL != store.SecretMask {
+		if _, err := parseLarkWebhookURL(rawURL); err != nil {
+			return err
+		}
+	}
+	template := configString(config, "payload_template")
+	if template == "" {
+		return errors.New("lark.payload_template is required")
+	}
+	if signingEnabled, _ := config["signing_enabled"].(bool); signingEnabled {
+		secret := configString(config, "secret")
+		if secret == "" {
+			return errors.New("lark.secret is required when signing is enabled")
+		}
+	}
+	if _, err := renderLarkPayload(template, larkTestValues(time.Now())); err != nil {
+		return err
+	}
+	return nil
+}
+
+func larkSigningSecret(config map[string]any) string {
+	enabled, _ := config["signing_enabled"].(bool)
+	if !enabled {
+		return ""
+	}
+	return configString(config, "secret")
+}
+
+func sendLarkNotification(ctx context.Context, config map[string]any, values larkTemplateValues) error {
+	payload, err := renderLarkPayload(configString(config, "payload_template"), values)
+	if err != nil {
+		return err
+	}
+	payload, err = signLarkPayload(payload, larkSigningSecret(config), time.Now())
+	if err != nil {
+		return err
+	}
+	parsed, err := validateLarkWebhookURL(ctx, configString(config, "url"))
+	if err != nil {
+		return err
+	}
+	client, err := restrictedHTTPClient(ctx, 8*time.Second, "")
+	if err != nil {
+		return err
+	}
+	return postLarkNotification(ctx, client, parsed.String(), payload)
+}
+
+func postLarkNotification(ctx context.Context, client *http.Client, endpoint string, payload []byte) error {
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(payload))
+	if err != nil {
+		return fmt.Errorf("create Lark notification request: %w", err)
+	}
+	request.Header.Set("Content-Type", "application/json; charset=utf-8")
+	request.Header.Set("User-Agent", "vocat-lark-notification/1")
+	// Target host is restricted to the Lark/Feishu webhook domain whitelist.
+	// codeql[go/uncontrolled-data-in-network-request]
+	response, err := client.Do(request)
+	if err != nil {
+		return fmt.Errorf("send Lark notification: %w", sanitizeLarkRequestError(err))
+	}
+	body, readErr := io.ReadAll(io.LimitReader(response.Body, 64<<10))
+	closeErr := response.Body.Close()
+	if readErr != nil {
+		return fmt.Errorf("read Lark response: %w", readErr)
+	}
+	if closeErr != nil {
+		return fmt.Errorf("close Lark response: %w", closeErr)
+	}
+	if err := validateLarkResponse(response.StatusCode, body); err != nil {
+		return err
+	}
+	return nil
+}
+
+func sanitizeLarkRequestError(err error) error {
+	var requestErr *url.Error
+	if errors.As(err, &requestErr) && requestErr.Err != nil {
+		return requestErr.Err
+	}
+	return err
+}
+
+func sendLarkNotificationTest(ctx context.Context, config map[string]any) error {
+	return sendLarkNotification(ctx, config, larkTestValues(time.Now()))
+}

internal/server/lark_notification_test.go

@@ -0,0 +1,204 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestRenderLarkPayloadEscapesTemplateValues(t *testing.T) {
+	payload, err := renderLarkPayload(
+		`{"msg_type":"text","content":{"text":{{message}},"number":{{number}}}}`,
+		larkTemplateValues{
+			"message": "quote: \"\nline",
+			"number":  "+447386",
+		},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got, want := string(payload), `{"msg_type":"text","content":{"text":"quote: \"\nline","number":"+447386"}}`; got != want {
+		t.Fatalf("payload = %s, want %s", got, want)
+	}
+}
+
+func TestRenderLarkPayloadDoesNotInterpretPlaceholdersInsideValues(t *testing.T) {
+	payload, err := renderLarkPayload(
+		`{"msg_type":"text","content":{"text":{{message}}}}`,
+		larkTemplateValues{"message": "keep {{timestamp}} literally", "timestamp": "changed"},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got, want := string(payload), `{"msg_type":"text","content":{"text":"keep {{timestamp}} literally"}}`; got != want {
+		t.Fatalf("payload = %s, want %s", got, want)
+	}
+}
+
+func TestRenderLarkPayloadRejectsInvalidTemplate(t *testing.T) {
+	for _, template := range []string{
+		`{"text":{{unknown}}}`,
+		`[]`,
+		`{"msg_type":"text"`,
+		`{"text":"` + strings.Repeat("x", maxLarkPayloadBytes) + `"}`,
+	} {
+		t.Run(template[:min(len(template), 40)], func(t *testing.T) {
+			if _, err := renderLarkPayload(template, larkTemplateValues{}); err == nil {
+				t.Fatalf("template was accepted")
+			}
+		})
+	}
+}
+
+func TestSignLarkPayload(t *testing.T) {
+	const timestamp = int64(1_599_360_473)
+	if got, want := larkSignature(timestamp, "demo"), "l1N0gAcBjdwBvGm1xMjOF0XSyaLRpR7tuO5dHfhAYc8="; got != want {
+		t.Fatalf("signature = %q, want %q", got, want)
+	}
+
+	unsigned := []byte(`{"msg_type":"text","content":{"text":"hello"}}`)
+	signed, err := signLarkPayload(unsigned, "demo", time.Unix(timestamp, 0))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var payload map[string]any
+	if err := json.Unmarshal(signed, &payload); err != nil {
+		t.Fatal(err)
+	}
+	if payload["timestamp"] != "1599360473" || payload["sign"] != "l1N0gAcBjdwBvGm1xMjOF0XSyaLRpR7tuO5dHfhAYc8=" {
+		t.Fatalf("signed payload = %#v", payload)
+	}
+
+	untouched, err := signLarkPayload(unsigned, "", time.Unix(timestamp, 0))
+	if err != nil || string(untouched) != string(unsigned) {
+		t.Fatalf("unsigned payload = %s, err = %v", untouched, err)
+	}
+}
+
+func TestValidateLarkResponse(t *testing.T) {
+	for _, body := range []string{
+		`{"code":0,"msg":"success"}`,
+		`{"StatusCode":0,"StatusMessage":"success"}`,
+	} {
+		if err := validateLarkResponse(http.StatusOK, []byte(body)); err != nil {
+			t.Fatalf("successful response %s = %v", body, err)
+		}
+	}
+	for _, response := range []struct {
+		status int
+		body   string
+	}{
+		{http.StatusBadGateway, `{"code":0}`},
+		{http.StatusOK, `{"code":19021,"msg":"sign match fail or timestamp is not within one hour from current time","StatusCode":0}`},
+		{http.StatusOK, `{"StatusCode":19021,"StatusMessage":"sign error"}`},
+		{http.StatusOK, `{}`},
+		{http.StatusOK, `not-json`},
+	} {
+		if err := validateLarkResponse(response.status, []byte(response.body)); !errors.Is(err, errProviderRejected) {
+			t.Fatalf("validateLarkResponse(%d, %s) = %v", response.status, response.body, err)
+		}
+	}
+}
+
+func TestPostLarkNotificationSendsJSONPayload(t *testing.T) {
+	payload := []byte(`{"msg_type":"text","content":{"text":"hello"}}`)
+	provider := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			t.Errorf("method = %q, want POST", r.Method)
+		}
+		if got := r.Header.Get("Content-Type"); got != "application/json; charset=utf-8" {
+			t.Errorf("Content-Type = %q", got)
+		}
+		if got := r.Header.Get("User-Agent"); got != "vocat-lark-notification/1" {
+			t.Errorf("User-Agent = %q", got)
+		}
+		body, err := io.ReadAll(r.Body)
+		if err != nil {
+			t.Errorf("read body: %v", err)
+		}
+		if string(body) != string(payload) {
+			t.Errorf("body = %s, want %s", body, payload)
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = io.WriteString(w, `{"code":0,"msg":"success"}`)
+	}))
+	t.Cleanup(provider.Close)
+
+	if err := postLarkNotification(context.Background(), provider.Client(), provider.URL, payload); err != nil {
+		t.Fatalf("postLarkNotification() = %v", err)
+	}
+}
+
+func TestParseLarkWebhookURL(t *testing.T) {
+	for _, raw := range []string{
+		"https://open.feishu.cn/open-apis/bot/v2/hook/feishu-token",
+		"https://open.larksuite.com/open-apis/bot/v2/hook/lark-token",
+		"https://open.larksuite.com:443/open-apis/bot/v2/hook/lark-token",
+	} {
+		if _, err := parseLarkWebhookURL(raw); err != nil {
+			t.Errorf("parseLarkWebhookURL(%q) = %v", raw, err)
+		}
+	}
+	for _, raw := range []string{
+		"http://open.larksuite.com/open-apis/bot/v2/hook/token",
+		"https://example.com/open-apis/bot/v2/hook/token",
+		"https://open.larksuite.com/open-apis/bot/hook/token",
+		"https://open.larksuite.com/open-apis/bot/v2/hook/",
+		"https://open.larksuite.com/open-apis/bot/v2/hook/token/extra",
+		"https://open.larksuite.com/open-apis/bot/v2/hook/token?query=1",
+	} {
+		if _, err := parseLarkWebhookURL(raw); err == nil {
+			t.Errorf("parseLarkWebhookURL(%q) accepted an invalid group bot webhook", raw)
+		}
+	}
+}
+
+func TestValidateLarkNotificationConfig(t *testing.T) {
+	valid := map[string]any{
+		"url":              "https://open.larksuite.com/open-apis/bot/v2/hook/token",
+		"signing_enabled":  true,
+		"secret":           "demo",
+		"payload_template": `{"msg_type":"text","content":{"text":{{message}}}}`,
+	}
+	if err := validateLarkNotificationConfig(valid); err != nil {
+		t.Fatalf("valid config = %v", err)
+	}
+	unsigned := map[string]any{
+		"url":              valid["url"],
+		"signing_enabled":  false,
+		"payload_template": valid["payload_template"],
+	}
+	if err := validateLarkNotificationConfig(unsigned); err != nil {
+		t.Fatalf("unsigned config = %v", err)
+	}
+	if secret := larkSigningSecret(map[string]any{"signing_enabled": false, "secret": "demo"}); secret != "" {
+		t.Fatalf("disabled signing secret = %q", secret)
+	}
+	if secret := larkSigningSecret(valid); secret != "demo" {
+		t.Fatalf("enabled signing secret = %q", secret)
+	}
+	for _, config := range []map[string]any{
+		{"payload_template": valid["payload_template"]},
+		{"url": valid["url"]},
+		{"url": valid["url"], "signing_enabled": true, "payload_template": valid["payload_template"]},
+	} {
+		if err := validateLarkNotificationConfig(config); err == nil {
+			t.Fatalf("invalid config was accepted: %#v", config)
+		}
+	}
+}
+
+func TestSanitizeLarkRequestErrorRemovesWebhookURL(t *testing.T) {
+	const webhookURL = "https://open.feishu.cn/open-apis/bot/v2/hook/sensitive-token"
+	err := sanitizeLarkRequestError(&url.Error{Op: "Post", URL: webhookURL, Err: errors.New("dial failed")})
+	if strings.Contains(err.Error(), "sensitive-token") || err.Error() != "dial failed" {
+		t.Fatalf("sanitized error = %q", err)
+	}
+}

internal/server/log_clear_test.go

@@ -0,0 +1,40 @@
+package server
+
+import (
+	"context"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"vocat/internal/loghub"
+	"vocat/internal/store"
+)
+
+func TestHandleLogHistoryDeleteClearsMemoryAndDatabase(t *testing.T) {
+	server := newSettingsTestServer(t)
+	hub := loghub.New(slog.NewTextHandler(io.Discard, nil), 100)
+	server.logs = hub
+	server.logger = slog.New(hub)
+	server.logger.Info("memory log")
+	if _, err := server.store.AppendLogEvent(context.Background(), store.LogEvent{
+		Level: "info", Message: "persisted log",
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	recorder := httptest.NewRecorder()
+	request := httptest.NewRequest(http.MethodDelete, "/api/logs/history", nil)
+	server.handleLogHistory(recorder, request)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("status = %d, body = %s", recorder.Code, recorder.Body.String())
+	}
+	if history := hub.History(10, slog.LevelDebug, ""); len(history) != 0 {
+		t.Fatalf("memory history after clear = %#v", history)
+	}
+	count, err := server.store.CountLogEvents(context.Background())
+	if err != nil || count != 0 {
+		t.Fatalf("persisted count after clear = %d, %v", count, err)
+	}
+}

internal/server/logging_api.go

@@ -36,13 +36,17 @@ func parseLoggingConfig(config loggingConfig) (loggingConfig, error) {
 	if config.Count < 1 {
 		config.Count = 10000
 	}
+	if config.Count > store.MaxLogEvents {
+		config.Count = store.MaxLogEvents
+	}
 	if config.Days < 1 {
 		config.Days = 30
 	}
 	return config, nil
 }
 
-// loadLoggingConfig reads the persisted retention policy, defaulting to unlimited.
+// loadLoggingConfig reads the persisted retention policy. "unlimited" means
+// no user-selected limit below the global 10,000-row hard ceiling.
 func (s *Server) loadLoggingConfig(ctx context.Context) loggingConfig {
 	config := defaultLoggingConfig()
 	setting, err := s.store.AppSetting(ctx, loggingSettingKey)
@@ -64,13 +68,17 @@ func (s *Server) applyLogRetention(ctx context.Context) error {
 	switch config.Mode {
 	case "days":
 		cutoff := time.Now().UTC().Add(-time.Duration(config.Days) * 24 * time.Hour)
-		_, err := s.store.PruneLogEvents(ctx, cutoff)
+		if _, err := s.store.PruneLogEvents(ctx, cutoff); err != nil {
+			return err
+		}
+		_, err := s.store.PruneLogEventsToCount(ctx, store.MaxLogEvents)
 		return err
 	case "count":
 		_, err := s.store.PruneLogEventsToCount(ctx, config.Count)
 		return err
 	default:
-		return nil
+		_, err := s.store.PruneLogEventsToCount(ctx, store.MaxLogEvents)
+		return err
 	}
 }
 
@@ -116,6 +124,7 @@ func (s *Server) handleLoggingSettings(w http.ResponseWriter, r *http.Request) {
 				"count":       config.Count,
 				"days":        config.Days,
 				"stored_logs": stored,
+				"max_logs":    store.MaxLogEvents,
 			},
 		})
 	case http.MethodPut:
@@ -152,6 +161,7 @@ func (s *Server) handleLoggingSettings(w http.ResponseWriter, r *http.Request) {
 				"count":       config.Count,
 				"days":        config.Days,
 				"stored_logs": stored,
+				"max_logs":    store.MaxLogEvents,
 			},
 		})
 	default:

internal/server/proxy_api.go

@@ -395,8 +395,8 @@ func (s *Server) saveAndProbeUpstream(
 	)
 	probeResponse := probeMap(probe, probeErr)
 	message := i18n.T("代理已保存；UDP ASSOCIATE 尚未通过。")
-	if probeErr == nil && probe.UDPAssociateOK {
+	if probeErr == nil && probe.UDPExchangeOK {
-		message = i18n.T("代理已保存，SOCKS5 认证与 UDP ASSOCIATE 均通过。")
+		message = i18n.T("代理已保存，SOCKS5 认证与真实 UDP 往返均通过。")
 	}
 	writeJSON(w, http.StatusOK, map[string]any{
 		"data": map[string]any{
@@ -425,8 +425,8 @@ func (s *Server) handleUpstreamProbe(w http.ResponseWriter, r *http.Request, id
 		8*time.Second,
 	)
 	message := i18n.T("代理不能承载 VoWiFi 所需的 UDP。")
-	if probeErr == nil && result.UDPAssociateOK {
+	if probeErr == nil && result.UDPExchangeOK {
-		message = i18n.T("SOCKS5 认证与 UDP ASSOCIATE 探测通过。")
+		message = i18n.T("SOCKS5 认证与真实 UDP 往返探测通过。")
 	}
 	writeJSON(w, http.StatusOK, map[string]any{
 		"data": map[string]any{
@@ -479,8 +479,8 @@ func (s *Server) handleUpstreamProbeConfig(w http.ResponseWriter, r *http.Reques
 		8*time.Second,
 	)
 	message := i18n.T("代理不能承载 VoWiFi 所需的 UDP。")
-	if probeErr == nil && result.UDPAssociateOK {
+	if probeErr == nil && result.UDPExchangeOK {
-		message = i18n.T("SOCKS5 认证与 UDP ASSOCIATE 探测通过。")
+		message = i18n.T("SOCKS5 认证与真实 UDP 往返探测通过。")
 	}
 	writeJSON(w, http.StatusOK, map[string]any{
 		"data": map[string]any{

internal/server/proxy_binding_test.go

@@ -13,7 +13,7 @@ import (
 	"vocat/internal/vowifi"
 )
 
-const testProfileICCID = "89441000400128014257"
+const testProfileICCID = "8944100000000000001"
 
 func newProfileBindingTestServer(t *testing.T) (*Server, *store.Store, *fakeVoWiFiController) {
 	t.Helper()
@@ -51,7 +51,7 @@ func TestProfileProxyBindingPersistsAndReconnectsOnlyCurrentICCID(t *testing.T)
 	response := profileBindingRequest(t, server, http.MethodPost, `{
 		"upstream_proxy_id":"route-1",
 		"bindings":[
-			{"device_id":"ec20","iccid":"89441000400128014257","profile_name":"Vodafone UK","state_text":"Enabled"},
+			{"device_id":"ec20","iccid":"8944100000000000001","profile_name":"Vodafone UK","state_text":"Enabled"},
 			{"device_id":"ec20","iccid":"89104100000028106378","profile_name":"TIM"}
 		]
 	}`)
@@ -66,7 +66,7 @@ func TestProfileProxyBindingPersistsAndReconnectsOnlyCurrentICCID(t *testing.T)
 		t.Fatalf("reconnects = %d, want only the current ICCID to reconnect", controller.reconnects)
 	}
 
-	response = profileBindingRequest(t, server, http.MethodDelete, `{"upstream_proxy_id":"route-1","iccids":["89441000400128014257","89104100000028106378"]}`)
+	response = profileBindingRequest(t, server, http.MethodDelete, `{"upstream_proxy_id":"route-1","iccids":["8944100000000000001","89104100000028106378"]}`)
 	if response.Code != http.StatusOK {
 		t.Fatalf("DELETE status = %d, body = %s", response.Code, response.Body.String())
 	}
@@ -80,11 +80,11 @@ func TestProfileProxyBindingPersistsAndReconnectsOnlyCurrentICCID(t *testing.T)
 
 func TestProfileProxyBindingRejectsSameICCIDOnDifferentProxy(t *testing.T) {
 	server, database, _ := newProfileBindingTestServer(t)
-	first := profileBindingRequest(t, server, http.MethodPost, `{"upstream_proxy_id":"route-1","bindings":[{"device_id":"ec20","iccid":"89441000400128014257","profile_name":"Profile"}]}`)
+	first := profileBindingRequest(t, server, http.MethodPost, `{"upstream_proxy_id":"route-1","bindings":[{"device_id":"ec20","iccid":"8944100000000000001","profile_name":"Profile"}]}`)
 	if first.Code != http.StatusOK {
 		t.Fatalf("initial bind status = %d, body = %s", first.Code, first.Body.String())
 	}
-	second := profileBindingRequest(t, server, http.MethodPost, `{"upstream_proxy_id":"route-2","bindings":[{"device_id":"ec20","iccid":"89441000400128014257","profile_name":"Profile"}]}`)
+	second := profileBindingRequest(t, server, http.MethodPost, `{"upstream_proxy_id":"route-2","bindings":[{"device_id":"ec20","iccid":"8944100000000000001","profile_name":"Profile"}]}`)
 	if second.Code != http.StatusConflict {
 		t.Fatalf("rebind status = %d, want 409, body = %s", second.Code, second.Body.String())
 	}

internal/server/security_settings_test.go

@@ -199,6 +199,16 @@ func TestHandleLoggingSettingsRoundTripAndEnforceCount(t *testing.T) {
 	}
 }
 
+func TestLoggingCountIsClampedToHardLimit(t *testing.T) {
+	config, err := parseLoggingConfig(loggingConfig{Mode: "count", Count: store.MaxLogEvents + 500})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if config.Count != store.MaxLogEvents {
+		t.Fatalf("count = %d, want %d", config.Count, store.MaxLogEvents)
+	}
+}
+
 func TestLoginLockoutViaHTTP(t *testing.T) {
 	app := newTestApplication(t)
 	for i := 0; i < 4; i++ {

internal/server/server.go

@@ -57,6 +57,7 @@ type Server struct {
 	auth                *auth.Service
 	devices             DeviceController
 	vowifi              VoWiFiController
+	ussdSessions        ussdSessionStore
 	logs                *loghub.Hub
 	assets              fs.FS
 	indexHTML           []byte
@@ -117,6 +118,7 @@ func New(options Options) (*Server, error) {
 		auth:                options.Auth,
 		devices:             options.Devices,
 		vowifi:              options.VoWiFi,
+		ussdSessions:        newUSSDSessionStore(),
 		logs:                options.Logs,
 		assets:              options.Assets,
 		indexHTML:           indexHTML,
@@ -144,6 +146,9 @@ func New(options Options) (*Server, error) {
 	server.loadUILanguage(context.Background())
 
 	mux := http.NewServeMux()
+	mux.HandleFunc("/healthz", server.handleLiveness)
+	mux.HandleFunc("/readyz", server.handleReadiness)
+	mux.HandleFunc("/metrics", server.handleMetrics)
 	mux.HandleFunc("/api/health", server.handleHealth)
 	mux.HandleFunc("/api/auth/login", server.handleLogin)
 	mux.HandleFunc("/api/auth/session", server.handleSession)
@@ -155,7 +160,7 @@ func New(options Options) (*Server, error) {
 	mux.HandleFunc("/", server.handleSPA)
 
 	server.handler = server.recoverPanics(
-		server.securityHeaders(server.accessControl(server.logRequests(mux))),
+		server.securityHeaders(server.accessControl(server.logUserOperation(mux))),
 	)
 	return server, nil
 }
@@ -552,16 +557,14 @@ func requireMethod(w http.ResponseWriter, r *http.Request, allowed string) bool
 	return false
 }
 
-type statusWriter struct {
+type operationStatusWriter struct {
 	http.ResponseWriter
 	status int
 }
 
-func (w *statusWriter) Unwrap() http.ResponseWriter {
+func (w *operationStatusWriter) Unwrap() http.ResponseWriter { return w.ResponseWriter }
-	return w.ResponseWriter
-}
 
-func (w *statusWriter) WriteHeader(status int) {
+func (w *operationStatusWriter) WriteHeader(status int) {
 	if w.status != 0 {
 		return
 	}
@@ -569,25 +572,60 @@ func (w *statusWriter) WriteHeader(status int) {
 	w.ResponseWriter.WriteHeader(status)
 }
 
-func (s *Server) logRequests(next http.Handler) http.Handler {
+// logUserOperation records state-changing API actions, not request traffic.
+// GET/HEAD polling, assets, health checks and the live log stream are never
+// emitted, keeping the diagnostic page focused on actions a user initiated.
+func (s *Server) logUserOperation(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		startedAt := time.Now()
+		if !strings.HasPrefix(r.URL.Path, "/api/") ||
-		writer := &statusWriter{ResponseWriter: w}
+			r.Method == http.MethodGet || r.Method == http.MethodHead || r.Method == http.MethodOptions ||
+			strings.HasPrefix(r.URL.Path, "/api/auth/") || strings.HasPrefix(r.URL.Path, "/api/logs/") {
+			next.ServeHTTP(w, r)
+			return
+		}
+		writer := &operationStatusWriter{ResponseWriter: w}
 		next.ServeHTTP(writer, r)
 		status := writer.status
 		if status == 0 {
 			status = http.StatusOK
 		}
-		s.logger.Info(
+		level := slog.LevelInfo
-			"http request",
+		outcome := "success"
-			"method", r.Method,
+		message := "user operation completed"
-			"path", r.URL.Path,
+		if status >= http.StatusBadRequest {
+			level = slog.LevelWarn
+			outcome = "failed"
+			message = "user operation failed"
+		}
+		s.logger.Log(r.Context(), level, message,
+			"category", operationPathCategory(r.URL.Path),
+			"event", "user.operation",
+			"operation", strings.TrimPrefix(r.URL.Path, "/api/"),
+			"outcome", outcome,
 			"status", status,
-			"duration", time.Since(startedAt),
 		)
 	})
 }
 
+func operationPathCategory(path string) string {
+	path = strings.ToLower(path)
+	switch {
+	case strings.Contains(path, "/sms"):
+		return "sms"
+	case strings.Contains(path, "/call"):
+		return "call"
+	case strings.Contains(path, "/vowifi") || strings.Contains(path, "/ims"):
+		return "vowifi"
+	case strings.Contains(path, "/network") || strings.Contains(path, "/operator"):
+		return "network"
+	case strings.Contains(path, "/device") || strings.Contains(path, "/esim") ||
+		strings.Contains(path, "/ussd") || strings.Contains(path, "/at"):
+		return "hardware"
+	default:
+		return "operation"
+	}
+}
+
 func (s *Server) securityHeaders(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("X-Content-Type-Options", "nosniff")

internal/server/server_test.go

@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"io"
 	"io/fs"
+	"log/slog"
 	"net/http"
 	"net/http/cookiejar"
 	"net/http/httptest"
@@ -18,9 +19,36 @@ import (
 	"golang.org/x/crypto/bcrypt"
 
 	"vocat/internal/auth"
+	"vocat/internal/loghub"
 	"vocat/internal/store"
 )
 
+func TestUserOperationLoggerExcludesReadTraffic(t *testing.T) {
+	hub := loghub.New(slog.NewTextHandler(io.Discard, nil), 100)
+	server := &Server{logger: slog.New(hub)}
+	handler := server.logUserOperation(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	}))
+
+	handler.ServeHTTP(httptest.NewRecorder(), httptest.NewRequest(http.MethodGet, "/api/devices", nil))
+	if history := hub.History(10, slog.LevelDebug, ""); len(history) != 0 {
+		t.Fatalf("GET traffic produced diagnostic logs: %#v", history)
+	}
+
+	handler.ServeHTTP(httptest.NewRecorder(), httptest.NewRequest(http.MethodPatch, "/api/devices/dev1/network", nil))
+	history := hub.History(10, slog.LevelDebug, "")
+	if len(history) != 1 {
+		t.Fatalf("mutation log count = %d, want 1", len(history))
+	}
+	if history[0].Message != "user operation completed" || history[0].Fields["category"] != "network" {
+		t.Fatalf("mutation log = %#v", history[0])
+	}
+	handler.ServeHTTP(httptest.NewRecorder(), httptest.NewRequest(http.MethodDelete, "/api/logs/history", nil))
+	if history = hub.History(10, slog.LevelDebug, ""); len(history) != 1 {
+		t.Fatalf("log clear endpoint produced an operation log: %#v", history)
+	}
+}
+
 type testApplication struct {
 	server *httptest.Server
 	client *http.Client

internal/server/settings_api.go

@@ -41,6 +41,7 @@ var notificationChannels = []string{
 	"bark",
 	"pushplus",
 	"wecom",
+	"lark",
 }
 
 var notificationFields = map[string]map[string]string{
@@ -65,6 +66,9 @@ var notificationFields = map[string]map[string]string{
 	"wecom": {
 		"urls": "strings", "payload_template": "string",
 	},
+	"lark": {
+		"url": "string", "signing_enabled": "boolean", "secret": "string", "payload_template": "string",
+	},
 }
 
 // routeSettingsAPI is intentionally independent of the main router so it can
@@ -240,6 +244,20 @@ func decodeNotificationConfig(
 	if err != nil {
 		return false, nil, fmt.Errorf("encode %s notification config: %w", channel, err)
 	}
+	if enabled && channel == "lark" {
+		var resolved map[string]any
+		if err := json.Unmarshal(config, &resolved); err != nil {
+			return false, nil, fmt.Errorf("decode lark notification config: %w", err)
+		}
+		signingEnabled, _ := resolved["signing_enabled"].(bool)
+		if signingEnabled && configString(resolved, "url") != store.SecretMask &&
+			configString(resolved, "secret") == store.SecretMask {
+			return false, nil, errors.New("lark.secret must be re-entered when lark.url changes")
+		}
+		if err := validateLarkNotificationConfig(resolved); err != nil {
+			return false, nil, err
+		}
+	}
 	return enabled, config, nil
 }
 
@@ -265,6 +283,9 @@ func validateNotificationField(
 		if name == "text_template" {
 			limit = 32768
 		}
+		if channel == "lark" && name == "payload_template" {
+			limit = maxLarkPayloadBytes
+		}
 		if len(value) > limit || strings.ContainsAny(value, "\x00") {
 			return fmt.Errorf("%s is too long or contains invalid characters", field)
 		}
@@ -274,7 +295,7 @@ func validateNotificationField(
 			}
 		}
 		if name == "proxy" && value != "" {
-			if _, err := parseOutboundURL(value, false); err != nil {
+			if _, err := parseProxyURL(value); err != nil {
 				return fmt.Errorf("%s is not a valid HTTP URL", field)
 			}
 		}
@@ -300,6 +321,16 @@ func validateNotificationField(
 				return fmt.Errorf("%s is not a valid JSON template: %w", field, err)
 			}
 		}
+		if channel == "lark" && name == "payload_template" && value != "" {
+			if _, err := renderLarkPayload(value, larkTestValues(time.Unix(0, 0))); err != nil {
+				return fmt.Errorf("%s is not a valid JSON template: %w", field, err)
+			}
+		}
+		if channel == "lark" && name == "url" && value != "" && value != store.SecretMask {
+			if _, err := parseLarkWebhookURL(value); err != nil {
+				return fmt.Errorf("%s must be a valid Feishu or Lark group bot webhook URL: %w", field, err)
+			}
+		}
 	case "integer":
 		var value int
 		if err := json.Unmarshal(raw, &value); err != nil {
@@ -387,7 +418,7 @@ func (s *Server) handleNotificationTest(
 		writeError(w, http.StatusNotFound, "not_found", "notification channel was not found")
 		return
 	}
-	if channel != "webhook" && channel != "telegram" && channel != "email" && channel != "bark" && channel != "wecom" {
+	if channel != "webhook" && channel != "telegram" && channel != "email" && channel != "bark" && channel != "wecom" && channel != "lark" {
 		writeError(
 			w,
 			http.StatusNotImplemented,
@@ -441,6 +472,8 @@ func (s *Server) handleNotificationTest(
 		err = sendBarkNotificationTest(notificationContext, resolved)
 	case "wecom":
 		err = sendWecomNotificationTest(notificationContext, resolved)
+	case "lark":
+		err = sendLarkNotificationTest(notificationContext, resolved)
 	}
 	if err != nil {
 		redacted := store.RedactText(err.Error(), provider)
@@ -546,8 +579,8 @@ func (s *Server) resolveNotificationTestConfig(
 
 // mergeNotificationTestSecretValue preserves masked values submitted by the
 // settings form while allowing newly entered sensitive values in the same
-// request. WeCom URLs are a sensitive list, unlike the string-based secrets
+// request. Provider webhook URLs can be sensitive lists, unlike the
-// used by the other notification channels.
+// string-based secrets used by the other notification channels.
 func mergeNotificationTestSecretValue(incoming, existing any) any {
 	if incoming == nil {
 		return existing
@@ -595,6 +628,8 @@ func validateNotificationTestConfig(channel string, config map[string]any) error
 		}
 	case "wecom":
 		return validateWecomNotificationConfig(config)
+	case "lark":
+		return validateLarkNotificationConfig(config)
 	case "telegram":
 		token := configString(config, "bot_token")
 		if token == "" || token == store.SecretMask {
@@ -848,6 +883,8 @@ func sendEmailNotificationTest(ctx context.Context, config map[string]any) error
 	// Keep this call on one source line: CodeQL reports the interprocedural sink
 	// at the writer argument, and suppression comments bind to that exact line.
 	// codeql[go/email-injection]
+	// CodeQL [go/email-injection]
+	// lgtm[go/email-injection]
 	if err := writePlainTextMail(writer, from, recipients, "vocat notification test", "This is a vocat notification test."); err != nil {
 		_ = writer.Close()
 		return fmt.Errorf("write SMTP test message: %w", err)
@@ -954,7 +991,7 @@ func validateOutboundURL(
 }
 
 func validateNotificationProxyURL(ctx context.Context, raw string) (*url.URL, error) {
-	parsed, err := parseOutboundURL(raw, false)
+	parsed, err := parseProxyURL(raw)
 	if err != nil {
 		return nil, err
 	}
@@ -964,6 +1001,26 @@ func validateNotificationProxyURL(ctx context.Context, raw string) (*url.URL, er
 	return parsed, nil
 }
 
+// parseProxyURL parses an HTTP(S) proxy URL. Unlike parseOutboundURL, it
+// permits embedded userinfo (http://user:pass@host:port) because HTTP proxies
+// commonly authenticate with Proxy-Authorization derived from the URL.
+func parseProxyURL(raw string) (*url.URL, error) {
+	parsed, err := url.Parse(strings.TrimSpace(raw))
+	if err != nil || parsed.Hostname() == "" || parsed.IsAbs() == false {
+		return nil, errors.New("proxy must be an absolute HTTP URL")
+	}
+	if parsed.Scheme != "http" && parsed.Scheme != "https" {
+		return nil, errors.New("proxy URL must use HTTP or HTTPS")
+	}
+	if parsed.Port() != "" {
+		port, err := strconv.Atoi(parsed.Port())
+		if err != nil || port < 1 || port > 65535 {
+			return nil, errors.New("proxy URL has an invalid port")
+		}
+	}
+	return parsed, nil
+}
+
 func parseOutboundURL(raw string, requireHTTPS bool) (*url.URL, error) {
 	parsed, err := url.Parse(strings.TrimSpace(raw))
 	if err != nil || parsed.Hostname() == "" || parsed.IsAbs() == false {

internal/server/settings_api_test.go

@@ -73,7 +73,7 @@ func decodeSettingsResponse(t *testing.T, recorder *httptest.ResponseRecorder) m
 	return response
 }
 
-func TestNotificationSettingsAlwaysReturnsFiveChannelsAndPreservesSecrets(t *testing.T) {
+func TestNotificationSettingsAlwaysReturnsKnownChannelsAndPreservesSecrets(t *testing.T) {
 	test := newSettingsAPITest(t)
 	recorder := test.request(t, http.MethodGet, "/api/settings/notifications", "")
 	if recorder.Code != http.StatusOK {
@@ -179,6 +179,73 @@ func TestWecomNotificationSettingsPreserveWebhookURLs(t *testing.T) {
 	}
 }
 
+func TestLarkNotificationSettingsPreserveSecrets(t *testing.T) {
+	test := newSettingsAPITest(t)
+	webhookURL := "https://open.feishu.cn/open-apis/bot/v2/hook/lark-token"
+	secret := "lark-signing-secret"
+	template := `{"msg_type":"text","content":{"text":{{message}}}}`
+	first, err := json.Marshal(map[string]any{
+		"lark": map[string]any{
+			"enabled": true, "url": webhookURL, "signing_enabled": true, "secret": secret, "payload_template": template,
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	recorder := test.request(t, http.MethodPut, "/api/settings/notifications", string(first))
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("first PUT status = %d, body = %s", recorder.Code, recorder.Body)
+	}
+	if bytes.Contains(recorder.Body.Bytes(), []byte("lark-token")) || bytes.Contains(recorder.Body.Bytes(), []byte(secret)) {
+		t.Fatalf("PUT response leaked Lark secrets: %s", recorder.Body)
+	}
+	response := decodeSettingsResponse(t, recorder)
+	lark := response["data"].(map[string]any)["lark"].(map[string]any)
+	if lark["url"] != store.SecretMask || lark["secret"] != store.SecretMask {
+		t.Fatalf("redacted Lark config = %#v", lark)
+	}
+
+	second, err := json.Marshal(map[string]any{
+		"lark": map[string]any{
+			"enabled": true, "url": store.SecretMask, "signing_enabled": true, "secret": store.SecretMask, "payload_template": template,
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	recorder = test.request(t, http.MethodPut, "/api/settings/notifications", string(second))
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("masked PUT status = %d, body = %s", recorder.Code, recorder.Body)
+	}
+	stored, err := test.database.NotificationSetting(context.Background(), "lark")
+	if err != nil || !bytes.Contains(stored.Config, []byte("lark-token")) || !bytes.Contains(stored.Config, []byte(secret)) {
+		t.Fatalf("stored Lark config = %s, err = %v", stored.Config, err)
+	}
+}
+
+func TestUnsignedLarkNotificationDoesNotCreateSigningSecret(t *testing.T) {
+	test := newSettingsAPITest(t)
+	template := `{"msg_type":"text","content":{"text":{{message}}}}`
+	body, err := json.Marshal(map[string]any{
+		"lark": map[string]any{
+			"enabled": true, "url": "https://open.larksuite.com/open-apis/bot/v2/hook/token",
+			"signing_enabled": false, "payload_template": template,
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	recorder := test.request(t, http.MethodPut, "/api/settings/notifications", string(body))
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("PUT status = %d, body = %s", recorder.Code, recorder.Body)
+	}
+	response := decodeSettingsResponse(t, recorder)
+	lark := response["data"].(map[string]any)["lark"].(map[string]any)
+	if _, exists := lark["secret"]; exists {
+		t.Fatalf("unsigned Lark config unexpectedly contains a secret: %#v", lark)
+	}
+}
+
 func TestResolveWecomNotificationTestConfigAcceptsUnsavedWebhookURLs(t *testing.T) {
 	test := newSettingsAPITest(t)
 	raw, err := json.Marshal(map[string]any{
@@ -232,6 +299,45 @@ func TestResolveWecomNotificationTestConfigMergesMaskedAndUnsavedWebhookURLs(t *
 	}
 }
 
+func TestResolveLarkNotificationTestConfigMergesMaskedSecrets(t *testing.T) {
+	test := newSettingsAPITest(t)
+	storedURL := "https://open.larksuite.com/open-apis/bot/v2/hook/stored"
+	storedConfig, err := json.Marshal(map[string]any{
+		"url":              storedURL,
+		"signing_enabled":  true,
+		"secret":           "stored-signing-secret",
+		"payload_template": `{"msg_type":"text","content":{"text":{{message}}}}`,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := test.database.UpsertNotificationSetting(context.Background(), store.NotificationSetting{
+		Channel: "lark",
+		Config:  storedConfig,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	raw, err := json.Marshal(map[string]any{
+		"url":              store.SecretMask,
+		"signing_enabled":  true,
+		"secret":           store.SecretMask,
+		"payload_template": `{"msg_type":"text","content":{"text":{{message}}}}`,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	resolved, _, err := test.server.resolveNotificationTestConfig(context.Background(), "lark", raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if resolved["url"] != storedURL {
+		t.Fatalf("resolved URL = %#v", resolved["url"])
+	}
+	if resolved["secret"] != "stored-signing-secret" {
+		t.Fatalf("resolved secret = %#v", resolved["secret"])
+	}
+}
+
 func TestNotificationSettingsRejectsUnknownAndMalformedInput(t *testing.T) {
 	test := newSettingsAPITest(t)
 	cases := []struct {
@@ -284,6 +390,41 @@ func TestNotificationSettingsRejectsUnknownAndMalformedInput(t *testing.T) {
 			body: `{"webhook":{"enabled":true,"headers":{"X:Bad":"v"}}}`,
 			code: "invalid_notification_config",
 		},
+		{
+			name: "invalid Lark payload template",
+			body: `{"lark":{"enabled":true,"payload_template":"[]"}}`,
+			code: "invalid_notification_config",
+		},
+		{
+			name: "enabled Lark config without webhook URL",
+			body: `{"lark":{"enabled":true,"payload_template":"{\"msg_type\":\"text\"}"}}`,
+			code: "invalid_notification_config",
+		},
+		{
+			name: "enabled Lark signing without secret",
+			body: `{"lark":{"enabled":true,"url":"https://open.larksuite.com/open-apis/bot/v2/hook/token","signing_enabled":true,"payload_template":"{\"msg_type\":\"text\"}"}}`,
+			code: "invalid_notification_config",
+		},
+		{
+			name: "changed Lark URL with masked signing secret",
+			body: `{"lark":{"enabled":true,"url":"https://open.larksuite.com/open-apis/bot/v2/hook/new-token","signing_enabled":true,"secret":"********","payload_template":"{\"msg_type\":\"text\"}"}}`,
+			code: "invalid_notification_config",
+		},
+		{
+			name: "insecure Lark group bot URL",
+			body: `{"lark":{"enabled":false,"url":"http://open.larksuite.com/open-apis/bot/v2/hook/token"}}`,
+			code: "invalid_notification_config",
+		},
+		{
+			name: "non-Lark group bot URL",
+			body: `{"lark":{"enabled":false,"url":"https://example.com/open-apis/bot/v2/hook/token"}}`,
+			code: "invalid_notification_config",
+		},
+		{
+			name: "webhook URL with embedded credentials",
+			body: `{"webhook":{"enabled":true,"urls":["http://user:[email protected]"]}}`,
+			code: "invalid_notification_config",
+		},
 		{
 			name: "null body",
 			body: `null`,
@@ -858,6 +999,41 @@ func TestRestrictedNotificationClientCapsTimeoutAndRedirects(t *testing.T) {
 	}
 }
 
+func TestNotificationProxyAcceptsAuthenticatedURL(t *testing.T) {
+	test := newSettingsAPITest(t)
+	body := `{"telegram":{"enabled":true,"bot_token":"123456:abc","chat_id":"1","proxy":"http://user:[email protected]:8080"}}`
+	recorder := test.request(t, http.MethodPut, "/api/settings/notifications", body)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("status = %d, body = %s", recorder.Code, recorder.Body)
+	}
+	response := decodeSettingsResponse(t, recorder)
+	data, ok := response["data"].(map[string]any)
+	if !ok {
+		t.Fatalf("data missing: %#v", response)
+	}
+	telegram, ok := data["telegram"].(map[string]any)
+	if !ok {
+		t.Fatalf("telegram response missing: %#v", data)
+	}
+	if telegram["proxy"] != "http://user:[email protected]:8080" {
+		t.Fatalf("proxy not preserved: %#v", telegram["proxy"])
+	}
+}
+
+func TestNotificationProxyRejectsMalformedURL(t *testing.T) {
+	test := newSettingsAPITest(t)
+	body := `{"telegram":{"enabled":true,"bot_token":"123456:abc","chat_id":"1","proxy":"not-a-url"}}`
+	recorder := test.request(t, http.MethodPut, "/api/settings/notifications", body)
+	if recorder.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, body = %s", recorder.Code, recorder.Body)
+	}
+	response := decodeSettingsResponse(t, recorder)
+	detail, ok := response["error"].(map[string]any)
+	if !ok || detail["code"] != "invalid_notification_config" {
+		t.Fatalf("error = %#v", detail)
+	}
+}
+
 func TestRouteSettingsAPIReturnsFalseForUnknownPath(t *testing.T) {
 	test := newSettingsAPITest(t)
 	request := httptest.NewRequest(http.MethodGet, "/api/not-settings", nil)

internal/server/sms_api.go

@@ -101,10 +101,16 @@ func (s *Server) handleSMSThread(w http.ResponseWriter, r *http.Request) {
 			s.writeStoreError(w, err)
 			return
 		}
-		for _, message := range messages {
+		unreadIDs := make([]int64, 0, len(messages))
-			if !message.Read && (message.Direction == "inbound" || message.Direction == "received") {
+		for i := range messages {
-				message.Read = true
+			if !messages[i].Read && (messages[i].Direction == "inbound" || messages[i].Direction == "received") {
-				_, _ = s.store.SaveSMSMessage(r.Context(), message)
+				messages[i].Read = true
+				unreadIDs = append(unreadIDs, messages[i].ID)
+			}
+		}
+		if len(unreadIDs) > 0 {
+			if markErr := s.store.MarkSMSMessagesRead(r.Context(), unreadIDs); markErr != nil {
+				s.logger.Warn("mark SMS messages read failed", "error", markErr)
 			}
 		}
 		reverseSMS(messages)
@@ -363,16 +369,26 @@ func (s *Server) handleSMSSend(w http.ResponseWriter, r *http.Request) {
 	if sendErr != nil {
 		data["retry_safe"] = false
 		if result.PartsAccepted > 0 {
+			s.logger.Warn("multipart SMS was only partially accepted",
+				"category", "sms", "event", "sms.submission",
+				"device_id", request.DeviceID, "peer", request.Phone,
+				"transport", "cellular_at", "parts_attempted", result.PartsAttempted,
+				"parts_accepted", result.PartsAccepted, "raw_error", sendErr,
+			)
 			data["warning"] = "Only part of the multipart SMS was accepted by the modem. Do not retry the whole message."
 			writeJSON(w, http.StatusAccepted, map[string]any{"data": data})
 			return
 		}
 		s.logger.Warn(
 			"SMS submission failed after modem interaction",
+			"category", "sms",
+			"event", "sms.submission",
 			"device_id", request.DeviceID,
+			"peer", request.Phone,
+			"transport", "cellular_at",
 			"parts_attempted", result.PartsAttempted,
 			"parts_accepted", result.PartsAccepted,
-			"error", sendErr,
+			"raw_error", sendErr,
 		)
 		writeJSON(w, http.StatusBadGateway, map[string]any{
 			"error": apiError{
@@ -384,6 +400,12 @@ func (s *Server) handleSMSSend(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if !result.AllPartsAccepted {
+		s.logger.Warn("SMS submission was not confirmed",
+			"category", "sms", "event", "sms.submission",
+			"device_id", request.DeviceID, "peer", request.Phone,
+			"transport", "cellular_at", "modem_final", result.ModemFinal,
+			"parts_attempted", result.PartsAttempted, "parts_accepted", result.PartsAccepted,
+		)
 		writeJSON(w, http.StatusBadGateway, map[string]any{
 			"error": apiError{
 				Code:    "sms_submission_unconfirmed",
@@ -393,6 +415,11 @@ func (s *Server) handleSMSSend(w http.ResponseWriter, r *http.Request) {
 		})
 		return
 	}
+	s.logger.Info("SMS submission accepted",
+		"category", "sms", "event", "sms.submission",
+		"device_id", request.DeviceID, "peer", request.Phone,
+		"transport", "cellular_at", "parts", result.PartsAccepted,
+	)
 	writeJSON(w, http.StatusAccepted, map[string]any{"data": data})
 }
 
@@ -469,6 +496,12 @@ func (s *Server) writeIMSSMSSendResult(
 		"outcome":             smsSendOutcome(result.AllPartsAccepted, result.PartsAccepted, result.PartsTotal, result.DeliveryConfirmed),
 	}
 	if sendErr != nil {
+		s.logger.Warn("IMS SMS submission failed",
+			"category", "sms", "event", "sms.submission",
+			"device_id", deviceID, "peer", result.To, "transport", "ims",
+			"parts_attempted", result.PartsAttempted, "parts_accepted", result.PartsAccepted,
+			"raw_error", sendErr,
+		)
 		data["retry_safe"] = false
 		data["warning"] = sendErr.Error()
 		if result.PartsAccepted == 0 {
@@ -483,6 +516,11 @@ func (s *Server) writeIMSSMSSendResult(
 		}
 	}
 	if !result.AllPartsAccepted && result.PartsAccepted == 0 {
+		s.logger.Warn("IMS SMS submission was not confirmed",
+			"category", "sms", "event", "sms.submission",
+			"device_id", deviceID, "peer", result.To, "transport", "ims",
+			"parts_attempted", result.PartsAttempted, "parts_accepted", result.PartsAccepted,
+		)
 		writeJSON(w, http.StatusBadGateway, map[string]any{
 			"error": apiError{
 				Code:    "ims_sms_submission_unconfirmed",
@@ -492,6 +530,19 @@ func (s *Server) writeIMSSMSSendResult(
 		})
 		return
 	}
+	if result.AllPartsAccepted {
+		s.logger.Info("IMS SMS submission accepted",
+			"category", "sms", "event", "sms.submission",
+			"device_id", deviceID, "peer", result.To, "transport", "ims",
+			"parts", result.PartsAccepted,
+		)
+	} else {
+		s.logger.Warn("multipart IMS SMS was only partially accepted",
+			"category", "sms", "event", "sms.submission",
+			"device_id", deviceID, "peer", result.To, "transport", "ims",
+			"parts_attempted", result.PartsAttempted, "parts_accepted", result.PartsAccepted,
+		)
+	}
 	writeJSON(w, http.StatusAccepted, map[string]any{"data": data})
 }
 
@@ -647,7 +698,7 @@ func (s *Server) syncModemSMS(ctx context.Context, onlyDevice string) {
 				"delivery_status":    message.DeliveryStatus,
 				"data_coding_scheme": message.DataCodingScheme,
 			})
-			_, saveErr := s.store.SaveSMSMessage(ctx, store.SMSMessage{
+			saved, saveErr := s.store.SaveSMSMessage(ctx, store.SMSMessage{
 				MessageID:     messageID,
 				DeviceID:      config.ID,
 				ModemIMEI:     modemIMEI,
@@ -664,7 +715,14 @@ func (s *Server) syncModemSMS(ctx context.Context, onlyDevice string) {
 				Extra:         extra,
 			})
 			if saveErr != nil {
-				s.logger.Warn("persist modem SMS failed", "device_id", config.ID, "error", saveErr)
+				s.logger.Warn("persist modem SMS failed", "category", "sms", "device_id", config.ID, "raw_error", saveErr)
+			} else if saved.Direction == "inbound" && saved.CreatedAt.Unix() == saved.UpdatedAt.Unix() {
+				s.logger.Info("cellular SMS received",
+					"category", "sms", "event", "sms.received",
+					"device_id", config.ID, "peer", saved.Peer,
+					"transport", "cellular_at", "encoding", message.Encoding,
+					"parts", saved.PartsTotal,
+				)
 			}
 		}
 	}
@@ -764,6 +822,6 @@ func (s *Server) writeStoreError(w http.ResponseWriter, err error) {
 		writeError(w, http.StatusNotFound, "not_found", "the requested record was not found")
 		return
 	}
-	s.logger.Error("database operation failed", "error", err)
+	s.logger.Error("database operation failed", "category", "system", "event", "store.operation_failed", "raw_error", err)
 	writeError(w, http.StatusInternalServerError, "database_error", "the database operation failed")
 }

internal/server/sms_notifications.go

@@ -24,7 +24,7 @@ import (
 
 const smsNotificationPollInterval = 2 * time.Second
 
-var smsOnlyNotificationChannels = []string{"bark", "email", "pushplus", "webhook", "wecom"}
+var smsOnlyNotificationChannels = []string{"bark", "email", "pushplus", "webhook", "wecom", "lark"}
 
 type smsNotification struct {
 	DeviceID    string
@@ -143,7 +143,7 @@ func (s *Server) smsNotificationConfig(ctx context.Context, channel string) (map
 
 func validateSMSNotificationConfig(channel string, config map[string]any) error {
 	switch channel {
-	case "bark", "email", "webhook", "wecom":
+	case "bark", "email", "webhook", "wecom", "lark":
 		if err := validateNotificationTestConfig(channel, config); err != nil {
 			return err
 		}
@@ -204,6 +204,8 @@ func sendSMSNotification(ctx context.Context, channel string, config map[string]
 		return sendWebhookSMSNotification(ctx, config, message)
 	case "wecom":
 		return sendWecomNotification(ctx, config, wecomSMSValues(message))
+	case "lark":
+		return sendLarkNotification(ctx, config, larkSMSValues(message))
 	default:
 		return fmt.Errorf("unsupported SMS notification channel %q", channel)
 	}

internal/server/sms_notifications_test.go

@@ -66,6 +66,31 @@ func TestWecomAutomaticTaskValuesLeaveSMSFieldsEmpty(t *testing.T) {
 	}
 }
 
+func TestLarkTemplateValuesCoverSMSAndAutomaticTasks(t *testing.T) {
+	message := smsNotification{
+		DeviceID: "device-1", DeviceName: "客厅", DeviceLabel: "EC20",
+		Number: "+447386", Time: time.Unix(1_700_000_000, 0), Content: "hello",
+	}
+	smsValues := larkSMSValues(message)
+	if smsValues["event"] != "sms.received" || smsValues["title"] != "收到新短信" ||
+		smsValues["message"] != message.Text() || smsValues["content"] != "hello" ||
+		smsValues["device_label"] != "EC20" {
+		t.Fatalf("Lark SMS values = %#v", smsValues)
+	}
+
+	taskValues := larkAutomaticTaskValues(automaticTaskNotification{
+		Title: "自动任务执行成功", Text: "任务已完成", Time: time.Unix(1_700_000_000, 0),
+	})
+	if taskValues["event"] != "automatic_task.completed" || taskValues["title"] != "自动任务执行成功" || taskValues["message"] != "任务已完成" {
+		t.Fatalf("Lark automatic task values = %#v", taskValues)
+	}
+	for _, name := range []string{"content", "number", "device_id", "device_name", "device_label", "time"} {
+		if taskValues[name] != "" {
+			t.Fatalf("%s = %q, want empty", name, taskValues[name])
+		}
+	}
+}
+
 func TestValidateSMSNotificationConfig(t *testing.T) {
 	valid := map[string]map[string]any{
 		"bark":     {"urls": []any{"https://api.day.app/key"}},
@@ -76,6 +101,12 @@ func TestValidateSMSNotificationConfig(t *testing.T) {
 			"urls":             []any{"https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=secret"},
 			"payload_template": `{"msgtype":"text","text":{"content":{{message}}}}`,
 		},
+		"lark": {
+			"url":              "https://open.larksuite.com/open-apis/bot/v2/hook/secret",
+			"signing_enabled":  true,
+			"secret":           "signing-secret",
+			"payload_template": `{"msg_type":"text","content":{"text":{{message}}}}`,
+		},
 	}
 	for channel, config := range valid {
 		if err := validateSMSNotificationConfig(channel, config); err != nil {

internal/server/telegram_bot.go

@@ -236,10 +236,10 @@ func (bot *telegramBot) getUpdates(
 func (bot *telegramBot) handleUpdate(ctx context.Context, config telegramRuntimeConfig, update telegramUpdate) {
 	if callback := update.CallbackQuery; callback != nil {
 		if callback.Message == nil || !bot.authorized(config, callback.Message.Chat.ID, callback.From.ID) {
-			_ = bot.answerCallback(ctx, config, callback.ID, "无权限")
+			go func() { _ = bot.answerCallback(context.Background(), config, callback.ID, "无权限") }()
 			return
 		}
-		_ = bot.answerCallback(ctx, config, callback.ID, "")
+		go func() { _ = bot.answerCallback(context.Background(), config, callback.ID, "") }()
 		bot.handleCallback(ctx, config, callback)
 		return
 	}
@@ -1981,7 +1981,7 @@ func (bot *telegramBot) handleATCommand(ctx context.Context, config telegramRunt
 
 func (bot *telegramBot) executeATCommand(ctx context.Context, deviceID, command string) (string, error) {
 	command = strings.TrimSpace(command)
-	if err := validateATCommand(command); err != nil {
+	if err := validateATCommand(command, false); err != nil {
 		return "", err
 	}
 	_, _, physicalID, err := bot.device(deviceID)

internal/server/telegram_bot_test.go

@@ -122,7 +122,7 @@ func TestResolveTelegramPhoneNumberRejectsPlaceholderAndStaleRuntime(t *testing.
 	}
 	state := &vowifi.State{
 		ICCID:       "previous-card",
-		PhoneNumber: "+447386083638",
+		PhoneNumber: "+447700900123",
 	}
 	if got := resolveTelegramPhoneNumber("", state, snapshot); got != "--" {
 		t.Fatalf("stale or placeholder number leaked as %q", got)
@@ -135,10 +135,10 @@ func TestResolveTelegramPhoneNumberRejectsPlaceholderAndStaleRuntime(t *testing.
 }
 
 func TestTelegramCarrierPresentationSeparatesHomeAndServingNetworks(t *testing.T) {
-	if got := telegramHomeCarrier("234336570710174"); !strings.Contains(got, "🇬🇧") || !strings.Contains(got, "23433") {
+	if got := telegramHomeCarrier("234330000000001"); !strings.Contains(got, "🇬🇧") || !strings.Contains(got, "23433") {
 		t.Fatalf("home carrier = %q", got)
 	}
-	if got := telegramHomeCarrier("454006395879502", "Saily"); !strings.Contains(got, "1O1O / csl / Club Sim") || !strings.Contains(got, "45400") || !strings.Contains(got, "🇭🇰") || strings.Contains(got, "Saily") {
+	if got := telegramHomeCarrier("454000000000001", "Saily"); !strings.Contains(got, "1O1O / csl / Club Sim") || !strings.Contains(got, "45400") || !strings.Contains(got, "🇭🇰") || strings.Contains(got, "Saily") {
 		t.Fatalf("profile brand overrode home carrier = %q", got)
 	}
 	if got := telegramHomeCarrier("999991234567890", "Unknown Brand"); got != "Unknown Brand" {

internal/server/ussd_sessions.go

@@ -0,0 +1,58 @@
+package server
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"strings"
+	"sync"
+	"time"
+
+	"vocat/internal/device"
+)
+
+// ussdSessionStore is the HTTP-layer counterpart of device.Manager's USSD
+// session map. A USSI awaiting-input reply opens a token here so the existing
+// continue/cancel endpoints keep working; the token only records which device
+// the dialog belongs to — the IMS session owns the actual network dialog.
+type ussdSessionStore struct {
+	mu       sync.Mutex
+	sessions map[string]ussdServerSession
+}
+
+type ussdServerSession struct {
+	deviceID  string
+	createdAt time.Time
+}
+
+func newUSSDSessionStore() ussdSessionStore {
+	return ussdSessionStore{sessions: make(map[string]ussdServerSession)}
+}
+
+func (store *ussdSessionStore) open(deviceID string) string {
+	var token [8]byte
+	_, _ = rand.Read(token[:])
+	id := hex.EncodeToString(token[:])
+	store.mu.Lock()
+	if store.sessions == nil {
+		store.sessions = make(map[string]ussdServerSession)
+	}
+	store.sessions[id] = ussdServerSession{deviceID: deviceID, createdAt: time.Now().UTC()}
+	store.mu.Unlock()
+	return id
+}
+
+func (store *ussdSessionStore) device(sessionID string) (string, error) {
+	store.mu.Lock()
+	defer store.mu.Unlock()
+	session, ok := store.sessions[strings.TrimSpace(sessionID)]
+	if !ok {
+		return "", device.ErrUSSDSessionNotFound
+	}
+	return session.deviceID, nil
+}
+
+func (store *ussdSessionStore) drop(sessionID string) {
+	store.mu.Lock()
+	delete(store.sessions, strings.TrimSpace(sessionID))
+	store.mu.Unlock()
+}

internal/server/wecom_notification.go

@@ -8,8 +8,11 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
 	"strings"
 	"time"
+
+	"vocat/internal/store"
 )
 
 var wecomTemplateVariableNames = []string{
@@ -25,6 +28,10 @@ var wecomTemplateVariableNames = []string{
 	"time",
 }
 
+var wecomWebhookHosts = map[string]struct{}{
+	"qyapi.weixin.qq.com": {},
+}
+
 type wecomTemplateValues map[string]string
 
 func renderWecomPayload(template string, values wecomTemplateValues) ([]byte, error) {
@@ -46,6 +53,46 @@ func renderWecomPayload(template string, values wecomTemplateValues) ([]byte, er
 	return []byte(template), nil
 }
 
+func parseWecomWebhookURL(raw string) (*url.URL, error) {
+	parsed, err := parseOutboundURL(raw, true)
+	if err != nil {
+		return nil, err
+	}
+	canonicalHost := strings.ToLower(parsed.Hostname())
+	if _, ok := wecomWebhookHosts[canonicalHost]; !ok {
+		return nil, errors.New("WeCom bot webhook must use qyapi.weixin.qq.com")
+	}
+	if parsed.Port() != "" && parsed.Port() != "443" {
+		return nil, errors.New("WeCom bot webhook must use the default HTTPS port")
+	}
+	if parsed.Path != "/cgi-bin/webhook/send" {
+		return nil, errors.New("WeCom bot webhook path must be /cgi-bin/webhook/send")
+	}
+	key := parsed.Query().Get("key")
+	if key == "" || strings.ContainsAny(key, " \t\r\n/") {
+		return nil, errors.New("WeCom bot webhook key parameter is missing or invalid")
+	}
+	query := url.Values{}
+	query.Set("key", key)
+	return &url.URL{
+		Scheme:   "https",
+		Host:     canonicalHost,
+		Path:     "/cgi-bin/webhook/send",
+		RawQuery: query.Encode(),
+	}, nil
+}
+
+func validateWecomWebhookURL(ctx context.Context, raw string) (*url.URL, error) {
+	parsed, err := parseWecomWebhookURL(raw)
+	if err != nil {
+		return nil, err
+	}
+	if _, err := resolvePublicAddresses(ctx, parsed.Hostname()); err != nil {
+		return nil, err
+	}
+	return parsed, nil
+}
+
 func validateWecomResponse(status int, body []byte) error {
 	var result struct {
 		ErrCode *int `json:"errcode"`
@@ -102,6 +149,13 @@ func validateWecomNotificationConfig(config map[string]any) error {
 	if len(urls) > 8 {
 		return errors.New("wecom.urls cannot contain more than 8 URLs")
 	}
+	for _, rawURL := range urls {
+		if rawURL != store.SecretMask {
+			if _, err := parseWecomWebhookURL(rawURL); err != nil {
+				return err
+			}
+		}
+	}
 	template := configString(config, "payload_template")
 	if template == "" {
 		return errors.New("wecom.payload_template is required")
@@ -120,7 +174,7 @@ func sendWecomNotification(ctx context.Context, config map[string]any, values we
 		return err
 	}
 	for _, destination := range configStrings(config, "urls") {
-		parsed, err := validateOutboundURL(ctx, destination, false)
+		parsed, err := validateWecomWebhookURL(ctx, destination)
 		if err != nil {
 			return err
 		}
@@ -130,6 +184,8 @@ func sendWecomNotification(ctx context.Context, config map[string]any, values we
 		}
 		request.Header.Set("Content-Type", "application/json; charset=utf-8")
 		request.Header.Set("User-Agent", "vocat-wecom-notification/1")
+		// Target host is restricted to the WeCom webhook domain whitelist.
+		// codeql[go/uncontrolled-data-in-network-request]
 		response, err := client.Do(request)
 		if err != nil {
 			return fmt.Errorf("send WeCom notification: %w", err)

internal/store/domain_test.go

@@ -128,7 +128,7 @@ func TestMigration12ConvertsOnlyKnownActiveDeviceBindingToICCID(t *testing.T) {
 		INSERT INTO device_proxy_bindings (device_id, upstream_proxy_id, created_at, updated_at) VALUES
 			('known', 'route', 100, 100), ('unknown', 'route', 100, 100);
 		INSERT INTO vowifi_runtime (device_id, iccid, updated_at)
-			VALUES ('known', '89441000400128014257', 100);
+			VALUES ('known', '8944100000000000001', 100);
 		PRAGMA user_version = 11;
 	`); err != nil {
 		t.Fatal(err)
@@ -138,7 +138,7 @@ func TestMigration12ConvertsOnlyKnownActiveDeviceBindingToICCID(t *testing.T) {
 	}
 
 	database := openTestStore(t, path)
-	binding, err := database.DeviceProxyBinding(ctx, "89441000400128014257")
+	binding, err := database.DeviceProxyBinding(ctx, "8944100000000000001")
 	if err != nil || binding.DeviceID != "known" || binding.UpstreamProxyID != "route" {
 		t.Fatalf("migrated binding = %+v, %v", binding, err)
 	}
@@ -579,6 +579,20 @@ func TestSMSPersistenceAndDerivedThreads(t *testing.T) {
 	if len(contacts) != 1 || contacts[0].UnreadCount != 0 {
 		t.Fatalf("thread should be read: %+v", contacts)
 	}
+
+	// A subsequent periodic modem AT sync with raw unread state must not revert is_read back to 0.
+	if _, err := database.SaveSMSMessage(ctx, SMSMessage{
+		MessageID: "network-1", DeviceID: "ec20-1", IMSI: "46000",
+		Peer: "10086", Direction: "inbound", Body: "第一条（完整）",
+		Timestamp: base, Status: "received", Read: false,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	contacts, err = database.ListSMSContacts(ctx, SMSFilter{Peer: "10086"})
+	if err != nil || len(contacts) != 1 || contacts[0].UnreadCount != 0 {
+		t.Fatalf("thread read state must survive modem rescan: %+v", contacts)
+	}
+
 	deleted, err := database.DeleteSMSThread(ctx, "ec20-1", "46000", "10086")
 	if err != nil || deleted != 2 {
 		t.Fatalf("DeleteSMSThread() = %d, %v", deleted, err)
@@ -789,11 +803,11 @@ func TestProxyCredentialsAndCountryRules(t *testing.T) {
 		t.Fatalf("CountryRule() = %+v, %v", rule, err)
 	}
 	if err := database.UpsertDeviceProxyBinding(ctx, DeviceProxyBinding{
-		DeviceID: "ec20-1", ICCID: "89441000400128014257", ProfileName: "Vodafone", UpstreamProxyID: "up-1",
+		DeviceID: "ec20-1", ICCID: "8944100000000000001", ProfileName: "Vodafone", UpstreamProxyID: "up-1",
 	}); err != nil {
 		t.Fatal(err)
 	}
-	binding, err := database.DeviceProxyBinding(ctx, "89441000400128014257")
+	binding, err := database.DeviceProxyBinding(ctx, "8944100000000000001")
 	if err != nil || binding.UpstreamProxyID != "up-1" || binding.DeviceID != "ec20-1" || binding.ProfileName != "Vodafone" {
 		t.Fatalf("DeviceProxyBinding() = %+v, %v", binding, err)
 	}
@@ -803,7 +817,7 @@ func TestProxyCredentialsAndCountryRules(t *testing.T) {
 	if _, err := database.CountryRule(ctx, "CN"); !errors.Is(err, ErrNotFound) {
 		t.Fatalf("country rule should cascade with upstream deletion, got %v", err)
 	}
-	if _, err := database.DeviceProxyBinding(ctx, "89441000400128014257"); !errors.Is(err, ErrNotFound) {
+	if _, err := database.DeviceProxyBinding(ctx, "8944100000000000001"); !errors.Is(err, ErrNotFound) {
 		t.Fatalf("device binding should cascade with upstream deletion, got %v", err)
 	}
 }
@@ -917,6 +931,56 @@ func TestNotificationArraySecretPreservation(t *testing.T) {
 	}
 }
 
+func TestLarkNotificationSecretsAreRedactedAndPreserved(t *testing.T) {
+	ctx := context.Background()
+	database := openTestStore(t, ":memory:")
+	originalURL := "https://open.feishu.cn/open-apis/bot/v2/hook/lark-token"
+	if err := database.UpsertNotificationSetting(ctx, NotificationSetting{
+		Channel: "lark", Enabled: true,
+		Config: json.RawMessage(`{"url":"` + originalURL + `","secret":"signing-secret"}`),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	setting, err := database.NotificationSetting(ctx, "lark")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var redacted map[string]any
+	if err := json.Unmarshal(setting.Redacted().Config, &redacted); err != nil {
+		t.Fatal(err)
+	}
+	if redacted["url"] != SecretMask || redacted["secret"] != SecretMask {
+		t.Fatalf("redacted Lark config = %#v", redacted)
+	}
+	if err := database.UpsertNotificationSetting(ctx, NotificationSetting{
+		Channel: "lark", Enabled: true,
+		Config: json.RawMessage(`{"url":"` + SecretMask + `","secret":"` + SecretMask + `"}`),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	setting, err = database.NotificationSetting(ctx, "lark")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Contains(setting.Config, []byte(originalURL)) || !bytes.Contains(setting.Config, []byte("signing-secret")) {
+		t.Fatalf("stored Lark config = %s", setting.Config)
+	}
+}
+
+func TestNotificationRedactionKeepsEmptySensitiveValuesEmpty(t *testing.T) {
+	setting := NotificationSetting{
+		Config:          json.RawMessage(`{"url":"","secret":""}`),
+		SensitiveFields: []string{"url", "secret"},
+	}
+	var redacted map[string]any
+	if err := json.Unmarshal(setting.Redacted().Config, &redacted); err != nil {
+		t.Fatal(err)
+	}
+	if redacted["url"] != "" || redacted["secret"] != "" {
+		t.Fatalf("empty sensitive values were masked: %#v", redacted)
+	}
+}
+
 func TestEventsPoliciesAndTraffic(t *testing.T) {
 	ctx := context.Background()
 	database := openTestStore(t, ":memory:")
@@ -953,6 +1017,15 @@ func TestEventsPoliciesAndTraffic(t *testing.T) {
 	if err != nil || len(logs) != 1 || logs[0].Message != "ready" {
 		t.Fatalf("log filter result = %+v, %v", logs, err)
 	}
+	if _, err := database.AppendLogEvent(ctx, LogEvent{
+		Time: recent, Level: "info", Message: " HTTP REQUEST ",
+	}); err != nil {
+		t.Fatal(err)
+	}
+	logs, err = database.ListLogEvents(ctx, LogFilter{Level: "info", ExcludeMessage: "http request"})
+	if err != nil || len(logs) != 1 || logs[0].Message != "ready" {
+		t.Fatalf("excluded log filter result = %+v, %v", logs, err)
+	}
 	auditDeleted, logDeleted, err := database.PruneEvents(
 		ctx,
 		old.Add(time.Minute),

internal/store/events.go

@@ -9,6 +9,10 @@ import (
 	"time"
 )
 
+// MaxLogEvents is the hard storage ceiling. Every new row beyond this limit
+// replaces the oldest row regardless of the optional, stricter retention rule.
+const MaxLogEvents = 10000
+
 func (s *Store) AppendAuditEvent(ctx context.Context, value AuditEvent) (AuditEvent, error) {
 	value.Action = strings.TrimSpace(value.Action)
 	if value.Action == "" {
@@ -123,6 +127,8 @@ func auditEvent(row rowScanner) (AuditEvent, error) {
 }
 
 func (s *Store) AppendLogEvent(ctx context.Context, value LogEvent) (LogEvent, error) {
+	s.logMu.Lock()
+	defer s.logMu.Unlock()
 	value.Level = strings.ToLower(strings.TrimSpace(value.Level))
 	if value.Level == "" {
 		return LogEvent{}, errors.New("log level is required")
@@ -137,7 +143,18 @@ func (s *Store) AppendLogEvent(ctx context.Context, value LogEvent) (LogEvent, e
 	if value.Time.IsZero() {
 		value.Time = time.Now().UTC()
 	}
-	result, err := s.db.ExecContext(ctx, `
+	value.Fields = fields
+	if !s.logClearedAt.IsZero() && !value.Time.After(s.logClearedAt) {
+		// The entry was queued before a user cleared the log. Silently discard it
+		// so an in-flight persistence worker cannot resurrect cleared history.
+		return value, nil
+	}
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return LogEvent{}, fmt.Errorf("begin log append: %w", err)
+	}
+	defer tx.Rollback()
+	result, err := tx.ExecContext(ctx, `
 		INSERT INTO log_events (event_time, level, message, caller, fields_json)
 		VALUES (?, ?, ?, ?, ?)
 	`, value.Time.Unix(), value.Level, value.Message, value.Caller, string(fields))
@@ -148,7 +165,17 @@ func (s *Store) AppendLogEvent(ctx context.Context, value LogEvent) (LogEvent, e
 	if err != nil {
 		return LogEvent{}, fmt.Errorf("read log event id: %w", err)
 	}
-	value.Fields = fields
+	if _, err := tx.ExecContext(ctx, `
+		DELETE FROM log_events
+		WHERE id <= COALESCE((
+			SELECT id FROM log_events ORDER BY id DESC LIMIT 1 OFFSET ?
+		), 0)
+	`, MaxLogEvents); err != nil {
+		return LogEvent{}, fmt.Errorf("enforce log event limit: %w", err)
+	}
+	if err := tx.Commit(); err != nil {
+		return LogEvent{}, fmt.Errorf("commit log append: %w", err)
+	}
 	return value, nil
 }
 
@@ -159,6 +186,10 @@ func (s *Store) ListLogEvents(ctx context.Context, filter LogFilter) ([]LogEvent
 		clauses = append(clauses, `level = ?`)
 		args = append(args, strings.ToLower(filter.Level))
 	}
+	if filter.ExcludeMessage != "" {
+		clauses = append(clauses, `LOWER(TRIM(message)) <> ?`)
+		args = append(args, strings.ToLower(strings.TrimSpace(filter.ExcludeMessage)))
+	}
 	if !filter.Since.IsZero() {
 		clauses = append(clauses, `event_time >= ?`)
 		args = append(args, filter.Since.UTC().Unix())
@@ -236,6 +267,29 @@ func (s *Store) CountLogEvents(ctx context.Context) (int64, error) {
 	return count, nil
 }
 
+// ClearLogEvents permanently removes all persisted logs. Entries timestamped
+// at or before clearedAt are also rejected if they were already queued by the
+// asynchronous persistence worker.
+func (s *Store) ClearLogEvents(ctx context.Context, clearedAt time.Time) (int64, error) {
+	s.logMu.Lock()
+	defer s.logMu.Unlock()
+	if clearedAt.IsZero() {
+		clearedAt = time.Now().UTC()
+	}
+	result, err := s.db.ExecContext(ctx, `DELETE FROM log_events`)
+	if err != nil {
+		return 0, fmt.Errorf("clear log events: %w", err)
+	}
+	affected, err := result.RowsAffected()
+	if err != nil {
+		return 0, fmt.Errorf("read cleared log count: %w", err)
+	}
+	if clearedAt.After(s.logClearedAt) {
+		s.logClearedAt = clearedAt
+	}
+	return affected, nil
+}
+
 // PruneLogEventsToCount keeps only the newest `keep` log rows, deleting the
 // rest. keep <= 0 deletes everything.
 func (s *Store) PruneLogEventsToCount(ctx context.Context, keep int) (int64, error) {

internal/store/events_limit_test.go

@@ -0,0 +1,73 @@
+package store
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+)
+
+func TestAppendLogEventEnforcesHardLimit(t *testing.T) {
+	database, err := Open(context.Background(), ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer database.Close()
+
+	if _, err := database.db.ExecContext(context.Background(), `
+		WITH RECURSIVE sequence(value) AS (
+			SELECT 1 UNION ALL SELECT value + 1 FROM sequence WHERE value <= ?
+		)
+		INSERT INTO log_events(event_time, level, message, caller, fields_json)
+		SELECT value, 'info', 'seed-' || value, '', '{}' FROM sequence
+	`, MaxLogEvents); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := database.AppendLogEvent(context.Background(), LogEvent{
+		Level: "info", Message: "newest", Time: time.Now().UTC(),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	count, err := database.CountLogEvents(context.Background())
+	if err != nil || count != MaxLogEvents {
+		t.Fatalf("CountLogEvents = %d, %v; want %d", count, err, MaxLogEvents)
+	}
+	logs, err := database.ListLogEvents(context.Background(), LogFilter{Limit: 1})
+	if err != nil || len(logs) != 1 || logs[0].Message != "newest" {
+		t.Fatalf("newest log = %#v, %v", logs, err)
+	}
+}
+
+func TestClearLogEventsRejectsAlreadyQueuedEntries(t *testing.T) {
+	database, err := Open(context.Background(), ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer database.Close()
+
+	cutoff := time.Now().UTC()
+	if _, err := database.AppendLogEvent(context.Background(), LogEvent{
+		Level: "info", Message: "existing", Time: cutoff.Add(-time.Second),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	deleted, err := database.ClearLogEvents(context.Background(), cutoff)
+	if err != nil || deleted != 1 {
+		t.Fatalf("ClearLogEvents = %d, %v", deleted, err)
+	}
+	late, err := database.AppendLogEvent(context.Background(), LogEvent{
+		Level: "info", Message: "queued-before-clear", Time: cutoff.Add(-time.Millisecond),
+	})
+	if err != nil || late.ID != 0 {
+		t.Fatalf("old queued append = %+v, %v", late, err)
+	}
+	if _, err := database.AppendLogEvent(context.Background(), LogEvent{
+		Level: "info", Message: fmt.Sprintf("new-%d", MaxLogEvents), Time: cutoff.Add(time.Millisecond),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	count, err := database.CountLogEvents(context.Background())
+	if err != nil || count != 1 {
+		t.Fatalf("CountLogEvents = %d, %v; want 1", count, err)
+	}
+}

internal/store/models.go

@@ -468,6 +468,7 @@ type LogEvent struct {
 
 type LogFilter struct {
 	Level          string
+	ExcludeMessage string
 	Since          time.Time
 	Until          time.Time
 	BeforeID       int64
@@ -610,6 +611,9 @@ func mergeJSONSecrets(
 func redactJSONValue(value any, replacement string) any {
 	switch typed := value.(type) {
 	case string:
+		if typed == "" {
+			return ""
+		}
 		return replacement
 	case []any:
 		result := make([]any, len(typed))

internal/store/settings.go

@@ -24,6 +24,8 @@ func DefaultNotificationSensitiveFields(channel string) []string {
 		return []string{"token"}
 	case "wecom":
 		return []string{"urls"}
+	case "lark":
+		return []string{"url", "secret"}
 	default:
 		return nil
 	}

internal/store/sms.go

@@ -92,15 +92,16 @@ func saveSMSMessage(
 		if mergeErr != nil {
 			return SMSMessage{}, fmt.Errorf("merge concatenated SMS segment: %w", mergeErr)
 		}
-		if existingErr == nil && !changed {
+		if existingErr == nil {
-			// This segment is already folded into the stored row (a periodic modem
+			if !changed {
-			// rescan redelivers every segment). Leave the row untouched so the
+				if value.Read != existing.Read {
-			// durable id stays put and Telegram does not re-notify.
+					if _, err := executor.ExecContext(ctx, `UPDATE sms_messages SET is_read = ?, updated_at = ? WHERE id = ?`, boolInt(value.Read), now.Unix(), existing.ID); err != nil {
+						return SMSMessage{}, fmt.Errorf("update concatenated SMS read state: %w", err)
+					}
+					existing.Read = value.Read
+				}
 				return existing, nil
 			}
-		value.Body = mergedBody
-		extra = mergedExtra
-		if existingErr == nil {
 			// A new segment advanced the message. Replace the stale partial row so
 			// the merged row receives a fresh durable id; the Telegram id-cursor
 			// then surfaces the now-more-complete message exactly once. Carry
@@ -116,6 +117,8 @@ func saveSMSMessage(
 				value.Timestamp = existing.Timestamp
 			}
 		}
+		value.Body = mergedBody
+		extra = mergedExtra
 	}
 	if value.Timestamp.IsZero() {
 		value.Timestamp = now
@@ -171,7 +174,10 @@ func saveSMSMessage(
 			source = excluded.source,
 			parts_total = excluded.parts_total,
 			delivery_state = excluded.delivery_state,
-			is_read = excluded.is_read,
+			is_read = CASE
+				WHEN sms_messages.is_read = 1 THEN 1
+				ELSE excluded.is_read
+			END,
 			extra_json = excluded.extra_json,
 			updated_at = excluded.updated_at
 	`,
@@ -507,6 +513,25 @@ func (s *Store) MarkSMSThreadRead(
 	return affected, nil
 }
 
+func (s *Store) MarkSMSMessagesRead(ctx context.Context, ids []int64) error {
+	if len(ids) == 0 {
+		return nil
+	}
+	placeholders := make([]string, len(ids))
+	args := make([]any, 0, len(ids)+1)
+	args = append(args, time.Now().UTC().Unix())
+	for i, id := range ids {
+		placeholders[i] = "?"
+		args = append(args, id)
+	}
+	query := fmt.Sprintf("UPDATE sms_messages SET is_read = 1, updated_at = ? WHERE id IN (%s) AND is_read = 0", strings.Join(placeholders, ","))
+	_, err := s.db.ExecContext(ctx, query, args...)
+	if err != nil {
+		return fmt.Errorf("mark SMS messages read: %w", err)
+	}
+	return nil
+}
+
 // ListSMSContacts derives contacts and thread counters from messages. No
 // duplicated contact/thread table can drift out of sync with message history.
 func (s *Store) ListSMSContacts(ctx context.Context, filter SMSFilter) ([]SMSContact, error) {

internal/store/sms_restart_test.go

@@ -0,0 +1,121 @@
+package store
+
+import (
+	"context"
+	"encoding/json"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+func TestLongSMSReassemblySurvivesServiceRestart(t *testing.T) {
+	ctx := context.Background()
+	path := filepath.Join(t.TempDir(), "vocat.db")
+	const (
+		deviceID = "dajiang"
+		imei     = "867394042309830"
+		peer     = "+447700900123"
+	)
+	messageID := StableConcatMessageID("ims", imei, deviceID, peer, 27, 2)
+
+	database, err := Open(ctx, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	mustSaveDevice(t, database, deviceID, "大疆")
+	first, err := database.SaveSMSMessage(ctx, SMSMessage{
+		MessageID: messageID, DeviceID: deviceID, ModemIMEI: imei, IMSI: "23433",
+		Peer: peer, Direction: "inbound", Body: "第一段：安全提醒，",
+		Timestamp: time.Unix(1_700_000_000, 0).UTC(), Status: "received", Source: "ims",
+		PartsTotal: 2, Extra: concatExtra(t, 27, 2, 1),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if ConcatSMSReadyToNotify(first.MessageID, first.Extra) {
+		t.Fatal("partial message must not be ready before restart")
+	}
+	if err := database.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	database, err = Open(ctx, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer database.Close()
+	second, err := database.SaveSMSMessage(ctx, SMSMessage{
+		MessageID: messageID, DeviceID: deviceID, ModemIMEI: imei, IMSI: "23433",
+		Peer: peer, Direction: "inbound", Body: "第二段：请通过官方渠道核实。",
+		Timestamp: time.Unix(1_700_000_030, 0).UTC(), Status: "received", Source: "ims",
+		PartsTotal: 2, Extra: concatExtra(t, 27, 2, 2),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if second.Body != "第一段：安全提醒，第二段：请通过官方渠道核实。" ||
+		!ConcatSMSReadyToNotify(second.MessageID, second.Extra) {
+		t.Fatalf("reassembled message after restart = %#v", second)
+	}
+	messages, err := database.ListSMSMessages(ctx, SMSFilter{DeviceID: deviceID})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(messages) != 1 || messages[0].ID != second.ID {
+		t.Fatalf("stored messages after restart = %#v, want one merged row", messages)
+	}
+	redelivered, err := database.SaveSMSMessage(ctx, SMSMessage{
+		MessageID: messageID, DeviceID: deviceID, ModemIMEI: imei, IMSI: "23433",
+		Peer: peer, Direction: "inbound", Body: "第二段：请通过官方渠道核实。",
+		Status: "received", Source: "ims", PartsTotal: 2, Extra: concatExtra(t, 27, 2, 2),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if redelivered.ID != second.ID || redelivered.Body != second.Body {
+		t.Fatalf("redelivery duplicated or changed message: %#v", redelivered)
+	}
+}
+
+func TestMultipartDeliveryReportsSurviveServiceRestart(t *testing.T) {
+	ctx := context.Background()
+	path := filepath.Join(t.TempDir(), "vocat.db")
+	database, err := Open(ctx, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	mustSaveDevice(t, database, "dajiang", "大疆")
+	extra := json.RawMessage(`{"transport":"ims","part_results":[{"reference":51},{"reference":52}]}`)
+	sent, err := database.SaveSMSMessage(ctx, SMSMessage{
+		MessageID: "ims-submit-restart", DeviceID: "dajiang", IMSI: "23433",
+		Peer: "+447700900123", Direction: "outbound", Body: "multipart",
+		Status: "accepted_by_ims", Source: "ims", PartsTotal: 2,
+		DeliveryState: "accepted_by_ims", Read: true, Extra: extra,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := database.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	database, err = Open(ctx, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer database.Close()
+	first, err := database.ApplySMSDeliveryReport(ctx, SMSDeliveryReport{
+		DeviceID: "dajiang", IMSI: "23433", Peer: "+447700900123", Source: "ims",
+		MessageReference: 51, StatusCode: 0, DeliveryState: "delivered",
+	})
+	if err != nil || first.ID != sent.ID || first.DeliveryState != "pending_delivery_report" {
+		t.Fatalf("first report after restart = (%#v, %v)", first, err)
+	}
+	second, err := database.ApplySMSDeliveryReport(ctx, SMSDeliveryReport{
+		DeviceID: "dajiang", IMSI: "23433", Peer: "+447700900123", Source: "ims",
+		MessageReference: 52, StatusCode: 0, DeliveryState: "delivered",
+	})
+	if err != nil || second.ID != sent.ID || second.DeliveryState != "delivered" {
+		t.Fatalf("second report after restart = (%#v, %v)", second, err)
+	}
+}

internal/store/store.go

@@ -8,6 +8,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"sync"
 	"time"
 
 	_ "modernc.org/sqlite"
@@ -20,6 +21,8 @@ var ErrNotFound = errors.New("store: not found")
 // Store owns the SQLite connection used by the process.
 type Store struct {
 	db           *sql.DB
+	logMu        sync.Mutex
+	logClearedAt time.Time
 }
 
 type Admin struct {