From 9ae9ebb327fd17feafc76d9023c5324bd3f47aa0 Mon Sep 17 00:00:00 2001
From: agessaman <adam@gessaman.com>
Date: Thu, 16 Jul 2026 10:21:50 -0700
Subject: [PATCH] Harden P0 security and release boundaries

---
 .github/workflows/test.yml                    |  29 +-
 .gitignore                                    |   3 +
 com.meshcore.bot.plist                        |   6 +-
 data/randomlines/__init__.py                  |   1 +
 install-service.sh                            | 359 +++++----
 meshcore-bot.service                          |  12 +-
 meshcore_bot.py                               |  24 +-
 modules/command_manager.py                    |  33 +-
 modules/database_restore.py                   | 451 ++++++++++++
 modules/db_migrations.py                      |  24 +
 modules/i18n.py                               |  34 +-
 modules/scheduler.py                          | 493 ++++++++-----
 modules/web_viewer/app.py                     |  91 ++-
 .../static/js/channel_operations.js           |  17 +-
 .../web_viewer/templates/api_explorer.html    |   2 +-
 modules/web_viewer/templates/base.html        |  32 +-
 modules/web_viewer/templates/cache.html       |  88 ++-
 modules/web_viewer/templates/config.html      | 208 ++++--
 modules/web_viewer/templates/contacts.html    | 226 +++---
 modules/web_viewer/templates/feeds.html       | 294 +++++---
 modules/web_viewer/templates/greeter.html     | 193 +++--
 modules/web_viewer/templates/index.html       | 218 ++++--
 modules/web_viewer/templates/logs.html        |  17 +-
 modules/web_viewer/templates/mesh.html        |  89 ++-
 .../templates/multibyte_rollout.html          | 130 ++--
 modules/web_viewer/templates/plugins.html     |  66 +-
 modules/web_viewer/templates/radio.html       | 274 +++++--
 modules/web_viewer/templates/realtime.html    | 680 ++++++++++--------
 modules/web_viewer/templates/stats.html       | 127 ++--
 pyproject.toml                                |  13 +-
 scripts/build-deb.sh                          | 100 ++-
 scripts/debian_service_state.sh               |  79 ++
 scripts/migrate_service_layout.py             | 206 ++++++
 scripts/smoke_test_wheel.py                   |  66 ++
 tests/test_contacts_template_xss.py           |  57 +-
 tests/test_database_restore.py                | 269 +++++++
 tests/test_i18n.py                            |   7 +
 tests/test_randomline.py                      |  23 +
 tests/test_scheduler_operation_claims.py      | 373 ++++++++++
 tests/test_service_packaging.py               | 330 +++++++++
 tests/test_web_viewer.py                      |  56 +-
 tests/test_web_viewer_xss_hardening.py        | 309 ++++++++
 translations/__init__.py                      |   6 +
 43 files changed, 4649 insertions(+), 1466 deletions(-)
 create mode 100644 data/randomlines/__init__.py
 create mode 100644 modules/database_restore.py
 create mode 100644 scripts/debian_service_state.sh
 create mode 100644 scripts/migrate_service_layout.py
 create mode 100644 scripts/smoke_test_wheel.py
 create mode 100644 tests/test_database_restore.py
 create mode 100644 tests/test_scheduler_operation_claims.py
 create mode 100644 tests/test_service_packaging.py
 create mode 100644 tests/test_web_viewer_xss_hardening.py
 create mode 100644 translations/__init__.py

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 28d61ab..e376187 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -106,13 +106,40 @@ jobs:
       - name: mypy — strict overrides on typed modules
         run: mypy modules/ --ignore-missing-imports
 
+  package:
+    name: Build and smoke-test distributions
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+          cache: pip
+
+      - name: Build wheel and source distribution
+        run: |
+          python -m pip install --upgrade pip build twine
+          python -m build
+          python -m twine check dist/*
+
+      - name: Install and smoke-test wheel outside the source tree
+        run: |
+          python -m venv /tmp/meshcore-wheel-smoke
+          /tmp/meshcore-wheel-smoke/bin/pip install dist/*.whl
+          cd /tmp
+          /tmp/meshcore-wheel-smoke/bin/python "$GITHUB_WORKSPACE/scripts/smoke_test_wheel.py"
+          /tmp/meshcore-wheel-smoke/bin/meshcore-bot --help >/dev/null
+          /tmp/meshcore-wheel-smoke/bin/meshcore-viewer --help >/dev/null
+
   test:
     name: Tests (Python ${{ matrix.python-version }})
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.11", "3.12", "3.13"]
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.gitignore b/.gitignore
index 237f2e2..e0ed502 100644
--- a/.gitignore
+++ b/.gitignore
@@ -182,3 +182,6 @@ local/service_plugins/*
 !local/service_plugins/.gitkeep
 
 .claude/settings.local.json
+
+# Local engineering audit reports (may contain security-sensitive findings)
+/PROJECT_REVIEW_*.md
diff --git a/com.meshcore.bot.plist b/com.meshcore.bot.plist
index 03e1d82..b5a1e4c 100644
--- a/com.meshcore.bot.plist
+++ b/com.meshcore.bot.plist
@@ -4,11 +4,16 @@
 <dict>
     <key>Label</key>
     <string>com.meshcore.bot</string>
+
+    <key>UserName</key>
+    <string>__MESHCORE_SERVICE_USER__</string>
     
     <key>ProgramArguments</key>
     <array>
         <string>/usr/local/meshcore-bot/venv/bin/python</string>
         <string>/usr/local/meshcore-bot/meshcore_bot.py</string>
+        <string>--config</string>
+        <string>/usr/local/etc/meshcore-bot/config.ini</string>
     </array>
     
     <key>WorkingDirectory</key>
@@ -47,4 +52,3 @@
     <integer>1</integer>
 </dict>
 </plist>
-
diff --git a/data/randomlines/__init__.py b/data/randomlines/__init__.py
new file mode 100644
index 0000000..2b1fed9
--- /dev/null
+++ b/data/randomlines/__init__.py
@@ -0,0 +1 @@
+"""Bundled default RandomLine response files."""
diff --git a/install-service.sh b/install-service.sh
index 10792ed..3544ab1 100755
--- a/install-service.sh
+++ b/install-service.sh
@@ -17,11 +17,12 @@
 #
 # Prerequisites:
 #   - Linux system with systemd OR macOS
-#   - Python 3.9+ installed
+#   - Python 3.10+ installed
 #   - sudo access (script will prompt if needed)
 #   - Run from the meshcore-bot directory
 
 set -e
+umask 077
 
 # Colors for output
 RED='\033[0;31m'
@@ -53,6 +54,8 @@ if [[ "$IS_MACOS" == true ]]; then
     SERVICE_USER="$(whoami)"  # macOS: use current user or _meshcore
     SERVICE_GROUP="staff"
     INSTALL_DIR="/usr/local/meshcore-bot"
+    CONF_DIR="/usr/local/etc/meshcore-bot"
+    STATE_DIR="/usr/local/var/lib/meshcore-bot"
     LOG_DIR="/usr/local/var/log/meshcore-bot"
     SERVICE_FILE="com.meshcore.bot.plist"
     LAUNCHD_DIR="/Library/LaunchDaemons"
@@ -60,11 +63,15 @@ else
     SERVICE_USER="meshcore"
     SERVICE_GROUP="meshcore"
     INSTALL_DIR="/opt/meshcore-bot"
+    CONF_DIR="/etc/meshcore-bot"
+    STATE_DIR="/var/lib/meshcore-bot"
     LOG_DIR="/var/log/meshcore-bot"
     SERVICE_FILE="meshcore-bot.service"
     SYSTEMD_DIR="/etc/systemd/system"
 fi
 
+CONFIG_FILE="$CONF_DIR/config.ini"
+
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 # Parse command line arguments (before sudo check so help works)
@@ -222,9 +229,34 @@ fi
 # Check if Python 3 is available
 if ! command -v python3 &> /dev/null; then
     print_error "Python 3 is not installed or not in PATH"
-    print_error "Please install Python 3.9 or higher before running this script"
+    print_error "Please install Python 3.10 or higher before running this script"
     exit 1
 fi
+if ! python3 -c 'import sys; raise SystemExit(sys.version_info < (3, 10))'; then
+    print_error "Python 3.10 or higher is required"
+    print_error "Found: $(python3 --version 2>&1)"
+    exit 1
+fi
+
+# Stop a running legacy service before changing code or taking the SQLite
+# backup used for layout migration.  This runs only after sudo re-execution and
+# service-manager validation, so --help and unprivileged discovery stay inert.
+SERVICE_WAS_ACTIVE=false
+if [[ "$IS_MACOS" == true ]]; then
+    if launchctl list "$PLIST_NAME" &>/dev/null; then
+        SERVICE_WAS_ACTIVE=true
+        if ! launchctl unload "$LAUNCHD_DIR/$SERVICE_FILE" 2>/dev/null; then
+            launchctl stop "$PLIST_NAME" 2>/dev/null || true
+        fi
+        if launchctl list "$PLIST_NAME" &>/dev/null; then
+            print_error "The launchd service is still running; refusing an unsafe live database migration"
+            exit 1
+        fi
+    fi
+elif systemctl is-active --quiet "$SERVICE_NAME" 2>/dev/null; then
+    SERVICE_WAS_ACTIVE=true
+    systemctl stop "$SERVICE_NAME"
+fi
 
 print_section "Step 1: Setting Up Service User"
 if [[ "$IS_MACOS" == true ]]; then
@@ -291,160 +323,53 @@ else
     print_success "Created installation directory: $INSTALL_DIR"
 fi
 
-# Create log directory
-mkdir -p "$LOG_DIR"
+# Create mutable runtime directories separately from executable code.
+mkdir -p "$CONF_DIR" "$STATE_DIR" "$LOG_DIR"
+print_success "Created configuration directory: $CONF_DIR"
+print_success "Created state directory: $STATE_DIR"
 print_success "Created log directory: $LOG_DIR"
 
 print_section "Step 3: Copying Bot Files"
 if [[ "$UPGRADE_MODE" == true ]]; then
     print_info "Upgrading files in $INSTALL_DIR"
-    print_info "Only newer files will be copied, preserving existing configuration"
+    print_info "Replacing executable files from the trusted source while preserving explicit runtime state"
 else
     print_info "Copying bot files to $INSTALL_DIR"
-    print_info "Existing files will be updated only if source is newer"
+    print_info "Executable files will exactly match the trusted source"
 fi
 
-# Function to copy files intelligently
+# Synchronize executable code authoritatively.  Using --update or a merge-only
+# fallback can preserve a newer/stale Python file written by a previously
+# compromised service account and then cement it as root-owned executable code.
+# Only the explicitly excluded runtime paths survive an upgrade.
 copy_files_smart() {
     local source_dir="$1"
     local dest_dir="$2"
-    local files_copied=0
-    local files_skipped=0
-    local files_updated=0
-    
-    # Use rsync if available (better for this use case)
-    if command -v rsync &> /dev/null; then
-        print_info "Using rsync for efficient file copying"
-        # Preserve config.ini if it exists
-        local preserve_config=""
-        if [ -f "$dest_dir/config.ini" ]; then
-            preserve_config="--exclude=config.ini"
-            print_info "Preserving existing config.ini (not overwriting)"
-        fi
-        
-        # Note: --update flag preserves files in alternatives/ if destination is newer or same
-        # This protects user's custom alternative commands while allowing updates to repository files
-        if [ -d "$dest_dir/modules/commands/alternatives" ]; then
-            print_info "Preserving existing alternative commands (only updating if source is newer)"
-        fi
-        
-        # Preserve install dir's local/ entirely (user custom commands and service plugins)
-        # Never overwrite or delete anything under $dest_dir/local/
-        if [ -d "$dest_dir/local" ]; then
-            print_info "Preserving existing local/ directory (not overwriting)"
-        fi
-        
-        # Exclude patterns
-        rsync -a --update --exclude='.git' \
-              --exclude='__pycache__' \
-              --exclude='*.pyc' \
-              --exclude='*.pyo' \
-              --exclude='.DS_Store' \
-              --exclude='venv' \
-              --exclude='*.db' \
-              --exclude='*.db-shm' \
-              --exclude='*.db-wal' \
-              --exclude='*.log' \
-              --exclude='backups' \
-              --exclude='local/' \
-              $preserve_config \
-              "$source_dir/" "$dest_dir/" 2>/dev/null || {
-            print_warning "rsync had some issues, falling back to manual copy"
-        }
-        # If install dir has no local/, create minimal structure from source so service has valid layout
-        if [ ! -d "$dest_dir/local" ]; then
-            print_info "Creating local/ directory structure (first-time install)"
-            mkdir -p "$dest_dir/local/commands" "$dest_dir/local/service_plugins"
-            [ -f "$source_dir/local/README.md" ] && cp "$source_dir/local/README.md" "$dest_dir/local/" || true
-            [ -f "$source_dir/local/__init__.py" ] && cp "$source_dir/local/__init__.py" "$dest_dir/local/" || true
-            [ -f "$source_dir/local/commands/.gitkeep" ] && cp "$source_dir/local/commands/.gitkeep" "$dest_dir/local/commands/" || true
-            [ -f "$source_dir/local/service_plugins/.gitkeep" ] && cp "$source_dir/local/service_plugins/.gitkeep" "$dest_dir/local/service_plugins/" || true
-        fi
-        print_success "Files synchronized using rsync"
-        return 0
+    if ! command -v rsync &> /dev/null; then
+        print_error "rsync is required for a source-authoritative secure install; install rsync and retry"
+        return 1
     fi
-    
-    # Fallback: manual copy with find
-    print_info "Using manual file copy (consider installing rsync for better performance)"
-    
-    # Preserve alternatives directory if it exists
-    if [ -d "$dest_dir/modules/commands/alternatives" ]; then
-        print_info "Preserving existing alternative commands (not overwriting)"
+
+    print_info "Using rsync for source-authoritative executable synchronization"
+    if ! rsync -a --delete --exclude='.git' \
+          --exclude='__pycache__' \
+          --exclude='*.pyc' \
+          --exclude='*.pyo' \
+          --exclude='.DS_Store' \
+          --exclude='venv' \
+          --exclude='*.db' \
+          --exclude='*.db-shm' \
+          --exclude='*.db-wal' \
+          --exclude='*.log' \
+          --exclude='backups' \
+          --exclude='local/' \
+          --exclude='config.ini' \
+          "$source_dir/" "$dest_dir/"; then
+        print_error "rsync failed; refusing to continue with a partially synchronized code tree"
+        return 1
     fi
-    
-    # Preserve install dir's local/ entirely - never overwrite when it exists
-    if [ -d "$dest_dir/local" ]; then
-        print_info "Preserving existing local/ directory (not overwriting)"
-    fi
-    
-    # Copy files, preserving config.ini if it exists
-    while IFS= read -r file; do
-        local rel_path="${file#$source_dir/}"
-        local dest_file="$dest_dir/$rel_path"
-        local dest_dir_path
-        dest_dir_path="$(dirname "$dest_file")"
-        
-        # Skip excluded patterns
-        [[ "$rel_path" == *".git"* ]] && continue
-        [[ "$rel_path" == *"__pycache__"* ]] && continue
-        [[ "$rel_path" == *".pyc" ]] && continue
-        [[ "$rel_path" == *".pyo" ]] && continue
-        [[ "$rel_path" == *".DS_Store"* ]] && continue
-        [[ "$rel_path" == *"/venv/"* ]] && continue
-        [[ "$rel_path" == *".db" ]] && continue
-        [[ "$rel_path" == *".db-shm" ]] && continue
-        [[ "$rel_path" == *".db-wal" ]] && continue
-        [[ "$rel_path" == *".log" ]] && continue
-        [[ "$rel_path" == *"/backups/"* ]] && continue
-        
-        # Preserve install dir's local/ entirely - skip all files under local/ when dest has local/
-        if [[ "$rel_path" == "local/"* ]] && [ -d "$dest_dir/local" ]; then
-            files_skipped=$((files_skipped + 1))
-            continue
-        fi
-        
-        # Preserve alternatives directory - only update if source file is newer
-        if [[ "$rel_path" == "modules/commands/alternatives/"* ]] && [ -d "$dest_dir/modules/commands/alternatives" ]; then
-            if [ -f "$dest_file" ]; then
-                # File exists in destination - only update if source is newer
-                if [ "$file" -nt "$dest_file" ]; then
-                    # Source is newer, will update below
-                    :
-                else
-                    # Destination is same or newer - preserve user's version
-                    files_skipped=$((files_skipped + 1))
-                    continue
-                fi
-            fi
-            # File doesn't exist in destination, or source is newer - will copy below
-        fi
-        
-        # Create destination directory if needed
-        mkdir -p "$dest_dir_path"
-        
-        # Special handling for config.ini - preserve existing if it exists
-        if [[ "$rel_path" == "config.ini" ]] && [ -f "$dest_file" ]; then
-            files_skipped=$((files_skipped + 1))
-            continue
-        fi
-        
-        # Copy if destination doesn't exist or source is newer
-        if [ ! -f "$dest_file" ] || [ "$file" -nt "$dest_file" ]; then
-            if cp "$file" "$dest_file" 2>/dev/null; then
-                if [ -f "$dest_file" ]; then
-                    files_updated=$((files_updated + 1))
-                else
-                    files_copied=$((files_copied + 1))
-                fi
-            else
-                print_warning "Could not copy $rel_path"
-            fi
-        else
-            files_skipped=$((files_skipped + 1))
-        fi
-    done < <(find "$source_dir" -type f 2>/dev/null)
-    
-    print_success "File sync complete: $files_updated updated, $files_copied new, $files_skipped unchanged"
+
+    print_success "Executable files synchronized authoritatively using rsync"
 }
 
 # Copy files using smart copy function
@@ -465,52 +390,63 @@ if command -v git &>/dev/null && [ -d "$SCRIPT_DIR/.git" ]; then
     print_success "Wrote version info (${INSTALLER_VER}) to $INSTALL_DIR/.version_info"
 fi
 
-# If no config.ini in install dir, create it from config.ini.example
-if [ ! -f "$INSTALL_DIR/config.ini" ]; then
-    if [ -f "$INSTALL_DIR/config.ini.example" ]; then
-        cp "$INSTALL_DIR/config.ini.example" "$INSTALL_DIR/config.ini"
-        print_success "Created $INSTALL_DIR/config.ini from config.ini.example (no config was present)"
+# Keep configuration out of the root-owned application tree.  On upgrade, copy
+# the legacy config once so existing credentials and settings are preserved.
+if [ ! -f "$CONFIG_FILE" ]; then
+    if [ -f "$INSTALL_DIR/config.ini" ] && [ ! -L "$INSTALL_DIR/config.ini" ]; then
+        cp -p "$INSTALL_DIR/config.ini" "$CONFIG_FILE"
+        print_success "Migrated existing configuration to $CONFIG_FILE"
+    elif [ -f "$INSTALL_DIR/config.ini.example" ]; then
+        cp "$INSTALL_DIR/config.ini.example" "$CONFIG_FILE"
+        print_success "Created $CONFIG_FILE from config.ini.example"
     elif [ -f "$SCRIPT_DIR/config.ini.example" ]; then
-        cp "$SCRIPT_DIR/config.ini.example" "$INSTALL_DIR/config.ini"
-        print_success "Created $INSTALL_DIR/config.ini from config.ini.example (no config was present)"
+        cp "$SCRIPT_DIR/config.ini.example" "$CONFIG_FILE"
+        print_success "Created $CONFIG_FILE from config.ini.example"
     else
-        print_warning "config.ini.example not found. Create $INSTALL_DIR/config.ini manually before starting the bot."
+        print_warning "config.ini.example not found. Create $CONFIG_FILE manually before starting the bot."
     fi
 fi
 
-# Create venv and install dependencies before chown so the service user ends up
-# owning a complete, working venv (avoids partial root-owned venv and import errors).
+# Rewrite all relative runtime paths and coherently migrate an existing SQLite
+# database.  Absolute custom paths are left untouched; operators can grant an
+# additional systemd path explicitly when they intentionally store state there.
+if [ -f "$CONFIG_FILE" ]; then
+    python3 "$INSTALL_DIR/scripts/migrate_service_layout.py" \
+        --config "$CONFIG_FILE" \
+        --legacy-base "$INSTALL_DIR" \
+        --state-dir "$STATE_DIR" \
+        --log-dir "$LOG_DIR"
+fi
+
+# Remove a source-tree config copied into the application tree only when it is
+# identical to the active service config; otherwise retain it root-only as a
+# migration backup.
+if [ -f "$INSTALL_DIR/config.ini" ] && [ ! -L "$INSTALL_DIR/config.ini" ]; then
+    chmod 0600 "$INSTALL_DIR/config.ini"
+fi
+
+if [ ! -f "$CONFIG_FILE" ]; then
+    # Retain the old diagnostic wording for automation which looks for it.
+    if [ -f "$INSTALL_DIR/config.ini.example" ]; then
+        print_warning "Failed to create $CONFIG_FILE; check directory permissions"
+    fi
+fi
+
+# Build dependencies in a fresh environment.  The legacy venv was writable by
+# the service account; reusing it could preserve a malicious .pth/module and
+# turn that persistence into root-owned executable code during hardening.
 print_section "Step 4: Setting Up Python Virtual Environment"
-if [ -d "$INSTALL_DIR/venv" ]; then
-    print_info "Virtual environment already exists at $INSTALL_DIR/venv"
-    print_info "Preserving existing virtual environment"
-    if [[ "$UPGRADE_MODE" == true ]]; then
-        print_info "Upgrade mode: will update dependencies"
-    else
-        print_info "Will update dependencies if requirements.txt changed"
-    fi
-else
-    print_info "Creating an isolated Python environment for the bot"
-    print_info "This ensures dependencies don't conflict with system Python packages"
-    python3 -m venv "$INSTALL_DIR/venv"
-    print_success "Created virtual environment at $INSTALL_DIR/venv"
-fi
-
-# Verify virtual environment looks healthy
-VENV_PYTHON="$INSTALL_DIR/venv/bin/python"
-if [ ! -x "$VENV_PYTHON" ]; then
-    print_error "Python virtual environment at $INSTALL_DIR/venv appears to be incomplete or corrupted"
-    print_error "Expected Python executable not found at: $VENV_PYTHON"
-    print_info "Try removing $INSTALL_DIR/venv and re-running this installer to recreate it:"
-    echo "  sudo rm -rf $INSTALL_DIR/venv"
-    echo "  sudo ./install-service.sh"
-    exit 1
-fi
+VENV_BUILD="$INSTALL_DIR/.venv-build-$$"
+VENV_OLD="$INSTALL_DIR/.venv-old-$$"
+rm -rf "$VENV_BUILD" "$VENV_OLD"
+print_info "Creating a fresh isolated Python environment"
+python3 -m venv "$VENV_BUILD"
+VENV_BUILD_PYTHON="$VENV_BUILD/bin/python"
 
 # Ensure pip is available and up to date inside the venv
 print_info "Ensuring pip is available and up to date in the virtual environment"
-$VENV_PYTHON -m ensurepip --upgrade >/dev/null 2>&1 || true
-$VENV_PYTHON -m pip install --quiet --upgrade pip >/dev/null 2>&1 || true
+$VENV_BUILD_PYTHON -m ensurepip --upgrade >/dev/null 2>&1 || true
+$VENV_BUILD_PYTHON -m pip install --quiet --upgrade pip >/dev/null 2>&1 || true
 
 # Install dependencies in venv using python -m pip (more portable than calling pip directly)
 print_info "Installing Python dependencies from requirements.txt"
@@ -519,12 +455,22 @@ if [ ! -f "$INSTALL_DIR/requirements.txt" ]; then
     print_error "requirements.txt not found in installation directory"
     exit 1
 fi
-$VENV_PYTHON -m pip install --quiet -r "$INSTALL_DIR/requirements.txt" || {
+$VENV_BUILD_PYTHON -m pip install --quiet -r "$INSTALL_DIR/requirements.txt" || {
     print_error "Failed to install Python dependencies"
     print_info "You may need to check your internet connection or Python version"
+    rm -rf "$VENV_BUILD"
     exit 1
 }
-print_success "Installed all Python dependencies"
+if [ -d "$INSTALL_DIR/venv" ]; then
+    mv "$INSTALL_DIR/venv" "$VENV_OLD"
+fi
+if ! mv "$VENV_BUILD" "$INSTALL_DIR/venv"; then
+    [ -d "$VENV_OLD" ] && mv "$VENV_OLD" "$INSTALL_DIR/venv"
+    print_error "Failed to activate the newly built virtual environment"
+    exit 1
+fi
+rm -rf "$VENV_OLD"
+print_success "Installed all Python dependencies into a fresh virtual environment"
 
 # Optional extras
 echo ""
@@ -555,19 +501,37 @@ fi
 
 print_section "Step 5: Setting File Permissions"
 print_info "Configuring file ownership and permissions for security"
-print_info "The service user will own all files, with appropriate read/write permissions"
-# Set ownership
-chown -R "$SERVICE_USER:$SERVICE_GROUP" "$INSTALL_DIR"
+print_info "Executable code is root-owned; the service owns only configuration and runtime state"
+# Executable code and the virtual environment must not be writable by the
+# network-facing service account.
+# The service group receives read-only access to any explicitly installed key
+# material while root remains the only account able to modify it.
+CODE_GROUP="$SERVICE_GROUP"
+chown -R "root:$CODE_GROUP" "$INSTALL_DIR"
 chown -R "$SERVICE_USER:$SERVICE_GROUP" "$LOG_DIR"
-print_success "Set ownership to $SERVICE_USER:$SERVICE_GROUP"
+chown -R "$SERVICE_USER:$SERVICE_GROUP" "$CONF_DIR" "$STATE_DIR"
+print_success "Separated root-owned code from service-owned runtime state"
 
-# Set permissions
+# Code is readable/executable but never service-writable.  Preserve executable
+# bits created by the virtualenv and source scripts while dropping group/other
+# write access.
 chmod 755 "$INSTALL_DIR"
+chmod -R go-w "$INSTALL_DIR"
 find "$INSTALL_DIR" -type f -name "*.py" -exec chmod 644 {} \; 2>/dev/null || true
-find "$INSTALL_DIR" -type f -name "*.ini" -exec chmod 644 {} \; 2>/dev/null || true
 find "$INSTALL_DIR" -type f -name "*.txt" -exec chmod 644 {} \; 2>/dev/null || true
 find "$INSTALL_DIR" -type f -name "*.json" -exec chmod 644 {} \; 2>/dev/null || true
 find "$INSTALL_DIR" -type d -exec chmod 755 {} \; 2>/dev/null || true
+find "$INSTALL_DIR" -type f -name "*.ini" -exec chmod 600 {} \; 2>/dev/null || true
+find "$INSTALL_DIR" -type f \( -name ".env" -o -name "*.key" -o -name "*.pem" -o -name "*.p12" -o -name "*.pfx" \) -exec chmod 640 {} \; 2>/dev/null || true
+find "$INSTALL_DIR" -type f \( -name "*.db" -o -name "*.db-wal" -o -name "*.db-shm" -o -name "*.log" -o -name "*.log.*" \) -exec chmod 600 {} \; 2>/dev/null || true
+
+# Credentials, databases, backups, and local-plugin settings are private to the
+# service user.  Directories must be writable for SQLite sidecars and atomic
+# config updates; the 0700 boundary prevents local disclosure.
+find "$CONF_DIR" "$STATE_DIR" -type d -exec chmod 700 {} \; 2>/dev/null || true
+find "$CONF_DIR" "$STATE_DIR" -type f -exec chmod 600 {} \; 2>/dev/null || true
+chmod 750 "$LOG_DIR"
+find "$LOG_DIR" -type f -exec chmod 600 {} \; 2>/dev/null || true
 
 # Make main script executable
 chmod 755 "$INSTALL_DIR/meshcore_bot.py"
@@ -594,13 +558,16 @@ import re
 with open('$SERVICE_FILE', 'r') as f:
     content = f.read()
 content = content.replace('/usr/local/meshcore-bot', '$INSTALL_DIR')
+content = content.replace('/usr/local/etc/meshcore-bot', '$CONF_DIR')
+content = content.replace('/usr/local/var/lib/meshcore-bot', '$STATE_DIR')
 content = content.replace('/usr/local/var/log/meshcore-bot', '$LOG_DIR')
+content = content.replace('__MESHCORE_SERVICE_USER__', '$SERVICE_USER')
 with open('$LAUNCHD_DIR/$SERVICE_FILE', 'w') as f:
     f.write(content)
 "
         else
             # Fallback to sed (works on both macOS and Linux)
-            sed "s|/usr/local/meshcore-bot|$INSTALL_DIR|g; s|/usr/local/var/log/meshcore-bot|$LOG_DIR|g" "$SERVICE_FILE" > "$LAUNCHD_DIR/$SERVICE_FILE"
+            sed "s|/usr/local/meshcore-bot|$INSTALL_DIR|g; s|/usr/local/etc/meshcore-bot|$CONF_DIR|g; s|/usr/local/var/lib/meshcore-bot|$STATE_DIR|g; s|/usr/local/var/log/meshcore-bot|$LOG_DIR|g; s|__MESHCORE_SERVICE_USER__|$SERVICE_USER|g" "$SERVICE_FILE" > "$LAUNCHD_DIR/$SERVICE_FILE"
         fi
         print_success "Copied and configured plist file to $LAUNCHD_DIR/"
     fi
@@ -668,6 +635,15 @@ else
     print_info "Note: The service is enabled but not started yet. You'll start it after configuration."
 fi
 
+if [[ "$SERVICE_WAS_ACTIVE" == true ]]; then
+    print_info "Restarting the service because it was running before the upgrade"
+    if [[ "$IS_MACOS" == true ]]; then
+        launchctl load "$LAUNCHD_DIR/$SERVICE_FILE" 2>/dev/null || true
+    else
+        systemctl start "$SERVICE_NAME"
+    fi
+fi
+
 if [[ "$UPGRADE_MODE" == true ]]; then
     print_section "Upgrade Complete!"
     echo ""
@@ -684,7 +660,7 @@ echo -e "${BLUE}📋 Next Steps${NC}"
 echo -e "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
 echo ""
 echo -e "${CYAN}1. Configure the bot:${NC}"
-echo -e "   ${YELLOW}sudo nano $INSTALL_DIR/config.ini${NC}"
+echo -e "   ${YELLOW}sudo nano $CONFIG_FILE${NC}"
 echo "   Edit the configuration file with your bot settings, API keys, and device information"
 echo ""
 
@@ -744,7 +720,8 @@ echo -e "${BLUE}━━━━━━━━━━━━━━━━━━━━━
 echo -e "${BLUE}📁 Important File Locations${NC}"
 echo -e "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
 echo ""
-echo -e "  ${CYAN}Configuration file:${NC}  ${YELLOW}$INSTALL_DIR/config.ini${NC}"
+echo -e "  ${CYAN}Configuration file:${NC}  ${YELLOW}$CONFIG_FILE${NC}"
+echo -e "  ${CYAN}State directory:${NC}       ${YELLOW}$STATE_DIR${NC}"
 echo -e "  ${CYAN}Log directory:${NC}        ${YELLOW}$LOG_DIR${NC}"
 echo -e "  ${CYAN}Installation directory:${NC} ${YELLOW}$INSTALL_DIR${NC}"
 if [[ "$IS_MACOS" == true ]]; then
@@ -792,4 +769,4 @@ if [[ "$UPGRADE_MODE" == true ]]; then
 else
     print_success "Installation complete! The bot is ready to configure and start."
 fi
-echo ""
\ No newline at end of file
+echo ""
diff --git a/meshcore-bot.service b/meshcore-bot.service
index 5f01c8e..ba0a9a2 100644
--- a/meshcore-bot.service
+++ b/meshcore-bot.service
@@ -9,7 +9,7 @@ Type=simple
 User=meshcore
 Group=meshcore
 WorkingDirectory=/opt/meshcore-bot
-ExecStart=/opt/meshcore-bot/venv/bin/python /opt/meshcore-bot/meshcore_bot.py
+ExecStart=/opt/meshcore-bot/venv/bin/python /opt/meshcore-bot/meshcore_bot.py --config /etc/meshcore-bot/config.ini
 ExecReload=/bin/kill -HUP $MAINPID
 Restart=always
 RestartSec=10
@@ -26,7 +26,15 @@ NoNewPrivileges=true
 PrivateTmp=true
 ProtectSystem=strict
 ProtectHome=true
-ReadWritePaths=/opt/meshcore-bot
+UMask=0077
+ConfigurationDirectory=meshcore-bot
+ConfigurationDirectoryMode=0700
+StateDirectory=meshcore-bot
+StateDirectoryMode=0700
+LogsDirectory=meshcore-bot
+LogsDirectoryMode=0750
+ReadWritePaths=/etc/meshcore-bot
+ReadWritePaths=/var/lib/meshcore-bot
 ReadWritePaths=/var/log/meshcore-bot
 
 # Resource limits
diff --git a/meshcore_bot.py b/meshcore_bot.py
index 1789bd7..18cacf7 100644
--- a/meshcore_bot.py
+++ b/meshcore_bot.py
@@ -142,6 +142,29 @@ def main():
     except Exception as exc:  # noqa: BLE001 - never block startup on the linter itself
         print(f"Config validation skipped: {exc}", file=sys.stderr)
 
+    # A restore requested by the viewer is applied only here, before importing
+    # and constructing MeshCoreBot (which opens the DB and launches writers).
+    # The service manager must restart the bot and viewer as one unit.
+    from modules.database_restore import (
+        DatabaseRestoreError,
+        apply_pending_restores_from_config,
+    )
+
+    try:
+        restore_results = apply_pending_restores_from_config(args.config)
+    except DatabaseRestoreError as exc:
+        print(f"Error: pending database restore was not applied: {exc}", file=sys.stderr)
+        print(
+            "The active database was left unchanged. Correct or remove the pending restore "
+            "file before restarting.",
+            file=sys.stderr,
+        )
+        sys.exit(1)
+    for restore_result in restore_results:
+        recovery = restore_result.recovery_backup_path
+        recovery_note = f"; recovery backup: {recovery}" if recovery else ""
+        print(f"Applied pending database restore: {restore_result.database_path}{recovery_note}")
+
     from modules.core import MeshCoreBot
     bot = MeshCoreBot(config_file=args.config)
 
@@ -238,4 +261,3 @@ if __name__ == "__main__":
     main()
 
 
-
diff --git a/modules/command_manager.py b/modules/command_manager.py
index 54b7dc7..41f9edd 100644
--- a/modules/command_manager.py
+++ b/modules/command_manager.py
@@ -10,6 +10,8 @@ import time
 from dataclasses import dataclass
 from datetime import datetime
 from hashlib import sha256
+from importlib import resources
+from pathlib import Path
 from typing import Any
 
 from meshcore import EventType
@@ -955,24 +957,43 @@ class CommandManager:
             if not self._is_channel_trigger_allowed(key, message):
                 return None
 
-        file_path = self.bot.config.get('RandomLine', f'file.{key}', fallback='').strip()
-        if not file_path:
+        configured_file_path = self.bot.config.get('RandomLine', f'file.{key}', fallback='').strip()
+        if not configured_file_path:
             self.logger.warning(f"RandomLine matched '{key}' but missing config file.{key}")
             return None
 
         try:
-            validated_path = validate_safe_path(file_path, allow_absolute=True)
+            validated_path = validate_safe_path(configured_file_path, allow_absolute=True)
         except ValueError:
             validated_path = None
         if validated_path is None:
-            self.logger.warning(f"RandomLine: unsafe or restricted path rejected for '{key}': {file_path}")
+            self.logger.warning(
+                f"RandomLine: unsafe or restricted path rejected for '{key}': {configured_file_path}"
+            )
             return None
         file_path = str(validated_path)
 
         # Read usable lines
         try:
-            with open(file_path, encoding="utf-8") as f:
-                lines = [ln.strip() for ln in f.readlines()]
+            if Path(file_path).is_file():
+                with open(file_path, encoding="utf-8") as f:
+                    lines = [ln.strip() for ln in f.readlines()]
+            else:
+                # Shipped RandomLine defaults live in package data in wheels.
+                # Only map the documented data/randomlines path; arbitrary
+                # missing custom files must still fail instead of silently
+                # selecting a same-named bundled file.
+                normalized = configured_file_path.replace("\\", "/").lstrip("./")
+                marker = "data/randomlines/"
+                if not normalized.startswith(marker):
+                    raise FileNotFoundError(file_path)
+                resource_name = normalized.removeprefix(marker)
+                if not resource_name or "/" in resource_name:
+                    raise FileNotFoundError(file_path)
+                bundled = resources.files("data.randomlines").joinpath(resource_name)
+                if not bundled.is_file():
+                    raise FileNotFoundError(file_path)
+                lines = [ln.strip() for ln in bundled.read_text(encoding="utf-8").splitlines()]
             lines = [ln for ln in lines if ln]  # drop blank lines
         except Exception as e:
             self.logger.error(f"RandomLine error reading {file_path} for '{key}': {e}", exc_info=True)
diff --git a/modules/database_restore.py b/modules/database_restore.py
new file mode 100644
index 0000000..6b413a2
--- /dev/null
+++ b/modules/database_restore.py
@@ -0,0 +1,451 @@
+"""Stage and apply SQLite restores without replacing a live database.
+
+The web viewer runs in a separate process from the bot and both processes open
+short-lived WAL connections.  Replacing the database from an HTTP request is
+therefore unsafe: existing descriptors and WAL sidecars can continue referring
+to the old database.  This module implements a two-phase restore instead:
+
+* the viewer validates and copies a backup to a sibling pending file; and
+* normal bot startup applies that pending file before any database manager,
+  scheduler, or viewer process is created.
+
+The startup caller is responsible for ensuring the service was restarted as a
+unit (that is, no separately managed viewer process is still using the file).
+"""
+
+from __future__ import annotations
+
+import configparser
+import os
+import shutil
+import sqlite3
+import stat
+import tempfile
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from pathlib import Path
+
+from modules.db_migrations import MIGRATIONS
+
+DEFAULT_MAX_RESTORE_BYTES = 2 * 1024 * 1024 * 1024
+
+# Databases created before numbered migrations do not have ``schema_version``.
+# Requiring bot_metadata plus multiple tables from the original MeshCore schema
+# distinguishes those legitimate backups from an arbitrary SQLite file while
+# still allowing MigrationRunner to upgrade them after startup.
+LEGACY_SCHEMA_TABLES = {
+    "channel_operations",
+    "channels",
+    "feed_activity",
+    "feed_errors",
+    "feed_message_queue",
+    "feed_subscriptions",
+    "generic_cache",
+    "geocoding_cache",
+}
+
+
+class DatabaseRestoreError(RuntimeError):
+    """Raised when a restore cannot be safely staged or applied."""
+
+
+@dataclass(frozen=True)
+class RestoreResult:
+    """Description of a restore applied during startup."""
+
+    database_path: Path
+    recovery_backup_path: Path | None
+
+
+def pending_restore_path(database_path: str | Path) -> Path:
+    """Return the same-filesystem staging path for *database_path*."""
+
+    database = Path(database_path).resolve()
+    return database.with_name(f".{database.name}.restore-pending")
+
+
+def validate_restore_database(database_path: str | Path) -> None:
+    """Fail unless *database_path* is an intact, compatible MeshCore database."""
+
+    path = Path(database_path).resolve()
+    if not path.is_file():
+        raise DatabaseRestoreError(f"Restore database does not exist: {path}")
+
+    try:
+        with path.open("rb") as handle:
+            if handle.read(16) != b"SQLite format 3\x00":
+                raise DatabaseRestoreError("Restore file is not a SQLite database")
+
+        uri = f"{path.as_uri()}?mode=ro"
+        with sqlite3.connect(uri, uri=True, timeout=5.0) as conn:
+            integrity_row = conn.execute("PRAGMA integrity_check(1)").fetchone()
+            if not integrity_row or str(integrity_row[0]).lower() != "ok":
+                detail = str(integrity_row[0]) if integrity_row else "no result"
+                raise DatabaseRestoreError(f"SQLite integrity check failed: {detail}")
+
+            tables = {
+                str(row[0])
+                for row in conn.execute(
+                    "SELECT name FROM sqlite_master WHERE type = 'table'"
+                ).fetchall()
+            }
+            if "bot_metadata" not in tables:
+                raise DatabaseRestoreError(
+                    "Restore file is not a MeshCore Bot database; "
+                    "missing table: bot_metadata"
+                )
+
+            if "schema_version" not in tables:
+                legacy_matches = sorted(LEGACY_SCHEMA_TABLES & tables)
+                if len(legacy_matches) < 2:
+                    raise DatabaseRestoreError(
+                        "Restore file is not a recognizable legacy MeshCore Bot "
+                        "database; numbered migration history is absent and fewer "
+                        "than two legacy schema tables were found"
+                    )
+            else:
+                known_versions = {
+                    int(version) for version, _description, _fn in MIGRATIONS
+                }
+                applied_versions = {
+                    int(row[0])
+                    for row in conn.execute(
+                        "SELECT version FROM schema_version"
+                    ).fetchall()
+                    if row and row[0] is not None
+                }
+                unknown_versions = sorted(applied_versions - known_versions)
+                if unknown_versions:
+                    raise DatabaseRestoreError(
+                        "Restore database was created by a newer or incompatible "
+                        "version; unknown migration version(s): "
+                        f"{unknown_versions}"
+                    )
+    except DatabaseRestoreError:
+        raise
+    except (OSError, sqlite3.Error, ValueError) as exc:
+        raise DatabaseRestoreError(f"Could not validate restore database: {exc}") from exc
+
+
+def _safe_database_mode(database_path: Path) -> int:
+    """Preserve owner/group access while never granting access to others."""
+
+    try:
+        current = stat.S_IMODE(database_path.stat().st_mode)
+    except OSError:
+        current = 0
+    return 0o600 | (current & 0o060)
+
+
+def _match_database_ownership(path: Path, database_path: Path) -> None:
+    os.chmod(path, _safe_database_mode(database_path))
+    try:
+        active_stat = database_path.stat()
+        os.chown(path, active_stat.st_uid, active_stat.st_gid)
+    except (AttributeError, FileNotFoundError, PermissionError):
+        # chown is unavailable on Windows and an unprivileged service can only
+        # create files as itself.  In both cases the creator is the safe owner.
+        pass
+
+
+def _fsync_directory(directory: Path) -> None:
+    if os.name == "nt":
+        return
+    descriptor = os.open(str(directory), os.O_RDONLY)
+    try:
+        os.fsync(descriptor)
+    finally:
+        os.close(descriptor)
+
+
+def stage_database_restore(
+    source_path: str | Path,
+    database_path: str | Path,
+    *,
+    max_bytes: int = DEFAULT_MAX_RESTORE_BYTES,
+) -> Path:
+    """Validate and stage *source_path* for application on the next bot startup."""
+
+    if max_bytes <= 0:
+        raise DatabaseRestoreError("Restore size limit must be positive")
+
+    source = Path(source_path).resolve()
+    database = Path(database_path).resolve()
+    pending = pending_restore_path(database)
+    if source in {database, pending}:
+        raise DatabaseRestoreError("Restore source must be a separate backup file")
+
+    validate_restore_database(source)
+    database.parent.mkdir(parents=True, exist_ok=True)
+    temp_path: Path | None = None
+    try:
+        descriptor, temp_name = tempfile.mkstemp(
+            dir=database.parent,
+            prefix=f".{database.name}.restore-",
+            suffix=".tmp",
+        )
+        os.close(descriptor)
+        temp_path = Path(temp_name)
+        source_uri = f"{source.as_uri()}?mode=ro"
+        with sqlite3.connect(source_uri, uri=True, timeout=30.0) as source_conn:
+            page_count = int(source_conn.execute("PRAGMA page_count").fetchone()[0])
+            page_size = int(source_conn.execute("PRAGMA page_size").fetchone()[0])
+            if page_count * page_size > max_bytes:
+                raise DatabaseRestoreError(
+                    f"Restore database exceeds the {max_bytes}-byte safety limit"
+                )
+            with sqlite3.connect(str(temp_path), timeout=30.0) as destination_conn:
+                # SQLite's online backup API produces a self-contained snapshot
+                # and includes committed WAL content; a raw file copy does not.
+                source_conn.backup(destination_conn)
+                destination_conn.commit()
+
+        if temp_path.stat().st_size > max_bytes:
+            raise DatabaseRestoreError(
+                f"Restore database exceeds the {max_bytes}-byte safety limit"
+            )
+        with temp_path.open("rb") as temp_handle:
+            os.fsync(temp_handle.fileno())
+
+        _match_database_ownership(temp_path, database)
+        validate_restore_database(temp_path)
+        os.replace(temp_path, pending)
+        temp_path = None
+        _fsync_directory(database.parent)
+        return pending
+    except DatabaseRestoreError:
+        raise
+    except OSError as exc:
+        raise DatabaseRestoreError(f"Could not stage restore database: {exc}") from exc
+    finally:
+        if temp_path is not None:
+            try:
+                temp_path.unlink()
+            except FileNotFoundError:
+                pass
+
+
+def _create_recovery_backup(database: Path) -> Path:
+    timestamp = datetime.now(timezone.utc).strftime("%Y%m%dT%H%M%S%fZ")
+    recovery = database.with_name(f"{database.stem}.pre-restore-{timestamp}.db")
+    descriptor, temp_name = tempfile.mkstemp(
+        dir=database.parent,
+        prefix=f".{database.name}.pre-restore-",
+        suffix=".tmp",
+    )
+    os.close(descriptor)
+    temp_path = Path(temp_name)
+    try:
+        with sqlite3.connect(str(database), timeout=30.0) as source_conn:
+            with sqlite3.connect(str(temp_path), timeout=30.0) as destination_conn:
+                source_conn.backup(destination_conn)
+                destination_conn.commit()
+        _match_database_ownership(temp_path, database)
+        validate_restore_database(temp_path)
+        os.replace(temp_path, recovery)
+        _fsync_directory(database.parent)
+        return recovery
+    except Exception:
+        try:
+            temp_path.unlink()
+        except FileNotFoundError:
+            pass
+        raise
+
+
+def _rollback_from_recovery(recovery: Path, database: Path) -> None:
+    """Atomically restore *database* from the already verified recovery copy."""
+
+    descriptor, temp_name = tempfile.mkstemp(
+        dir=database.parent,
+        prefix=f".{database.name}.rollback-",
+        suffix=".tmp",
+    )
+    os.close(descriptor)
+    temp_path = Path(temp_name)
+    try:
+        shutil.copy2(recovery, temp_path)
+        with temp_path.open("rb") as handle:
+            os.fsync(handle.fileno())
+        _match_database_ownership(temp_path, database)
+        for suffix in ("-wal", "-shm"):
+            try:
+                Path(f"{database}{suffix}").unlink()
+            except FileNotFoundError:
+                pass
+        os.replace(temp_path, database)
+        _fsync_directory(database.parent)
+        validate_restore_database(database)
+    finally:
+        try:
+            temp_path.unlink()
+        except FileNotFoundError:
+            pass
+
+
+def apply_pending_database_restore(database_path: str | Path) -> RestoreResult | None:
+    """Apply a staged restore before any process opens *database_path*."""
+
+    database = Path(database_path).resolve()
+    pending = pending_restore_path(database)
+    if not pending.exists():
+        return None
+
+    validate_restore_database(pending)
+    database.parent.mkdir(parents=True, exist_ok=True)
+    recovery: Path | None = None
+    replaced = False
+    try:
+        if database.exists():
+            recovery = _create_recovery_backup(database)
+            active_stat = database.stat()
+        else:
+            active_stat = None
+
+        _match_database_ownership(pending, database)
+        for suffix in ("-wal", "-shm"):
+            sidecar = Path(f"{database}{suffix}")
+            try:
+                sidecar.unlink()
+            except FileNotFoundError:
+                pass
+
+        os.replace(pending, database)
+        replaced = True
+        if active_stat is not None:
+            os.chmod(database, 0o600 | (stat.S_IMODE(active_stat.st_mode) & 0o060))
+            try:
+                os.chown(database, active_stat.st_uid, active_stat.st_gid)
+            except (AttributeError, PermissionError):
+                pass
+        else:
+            os.chmod(database, 0o600)
+        _fsync_directory(database.parent)
+        validate_restore_database(database)
+        return RestoreResult(database_path=database, recovery_backup_path=recovery)
+    except (DatabaseRestoreError, OSError, sqlite3.Error) as exc:
+        if replaced:
+            try:
+                # Preserve the staged candidate for diagnosis/retry before
+                # putting the previous active database back.  Without this,
+                # a failure after os.replace consumes one member of a
+                # coordinated Bot/Viewer restore set.
+                os.replace(database, pending)
+                _fsync_directory(database.parent)
+                if recovery is not None:
+                    _rollback_from_recovery(recovery, database)
+            except Exception as rollback_exc:
+                raise DatabaseRestoreError(
+                    "Pending restore failed after replacement and automatic recovery also "
+                    f"failed. Recovery backup: {recovery}. Restore error: {exc}; "
+                    f"rollback error: {rollback_exc}"
+                ) from exc
+            if recovery is not None:
+                raise DatabaseRestoreError(
+                    "Pending restore failed; the candidate was re-queued and the "
+                    f"original database was restored from {recovery}: {exc}"
+                ) from exc
+            raise DatabaseRestoreError(
+                "Pending restore failed; the candidate was re-queued and no active "
+                f"database had existed: {exc}"
+            ) from exc
+        if isinstance(exc, DatabaseRestoreError):
+            raise
+        raise DatabaseRestoreError(f"Could not apply pending database restore: {exc}") from exc
+
+
+def _configured_database_paths(config_path: str | Path) -> list[Path]:
+    path = Path(config_path).resolve()
+    if not path.exists():
+        return []
+
+    config = configparser.ConfigParser()
+    try:
+        loaded = config.read(path, encoding="utf-8")
+    except configparser.Error as exc:
+        raise DatabaseRestoreError(f"Could not read restore configuration: {exc}") from exc
+    if not loaded:
+        return []
+
+    base = path.parent
+    local_dir = Path(config.get("Bot", "local_dir_path", fallback="local"))
+    if not local_dir.is_absolute():
+        local_dir = base / local_dir
+    local_config = local_dir / "config.ini"
+    if local_config.exists():
+        try:
+            config.read(local_config, encoding="utf-8")
+        except configparser.Error as exc:
+            raise DatabaseRestoreError(f"Could not read local restore configuration: {exc}") from exc
+
+    raw_paths = [config.get("Bot", "db_path", fallback="meshcore_bot.db")]
+    viewer_path = config.get("Web_Viewer", "db_path", fallback="").strip()
+    if viewer_path:
+        raw_paths.append(viewer_path)
+
+    resolved: list[Path] = []
+    for raw in raw_paths:
+        if raw == ":memory:":
+            continue
+        candidate = Path(raw)
+        if not candidate.is_absolute():
+            candidate = base / candidate
+        candidate = candidate.resolve()
+        if candidate not in resolved:
+            resolved.append(candidate)
+    return resolved
+
+
+def apply_pending_restores_from_config(config_path: str | Path) -> list[RestoreResult]:
+    """Apply pending bot/viewer restores before normal startup opens either DB."""
+
+    database_paths = _configured_database_paths(config_path)
+    pending_paths = [
+        pending_restore_path(path)
+        for path in database_paths
+        if pending_restore_path(path).exists()
+    ]
+    # Validate the entire set before changing any active database.  This avoids
+    # applying the bot restore only to discover that a split viewer restore is
+    # corrupt or incompatible.
+    for pending in pending_paths:
+        validate_restore_database(pending)
+
+    results: list[RestoreResult] = []
+    try:
+        for database_path in database_paths:
+            result = apply_pending_database_restore(database_path)
+            if result is not None:
+                results.append(result)
+    except Exception as exc:
+        rollback_errors: list[str] = []
+        for result in reversed(results):
+            database = result.database_path
+            pending = pending_restore_path(database)
+            try:
+                # Preserve the already-applied candidate so the complete restore
+                # set can be retried after the failure is corrected.
+                for suffix in ("-wal", "-shm"):
+                    try:
+                        Path(f"{database}{suffix}").unlink()
+                    except FileNotFoundError:
+                        pass
+                os.replace(database, pending)
+                _fsync_directory(database.parent)
+                validate_restore_database(pending)
+                if result.recovery_backup_path is not None:
+                    _rollback_from_recovery(result.recovery_backup_path, database)
+            except Exception as rollback_exc:
+                rollback_errors.append(f"{database}: {rollback_exc}")
+
+        if rollback_errors:
+            raise DatabaseRestoreError(
+                "A configured restore failed and rollback was incomplete. "
+                f"Restore error: {exc}. Rollback error(s): "
+                + "; ".join(rollback_errors)
+            ) from exc
+        raise DatabaseRestoreError(
+            "A configured restore failed; every previously applied database was "
+            f"rolled back and re-queued: {exc}"
+        ) from exc
+    return results
diff --git a/modules/db_migrations.py b/modules/db_migrations.py
index ccd1443..4588509 100644
--- a/modules/db_migrations.py
+++ b/modules/db_migrations.py
@@ -530,6 +530,28 @@ def _m0014_observed_paths_multibyte_covering_index(cursor: sqlite3.Cursor) -> No
     )
 
 
+def _m0015_channel_operations_claimed_at(cursor: sqlite3.Cursor) -> None:
+    """Record when a queued hardware/config operation is durably claimed.
+
+    A ``processing`` row is deliberately not auto-requeued: after a process
+    crash the device may already have applied the operation, so retrying it
+    automatically could execute a non-idempotent command twice.  ``claimed_at``
+    gives operators enough information to diagnose and explicitly resolve such
+    an ambiguous operation.
+    """
+    if _table_exists(cursor, "channel_operations"):
+        _add_column(cursor, "channel_operations", "claimed_at", "TIMESTAMP")
+
+
+def _m0016_channel_operations_claim_owner(cursor: sqlite3.Cursor) -> None:
+    """Persist enough local-process identity to recover only provably dead claims."""
+    if not _table_exists(cursor, "channel_operations"):
+        return
+    _add_column(cursor, "channel_operations", "claim_owner_host", "TEXT")
+    _add_column(cursor, "channel_operations", "claim_owner_pid", "INTEGER")
+    _add_column(cursor, "channel_operations", "claim_owner_boot_id", "TEXT")
+
+
 # ---------------------------------------------------------------------------
 # Migration registry — append new entries here, never remove or reorder.
 # ---------------------------------------------------------------------------
@@ -551,6 +573,8 @@ MIGRATIONS: list[MigrationEntry] = [
     (12, "purging_log: add details column", _m0012_purging_log_details_column),
     (13, "observed_paths: advert covering index for contacts page", _m0013_observed_paths_advert_covering_index),
     (14, "observed_paths: multibyte covering index for mesh graph", _m0014_observed_paths_multibyte_covering_index),
+    (15, "channel_operations: claimed_at", _m0015_channel_operations_claimed_at),
+    (16, "channel_operations: claim owner identity", _m0016_channel_operations_claim_owner),
 ]
 
 
diff --git a/modules/i18n.py b/modules/i18n.py
index 0ac8999..b8a1c22 100644
--- a/modules/i18n.py
+++ b/modules/i18n.py
@@ -5,6 +5,7 @@ Provides translation functionality for bot commands and responses
 """
 
 import json
+from importlib import resources
 from pathlib import Path
 from typing import Any
 
@@ -108,12 +109,20 @@ class Translator:
             Dictionary of translations, empty dict if file not found
         """
         file_path = Path(self.translation_path) / f"{lang}.json"
-        if not file_path.exists():
-            return {}
-
         try:
-            with open(file_path, encoding='utf-8') as f:
-                return json.load(f)
+            # An explicitly configured filesystem catalog always wins.  The
+            # package fallback makes the defaults work from an installed wheel
+            # (where ``translations/`` is not relative to the current cwd).
+            if file_path.is_file():
+                with open(file_path, encoding='utf-8') as f:
+                    return json.load(f)
+
+            if not self._uses_bundled_defaults():
+                return {}
+            bundled = resources.files("translations").joinpath(f"{lang}.json")
+            if not bundled.is_file():
+                return {}
+            return json.loads(bundled.read_text(encoding="utf-8"))
         except json.JSONDecodeError as e:
             print(f"Error parsing translation file {file_path}: {e}")
             return {}
@@ -179,7 +188,19 @@ class Translator:
         if trans_path.exists():
             for file in trans_path.glob('*.json'):
                 languages.append(file.stem)
-        return sorted(languages)
+        if self._uses_bundled_defaults():
+            try:
+                for resource in resources.files("translations").iterdir():
+                    if resource.is_file() and resource.name.endswith(".json"):
+                        languages.append(resource.name[:-5])
+            except (ModuleNotFoundError, OSError):
+                pass
+        return sorted(set(languages))
+
+    def _uses_bundled_defaults(self) -> bool:
+        """Return whether ``translation_path`` names the shipped catalog."""
+        normalized = str(self.translation_path).replace("\\", "/").rstrip("/")
+        return normalized == "translations"
 
     def get_value(self, key: str) -> Any:
         """
@@ -210,4 +231,3 @@ class Translator:
                 break
 
         return value
-
diff --git a/modules/scheduler.py b/modules/scheduler.py
index ddad033..ab10a90 100644
--- a/modules/scheduler.py
+++ b/modules/scheduler.py
@@ -9,9 +9,11 @@ import datetime
 import hashlib
 import json
 import os
+import socket
 import sqlite3
 import threading
 import time
+import uuid
 from pathlib import Path
 from typing import Any, Optional
 
@@ -26,7 +28,24 @@ from .scheduled_message_cron import (
     parse_scheduled_message_value,
 )
 from .security_utils import validate_external_url
-from .utils import decode_escape_sequences, format_keyword_response_with_placeholders, get_config_timezone
+from .utils import (
+    decode_escape_sequences,
+    format_keyword_response_with_placeholders,
+    get_config_timezone,
+)
+
+_CHANNEL_OPERATION_TYPES = ('add', 'remove')
+_RADIO_OPERATION_TYPES = (
+    'radio_reboot',
+    'radio_connect',
+    'radio_disconnect',
+    'firmware_read',
+    'firmware_write',
+    'radio_params_read',
+    'radio_params_write',
+    'radio_advert',
+)
+_CONFIG_OPERATION_TYPES = ('config_reload',)
 
 
 class MessageScheduler:
@@ -35,6 +54,12 @@ class MessageScheduler:
     def __init__(self, bot):
         self.bot = bot
         self.logger = bot.logger
+        self._claim_owner_host = socket.gethostname()
+        self._claim_owner_pid = os.getpid()
+        # Unique to this scheduler/process start; retained with the PID to make
+        # ownership auditable and prevent one scheduler instance finalizing a
+        # claim made by another instance in the same process.
+        self._claim_owner_boot_id = uuid.uuid4().hex
         self.scheduled_messages = {}
         self.scheduler_thread = None
         self._apscheduler: Optional[BackgroundScheduler] = None
@@ -48,6 +73,10 @@ class MessageScheduler:
         self.last_db_backup_run = 0
         self.last_log_rotation_check_time = 0
         self.maintenance = MaintenanceRunner(bot, get_current_time=self.get_current_time)
+        db_manager = getattr(bot, 'db_manager', None)
+        db_path = getattr(db_manager, 'db_path', None)
+        if db_manager is not None and isinstance(db_path, (str, os.PathLike)):
+            self._recover_interrupted_operations()
 
     def get_current_time(self):
         """Get current time in configured timezone"""
@@ -835,106 +864,237 @@ class MessageScheduler:
             raise RuntimeError(f"send_advert failed: {reason}")
         self.logger.info("Interval-based flood advert sent successfully")
 
-    async def _process_channel_operations(self):
-        """Process pending channel operations from the web viewer"""
+    def _claim_operation(self, operation_types: tuple[str, ...]) -> Optional[dict[str, Any]]:
+        """Atomically claim the oldest pending operation in one serialized group.
+
+        ``BEGIN IMMEDIATE`` prevents two scheduler ticks (or two bot processes)
+        from selecting the same pending row.  A group permits only one
+        ``processing`` operation at a time, preserving device-operation order
+        when an earlier command is slow.
+
+        Processing rows are never auto-requeued.  If a previous same-host owner
+        is provably dead at startup, its claim becomes ``interrupted`` so later
+        work can proceed without replaying the ambiguous action.  Live or
+        unprovable owners continue to block the group conservatively.
+        """
+        if not operation_types:
+            raise ValueError("operation_types must not be empty")
+
+        placeholders = ', '.join('?' for _ in operation_types)
+        with self.bot.db_manager.connection() as conn:
+            conn.row_factory = sqlite3.Row
+            cursor = conn.cursor()
+            cursor.execute('BEGIN IMMEDIATE')
+
+            cursor.execute(
+                f'''SELECT id
+                    FROM channel_operations
+                    WHERE status = 'processing'
+                      AND operation_type IN ({placeholders})
+                    LIMIT 1''',
+                operation_types,
+            )
+            if cursor.fetchone() is not None:
+                conn.commit()
+                return None
+
+            cursor.execute(
+                f'''SELECT *
+                    FROM channel_operations
+                    WHERE status = 'pending'
+                      AND operation_type IN ({placeholders})
+                    ORDER BY created_at ASC, id ASC
+                    LIMIT 1''',
+                operation_types,
+            )
+            row = cursor.fetchone()
+            if row is None:
+                conn.commit()
+                return None
+
+            cursor.execute(
+                '''UPDATE channel_operations
+                   SET status = 'processing',
+                       claimed_at = CURRENT_TIMESTAMP,
+                       claim_owner_host = ?,
+                       claim_owner_pid = ?,
+                       claim_owner_boot_id = ?,
+                       processed_at = NULL,
+                       error_message = NULL,
+                       result_data = NULL
+                   WHERE id = ? AND status = 'pending' ''',
+                (
+                    self._claim_owner_host,
+                    self._claim_owner_pid,
+                    self._claim_owner_boot_id,
+                    row['id'],
+                ),
+            )
+            if cursor.rowcount != 1:
+                conn.rollback()
+                return None
+
+            conn.commit()
+            claimed = dict(row)
+            claimed['status'] = 'processing'
+            return claimed
+
+    @staticmethod
+    def _is_local_pid_alive(pid: int) -> Optional[bool]:
+        """Return PID liveness, or ``None`` when it cannot be proven either way."""
+        if not isinstance(pid, int) or pid <= 0:
+            return None
+        try:
+            os.kill(pid, 0)
+        except ProcessLookupError:
+            return False
+        except PermissionError:
+            # The kernel found the process but this user cannot signal it.
+            return True
+        except OSError:
+            return None
+        return True
+
+    def _recover_interrupted_operations(self) -> int:
+        """Resolve only startup claims provably abandoned by a local process.
+
+        Legacy ownerless rows may be interrupted.  An owned row is interrupted
+        only when it belongs to this host and its PID is provably dead.  Live
+        same-host owners, other hosts, and incomplete/unknown identities stay
+        blocked conservatively.  This method is only invoked during scheduler
+        construction, never by polling or a timer.
+        """
+        explanation = (
+            "Bot restarted while this operation was processing; the action may "
+            "already have reached the device. Automatic retry is disabled. "
+            "Verify device state before submitting another operation."
+        )
         try:
-            # Get pending operations
             with self.bot.db_manager.connection() as conn:
                 conn.row_factory = sqlite3.Row
                 cursor = conn.cursor()
+                cursor.execute('BEGIN IMMEDIATE')
+                cursor.execute(
+                    '''SELECT id, claim_owner_host, claim_owner_pid,
+                              claim_owner_boot_id
+                       FROM channel_operations
+                       WHERE status = 'processing' ''',
+                )
+                rows = cursor.fetchall()
+                recovered = 0
+                blocked = 0
+                for row in rows:
+                    owner_host = row['claim_owner_host']
+                    owner_pid = row['claim_owner_pid']
+                    owner_boot_id = row['claim_owner_boot_id']
+                    legacy_ownerless = (
+                        owner_host is None
+                        and owner_pid is None
+                        and owner_boot_id is None
+                    )
+                    same_host_dead = (
+                        owner_host == self._claim_owner_host
+                        and self._is_local_pid_alive(owner_pid) is False
+                    )
+                    if not legacy_ownerless and not same_host_dead:
+                        blocked += 1
+                        continue
 
-                cursor.execute('''
-                    SELECT id, operation_type, channel_idx, channel_name, channel_key_hex
-                    FROM channel_operations
-                    WHERE status = 'pending'
-                      AND operation_type IN ('add', 'remove')
-                    ORDER BY created_at ASC
-                    LIMIT 10
-                ''')
+                    cursor.execute(
+                        '''UPDATE channel_operations
+                           SET status = 'interrupted',
+                               processed_at = CURRENT_TIMESTAMP,
+                               error_message = ?
+                           WHERE id = ? AND status = 'processing' ''',
+                        (explanation, row['id']),
+                    )
+                    recovered += cursor.rowcount
+                conn.commit()
+        except sqlite3.Error as exc:
+            self.logger.exception(
+                "Could not recover interrupted channel/radio operations at startup: %s",
+                exc,
+            )
+            return 0
 
-                operations = cursor.fetchall()
+        if recovered:
+            self.logger.warning(
+                "Marked %s operation(s) interrupted after restart; verify device state before retrying",
+                recovered,
+            )
+        if blocked:
+            self.logger.warning(
+                "Left %s processing operation(s) blocked because their owner is live or cannot be proven dead",
+                blocked,
+            )
+        return recovered
 
-            if not operations:
-                return
+    def _finish_claimed_operation(
+        self,
+        op_id: int,
+        *,
+        success: bool,
+        result_payload: Optional[dict[str, Any]] = None,
+        error_message: Optional[str] = None,
+    ) -> None:
+        """Finalize a claim without overwriting externally resolved state."""
+        with self.bot.db_manager.connection() as conn:
+            cursor = conn.cursor()
+            if success:
+                cursor.execute(
+                    '''UPDATE channel_operations
+                       SET status = 'completed',
+                           processed_at = CURRENT_TIMESTAMP,
+                           result_data = ?,
+                           error_message = NULL
+                       WHERE id = ? AND status = 'processing'
+                         AND claim_owner_host = ?
+                         AND claim_owner_pid = ?
+                         AND claim_owner_boot_id = ? ''',
+                    (
+                        json.dumps(result_payload or {'success': True}),
+                        op_id,
+                        self._claim_owner_host,
+                        self._claim_owner_pid,
+                        self._claim_owner_boot_id,
+                    ),
+                )
+            else:
+                cursor.execute(
+                    '''UPDATE channel_operations
+                       SET status = 'failed',
+                           processed_at = CURRENT_TIMESTAMP,
+                           error_message = ?
+                       WHERE id = ? AND status = 'processing'
+                         AND claim_owner_host = ?
+                         AND claim_owner_pid = ?
+                         AND claim_owner_boot_id = ? ''',
+                    (
+                        error_message or 'Unknown error',
+                        op_id,
+                        self._claim_owner_host,
+                        self._claim_owner_pid,
+                        self._claim_owner_boot_id,
+                    ),
+                )
+            if cursor.rowcount != 1:
+                self.logger.warning(
+                    "Operation %s was no longer processing when finalization was attempted",
+                    op_id,
+                )
+            conn.commit()
 
-            self.logger.info(f"Processing {len(operations)} pending channel operation(s)")
-
-            for op in operations:
-                op_id = op['id']
-                op_type = op['operation_type']
-                channel_idx = op['channel_idx']
-                channel_name = op['channel_name']
-                channel_key_hex = op['channel_key_hex']
-
-                try:
-                    success = False
-                    error_msg = None
-
-                    if op_type == 'add':
-                        # Add channel
-                        if channel_key_hex:
-                            # Custom channel with key
-                            channel_secret = bytes.fromhex(channel_key_hex)
-                            success = await self.bot.channel_manager.add_channel(
-                                channel_idx, channel_name, channel_secret=channel_secret
-                            )
-                        else:
-                            # Hashtag channel (firmware generates key)
-                            success = await self.bot.channel_manager.add_channel(
-                                channel_idx, channel_name
-                            )
-
-                        if success:
-                            self.logger.info(f"Successfully processed channel add operation: {channel_name} at index {channel_idx}")
-                        else:
-                            error_msg = "Failed to add channel"
-
-                    elif op_type == 'remove':
-                        # Remove channel
-                        success = await self.bot.channel_manager.remove_channel(channel_idx)
-
-                        if success:
-                            self.logger.info(f"Successfully processed channel remove operation: index {channel_idx}")
-                        else:
-                            error_msg = "Failed to remove channel"
-
-                    # Update operation status
-                    with self.bot.db_manager.connection() as conn:
-                        cursor = conn.cursor()
-                        if success:
-                            cursor.execute('''
-                                UPDATE channel_operations
-                                SET status = 'completed',
-                                    processed_at = CURRENT_TIMESTAMP,
-                                    result_data = ?
-                                WHERE id = ?
-                            ''', (json.dumps({'success': True}), op_id))
-                        else:
-                            cursor.execute('''
-                                UPDATE channel_operations
-                                SET status = 'failed',
-                                    processed_at = CURRENT_TIMESTAMP,
-                                    error_message = ?
-                                WHERE id = ?
-                            ''', (error_msg or 'Unknown error', op_id))
-                        conn.commit()
-
-                except Exception as e:
-                    self.logger.error(f"Error processing channel operation {op_id}: {e}")
-                    # Mark as failed
-                    try:
-                        with self.bot.db_manager.connection() as conn:
-                            cursor = conn.cursor()
-                            cursor.execute('''
-                                UPDATE channel_operations
-                                SET status = 'failed',
-                                    processed_at = CURRENT_TIMESTAMP,
-                                    error_message = ?
-                                WHERE id = ?
-                            ''', (str(e), op_id))
-                            conn.commit()
-                    except Exception as update_error:
-                        self.logger.error(f"Error updating operation status: {update_error}")
+    async def _process_channel_operations(self):
+        """Process pending channel operations from the web viewer"""
+        try:
+            # Preserve the previous per-tick batch capacity, but claim only one
+            # row immediately before executing it.  The next claim cannot
+            # succeed until the previous row has reached a terminal state.
+            for _ in range(10):
+                op = self._claim_operation(_CHANNEL_OPERATION_TYPES)
+                if not op:
+                    return
+                await self._execute_claimed_channel_operation(op)
 
         except Exception as e:
             db_path = getattr(self.bot.db_manager, 'db_path', 'unknown')
@@ -950,27 +1110,60 @@ class MessageScheduler:
             else:
                 self.logger.error(f"Database path: {db_path_str}")
 
+    async def _execute_claimed_channel_operation(self, op: dict[str, Any]) -> None:
+        """Execute and finalize one already-claimed channel operation."""
+        op_id = op['id']
+        op_type = op['operation_type']
+        channel_idx = op['channel_idx']
+        channel_name = op['channel_name']
+        channel_key_hex = op['channel_key_hex']
+        self.logger.info("Processing claimed channel operation %s: %s", op_id, op_type)
+
+        try:
+            success = False
+            error_msg = None
+
+            if op_type == 'add':
+                if channel_key_hex:
+                    channel_secret = bytes.fromhex(channel_key_hex)
+                    success = await self.bot.channel_manager.add_channel(
+                        channel_idx, channel_name, channel_secret=channel_secret
+                    )
+                else:
+                    success = await self.bot.channel_manager.add_channel(
+                        channel_idx, channel_name
+                    )
+
+                if success:
+                    self.logger.info(f"Successfully processed channel add operation: {channel_name} at index {channel_idx}")
+                else:
+                    error_msg = "Failed to add channel"
+
+            elif op_type == 'remove':
+                success = await self.bot.channel_manager.remove_channel(channel_idx)
+
+                if success:
+                    self.logger.info(f"Successfully processed channel remove operation: index {channel_idx}")
+                else:
+                    error_msg = "Failed to remove channel"
+
+            self._finish_claimed_operation(
+                op_id,
+                success=success,
+                error_message=error_msg,
+            )
+
+        except Exception as e:
+            self.logger.error(f"Error processing channel operation {op_id}: {e}")
+            try:
+                self._finish_claimed_operation(op_id, success=False, error_message=str(e))
+            except Exception as update_error:
+                self.logger.error(f"Error updating operation status: {update_error}")
+
     async def _process_radio_operations(self):
         """Process pending radio connect/disconnect/reboot/firmware operations from the web viewer."""
         try:
-            with self.bot.db_manager.connection() as conn:
-                conn.row_factory = sqlite3.Row
-                cursor = conn.cursor()
-                cursor.execute('''
-                    SELECT id, operation_type, payload_data
-                    FROM channel_operations
-                    WHERE status = 'pending'
-                      AND operation_type IN (
-                          'radio_reboot', 'radio_connect', 'radio_disconnect',
-                          'firmware_read', 'firmware_write',
-                          'radio_params_read', 'radio_params_write',
-                          'radio_advert'
-                      )
-                    ORDER BY created_at ASC
-                    LIMIT 1
-                ''')
-                op = cursor.fetchone()
-
+            op = self._claim_operation(_RADIO_OPERATION_TYPES)
             if not op:
                 return
 
@@ -1002,41 +1195,19 @@ class MessageScheduler:
                 else:
                     success = False
 
-                with self.bot.db_manager.connection() as conn:
-                    cursor = conn.cursor()
-                    if success:
-                        cursor.execute('''
-                            UPDATE channel_operations
-                            SET status = 'completed',
-                                processed_at = CURRENT_TIMESTAMP,
-                                result_data = ?
-                            WHERE id = ?
-                        ''', (json.dumps(result_payload), op_id))
-                    else:
-                        error_msg = result_payload.get('error', 'Radio operation returned False') \
-                            if isinstance(result_payload, dict) else 'Radio operation returned False'
-                        cursor.execute('''
-                            UPDATE channel_operations
-                            SET status = 'failed',
-                                processed_at = CURRENT_TIMESTAMP,
-                                error_message = ?
-                            WHERE id = ?
-                        ''', (error_msg, op_id))
-                    conn.commit()
+                error_msg = result_payload.get('error', 'Radio operation returned False') \
+                    if isinstance(result_payload, dict) else 'Radio operation returned False'
+                self._finish_claimed_operation(
+                    op_id,
+                    success=success,
+                    result_payload=result_payload,
+                    error_message=error_msg,
+                )
 
             except Exception as e:
                 self.logger.error(f"Error executing radio operation {op_id}: {e}")
                 try:
-                    with self.bot.db_manager.connection() as conn:
-                        cursor = conn.cursor()
-                        cursor.execute('''
-                            UPDATE channel_operations
-                            SET status = 'failed',
-                                processed_at = CURRENT_TIMESTAMP,
-                                error_message = ?
-                            WHERE id = ?
-                        ''', (str(e), op_id))
-                        conn.commit()
+                    self._finish_claimed_operation(op_id, success=False, error_message=str(e))
                 except Exception as update_error:
                     self.logger.error(f"Error updating radio operation status: {update_error}")
 
@@ -1052,17 +1223,7 @@ class MessageScheduler:
         start/stop is not handled by reload_config and still needs a restart.
         """
         try:
-            with self.bot.db_manager.connection() as conn:
-                conn.row_factory = sqlite3.Row
-                cursor = conn.cursor()
-                cursor.execute('''
-                    SELECT id FROM channel_operations
-                    WHERE status = 'pending' AND operation_type = 'config_reload'
-                    ORDER BY created_at ASC
-                    LIMIT 1
-                ''')
-                op = cursor.fetchone()
-
+            op = self._claim_operation(_CONFIG_OPERATION_TYPES)
             if not op:
                 return
 
@@ -1075,25 +1236,12 @@ class MessageScheduler:
                 success, message = False, str(e)
                 self.logger.exception("Error during config reload")
 
-            with self.bot.db_manager.connection() as conn:
-                cursor = conn.cursor()
-                if success:
-                    cursor.execute('''
-                        UPDATE channel_operations
-                        SET status = 'completed',
-                            processed_at = CURRENT_TIMESTAMP,
-                            result_data = ?
-                        WHERE id = ?
-                    ''', (json.dumps({'success': True, 'message': message}), op_id))
-                else:
-                    cursor.execute('''
-                        UPDATE channel_operations
-                        SET status = 'failed',
-                            processed_at = CURRENT_TIMESTAMP,
-                            error_message = ?
-                        WHERE id = ?
-                    ''', (message, op_id))
-                conn.commit()
+            self._finish_claimed_operation(
+                op_id,
+                success=success,
+                result_payload={'success': True, 'message': message},
+                error_message=message,
+            )
 
             self.logger.info("Config reload %s: %s", 'succeeded' if success else 'failed', message)
 
@@ -1645,4 +1793,3 @@ class MessageScheduler:
             self.bot.logger.error(f"Failed to send radio-offline alert email: {e}")
 
     # ── Maintenance helpers ──────────────────────────────────────────────────
-
diff --git a/modules/web_viewer/app.py b/modules/web_viewer/app.py
index c6c763c..cc193f6 100644
--- a/modules/web_viewer/app.py
+++ b/modules/web_viewer/app.py
@@ -9,6 +9,7 @@ import json
 import logging
 import os
 import re
+import secrets
 import sqlite3
 import sys
 import threading
@@ -31,6 +32,7 @@ from flask import (
     Response,
     abort,
     current_app,
+    g,
     jsonify,
     make_response,
     redirect,
@@ -42,6 +44,11 @@ from flask import (
 )
 from flask_socketio import SocketIO, disconnect, emit
 
+from modules.database_restore import (
+    DEFAULT_MAX_RESTORE_BYTES,
+    DatabaseRestoreError,
+    stage_database_restore,
+)
 from modules.ini_writer import update_ini_values
 from modules.security_utils import (
     VALID_JOURNAL_MODES,
@@ -620,6 +627,11 @@ class BotDataViewer:
             '/site.webmanifest', '/favicon.ico',
         ])
 
+        @self.app.before_request
+        def create_csp_nonce():
+            """Create a per-response nonce for templates migrated off inline-script CSP."""
+            g.csp_nonce = secrets.token_urlsafe(24)
+
         @self.app.before_request
         def require_auth():
             if not self.web_viewer_password:
@@ -664,10 +676,33 @@ class BotDataViewer:
             response.headers['Referrer-Policy'] = 'strict-origin-when-cross-origin'
             # Allow CDNs used by templates (base.html, login.html, mesh.html).
             # Without these hosts, browsers block external CSS/JS/fonts (not CSRF).
+            # The highest-risk admin screens have migrated their inline handlers
+            # and authorize their remaining template scripts with a per-request
+            # nonce. Other legacy screens retain unsafe-inline until their inline
+            # scripts/handlers are migrated, rather than silently breaking them.
+            nonce_hardened_endpoints = {
+                'index',
+                'feeds',
+                'config_page',
+                'radio',
+                'realtime',
+                'contacts',
+                'stats',
+                'plugins_page',
+                'greeter',
+                'logs',
+                'multibyte_rollout',
+                'mesh',
+                'api_explorer',
+            }
+            if request.endpoint in nonce_hardened_endpoints:
+                script_source = f"script-src 'self' 'nonce-{g.csp_nonce}' "
+            else:
+                script_source = "script-src 'self' 'unsafe-inline' "
             response.headers['Content-Security-Policy'] = (
                 "default-src 'self'; "
-                "script-src 'self' 'unsafe-inline' "
-                "https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://unpkg.com; "
+                + script_source
+                + "https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://unpkg.com; "
                 "style-src 'self' 'unsafe-inline' "
                 "https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://unpkg.com; "
                 "img-src 'self' data: https://*.tile.openstreetmap.org "
@@ -1535,10 +1570,11 @@ class BotDataViewer:
 
         @self.app.route('/api/maintenance/restore', methods=['POST'])
         def api_maintenance_restore():
-            """Restore DB from a backup file.
+            """Stage a verified DB backup for the next full service restart.
 
             Body: {"db_file": "/absolute/path/to/backup.db"}
-            The active DB is overwritten; the caller must restart the bot.
+            The active DB is never modified by this request.  Normal bot startup
+            applies the sibling pending file before any DB connection is opened.
             """
             try:
                 data = request.get_json(silent=True) or {}
@@ -1574,25 +1610,37 @@ class BotDataViewer:
 
                 if not src.exists():
                     return jsonify({'error': f'File not found: {db_file}'}), 400
-                # Validate it is a real SQLite file by checking the magic header
-                _SQLITE_MAGIC = b"SQLite format 3\x00"
                 try:
-                    with open(str(src), 'rb') as _fh:
-                        _header = _fh.read(16)
-                    if _header != _SQLITE_MAGIC:
-                        raise ValueError("bad magic")
-                except Exception:
-                    return jsonify({'error': f'Not a valid SQLite file: {db_file}'}), 400
-                # Copy to active DB path
-                import shutil
-                shutil.copy2(str(src), self.db_path)
-                self.logger.info(f"Database restored from {src} to {self.db_path}")
+                    max_restore_bytes = self.config.getint(
+                        'Web_Viewer',
+                        'restore_max_bytes',
+                        fallback=DEFAULT_MAX_RESTORE_BYTES,
+                    )
+                    pending = stage_database_restore(
+                        src,
+                        self.db_path,
+                        max_bytes=max_restore_bytes,
+                    )
+                except (DatabaseRestoreError, OSError, ValueError) as exc:
+                    self.logger.warning("Database restore staging rejected for %s: %s", src, exc)
+                    return jsonify({'error': str(exc)}), 400
+
+                self.logger.warning(
+                    "Database restore staged from %s at %s; a full service restart is required",
+                    src,
+                    pending,
+                )
                 return jsonify({
                     'success': True,
-                    'restored_from': db_file,
+                    'staged_from': db_file,
+                    'pending_path': str(pending),
                     'active_db': self.db_path,
-                    'warning': 'Restart the bot for the restored database to take effect.',
-                })
+                    'requires_restart': True,
+                    'warning': (
+                        'Restore verified and staged. Restart the complete MeshCore Bot service '
+                        'to apply it before any database writer starts.'
+                    ),
+                }), 202
             except Exception as e:
                 self.logger.error(f"Error in restore: {e}", exc_info=True)
                 return jsonify({'error': str(e)}), 500
@@ -3430,7 +3478,7 @@ class BotDataViewer:
                 conn = self._get_db_connection()
                 cursor = conn.cursor()
                 cursor.execute('''
-                    SELECT status, error_message, result_data, processed_at
+                    SELECT status, error_message, result_data, processed_at, claimed_at
                     FROM channel_operations
                     WHERE id = ?
                 ''', (operation_id,))
@@ -3440,12 +3488,13 @@ class BotDataViewer:
                 if not result:
                     return jsonify({'error': 'Operation not found'}), 404
 
-                status, error_msg, result_data, processed_at = result
+                status, error_msg, result_data, processed_at, claimed_at = result
 
                 return jsonify({
                     'operation_id': operation_id,
                     'status': status,
                     'error_message': error_msg,
+                    'claimed_at': claimed_at,
                     'processed_at': processed_at,
                     'result_data': json.loads(result_data) if result_data else None
                 })
diff --git a/modules/web_viewer/static/js/channel_operations.js b/modules/web_viewer/static/js/channel_operations.js
index dd6f0c7..bb15d55 100644
--- a/modules/web_viewer/static/js/channel_operations.js
+++ b/modules/web_viewer/static/js/channel_operations.js
@@ -34,7 +34,8 @@
     }
 
     /**
-     * Poll GET /api/channel-operations/:id until completed, failed, or timeouts.
+     * Poll GET /api/channel-operations/:id until completed, failed,
+     * interrupted, or timeouts.
      * Behavior aligned with legacy radio.html pollOperationStatus.
      *
      * @param {number} operationId
@@ -48,7 +49,7 @@
      * @param {number} [options.maxWaitSeconds=60]
      * @param {number} [options.extendedMaxWaitSeconds=120]
      * @param {number} [options.checkIntervalMs=1000]
-     * @returns {Promise<'completed'|'failed'|'timeout'>}
+     * @returns {Promise<'completed'|'failed'|'interrupted'|'timeout'>}
      */
     function pollChannelOperation(operationId, options) {
         options = options || {};
@@ -95,12 +96,12 @@
                     if (result.status === 'completed') {
                         return 'completed';
                     }
-                    if (result.status === 'failed') {
+                    if (result.status === 'failed' || result.status === 'interrupted') {
                         if (typeof options.onFailed === 'function') {
                             options.onFailed(result.error_message || 'Channel operation failed');
                         }
                         resetButton();
-                        return 'failed';
+                        return result.status;
                     }
                     var elapsed = Math.floor((Date.now() - startTime) / 1000);
                     setBtn(
@@ -122,12 +123,12 @@
                 if (result2.status === 'completed') {
                     return 'completed';
                 }
-                if (result2.status === 'failed') {
+                if (result2.status === 'failed' || result2.status === 'interrupted') {
                     if (typeof options.onFailed === 'function') {
                         options.onFailed(result2.error_message || 'Channel operation failed');
                     }
                     resetButton();
-                    return 'failed';
+                    return result2.status;
                 }
             } catch (error) {
                 console.error('Error checking final status:', error);
@@ -149,12 +150,12 @@
                     if (result3.status === 'completed') {
                         return 'completed';
                     }
-                    if (result3.status === 'failed') {
+                    if (result3.status === 'failed' || result3.status === 'interrupted') {
                         if (typeof options.onFailed === 'function') {
                             options.onFailed(result3.error_message || 'Channel operation failed');
                         }
                         resetButton();
-                        return 'failed';
+                        return result3.status;
                     }
                     var elapsed2 = Math.floor((Date.now() - startTime) / 1000);
                     setBtn(
diff --git a/modules/web_viewer/templates/api_explorer.html b/modules/web_viewer/templates/api_explorer.html
index 72d5592..810c187 100644
--- a/modules/web_viewer/templates/api_explorer.html
+++ b/modules/web_viewer/templates/api_explorer.html
@@ -227,7 +227,7 @@
 {% endblock %}
 
 {% block extra_js %}
-<script>
+<script nonce="{{ g.csp_nonce }}">
 (function() {
     var host = window.location.origin;
 
diff --git a/modules/web_viewer/templates/base.html b/modules/web_viewer/templates/base.html
index 325386e..f8d8557 100644
--- a/modules/web_viewer/templates/base.html
+++ b/modules/web_viewer/templates/base.html
@@ -10,7 +10,7 @@
     <link rel="manifest" href="{{ url_for('static', filename='ico/site.webmanifest') }}">
 
     <!-- Apply theme immediately to prevent flash -->
-    <script>
+    <script nonce="{{ g.csp_nonce }}">
         (function () {
             const storedTheme = localStorage.getItem('theme');
             const systemPreference = window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light';
@@ -518,7 +518,7 @@
                 </div>
                 <div class="d-flex gap-2 align-items-center flex-shrink-0">
                     <span class="small opacity-75">After power cycling:</span>
-                    <button id="zombie-recover-btn" class="btn btn-warning btn-sm fw-semibold" onclick="zombieRecover()"
+                    <button id="zombie-recover-btn" class="btn btn-warning btn-sm fw-semibold"
                         type="button">
                         <i class="fas fa-power-off me-1"></i>Restart Bot Processing
                     </button>
@@ -545,7 +545,7 @@
                 </div>
                 <div class="d-flex gap-2 align-items-center flex-shrink-0">
                     <span class="small opacity-75">Once radio is fixed:</span>
-                    <button id="offline-clear-btn" class="btn btn-dark btn-sm fw-semibold" onclick="radioOfflineClear()"
+                    <button id="offline-clear-btn" class="btn btn-dark btn-sm fw-semibold"
                         type="button">
                         <i class="fas fa-check me-1"></i>Clear Offline Flag
                     </button>
@@ -554,7 +554,7 @@
         </div>
     </div>
 
-    <script>
+    <script nonce="{{ g.csp_nonce }}">
         // Global 401 interceptor: redirect to login when session expires mid-page.
         // Wraps window.fetch so all AJAX calls in every template are covered.
         (function () {
@@ -622,6 +622,9 @@
                 });
         }
 
+        document.getElementById('zombie-recover-btn')?.addEventListener('click', zombieRecover);
+        document.getElementById('offline-clear-btn')?.addEventListener('click', radioOfflineClear);
+
         // Live banner polling — updates all banners every 10s without a page reload
         (function () {
             function applyBannerStatus(d) {
@@ -700,7 +703,7 @@
     <script src="https://cdnjs.cloudflare.com/ajax/libs/js-sha256/0.11.0/sha256.min.js"></script>
 
     <!-- Base JavaScript -->
-    <script>
+    <script nonce="{{ g.csp_nonce }}">
         // Global connection management
         class ModernConnectionManager {
             constructor() {
@@ -797,13 +800,20 @@
             showNotification(message, type = 'info') {
                 // Create notification element
                 const notification = document.createElement('div');
-                notification.className = `alert alert-${type} alert-dismissible fade show position-fixed`;
+                const safeType = ['info', 'success', 'warning', 'danger'].includes(type)
+                    ? type
+                    : 'info';
+                notification.className = `alert alert-${safeType} alert-dismissible fade show position-fixed`;
                 notification.style.cssText = 'top: 20px; right: 20px; z-index: 9999; max-width: 300px;';
 
-                notification.innerHTML = `
-                    ${message}
-                    <button type="button" class="btn-close" data-bs-dismiss="alert"></button>
-                `;
+                const notificationText = document.createElement('span');
+                notificationText.textContent = String(message ?? '');
+                const closeButton = document.createElement('button');
+                closeButton.type = 'button';
+                closeButton.className = 'btn-close';
+                closeButton.setAttribute('data-bs-dismiss', 'alert');
+                closeButton.setAttribute('aria-label', 'Close');
+                notification.append(notificationText, closeButton);
 
                 document.body.appendChild(notification);
 
@@ -908,4 +918,4 @@
     {% block extra_js %}{% endblock %}
 </body>
 
-</html>
\ No newline at end of file
+</html>
diff --git a/modules/web_viewer/templates/cache.html b/modules/web_viewer/templates/cache.html
index 67c3641..66327df 100644
--- a/modules/web_viewer/templates/cache.html
+++ b/modules/web_viewer/templates/cache.html
@@ -104,7 +104,7 @@
 {% endblock %}
 
 {% block extra_js %}
-<script>
+<script nonce="{{ g.csp_nonce }}">
 class DatabaseInfoManager {
     constructor() {
         this.dbData = {};
@@ -162,43 +162,61 @@ class DatabaseInfoManager {
     
     renderTablesInfo() {
         const infoElement = document.getElementById('tables-info');
-        
+        infoElement.replaceChildren();
         if (!this.dbData.tables || this.dbData.tables.length === 0) {
-            infoElement.innerHTML = '<div class="text-muted">No tables found</div>';
+            const empty = document.createElement('div');
+            empty.className = 'text-muted';
+            empty.textContent = 'No tables found';
+            infoElement.appendChild(empty);
             return;
         }
-        
-        const tablesHtml = this.dbData.tables.map(table => `
-            <div class="row mb-3 p-3 border rounded">
-                <div class="col-md-4">
-                    <h6 class="mb-1">
-                        <i class="fas fa-table text-primary"></i> ${table.name}
-                    </h6>
-                    <small class="text-muted">${table.description || 'Database table'}</small>
-                </div>
-                <div class="col-md-2">
-                    <div class="text-center">
-                        <h5 class="mb-0 text-primary">${table.record_count || 0}</h5>
-                        <small class="text-muted">Records</small>
-                    </div>
-                </div>
-                <div class="col-md-3">
-                    <div class="text-center">
-                        <h6 class="mb-0">${table.size || 'Unknown'}</h6>
-                        <small class="text-muted">Size</small>
-                    </div>
-                </div>
-                <div class="col-md-3">
-                    <div class="text-center">
-                        <span class="badge bg-${this.getTableStatusClass(table)}">${this.getTableStatus(table)}</span>
-                        <br>
-                        <small class="text-muted">Status</small>
-                    </div>
-                </div>
-            </div>
-        `).join('');
-        
-        infoElement.innerHTML = tablesHtml;
+
+        const makeTextElement = (tag, value, classes = '') => {
+            const element = document.createElement(tag);
+            element.className = classes;
+            element.textContent = String(value ?? '');
+            return element;
+        };
+        this.dbData.tables.forEach(table => {
+            const row = document.createElement('div');
+            row.className = 'row mb-3 p-3 border rounded';
+            const identity = document.createElement('div');
+            identity.className = 'col-md-4';
+            identity.append(
+                makeTextElement('h6', table.name, 'mb-1'),
+                makeTextElement('small', table.description || 'Database table', 'text-muted'),
+            );
+            const metric = (value, label, width, valueClass = 'h6 mb-0') => {
+                const column = document.createElement('div');
+                column.className = width;
+                const content = document.createElement('div');
+                content.className = 'text-center';
+                content.append(
+                    makeTextElement('div', value, valueClass),
+                    makeTextElement('small', label, 'text-muted'),
+                );
+                column.appendChild(content);
+                return column;
+            };
+            const statusColumn = document.createElement('div');
+            statusColumn.className = 'col-md-3 text-center';
+            statusColumn.append(
+                makeTextElement(
+                    'span',
+                    this.getTableStatus(table),
+                    `badge bg-${this.getTableStatusClass(table)}`,
+                ),
+                document.createElement('br'),
+                makeTextElement('small', 'Status', 'text-muted'),
+            );
+            row.append(
+                identity,
+                metric(table.record_count || 0, 'Records', 'col-md-2', 'h5 mb-0 text-primary'),
+                metric(table.size || 'Unknown', 'Size', 'col-md-3'),
+                statusColumn,
+            );
+            infoElement.appendChild(row);
+        });
     }
     
     getTableStatus(table) {
diff --git a/modules/web_viewer/templates/config.html b/modules/web_viewer/templates/config.html
index b672755..d8377ab 100644
--- a/modules/web_viewer/templates/config.html
+++ b/modules/web_viewer/templates/config.html
@@ -346,15 +346,15 @@
         <div class="modal-content">
             <div class="modal-header">
                 <h5 class="modal-title" id="restoreModalLabel">
-                    <i class="fas fa-undo me-2"></i>Restore Database
+                    <i class="fas fa-undo me-2"></i>Stage Database Restore
                 </h5>
                 <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
             </div>
             <div class="modal-body">
                 <div class="alert alert-warning">
                     <i class="fas fa-exclamation-triangle me-2"></i>
-                    <strong>Warning:</strong> Restoring will overwrite the active database.
-                    The bot must be restarted after restore for changes to take effect.
+                    <strong>Restart required:</strong> This verifies and stages the selected backup.
+                    The active database remains unchanged until the complete MeshCore Bot service is restarted.
                 </div>
                 <div class="mb-3">
                     <label class="form-label" for="restore-db-path">Backup file path</label>
@@ -379,7 +379,7 @@
             <div class="modal-footer">
                 <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
                 <button type="button" class="btn btn-warning" id="restore-confirm-btn">
-                    <i class="fas fa-undo me-1"></i>Restore
+                    <i class="fas fa-undo me-1"></i>Stage Restore
                 </button>
             </div>
         </div>
@@ -389,7 +389,7 @@
 {% endblock %}
 
 {% block extra_js %}
-<script>
+<script nonce="{{ g.csp_nonce }}">
 class ConfigManager {
     constructor() {
         this.fields = {
@@ -1003,27 +1003,49 @@ class MaintenanceStatusManager {
                 { label: 'Log rotation (applied)', ran: d.log_rotation_applied_at, outcome: '' },
             ];
 
-            this.tbody.innerHTML = jobs.map(j => {
-                const ranDisplay = !j.ran
-                    ? '<span class="text-muted">never</span>'
-                    : `<span class="text-muted config-maint-time">${j.ran.replace('T', ' ').split('.')[0]}</span>`;
-                let outHtml;
+            this.tbody.replaceChildren();
+            jobs.forEach(j => {
+                const row = document.createElement('tr');
+                const labelCell = document.createElement('td');
+                labelCell.className = 'fw-medium';
+                labelCell.textContent = j.label;
+                const ranCell = document.createElement('td');
+                ranCell.className = 'text-center config-maint-col-ran';
+                const ranDisplay = document.createElement('span');
+                ranDisplay.className = j.ran
+                    ? 'text-muted config-maint-time'
+                    : 'text-muted';
+                ranDisplay.textContent = j.ran
+                    ? String(j.ran).replace('T', ' ').split('.')[0]
+                    : 'never';
+                ranCell.appendChild(ranDisplay);
+                const outcomeCell = document.createElement('td');
+                outcomeCell.className = 'text-end config-outcome-cell';
+                const outcome = document.createElement('span');
                 if (j.outcome === 'ok') {
-                    outHtml = '<span class="badge bg-success">ok</span>';
+                    outcome.className = 'badge bg-success';
+                    outcome.textContent = 'ok';
                 } else if (j.outcome) {
-                    const esc = String(j.outcome).replace(/"/g, '&quot;');
-                    outHtml = `<span class="badge bg-danger" title="${esc}">error</span>`;
+                    outcome.className = 'badge bg-danger';
+                    outcome.title = String(j.outcome);
+                    outcome.textContent = 'error';
                 } else {
-                    outHtml = '<span class="text-muted config-outcome-dash" aria-hidden="true">—</span>';
+                    outcome.className = 'text-muted config-outcome-dash';
+                    outcome.setAttribute('aria-hidden', 'true');
+                    outcome.textContent = '—';
                 }
-                return `<tr>
-                    <td class="fw-medium">${j.label}</td>
-                    <td class="text-center config-maint-col-ran">${ranDisplay}</td>
-                    <td class="text-end config-outcome-cell">${outHtml}</td>
-                </tr>`;
-            }).join('');
+                outcomeCell.appendChild(outcome);
+                row.append(labelCell, ranCell, outcomeCell);
+                this.tbody.appendChild(row);
+            });
         } catch (err) {
-            this.tbody.innerHTML = `<tr><td colspan="3" class="text-danger text-center">Failed to load: ${err.message}</td></tr>`;
+            const row = document.createElement('tr');
+            const cell = document.createElement('td');
+            cell.colSpan = 3;
+            cell.className = 'text-danger text-center';
+            cell.textContent = `Failed to load: ${err.message}`;
+            row.appendChild(cell);
+            this.tbody.replaceChildren(row);
         } finally {
             this.refreshBtn.disabled = false;
         }
@@ -1048,7 +1070,7 @@ class RestoreManager {
         loading.style.display = '';
         empty.style.display   = 'none';
         table.style.display   = 'none';
-        tbody.innerHTML       = '';
+        tbody.replaceChildren();
         try {
             const resp = await fetch('/api/maintenance/list_backups');
             const data = await resp.json();
@@ -1061,13 +1083,27 @@ class RestoreManager {
             for (const b of data.backups) {
                 const dt = new Date(b.mtime * 1000).toLocaleString();
                 const tr = document.createElement('tr');
-                tr.innerHTML = `
-                    <td><small>${b.name}</small></td>
-                    <td><small>${b.size_mb} MB</small></td>
-                    <td><small>${dt}</small></td>
-                    <td><button class="btn btn-xs btn-outline-secondary btn-sm py-0"
-                        onclick="document.getElementById('restore-db-path').value='${b.path}'">
-                        Use</button></td>`;
+                const addCell = (value) => {
+                    const td = document.createElement('td');
+                    const small = document.createElement('small');
+                    small.textContent = String(value ?? '');
+                    td.appendChild(small);
+                    tr.appendChild(td);
+                    return td;
+                };
+                addCell(b.name);
+                addCell(`${b.size_mb} MB`);
+                addCell(dt);
+                const actionCell = document.createElement('td');
+                const useButton = document.createElement('button');
+                useButton.type = 'button';
+                useButton.className = 'btn btn-xs btn-outline-secondary btn-sm py-0';
+                useButton.textContent = 'Use';
+                useButton.addEventListener('click', () => {
+                    this.pathEl.value = String(b.path ?? '');
+                });
+                actionCell.appendChild(useButton);
+                tr.appendChild(actionCell);
                 tbody.appendChild(tr);
             }
         } catch (e) {
@@ -1080,9 +1116,12 @@ class RestoreManager {
     async restore() {
         const path = this.pathEl ? this.pathEl.value.trim() : '';
         if (!path) { this.showStatus('Please enter a backup file path.', 'danger'); return; }
-        if (!confirm(`Restore database from:\n${path}\n\nThis will overwrite the active database. Continue?`)) return;
+        if (!confirm(
+            `Stage database restore from:\n${path}\n\n` +
+            'The active database will remain unchanged until the complete MeshCore Bot service is restarted. Continue?'
+        )) return;
         this.confirmBtn.disabled = true;
-        this.confirmBtn.innerHTML = '<span class="spinner-border spinner-border-sm me-1"></span>Restoring…';
+        this.confirmBtn.innerHTML = '<span class="spinner-border spinner-border-sm me-1"></span>Staging…';
         try {
             const resp = await fetch('/api/maintenance/restore', {
                 method: 'POST',
@@ -1094,12 +1133,15 @@ class RestoreManager {
             });
             const data = await resp.json();
             if (!resp.ok) throw new Error(data.error || 'Restore failed');
-            this.showStatus(`Restored successfully. ${data.warning || ''}`, 'success');
+            this.showStatus(
+                data.warning || 'Restore verified and staged. Restart the complete MeshCore Bot service to apply it.',
+                'success',
+            );
         } catch (err) {
             this.showStatus('Restore failed: ' + err.message, 'danger');
         } finally {
             this.confirmBtn.disabled = false;
-            this.confirmBtn.innerHTML = '<i class="fas fa-undo me-1"></i>Restore';
+            this.confirmBtn.innerHTML = '<i class="fas fa-undo me-1"></i>Stage Restore';
         }
     }
 
@@ -1225,9 +1267,18 @@ class PurgeManager {
             const total = Object.values(deleted).reduce((s, v) => s + v, 0);
             this.showStatus(`Done — ${total} row${total === 1 ? '' : 's'} deleted`, 'success');
             if (this.resultsBody && Object.keys(deleted).length > 0) {
-                this.resultsBody.innerHTML = Object.entries(deleted)
-                    .map(([t, c]) => `<tr><td><code>${t}</code></td><td>${c}</td></tr>`)
-                    .join('');
+                this.resultsBody.replaceChildren();
+                Object.entries(deleted).forEach(([tableName, count]) => {
+                    const row = document.createElement('tr');
+                    const tableCell = document.createElement('td');
+                    const code = document.createElement('code');
+                    code.textContent = String(tableName);
+                    tableCell.appendChild(code);
+                    const countCell = document.createElement('td');
+                    countCell.textContent = String(count);
+                    row.append(tableCell, countCell);
+                    this.resultsBody.appendChild(row);
+                });
                 if (this.resultsEl) this.resultsEl.style.display = 'block';
             }
         } catch (e) {
@@ -1295,30 +1346,66 @@ class DatabaseInfoManager {
     renderTablesInfo() {
         const infoElement = document.getElementById('tables-info');
         if (!infoElement) return;
+        infoElement.replaceChildren();
         if (!this.dbData.tables || this.dbData.tables.length === 0) {
-            infoElement.innerHTML = '<div class="text-muted">No tables found</div>';
+            const empty = document.createElement('div');
+            empty.className = 'text-muted';
+            empty.textContent = 'No tables found';
+            infoElement.appendChild(empty);
             return;
         }
-        infoElement.innerHTML = this.dbData.tables.map(table => `
-            <div class="row mb-3 p-3 border rounded config-db-table-row g-2 align-items-center">
-                <div class="col-md-4">
-                    <h6 class="mb-1"><i class="fas fa-table config-table-name-icon me-1"></i>${table.name}</h6>
-                    <small class="text-muted">${table.description || 'Database table'}</small>
-                </div>
-                <div class="col-md-2 text-center">
-                    <div class="h5 mb-0 config-table-metric">${table.record_count || 0}</div>
-                    <small class="text-muted">Records</small>
-                </div>
-                <div class="col-md-3 text-center">
-                    <div class="h6 mb-0">${table.size || 'Unknown'}</div>
-                    <small class="text-muted">Size</small>
-                </div>
-                <div class="col-md-3 text-center">
-                    <span class="badge bg-${this.getTableStatusClass(table)}">${this.getTableStatus(table)}</span>
-                    <br><small class="text-muted">Status</small>
-                </div>
-            </div>
-        `).join('');
+        const makeTextElement = (tag, text, className = '') => {
+            const element = document.createElement(tag);
+            element.className = className;
+            element.textContent = String(text ?? '');
+            return element;
+        };
+        this.dbData.tables.forEach(table => {
+            const row = document.createElement('div');
+            row.className = 'row mb-3 p-3 border rounded config-db-table-row g-2 align-items-center';
+
+            const identity = document.createElement('div');
+            identity.className = 'col-md-4';
+            const heading = document.createElement('h6');
+            heading.className = 'mb-1';
+            const icon = document.createElement('i');
+            icon.className = 'fas fa-table config-table-name-icon me-1';
+            heading.append(icon, document.createTextNode(String(table.name ?? '')));
+            identity.append(
+                heading,
+                makeTextElement('small', table.description || 'Database table', 'text-muted'),
+            );
+
+            const records = document.createElement('div');
+            records.className = 'col-md-2 text-center';
+            records.append(
+                makeTextElement('div', table.record_count || 0, 'h5 mb-0 config-table-metric'),
+                makeTextElement('small', 'Records', 'text-muted'),
+            );
+
+            const size = document.createElement('div');
+            size.className = 'col-md-3 text-center';
+            size.append(
+                makeTextElement('div', table.size || 'Unknown', 'h6 mb-0'),
+                makeTextElement('small', 'Size', 'text-muted'),
+            );
+
+            const status = document.createElement('div');
+            status.className = 'col-md-3 text-center';
+            const badge = makeTextElement(
+                'span',
+                this.getTableStatus(table),
+                `badge bg-${this.getTableStatusClass(table)}`,
+            );
+            status.append(
+                badge,
+                document.createElement('br'),
+                makeTextElement('small', 'Status', 'text-muted'),
+            );
+
+            row.append(identity, records, size, status);
+            infoElement.appendChild(row);
+        });
     }
 
     getTableStatus(table) {
@@ -1391,7 +1478,12 @@ class DatabaseInfoManager {
 
     showError(message) {
         const tablesInfo = document.getElementById('tables-info');
-        if (tablesInfo) tablesInfo.innerHTML = `<div class="alert alert-danger">${message}</div>`;
+        if (tablesInfo) {
+            const alert = document.createElement('div');
+            alert.className = 'alert alert-danger';
+            alert.textContent = String(message ?? '');
+            tablesInfo.replaceChildren(alert);
+        }
     }
 }
 
diff --git a/modules/web_viewer/templates/contacts.html b/modules/web_viewer/templates/contacts.html
index c436050..86b56ba 100644
--- a/modules/web_viewer/templates/contacts.html
+++ b/modules/web_viewer/templates/contacts.html
@@ -386,12 +386,12 @@
                                 </li>
                                 <li><hr class="dropdown-divider"></li>
                                 <li><h6 class="dropdown-header">Export Contacts</h6></li>
-                                <li><a class="dropdown-item" href="#" onclick="exportData('contacts','csv');return false;"><i class="fas fa-file-csv me-2 text-success"></i>CSV</a></li>
-                                <li><a class="dropdown-item" href="#" onclick="exportData('contacts','json');return false;"><i class="fas fa-file-code me-2 text-warning"></i>JSON</a></li>
+                                <li><a class="dropdown-item contacts-export-action" href="#" data-export-kind="contacts" data-export-format="csv"><i class="fas fa-file-csv me-2 text-success"></i>CSV</a></li>
+                                <li><a class="dropdown-item contacts-export-action" href="#" data-export-kind="contacts" data-export-format="json"><i class="fas fa-file-code me-2 text-warning"></i>JSON</a></li>
                                 <li><hr class="dropdown-divider"></li>
                                 <li><h6 class="dropdown-header">Export Paths</h6></li>
-                                <li><a class="dropdown-item" href="#" onclick="exportData('paths','csv');return false;"><i class="fas fa-file-csv me-2 text-success"></i>CSV</a></li>
-                                <li><a class="dropdown-item" href="#" onclick="exportData('paths','json');return false;"><i class="fas fa-file-code me-2 text-warning"></i>JSON</a></li>
+                                <li><a class="dropdown-item contacts-export-action" href="#" data-export-kind="paths" data-export-format="csv"><i class="fas fa-file-csv me-2 text-success"></i>CSV</a></li>
+                                <li><a class="dropdown-item contacts-export-action" href="#" data-export-kind="paths" data-export-format="json"><i class="fas fa-file-code me-2 text-warning"></i>JSON</a></li>
                                 <li><hr class="dropdown-divider"></li>
                                 <li><h6 class="dropdown-header">Time range</h6></li>
                                 <li>
@@ -467,8 +467,7 @@
                                     <button type="button" class="btn btn-link p-0 border-0 align-baseline text-muted path-encoding-info-btn"
                                             id="contacts-list-multibyte-badge-info"
                                             aria-label="How Multibyte and 1-byte only badges are determined"
-                                            data-bs-toggle="tooltip" data-bs-placement="top"
-                                            onclick="event.stopPropagation();">
+                                            data-bs-toggle="tooltip" data-bs-placement="top">
                                         <i class="fas fa-info-circle" aria-hidden="true"></i>
                                     </button>
                                 </span>
@@ -538,7 +537,7 @@
 {% endblock %}
 
 {% block extra_js %}
-        <script>
+        <script nonce="{{ g.csp_nonce }}">
 class ModernContactsManager {
     constructor() {
         this.contactsData = [];
@@ -594,6 +593,14 @@ class ModernContactsManager {
     }
     
     setupEventHandlers() {
+        document.querySelectorAll('.contacts-export-action').forEach(link => {
+            link.addEventListener('click', (event) => {
+                event.preventDefault();
+                exportData(link.dataset.exportKind, link.dataset.exportFormat);
+            });
+        });
+        document.getElementById('contacts-list-multibyte-badge-info')
+            ?.addEventListener('click', event => event.stopPropagation());
         document.getElementById('refresh-contacts').addEventListener('click', () => {
             this.loadContactsData().then(() => {
                 this.applySearch();
@@ -655,13 +662,26 @@ class ModernContactsManager {
                     this.updateBulkDeleteButton();
                     this.updateSelectAllCheckbox();
                 } else if (t.classList.contains('contact-row-checkbox')) {
-                    const userId = t.dataset.userId;
+                    const contact = this.filteredData[Number(t.dataset.contactIndex)];
+                    if (!contact) return;
+                    const userId = contact.user_id;
                     if (t.checked) this.selectedContactIds.add(userId);
                     else this.selectedContactIds.delete(userId);
                     this.updateBulkDeleteButton();
                     this.updateSelectAllCheckbox();
                 }
             });
+            listPanel.addEventListener('click', (event) => {
+                const action = event.target.closest('[data-contact-action]');
+                if (!action) return;
+                const contact = this.filteredData[Number(action.dataset.contactIndex)];
+                if (!contact) return;
+                const kind = action.dataset.contactAction;
+                if (kind === 'star') this.toggleStar(contact.user_id, action);
+                else if (kind === 'advert') this.viewAdvertData(contact.user_id);
+                else if (kind === 'geocode') this.geocodeContact(contact.user_id, action);
+                else if (kind === 'delete') this.showDeleteConfirmation(contact.user_id);
+            });
         }
 
         const mobileSort = document.getElementById('contacts-mobile-sort');
@@ -760,9 +780,9 @@ class ModernContactsManager {
     
     getLocationString(contact) {
         if (contact.city && contact.state) {
-            return `${contact.city}, ${contact.state}`;
+            return `${this.escapeHtml(contact.city)}, ${this.escapeHtml(contact.state)}`;
         } else if (contact.city) {
-            return contact.city;
+            return this.escapeHtml(contact.city);
         } else if (contact.latitude && contact.longitude) {
             return `${contact.latitude}, ${contact.longitude}`;
         } else {
@@ -863,24 +883,22 @@ class ModernContactsManager {
         });
     }
     
-    renderContactCardHtml(contact) {
-        const uidEsc = this.escapeHtml(contact.user_id);
-        const uidJs = contact.user_id.replace(/'/g, "\\'");
+    renderContactCardHtml(contact, contactIndex) {
         const checked = this.selectedContactIds.has(contact.user_id) ? 'checked' : '';
         const hasGeo = !!(contact.latitude && contact.longitude && contact.latitude !== 0 && contact.longitude !== 0);
         const starLabel = contact.is_starred ? 'Unstar contact' : 'Star contact';
         const geoMenuItem = hasGeo
-            ? `<li><button type="button" class="dropdown-item" onclick="contactsManager.geocodeContact('${uidJs}', this)"><i class="fas fa-map-marker-alt me-2 text-primary"></i>Geocode location</button></li>`
+            ? `<li><button type="button" class="dropdown-item" data-contact-action="geocode" data-contact-index="${contactIndex}"><i class="fas fa-map-marker-alt me-2 text-primary"></i>Geocode location</button></li>`
             : '';
         return `
             <div class="contact-mobile-card">
                 <div class="d-flex align-items-start gap-2">
-                    <input type="checkbox" class="form-check-input contact-row-checkbox mt-1 flex-shrink-0" data-user-id="${uidEsc}" ${checked}>
+                    <input type="checkbox" class="form-check-input contact-row-checkbox mt-1 flex-shrink-0" data-contact-index="${contactIndex}" ${checked}>
                     <div class="flex-grow-1 min-w-0">
                         <div class="d-flex justify-content-between align-items-start gap-2">
                             <div class="min-w-0">
                                 <div class="fw-bold">${this.escapeHtml(contact.username || 'Unknown')}</div>
-                                <small class="text-muted text-break d-block">${contact.user_id ? contact.user_id.substring(0, 16) + '...' : 'Unknown'}</small>
+                                <small class="text-muted text-break d-block">${this.escapeHtml(contact.user_id ? contact.user_id.substring(0, 16) + '...' : 'Unknown')}</small>
                             </div>
                             <div class="contact-mobile-device text-end flex-shrink-0">${this.formatDeviceType(contact)}</div>
                         </div>
@@ -894,7 +912,7 @@ class ModernContactsManager {
                                 ${this.formatPathEncodingBadge(contact)}
                                 </div>
                                 <div class="d-flex align-items-center gap-1">
-                                    <span class="badge bg-success">${contact.advert_count || 0}</span>
+                                    <span class="badge bg-success">${Number(contact.advert_count) || 0}</span>
                                     <span class="text-muted small">adverts</span>
                                 </div>
                             </div>
@@ -905,11 +923,11 @@ class ModernContactsManager {
                                     <i class="fas fa-ellipsis-vertical" aria-hidden="true"></i>
                                 </button>
                                 <ul class="dropdown-menu dropdown-menu-end">
-                                    <li><button type="button" class="dropdown-item" onclick="contactsManager.toggleStar('${uidJs}', this)"><i class="fas fa-star me-2 text-warning"></i>${starLabel}</button></li>
-                                    <li><button type="button" class="dropdown-item" onclick="contactsManager.viewAdvertData('${contact.user_id}')"><i class="fas fa-info-circle me-2 text-info"></i>View advertisement data</button></li>
+                                    <li><button type="button" class="dropdown-item" data-contact-action="star" data-contact-index="${contactIndex}"><i class="fas fa-star me-2 text-warning"></i>${starLabel}</button></li>
+                                    <li><button type="button" class="dropdown-item" data-contact-action="advert" data-contact-index="${contactIndex}"><i class="fas fa-info-circle me-2 text-info"></i>View advertisement data</button></li>
                                     ${geoMenuItem}
                                     <li><hr class="dropdown-divider"></li>
-                                    <li><button type="button" class="dropdown-item text-danger" onclick="contactsManager.showDeleteConfirmation('${uidJs}')"><i class="fas fa-trash me-2"></i>Delete contact</button></li>
+                                    <li><button type="button" class="dropdown-item text-danger" data-contact-action="delete" data-contact-index="${contactIndex}"><i class="fas fa-trash me-2"></i>Delete contact</button></li>
                                 </ul>
                             </div>
                         </div>
@@ -927,30 +945,33 @@ class ModernContactsManager {
             const message = this.searchTerm ?
                 `No contacts match "${this.searchTerm}"` :
                 'No contacts data available';
-            tbody.innerHTML = `
-                <tr>
-                    <td colspan="11" class="text-center text-muted">
-                        ${message}
-                    </td>
-                </tr>
-            `;
+            const row = document.createElement('tr');
+            const cell = document.createElement('td');
+            cell.colSpan = 11;
+            cell.className = 'text-center text-muted';
+            cell.textContent = message;
+            row.appendChild(cell);
+            tbody.replaceChildren(row);
             if (mobileStack) {
-                mobileStack.innerHTML = `<div class="text-center text-muted py-4">${message}</div>`;
+                const empty = document.createElement('div');
+                empty.className = 'text-center text-muted py-4';
+                empty.textContent = message;
+                mobileStack.replaceChildren(empty);
             }
             this.updateBulkDeleteButton();
             this.updateSelectAllCheckbox();
             return;
         }
 
-        tbody.innerHTML = this.filteredData.map(contact => `
+        tbody.innerHTML = this.filteredData.map((contact, contactIndex) => `
             <tr>
                 <td class="text-center align-middle">
-                    <input type="checkbox" class="form-check-input contact-row-checkbox" data-user-id="${this.escapeHtml(contact.user_id)}" ${this.selectedContactIds.has(contact.user_id) ? 'checked' : ''}>
+                    <input type="checkbox" class="form-check-input contact-row-checkbox" data-contact-index="${contactIndex}" ${this.selectedContactIds.has(contact.user_id) ? 'checked' : ''}>
                 </td>
                 <td>
                     <strong>${this.escapeHtml(contact.username || 'Unknown')}</strong>
                     <br>
-                    <small class="text-muted">${contact.user_id ? contact.user_id.substring(0, 16) + '...' : 'Unknown'}</small>
+                    <small class="text-muted">${this.escapeHtml(contact.user_id ? contact.user_id.substring(0, 16) + '...' : 'Unknown')}</small>
                 </td>
                 <td>${this.formatDeviceType(contact)}</td>
                 <td>${this.formatLocation(contact)}</td>
@@ -959,22 +980,22 @@ class ModernContactsManager {
                 <td><div class="d-flex flex-column align-items-start gap-1">${this.formatHops(contact)}${this.formatPathEncodingBadge(contact)}</div></td>
                 <td>${this.formatTimestamp(contact.first_heard)}</td>
                 <td>${this.formatTimeAgo(contact.last_seen)}</td>
-                <td><span class="badge bg-success">${contact.advert_count || 0}</span></td>
+                <td><span class="badge bg-success">${Number(contact.advert_count) || 0}</span></td>
                 <td>
                     <div class="btn-group" role="group">
-                        <button class="btn btn-sm ${contact.is_starred ? 'btn-warning' : 'btn-outline-warning'}" onclick="contactsManager.toggleStar('${contact.user_id.replace(/'/g, "\\'")}', this)" title="${contact.is_starred ? 'Unstar contact' : 'Star contact'}">
+                        <button class="btn btn-sm ${contact.is_starred ? 'btn-warning' : 'btn-outline-warning'}" data-contact-action="star" data-contact-index="${contactIndex}" title="${contact.is_starred ? 'Unstar contact' : 'Star contact'}">
                             <i class="fas fa-star"></i>
                         </button>
-                        <button class="btn btn-sm btn-outline-info" onclick="contactsManager.viewAdvertData('${contact.user_id}')" title="View Advertisement Data">
+                        <button class="btn btn-sm btn-outline-info" data-contact-action="advert" data-contact-index="${contactIndex}" title="View Advertisement Data">
                             <i class="fas fa-info-circle"></i>
                         </button>
                         ${contact.latitude && contact.longitude && contact.latitude !== 0 && contact.longitude !== 0 ? 
-                            `<button class="btn btn-sm btn-outline-primary" onclick="contactsManager.geocodeContact('${contact.user_id.replace(/'/g, "\\'")}', this)" title="Geocode Location">
+                            `<button class="btn btn-sm btn-outline-primary" data-contact-action="geocode" data-contact-index="${contactIndex}" title="Geocode Location">
                                 <i class="fas fa-map-marker-alt"></i>
                             </button>` : 
                             ''
                         }
-                        <button class="btn btn-sm btn-outline-danger" onclick="contactsManager.showDeleteConfirmation('${contact.user_id.replace(/'/g, "\\'")}')" title="Delete Contact">
+                        <button class="btn btn-sm btn-outline-danger" data-contact-action="delete" data-contact-index="${contactIndex}" title="Delete Contact">
                             <i class="fas fa-trash"></i>
                         </button>
                     </div>
@@ -983,7 +1004,7 @@ class ModernContactsManager {
         `).join('');
 
         if (mobileStack) {
-            mobileStack.innerHTML = this.filteredData.map(contact => this.renderContactCardHtml(contact)).join('');
+            mobileStack.innerHTML = this.filteredData.map((contact, contactIndex) => this.renderContactCardHtml(contact, contactIndex)).join('');
         }
 
         // Setup path tooltips after rendering
@@ -1401,9 +1422,9 @@ class ModernContactsManager {
     
     formatLocation(contact) {
         if (contact.city && contact.state) {
-            return `${contact.city}, ${contact.state}`;
+            return `${this.escapeHtml(contact.city)}, ${this.escapeHtml(contact.state)}`;
         } else if (contact.city) {
-            return contact.city;
+            return this.escapeHtml(contact.city);
         } else if (contact.latitude && contact.longitude) {
             return `${contact.latitude.toFixed(4)}, ${contact.longitude.toFixed(4)}`;
         } else {
@@ -1441,7 +1462,7 @@ class ModernContactsManager {
             badgeClass = 'bg-info'; // Light blue for Sensor
         }
         
-        return `<span class="badge ${badgeClass}">${displayText}</span>`;
+        return `<span class="badge ${badgeClass}">${this.escapeHtml(displayText)}</span>`;
     }
     
     formatSignal(contact) {
@@ -1458,16 +1479,16 @@ class ModernContactsManager {
     }
     
     formatHops(contact) {
-        const hopCount = contact.hop_count || 0;
+        const hopCount = Number(contact.hop_count) || 0;
         const outPath = contact.out_path || '';
-        const outPathLen = contact.out_path_len || -1;
+        const outPathLen = Number(contact.out_path_len ?? -1);
         // Full paths are loaded on demand in the modal; the list only needs the count.
-        const pathsCount = contact.paths_count || 0;
+        const pathsCount = Number(contact.paths_count) || 0;
         const hasMultiplePaths = pathsCount > 1;
         
         // Escape the path for use in HTML attributes
-        const escapedPath = outPath.replace(/"/g, '&quot;');
-        const escapedUserId = contact.user_id.replace(/"/g, '&quot;');
+        const escapedPath = this.escapeAttribute(outPath);
+        const escapedUserId = this.escapeAttribute(contact.user_id);
         
         // If we have path data, add tooltip and click functionality
         if (outPath && outPathLen > 0) {
@@ -1481,7 +1502,6 @@ class ModernContactsManager {
                           data-path-len="${outPathLen}"
                           data-bytes-per-hop="${bytesPerHop}"
                           data-user-id="${escapedUserId}"
-                          onclick="contactsManager.showPathsModal('${escapedUserId}')"
                           style="cursor: pointer; position: relative;" 
                           title="${hasMultiplePaths ? 'Click to view all paths' : 'Click to view path'}">
                       ${hopCount}${pathCountText}
@@ -1532,6 +1552,7 @@ class ModernContactsManager {
             if (badge.dataset.tooltipSetup === 'true') return;
             
             badge.dataset.tooltipSetup = 'true';
+            badge.addEventListener('click', () => this.showPathsModal(badge.dataset.userId));
             
             // Load path data on first hover (for tooltip)
             let pathLoaded = false;
@@ -1539,7 +1560,8 @@ class ModernContactsManager {
             
             const showTooltip = (event) => {
                 const rect = badge.getBoundingClientRect();
-                customTooltip.innerHTML = pathContent;
+                customTooltip.textContent = pathContent;
+                customTooltip.style.whiteSpace = 'pre-line';
                 customTooltip.style.display = 'block';
                 customTooltip.style.left = (rect.left + rect.width / 2 - customTooltip.offsetWidth / 2) + 'px';
                 customTooltip.style.top = (rect.top - customTooltip.offsetHeight - 8) + 'px';
@@ -1607,8 +1629,7 @@ class ModernContactsManager {
                         // Format the path response
                         const pathLines = data.path.map(node => {
                             if (node.found) {
-                                // Escape HTML to prevent XSS
-                                const name = this.escapeHtml(node.name);
+                                const name = String(node.name ?? '');
                                 // Add ❓ emoji if this is a geographic guess (collision)
                                 const guessIndicator = node.geographic_guess ? ' ❓' : '';
                                 return `${node.node_id}: ${name}${guessIndicator}`;
@@ -1617,7 +1638,7 @@ class ModernContactsManager {
                             }
                         });
                         
-                        pathContent = pathLines.length > 0 ? pathLines.join('<br>') : 'No path data';
+                        pathContent = pathLines.length > 0 ? pathLines.join('\n') : 'No path data';
                         pathLoaded = true;
                         badge.dataset.loading = 'false';
                         
@@ -1701,6 +1722,7 @@ class ModernContactsManager {
     }
     
     renderPathsInModal(paths, primaryPath) {
+        this.renderedModalPaths = paths;
         if (paths.length === 0) {
             return '<p class="text-muted">No path data available for this contact.</p>';
         }
@@ -1721,12 +1743,12 @@ class ModernContactsManager {
                         <div class="flex-grow-1">
                             <h6 class="mb-1">
                                 Path ${i + 1} ${primaryBadge}
-                                <small class="text-muted">(${hopLabel}${path.path_length} bytes, ${path.observation_count} observations)</small>
+                                <small class="text-muted">(${hopLabel}${Number(path.path_length) || 0} bytes, ${Number(path.observation_count) || 0} observations)</small>
                             </h6>
                             <p class="mb-1"><code class="path-hex-code">${this.escapeHtml(formattedPathHex)}</code></p>
                             <small class="text-muted">Last seen: ${this.formatTimeAgo(path.last_seen)}</small>
                         </div>
-                        <button class="btn btn-sm btn-outline-primary" onclick="contactsManager.decodePathInModal('${String(path.path_hex).replace(/\\/g, '\\\\').replace(/'/g, "\\'")}', ${i}, ${bph != null ? bph : 'null'})">
+                        <button class="btn btn-sm btn-outline-primary" data-decode-path-index="${i}">
                             <i class="fas fa-code"></i> Decode
                         </button>
                     </div>
@@ -1819,6 +1841,19 @@ class ModernContactsManager {
         
         // Add modal to page
         document.body.insertAdjacentHTML('beforeend', modalHtml);
+
+        const pathsListContainer = document.getElementById('paths-list-container');
+        pathsListContainer.addEventListener('click', (event) => {
+            const button = event.target.closest('[data-decode-path-index]');
+            if (!button) return;
+            const index = Number(button.dataset.decodePathIndex);
+            const path = this.renderedModalPaths[index];
+            if (!path) return;
+            const bph = path.bytes_per_hop != null && [1, 2, 3].includes(Number(path.bytes_per_hop))
+                ? Number(path.bytes_per_hop)
+                : null;
+            this.decodePathInModal(String(path.path_hex ?? ''), index, bph);
+        });
         
         // Setup sort dropdown event handler
         const sortSelect = document.getElementById('pathSortOrder');
@@ -1894,31 +1929,35 @@ class ModernContactsManager {
                 throw new Error('Invalid path data format');
             }
             
-            // Format the decoded path
-            const pathLines = data.path.map(node => {
-                if (node.found) {
-                    const name = this.escapeHtml(node.name);
-                    const guessIndicator = node.geographic_guess ? ' <span class="badge bg-warning">Guess</span>' : '';
-                    return `<div class="mb-1"><strong>${node.node_id}:</strong> ${name}${guessIndicator}</div>`;
-                } else {
-                    return `<div class="mb-1 text-muted"><strong>${node.node_id}:</strong> Unknown</div>`;
+            const alert = document.createElement('div');
+            alert.className = 'alert alert-info decoded-path-alert mb-0';
+            const heading = document.createElement('strong');
+            heading.textContent = 'Decoded Path:';
+            const content = document.createElement('div');
+            content.className = 'mt-2 decoded-path-content';
+            data.path.forEach(node => {
+                const line = document.createElement('div');
+                line.className = node.found ? 'mb-1' : 'mb-1 text-muted';
+                const id = document.createElement('strong');
+                id.textContent = `${String(node.node_id ?? '')}:`;
+                line.append(id, document.createTextNode(` ${node.found ? String(node.name ?? '') : 'Unknown'}`));
+                if (node.found && node.geographic_guess) {
+                    const guess = document.createElement('span');
+                    guess.className = 'badge bg-warning ms-1';
+                    guess.textContent = 'Guess';
+                    line.appendChild(guess);
                 }
+                content.appendChild(line);
             });
-            
-            decodedDiv.innerHTML = `
-                <div class="alert alert-info decoded-path-alert mb-0">
-                    <strong>Decoded Path:</strong>
-                    <div class="mt-2 decoded-path-content">${pathLines.join('')}</div>
-                </div>
-            `;
+            alert.append(heading, content);
+            decodedDiv.replaceChildren(alert);
             
         } catch (error) {
             console.error('Error decoding path:', error);
-            decodedDiv.innerHTML = `
-                <div class="alert alert-danger mb-0">
-                    <strong>Error:</strong> ${this.escapeHtml(error.message)}
-                </div>
-            `;
+            const alert = document.createElement('div');
+            alert.className = 'alert alert-danger mb-0';
+            alert.textContent = `Error: ${error.message}`;
+            decodedDiv.replaceChildren(alert);
         } finally {
             button.disabled = false;
             button.innerHTML = originalHtml;
@@ -2199,7 +2238,7 @@ class ModernContactsManager {
                             <div class="alert alert-warning">
                                 <strong>Contact Information:</strong><br>
                                 <strong>Name:</strong> ${this.escapeHtml(username || 'Unknown')}<br>
-                                <strong>Public Key:</strong> <code>${userId.substring(0, 16)}...</code>
+                                <strong>Public Key:</strong> <code>${this.escapeHtml(userId.substring(0, 16))}...</code>
                             </div>
                             <div class="alert alert-danger">
                                 <i class="fas fa-exclamation-triangle"></i>
@@ -2433,15 +2472,28 @@ class ModernContactsManager {
         div.textContent = text;
         return div.innerHTML;
     }
+
+    escapeAttribute(text) {
+        return String(text ?? '')
+            .replace(/&/g, '&amp;')
+            .replace(/"/g, '&quot;')
+            .replace(/'/g, '&#39;')
+            .replace(/</g, '&lt;')
+            .replace(/>/g, '&gt;');
+    }
     
     showError(message) {
         const errorDiv = document.createElement('div');
         errorDiv.className = 'alert alert-danger alert-dismissible fade show';
         errorDiv.setAttribute('role', 'alert');
-        errorDiv.innerHTML = `
-            <strong>Error:</strong> ${message}
-            <button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>
-        `;
+        const text = document.createElement('span');
+        text.textContent = `Error: ${String(message ?? '')}`;
+        const close = document.createElement('button');
+        close.type = 'button';
+        close.className = 'btn-close';
+        close.dataset.bsDismiss = 'alert';
+        close.setAttribute('aria-label', 'Close');
+        errorDiv.append(text, close);
         
         const content = document.querySelector('.container-fluid');
         if (content) {
@@ -2459,10 +2511,14 @@ class ModernContactsManager {
         const successDiv = document.createElement('div');
         successDiv.className = 'alert alert-success alert-dismissible fade show';
         successDiv.setAttribute('role', 'alert');
-        successDiv.innerHTML = `
-            <strong>Success:</strong> ${message}
-            <button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>
-        `;
+        const text = document.createElement('span');
+        text.textContent = `Success: ${String(message ?? '')}`;
+        const close = document.createElement('button');
+        close.type = 'button';
+        close.className = 'btn-close';
+        close.dataset.bsDismiss = 'alert';
+        close.setAttribute('aria-label', 'Close');
+        successDiv.append(text, close);
         
         const content = document.querySelector('.container-fluid');
         if (content) {
@@ -2490,17 +2546,17 @@ class ModernContactsManager {
             const data = await resp.json();
             if (!resp.ok) throw new Error(data.error || 'Failed to load preview');
             if (data.count === 0) {
-                previewText.innerHTML = `<i class="fas fa-check-circle text-success me-1"></i>No contacts found that are older than <strong>${days} days</strong>.`;
+                previewText.textContent = `No contacts found that are older than ${days} days.`;
                 confirmBtn.disabled = true;
             } else {
-                const sampleNames = (data.samples || []).map(s => `<em>${this.escapeHtml(s.name)}</em>`).join(', ');
+                const sampleNames = (data.samples || []).map(s => String(s.name ?? '')).join(', ');
                 const more = data.count > 5 ? ` and ${data.count - 5} more` : '';
-                previewText.innerHTML = `<i class="fas fa-exclamation-triangle text-warning me-1"></i><strong>${data.count}</strong> contact(s) will be deleted: ${sampleNames}${more}.`;
+                previewText.textContent = `${data.count} contact(s) will be deleted: ${sampleNames}${more}.`;
                 confirmLabel.textContent = `Purge ${data.count} contact(s)`;
                 confirmBtn.disabled = false;
             }
         } catch (err) {
-            previewText.innerHTML = `<i class="fas fa-times-circle text-danger me-1"></i>Error: ${err.message}`;
+            previewText.textContent = `Error: ${err.message}`;
             confirmBtn.disabled = true;
         }
     }
diff --git a/modules/web_viewer/templates/feeds.html b/modules/web_viewer/templates/feeds.html
index c1198dd..0c60e16 100644
--- a/modules/web_viewer/templates/feeds.html
+++ b/modules/web_viewer/templates/feeds.html
@@ -307,7 +307,7 @@
 {% endblock %}
 
 {% block extra_js %}
-<script>
+<script nonce="{{ g.csp_nonce }}">
 class FeedManager {
     constructor() {
         this.feeds = [];
@@ -490,7 +490,11 @@ class FeedManager {
     
     updateChannelSelect() {
         const select = document.getElementById('channelSelect');
-        select.innerHTML = '<option value="">Select channel...</option>';
+        select.replaceChildren();
+        const placeholder = document.createElement('option');
+        placeholder.value = '';
+        placeholder.textContent = 'Select channel...';
+        select.appendChild(placeholder);
         
         this.channels.forEach(channel => {
             const option = document.createElement('option');
@@ -502,17 +506,20 @@ class FeedManager {
     
     renderFeeds() {
         const tbody = document.getElementById('feedsTableBody');
+        tbody.replaceChildren();
         
         if (this.feeds.length === 0) {
-            tbody.innerHTML = '<tr><td colspan="9" class="text-center">No feed subscriptions</td></tr>';
+            const row = document.createElement('tr');
+            const cell = document.createElement('td');
+            cell.colSpan = 9;
+            cell.className = 'text-center';
+            cell.textContent = 'No feed subscriptions';
+            row.appendChild(cell);
+            tbody.appendChild(row);
             return;
         }
         
-        tbody.innerHTML = this.feeds.map(feed => {
-            const statusBadge = feed.enabled 
-                ? '<span class="badge bg-success">Enabled</span>'
-                : '<span class="badge bg-secondary">Disabled</span>';
-            
+        this.feeds.forEach(feed => {
             // Parse timestamp and convert to local time
             let lastCheck = 'Never';
             if (feed.last_check_time) {
@@ -531,34 +538,70 @@ class FeedManager {
                     lastCheck = feed.last_check_time; // Fallback to raw value
                 }
             }
-            
-            return `
-                <tr>
-                    <td>${feed.id}</td>
-                    <td>${feed.feed_name || feed.feed_url.substring(0, 30)}</td>
-                    <td><span class="badge bg-info">${feed.feed_type.toUpperCase()}</span></td>
-                    <td>${feed.channel_name}</td>
-                    <td>${statusBadge}</td>
-                    <td>${lastCheck}</td>
-                    <td>${feed.item_count || 0}</td>
-                    <td>${feed.error_count > 0 ? `<span class="badge bg-danger">${feed.error_count}</span>` : '0'}</td>
-                    <td>
-                        <button class="btn btn-sm btn-info" onclick="feedManager.viewFeed(${feed.id})" title="View Details">
-                            <i class="fas fa-eye"></i>
-                        </button>
-                        <button class="btn btn-sm btn-primary" onclick="feedManager.editFeed(${feed.id})" title="Edit">
-                            <i class="fas fa-edit"></i>
-                        </button>
-                        <button class="btn btn-sm btn-${feed.enabled ? 'warning' : 'success'}" onclick="feedManager.toggleFeed(${feed.id}, ${!feed.enabled})" title="${feed.enabled ? 'Disable' : 'Enable'}">
-                            <i class="fas fa-${feed.enabled ? 'pause' : 'play'}"></i>
-                        </button>
-                        <button class="btn btn-sm btn-danger" onclick="feedManager.deleteFeed(${feed.id})" title="Delete">
-                            <i class="fas fa-trash"></i>
-                        </button>
-                    </td>
-                </tr>
-            `;
-        }).join('');
+
+            const row = document.createElement('tr');
+            const addTextCell = (value) => {
+                const cell = document.createElement('td');
+                cell.textContent = String(value ?? '');
+                row.appendChild(cell);
+                return cell;
+            };
+
+            addTextCell(feed.id);
+            addTextCell(feed.feed_name || String(feed.feed_url || '').substring(0, 30));
+
+            const typeCell = addTextCell('');
+            const typeBadge = document.createElement('span');
+            typeBadge.className = 'badge bg-info';
+            typeBadge.textContent = String(feed.feed_type || '').toUpperCase();
+            typeCell.appendChild(typeBadge);
+
+            addTextCell(feed.channel_name);
+
+            const statusCell = addTextCell('');
+            const statusBadge = document.createElement('span');
+            statusBadge.className = `badge ${feed.enabled ? 'bg-success' : 'bg-secondary'}`;
+            statusBadge.textContent = feed.enabled ? 'Enabled' : 'Disabled';
+            statusCell.appendChild(statusBadge);
+
+            addTextCell(lastCheck);
+            addTextCell(feed.item_count || 0);
+
+            const errorCell = addTextCell('');
+            if (Number(feed.error_count) > 0) {
+                const errorBadge = document.createElement('span');
+                errorBadge.className = 'badge bg-danger';
+                errorBadge.textContent = String(feed.error_count);
+                errorCell.appendChild(errorBadge);
+            } else {
+                errorCell.textContent = '0';
+            }
+
+            const actions = addTextCell('');
+            const addAction = (classes, iconClass, title, handler) => {
+                const button = document.createElement('button');
+                button.type = 'button';
+                button.className = `btn btn-sm ${classes}`;
+                button.title = title;
+                const icon = document.createElement('i');
+                icon.className = `fas ${iconClass}`;
+                button.appendChild(icon);
+                button.addEventListener('click', handler);
+                actions.appendChild(button);
+                actions.appendChild(document.createTextNode(' '));
+            };
+            addAction('btn-info', 'fa-eye', 'View Details', () => this.viewFeed(feed.id));
+            addAction('btn-primary', 'fa-edit', 'Edit', () => this.editFeed(feed.id));
+            addAction(
+                feed.enabled ? 'btn-warning' : 'btn-success',
+                feed.enabled ? 'fa-pause' : 'fa-play',
+                feed.enabled ? 'Disable' : 'Enable',
+                () => this.toggleFeed(feed.id, !feed.enabled),
+            );
+            addAction('btn-danger', 'fa-trash', 'Delete', () => this.deleteFeed(feed.id));
+
+            tbody.appendChild(row);
+        });
     }
     
     setupEventHandlers() {
@@ -798,7 +841,14 @@ class FeedManager {
         const previewResults = document.getElementById('previewResults');
         const previewContent = document.getElementById('previewContent');
         previewResults.style.display = 'block';
-        previewContent.innerHTML = '<div class="spinner-border spinner-border-sm" role="status"><span class="visually-hidden">Loading...</span></div>';
+        const spinner = document.createElement('div');
+        spinner.className = 'spinner-border spinner-border-sm';
+        spinner.setAttribute('role', 'status');
+        const spinnerText = document.createElement('span');
+        spinnerText.className = 'visually-hidden';
+        spinnerText.textContent = 'Loading...';
+        spinner.appendChild(spinnerText);
+        previewContent.replaceChildren(spinner);
         
         try {
             const data = {
@@ -849,21 +899,37 @@ class FeedManager {
             const result = await response.json();
             
             if (response.ok && result.items) {
+                previewContent.replaceChildren();
                 if (result.items.length === 0) {
-                    previewContent.innerHTML = '<p class="text-muted small mb-0">No items found in feed</p>';
+                    const empty = document.createElement('p');
+                    empty.className = 'text-muted small mb-0';
+                    empty.textContent = 'No items found in feed';
+                    previewContent.appendChild(empty);
                 } else {
-                    previewContent.innerHTML = result.items.map((item, index) => `
-                        <div class="mb-2 p-2 border rounded">
-                            <small class="text-muted d-block mb-1"><strong>Item ${index + 1}:</strong></small>
-                            <pre class="mb-1 bg-light p-2 rounded small" style="white-space: pre-wrap; word-wrap: break-word; font-size: 0.8rem; background-color: var(--bg-secondary) !important; color: var(--text-color) !important;">${item.formatted}</pre>
-                        </div>
-                    `).join('');
+                    result.items.forEach((item, index) => {
+                        const wrapper = document.createElement('div');
+                        wrapper.className = 'mb-2 p-2 border rounded';
+                        const label = document.createElement('small');
+                        label.className = 'text-muted d-block mb-1 fw-bold';
+                        label.textContent = `Item ${index + 1}:`;
+                        const formatted = document.createElement('pre');
+                        formatted.className = 'mb-1 bg-light p-2 rounded small feed-preview-text';
+                        formatted.textContent = String(item.formatted ?? '');
+                        wrapper.append(label, formatted);
+                        previewContent.appendChild(wrapper);
+                    });
                 }
             } else {
-                previewContent.innerHTML = `<p class="text-danger small mb-0">Error: ${result.error || 'Failed to preview feed'}</p>`;
+                const errorMessage = document.createElement('p');
+                errorMessage.className = 'text-danger small mb-0';
+                errorMessage.textContent = `Error: ${result.error || 'Failed to preview feed'}`;
+                previewContent.replaceChildren(errorMessage);
             }
         } catch (error) {
-            previewContent.innerHTML = `<p class="text-danger">Error: ${error.message}</p>`;
+            const errorMessage = document.createElement('p');
+            errorMessage.className = 'text-danger';
+            errorMessage.textContent = `Error: ${error.message}`;
+            previewContent.replaceChildren(errorMessage);
         }
     }
     
@@ -885,43 +951,67 @@ class FeedManager {
         try {
             const response = await fetch(`/api/feeds/${feedId}`);
             const feed = await response.json();
-            
-            const content = `
-                <div class="row">
-                    <div class="col-md-6">
-                        <h6>Configuration</h6>
-                        <p><strong>Name:</strong> ${feed.feed_name || 'N/A'}</p>
-                        <p><strong>Type:</strong> ${feed.feed_type.toUpperCase()}</p>
-                        <p><strong>URL:</strong> ${feed.feed_url}</p>
-                        <p><strong>Channel:</strong> ${feed.channel_name}</p>
-                        <p><strong>Check Interval:</strong> ${feed.check_interval_seconds}s</p>
-                        <p><strong>Send Interval:</strong> ${feed.message_send_interval_seconds || 2.0}s</p>
-                        <p><strong>Status:</strong> ${feed.enabled ? 'Enabled' : 'Disabled'}</p>
-                        ${feed.output_format ? `<p><strong>Output Format:</strong><br><code class="small">${feed.output_format.replace(/\n/g, '<br>')}</code></p>` : ''}
-                    </div>
-                    <div class="col-md-6">
-                        <h6>Activity</h6>
-                        <p><strong>Last Check:</strong> ${(() => {
-                            if (!feed.last_check_time) return 'Never';
-                            try {
-                                let dateStr = feed.last_check_time;
-                                if (/^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$/.test(dateStr)) {
-                                    dateStr = dateStr.replace(' ', 'T') + 'Z';
-                                }
-                                const date = new Date(dateStr);
-                                return !isNaN(date.getTime()) ? date.toLocaleString() : feed.last_check_time;
-                            } catch (e) {
-                                return feed.last_check_time;
-                            }
-                        })()}</p>
-                        <p><strong>Last Item:</strong> ${feed.last_item_id ? feed.last_item_id.substring(0, 30) + '...' : 'None'}</p>
-                        <p><strong>Total Items:</strong> ${feed.activity?.length || 0}</p>
-                        <p><strong>Errors:</strong> ${feed.errors?.length || 0}</p>
-                    </div>
-                </div>
-            `;
-            
-            document.getElementById('feedDetailsContent').innerHTML = content;
+
+            let lastCheck = 'Never';
+            if (feed.last_check_time) {
+                try {
+                    let dateStr = feed.last_check_time;
+                    if (/^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$/.test(dateStr)) {
+                        dateStr = dateStr.replace(' ', 'T') + 'Z';
+                    }
+                    const date = new Date(dateStr);
+                    lastCheck = !isNaN(date.getTime()) ? date.toLocaleString() : feed.last_check_time;
+                } catch (e) {
+                    lastCheck = feed.last_check_time;
+                }
+            }
+
+            const content = document.getElementById('feedDetailsContent');
+            const row = document.createElement('div');
+            row.className = 'row';
+            const configColumn = document.createElement('div');
+            configColumn.className = 'col-md-6';
+            const activityColumn = document.createElement('div');
+            activityColumn.className = 'col-md-6';
+            const addHeading = (parent, text) => {
+                const heading = document.createElement('h6');
+                heading.textContent = text;
+                parent.appendChild(heading);
+            };
+            const addDetail = (parent, label, value) => {
+                const paragraph = document.createElement('p');
+                const strong = document.createElement('strong');
+                strong.textContent = `${label}:`;
+                paragraph.append(strong, document.createTextNode(` ${String(value ?? '')}`));
+                parent.appendChild(paragraph);
+            };
+
+            addHeading(configColumn, 'Configuration');
+            addDetail(configColumn, 'Name', feed.feed_name || 'N/A');
+            addDetail(configColumn, 'Type', String(feed.feed_type || '').toUpperCase());
+            addDetail(configColumn, 'URL', feed.feed_url);
+            addDetail(configColumn, 'Channel', feed.channel_name);
+            addDetail(configColumn, 'Check Interval', `${feed.check_interval_seconds}s`);
+            addDetail(configColumn, 'Send Interval', `${feed.message_send_interval_seconds || 2.0}s`);
+            addDetail(configColumn, 'Status', feed.enabled ? 'Enabled' : 'Disabled');
+            if (feed.output_format) {
+                const paragraph = document.createElement('p');
+                const strong = document.createElement('strong');
+                strong.textContent = 'Output Format:';
+                const format = document.createElement('code');
+                format.className = 'small d-block feed-output-format';
+                format.textContent = String(feed.output_format);
+                paragraph.append(strong, format);
+                configColumn.appendChild(paragraph);
+            }
+
+            addHeading(activityColumn, 'Activity');
+            addDetail(activityColumn, 'Last Check', lastCheck);
+            addDetail(activityColumn, 'Last Item', feed.last_item_id ? String(feed.last_item_id).substring(0, 30) + '...' : 'None');
+            addDetail(activityColumn, 'Total Items', feed.activity?.length || 0);
+            addDetail(activityColumn, 'Errors', feed.errors?.length || 0);
+            row.append(configColumn, activityColumn);
+            content.replaceChildren(row);
             const modal = new bootstrap.Modal(document.getElementById('feedDetailsModal'));
             modal.show();
         } catch (error) {
@@ -977,21 +1067,27 @@ class FeedManager {
     }
     
     showError(message) {
-        const alert = document.createElement('div');
-        alert.className = 'alert alert-danger alert-dismissible fade show position-fixed';
-        alert.style.cssText = 'top: 20px; right: 20px; z-index: 9999; max-width: 300px;';
-        alert.innerHTML = `${message}<button type="button" class="btn-close" data-bs-dismiss="alert"></button>`;
-        document.body.appendChild(alert);
-        setTimeout(() => alert.remove(), 5000);
+        this.showAlert(message, 'danger', 5000);
     }
     
     showSuccess(message) {
+        this.showAlert(message, 'success', 3000);
+    }
+
+    showAlert(message, kind, timeout) {
         const alert = document.createElement('div');
-        alert.className = 'alert alert-success alert-dismissible fade show position-fixed';
+        alert.className = `alert alert-${kind} alert-dismissible fade show position-fixed`;
         alert.style.cssText = 'top: 20px; right: 20px; z-index: 9999; max-width: 300px;';
-        alert.innerHTML = `${message}<button type="button" class="btn-close" data-bs-dismiss="alert"></button>`;
+        const messageNode = document.createElement('span');
+        messageNode.textContent = String(message ?? '');
+        const closeButton = document.createElement('button');
+        closeButton.type = 'button';
+        closeButton.className = 'btn-close';
+        closeButton.setAttribute('data-bs-dismiss', 'alert');
+        closeButton.setAttribute('aria-label', 'Close');
+        alert.append(messageNode, closeButton);
         document.body.appendChild(alert);
-        setTimeout(() => alert.remove(), 3000);
+        setTimeout(() => alert.remove(), timeout);
     }
 }
 
@@ -1003,6 +1099,19 @@ document.addEventListener('DOMContentLoaded', () => {
 </script>
 
 <style>
+.feed-preview-text {
+    white-space: pre-wrap;
+    overflow-wrap: anywhere;
+    font-size: 0.8rem;
+    background-color: var(--bg-secondary) !important;
+    color: var(--text-color) !important;
+}
+
+.feed-output-format {
+    white-space: pre-wrap;
+    overflow-wrap: anywhere;
+}
+
 /* Dark mode table styling with better contrast - matching contacts page */
 [data-theme="dark"] .table-striped > tbody > tr:nth-of-type(odd) > td {
     background-color: #3a3a3a; /* Slightly lighter than even rows, but not too light */
@@ -1044,4 +1153,3 @@ document.addEventListener('DOMContentLoaded', () => {
 }
 </style>
 {% endblock %}
-
diff --git a/modules/web_viewer/templates/greeter.html b/modules/web_viewer/templates/greeter.html
index 7c8bc58..9ee39a7 100644
--- a/modules/web_viewer/templates/greeter.html
+++ b/modules/web_viewer/templates/greeter.html
@@ -106,7 +106,7 @@
 {% endblock %}
 
 {% block extra_js %}
-<script>
+<script nonce="{{ g.csp_nonce }}">
 class GreeterManager {
     constructor() {
         this.greeterData = null;
@@ -184,16 +184,14 @@ class GreeterManager {
         const statusDiv = document.getElementById('rollout-status');
         
         if (!this.greeterData) {
-            statusDiv.innerHTML = '<div class="loading">Loading...</div>';
+            statusDiv.replaceChildren(this.makeTextElement('div', 'Loading...', 'loading'));
             return;
         }
         
         if (!this.greeterData.enabled) {
-            statusDiv.innerHTML = `
-                <div class="alert alert-warning">
-                    <i class="fas fa-exclamation-triangle"></i> Greeter is currently disabled.
-                </div>
-            `;
+            statusDiv.replaceChildren(
+                this.makeTextElement('div', 'Greeter is currently disabled.', 'alert alert-warning'),
+            );
             return;
         }
         
@@ -202,31 +200,37 @@ class GreeterManager {
             const timeStr = this.formatTimeRemaining(timeRemaining);
             const endDate = new Date(this.greeterData.rollout_data.end_date);
             
-            statusDiv.innerHTML = `
-                <div class="alert alert-info">
-                    <h5><i class="fas fa-hourglass-half"></i> Onboarding Period Active</h5>
-                    <p class="mb-2"><strong>Time Remaining:</strong> <span class="badge bg-primary" style="font-size: 1.1em;">${timeStr}</span></p>
-                    <p class="mb-2"><strong>Started:</strong> ${new Date(this.greeterData.rollout_data.started_at).toLocaleString()}</p>
-                    <p class="mb-2"><strong>Ends:</strong> ${endDate.toLocaleString()}</p>
-                    <p class="mb-0"><strong>Duration:</strong> ${this.greeterData.rollout_data.days} days</p>
-                </div>
-                <div class="mt-3">
-                    <button class="btn btn-danger" id="end-rollout-btn">
-                        <i class="fas fa-stop-circle"></i> End Onboarding Period
-                    </button>
-                </div>
-            `;
-            
-            // Setup end rollout button
-            document.getElementById('end-rollout-btn').addEventListener('click', () => {
-                this.endRollout();
-            });
+            const alert = document.createElement('div');
+            alert.className = 'alert alert-info';
+            alert.appendChild(this.makeTextElement('h5', 'Onboarding Period Active'));
+            this.appendLabeledParagraph(alert, 'Time Remaining', timeStr, 'mb-2');
+            this.appendLabeledParagraph(
+                alert,
+                'Started',
+                new Date(this.greeterData.rollout_data.started_at).toLocaleString(),
+                'mb-2',
+            );
+            this.appendLabeledParagraph(alert, 'Ends', endDate.toLocaleString(), 'mb-2');
+            this.appendLabeledParagraph(
+                alert,
+                'Duration',
+                `${this.greeterData.rollout_data.days} days`,
+                'mb-0',
+            );
+            const actions = document.createElement('div');
+            actions.className = 'mt-3';
+            const endButton = this.makeTextElement('button', 'End Onboarding Period', 'btn btn-danger');
+            endButton.type = 'button';
+            endButton.id = 'end-rollout-btn';
+            endButton.addEventListener('click', () => this.endRollout());
+            actions.appendChild(endButton);
+            statusDiv.replaceChildren(alert, actions);
         } else {
-            statusDiv.innerHTML = `
-                <div class="alert alert-success">
-                    <i class="fas fa-check-circle"></i> No active onboarding period. New users will be greeted immediately.
-                </div>
-            `;
+            statusDiv.replaceChildren(this.makeTextElement(
+                'div',
+                'No active onboarding period. New users will be greeted immediately.',
+                'alert alert-success',
+            ));
         }
     }
     
@@ -234,34 +238,36 @@ class GreeterManager {
         const settingsDiv = document.getElementById('greeter-settings');
         
         if (!this.greeterData) {
-            settingsDiv.innerHTML = '<div class="loading">Loading...</div>';
+            settingsDiv.replaceChildren(this.makeTextElement('div', 'Loading...', 'loading'));
             return;
         }
         
         const settings = this.greeterData.settings;
-        settingsDiv.innerHTML = `
-            <ul class="list-unstyled">
-                <li><strong>Enabled:</strong> <span class="badge bg-${settings.enabled ? 'success' : 'secondary'}">${settings.enabled ? 'Yes' : 'No'}</span></li>
-                <li><strong>Rollout Days:</strong> ${settings.rollout_days}</li>
-                <li><strong>Per-Channel Greetings:</strong> <span class="badge bg-${settings.per_channel_greetings ? 'info' : 'secondary'}">${settings.per_channel_greetings ? 'Yes' : 'No'}</span></li>
-                <li><strong>Include Mesh Info:</strong> <span class="badge bg-${settings.include_mesh_info ? 'info' : 'secondary'}">${settings.include_mesh_info ? 'Yes' : 'No'}</span></li>
-            </ul>
-        `;
+        const list = document.createElement('ul');
+        list.className = 'list-unstyled';
+        [
+            ['Enabled', settings.enabled ? 'Yes' : 'No'],
+            ['Rollout Days', settings.rollout_days],
+            ['Per-Channel Greetings', settings.per_channel_greetings ? 'Yes' : 'No'],
+            ['Include Mesh Info', settings.include_mesh_info ? 'Yes' : 'No'],
+        ].forEach(([label, value]) => this.appendLabeledListItem(list, label, value));
+        settingsDiv.replaceChildren(list);
     }
     
     renderSampleGreeting() {
         const greetingDiv = document.getElementById('sample-greeting');
         
         if (!this.greeterData) {
-            greetingDiv.innerHTML = '<div class="loading">Loading...</div>';
+            greetingDiv.replaceChildren(this.makeTextElement('div', 'Loading...', 'loading'));
             return;
         }
         
-        greetingDiv.innerHTML = `
-            <div class="alert alert-light" style="white-space: pre-wrap; font-family: monospace;">
-${this.escapeHtml(this.greeterData.sample_greeting)}
-            </div>
-        `;
+        const sample = this.makeTextElement(
+            'div',
+            this.greeterData.sample_greeting,
+            'alert alert-light greeter-sample-text',
+        );
+        greetingDiv.replaceChildren(sample);
     }
     
     renderGreetedUsers(usersToRender = null) {
@@ -269,7 +275,7 @@ ${this.escapeHtml(this.greeterData.sample_greeting)}
         const badge = document.getElementById('total-greeted-badge');
         
         if (!this.greeterData) {
-            tableBody.innerHTML = '<tr><td colspan="6" class="text-center"><div class="loading">Loading...</div></td></tr>';
+            this.renderEmptyRow(tableBody, 'Loading...', 'text-center loading');
             return;
         }
         
@@ -286,11 +292,16 @@ ${this.escapeHtml(this.greeterData.sample_greeting)}
         if (users.length === 0) {
             const searchInput = document.getElementById('greeted-users-search');
             const hasSearch = searchInput && searchInput.value.trim();
-            tableBody.innerHTML = `<tr><td colspan="6" class="text-center text-muted">${hasSearch ? 'No users match your search.' : 'No users have been greeted yet.'}</td></tr>`;
+            this.renderEmptyRow(
+                tableBody,
+                hasSearch ? 'No users match your search.' : 'No users have been greeted yet.',
+                'text-center text-muted',
+            );
             return;
         }
-        
-        tableBody.innerHTML = users.map(user => {
+
+        tableBody.replaceChildren();
+        users.forEach(user => {
             // greeted_at is a SQLite timestamp string (ISO format like "2025-12-03 02:52:38")
             // SQLite stores timestamps in UTC, but without timezone indicator
             // JavaScript Date will interpret it as local time, so we need to be explicit
@@ -315,26 +326,62 @@ ${this.escapeHtml(this.greeterData.sample_greeting)}
                 // Convert to milliseconds
                 lastSeenDate = new Date(timestamp * 1000);
             }
-            const lastSeenStr = lastSeenDate ? lastSeenDate.toLocaleString() : '<span class="text-muted">Never</span>';
-            const rolloutBadge = user.rollout_marked 
-                ? '<span class="badge bg-warning">Rollout</span>' 
-                : '<span class="badge bg-success">Manual</span>';
-            
-            return `
-                <tr>
-                    <td><code>${this.escapeHtml(user.sender_id)}</code></td>
-                    <td>${this.escapeHtml(user.channel)}</td>
-                    <td>${greetedDate.toLocaleString()}</td>
-                    <td>${lastSeenStr}</td>
-                    <td>${rolloutBadge}</td>
-                    <td>
-                        <button class="btn btn-sm btn-danger" onclick="greeterManager.ungreetUser('${this.escapeHtml(user.sender_id)}', '${this.escapeHtml(user.channel)}')">
-                            <i class="fas fa-undo"></i> Mark Ungreeted
-                        </button>
-                    </td>
-                </tr>
-            `;
-        }).join('');
+            const row = document.createElement('tr');
+            const senderCell = document.createElement('td');
+            senderCell.appendChild(this.makeTextElement('code', user.sender_id));
+            row.appendChild(senderCell);
+            [
+                user.channel,
+                greetedDate.toLocaleString(),
+                lastSeenDate ? lastSeenDate.toLocaleString() : 'Never',
+            ].forEach(value => row.appendChild(this.makeTextElement('td', value)));
+            const rolloutCell = document.createElement('td');
+            rolloutCell.appendChild(this.makeTextElement(
+                'span',
+                user.rollout_marked ? 'Rollout' : 'Manual',
+                `badge ${user.rollout_marked ? 'bg-warning' : 'bg-success'}`,
+            ));
+            row.appendChild(rolloutCell);
+            const actionCell = document.createElement('td');
+            const button = this.makeTextElement('button', 'Mark Ungreeted', 'btn btn-sm btn-danger');
+            button.type = 'button';
+            button.addEventListener('click', () => this.ungreetUser(user.sender_id, user.channel));
+            actionCell.appendChild(button);
+            row.appendChild(actionCell);
+            tableBody.appendChild(row);
+        });
+    }
+
+    makeTextElement(tagName, value, className = '') {
+        const element = document.createElement(tagName);
+        element.className = className;
+        element.textContent = String(value ?? '');
+        return element;
+    }
+
+    appendLabeledParagraph(parent, label, value, className = '') {
+        const paragraph = document.createElement('p');
+        paragraph.className = className;
+        const strong = document.createElement('strong');
+        strong.textContent = `${label}:`;
+        paragraph.append(strong, document.createTextNode(` ${String(value ?? '')}`));
+        parent.appendChild(paragraph);
+    }
+
+    appendLabeledListItem(parent, label, value) {
+        const item = document.createElement('li');
+        const strong = document.createElement('strong');
+        strong.textContent = `${label}:`;
+        item.append(strong, document.createTextNode(` ${String(value ?? '')}`));
+        parent.appendChild(item);
+    }
+
+    renderEmptyRow(tableBody, message, className) {
+        const row = document.createElement('tr');
+        const cell = this.makeTextElement('td', message, className);
+        cell.colSpan = 6;
+        row.appendChild(cell);
+        tableBody.replaceChildren(row);
     }
     
     filterUsers(searchTerm) {
@@ -493,6 +540,11 @@ document.addEventListener('DOMContentLoaded', () => {
 </script>
 
 <style>
+.greeter-sample-text {
+    white-space: pre-wrap;
+    font-family: monospace;
+}
+
 /* Dark mode table styling with better contrast - matching contacts page */
 [data-theme="dark"] .table-striped > tbody > tr:nth-of-type(odd) > td {
     background-color: #3a3a3a; /* Slightly lighter than even rows, but not too light */
@@ -540,4 +592,3 @@ document.addEventListener('DOMContentLoaded', () => {
 }
 </style>
 {% endblock %}
-
diff --git a/modules/web_viewer/templates/index.html b/modules/web_viewer/templates/index.html
index 4a64e12..644f8d5 100644
--- a/modules/web_viewer/templates/index.html
+++ b/modules/web_viewer/templates/index.html
@@ -61,8 +61,7 @@
                         </div>
                         <h3 class="text-primary mb-1">
                             <a href="#" id="connected-clients" class="text-primary text-decoration-none"
-                               data-bs-toggle="modal" data-bs-target="#connectedClientsModal"
-                               onclick="window.dashboard && window.dashboard.loadConnectedClients()">0</a>
+                               data-bs-toggle="modal" data-bs-target="#connectedClientsModal">0</a>
                         </h3>
                         <small class="text-muted text-uppercase">Connected Clients</small>
                     </div>
@@ -429,17 +428,17 @@
                         </div>
                     </div>
                     <!-- Scroll buttons -->
-                    <button class="btn btn-sm btn-outline-secondary" id="live-scroll-top" onclick="scrollLiveFeed('top')" title="Scroll to newest">
+                    <button class="btn btn-sm btn-outline-secondary" id="live-scroll-top" title="Scroll to newest">
                         <i class="fas fa-arrow-up"></i>
                     </button>
-                    <button class="btn btn-sm btn-outline-secondary" id="live-scroll-bottom" onclick="scrollLiveFeed('bottom')" title="Scroll to oldest">
+                    <button class="btn btn-sm btn-outline-secondary" id="live-scroll-bottom" title="Scroll to oldest">
                         <i class="fas fa-arrow-down"></i>
                     </button>
                     <span id="live-count" class="badge bg-secondary">0</span>
-                    <button class="btn btn-sm btn-outline-secondary" id="live-pause-btn" onclick="toggleLivePause()">
+                    <button class="btn btn-sm btn-outline-secondary" id="live-pause-btn">
                         <i class="fas fa-pause" id="live-pause-icon"></i>
                     </button>
-                    <button class="btn btn-sm btn-outline-secondary" onclick="clearLiveFeed()">
+                    <button class="btn btn-sm btn-outline-secondary" id="live-clear-btn">
                         <i class="fas fa-trash-alt"></i>
                     </button>
                     <a href="/realtime" class="btn btn-sm btn-outline-primary">
@@ -494,7 +493,7 @@
 {% endblock %}
 
 {% block extra_js %}
-<script>
+<script nonce="{{ g.csp_nonce }}">
 class ModernDashboard {
     constructor() {
         this.botStartTime = null;
@@ -935,8 +934,7 @@ class ModernDashboard {
             if (data.top_commands && data.top_commands.length > 0) {
                 this.updateTopCommands(data.top_commands);
             } else {
-                const container = document.getElementById('top-commands-list');
-                container.innerHTML = '<div class="text-muted text-center">No commands found</div>';
+                this.setEmptyList('top-commands-list', 'No commands found');
             }
         } catch (error) {
             console.error('Error loading top commands:', error);
@@ -945,15 +943,19 @@ class ModernDashboard {
     
     updateTopCommands(commands) {
         const container = document.getElementById('top-commands-list');
-        container.innerHTML = commands.map((cmd, index) => `
-            <div class="d-flex justify-content-between align-items-center mb-2">
-                <div class="d-flex align-items-center">
-                    <span class="badge bg-primary me-2">${index + 1}</span>
-                    <span class="fw-bold">${cmd.command}</span>
-                </div>
-                <span class="badge bg-secondary">${cmd.count} uses</span>
-            </div>
-        `).join('');
+        container.replaceChildren();
+        commands.forEach((cmd, index) => {
+            const row = document.createElement('div');
+            row.className = 'd-flex justify-content-between align-items-center mb-2';
+            const identity = document.createElement('div');
+            identity.className = 'd-flex align-items-center';
+            identity.append(
+                this.makeBadge(index + 1, 'bg-primary me-2'),
+                this.makeTextElement('span', cmd.command, 'fw-bold'),
+            );
+            row.append(identity, this.makeBadge(`${cmd.count} uses`, 'bg-secondary'));
+            container.appendChild(row);
+        });
     }
     
     async loadTopUsers(timeWindow = 'all') {
@@ -969,8 +971,7 @@ class ModernDashboard {
             if (data.top_users && data.top_users.length > 0) {
                 this.updateTopUsers(data.top_users);
             } else {
-                const container = document.getElementById('top-users-list');
-                container.innerHTML = '<div class="text-muted text-center">No users found</div>';
+                this.setEmptyList('top-users-list', 'No users found');
             }
         } catch (error) {
             console.error('Error loading top users:', error);
@@ -979,15 +980,19 @@ class ModernDashboard {
     
     updateTopUsers(users) {
         const container = document.getElementById('top-users-list');
-        container.innerHTML = users.map((user, index) => `
-            <div class="d-flex justify-content-between align-items-center mb-2">
-                <div class="d-flex align-items-center">
-                    <span class="badge bg-success me-2">${index + 1}</span>
-                    <span class="fw-bold text-truncate" style="max-width: 200px;" title="${user.user}">${user.user}</span>
-                </div>
-                <span class="badge bg-info">${user.count} messages</span>
-            </div>
-        `).join('');
+        container.replaceChildren();
+        users.forEach((user, index) => {
+            const row = document.createElement('div');
+            row.className = 'd-flex justify-content-between align-items-center mb-2';
+            const identity = document.createElement('div');
+            identity.className = 'd-flex align-items-center';
+            const username = this.makeTextElement('span', user.user, 'fw-bold text-truncate');
+            username.style.maxWidth = '200px';
+            username.title = String(user.user ?? '');
+            identity.append(this.makeBadge(index + 1, 'bg-success me-2'), username);
+            row.append(identity, this.makeBadge(`${user.count} messages`, 'bg-info'));
+            container.appendChild(row);
+        });
     }
     
     async loadLongestPaths(timeWindow = 'all') {
@@ -1003,8 +1008,7 @@ class ModernDashboard {
             if (data.top_paths && data.top_paths.length > 0) {
                 this.updateLongestPaths(data.top_paths);
             } else {
-                const container = document.getElementById('longest-paths-list');
-                container.innerHTML = '<div class="text-muted text-center">No paths found</div>';
+                this.setEmptyList('longest-paths-list', 'No paths found');
             }
         } catch (error) {
             console.error('Error loading longest paths:', error);
@@ -1013,21 +1017,34 @@ class ModernDashboard {
     
     updateLongestPaths(paths) {
         const container = document.getElementById('longest-paths-list');
-        container.innerHTML = paths.map((path, index) => `
-            <div class="mb-3 p-2 border rounded">
-                <div class="d-flex align-items-center mb-2">
-                    <span class="badge bg-warning me-2">${index + 1}</span>
-                    <span class="fw-bold text-truncate" style="max-width: 150px;" title="${path.user}">${path.user}</span>
-                    <span class="badge bg-danger ms-2">${path.path_length} hops</span>
-                </div>
-                <div class="small text-muted mb-1">
-                    <code class="text-break" style="word-break: break-all; font-size: 0.75rem;">${path.path_string}</code>
-                </div>
-                <div class="small text-muted">
-                    ${new Date(path.timestamp * 1000).toLocaleString()}
-                </div>
-            </div>
-        `).join('');
+        container.replaceChildren();
+        paths.forEach((path, index) => {
+            const card = document.createElement('div');
+            card.className = 'mb-3 p-2 border rounded';
+            const heading = document.createElement('div');
+            heading.className = 'd-flex align-items-center mb-2';
+            const username = this.makeTextElement('span', path.user, 'fw-bold text-truncate');
+            username.style.maxWidth = '150px';
+            username.title = String(path.user ?? '');
+            heading.append(
+                this.makeBadge(index + 1, 'bg-warning me-2'),
+                username,
+                this.makeBadge(`${path.path_length} hops`, 'bg-danger ms-2'),
+            );
+            const pathLine = document.createElement('div');
+            pathLine.className = 'small text-muted mb-1';
+            const pathCode = this.makeTextElement('code', path.path_string, 'text-break');
+            pathCode.style.wordBreak = 'break-all';
+            pathCode.style.fontSize = '0.75rem';
+            pathLine.appendChild(pathCode);
+            const timestamp = this.makeTextElement(
+                'div',
+                new Date(Number(path.timestamp) * 1000).toLocaleString(),
+                'small text-muted',
+            );
+            card.append(heading, pathLine, timestamp);
+            container.appendChild(card);
+        });
     }
     
     async loadTopChannels(timeWindow = 'all') {
@@ -1043,8 +1060,7 @@ class ModernDashboard {
             if (data.top_channels && data.top_channels.length > 0) {
                 this.updateTopChannels(data.top_channels);
             } else {
-                const container = document.getElementById('top-channels-list');
-                container.innerHTML = '<div class="text-muted text-center">No channels found</div>';
+                this.setEmptyList('top-channels-list', 'No channels found');
             }
         } catch (error) {
             console.error('Error loading top channels:', error);
@@ -1053,28 +1069,52 @@ class ModernDashboard {
     
     updateTopChannels(channels) {
         const container = document.getElementById('top-channels-list');
-        container.innerHTML = channels.map((channel, index) => `
-            <div class="d-flex justify-content-between align-items-center mb-2">
-                <div class="d-flex align-items-center">
-                    <span class="badge bg-primary me-2">${index + 1}</span>
-                    <span class="fw-bold text-truncate" style="max-width: 200px;" title="${channel.channel}">${channel.channel}</span>
-                </div>
-                <div class="text-end">
-                    <span class="badge bg-secondary me-1">${channel.messages} msgs</span>
-                    <span class="badge bg-info">${channel.users} users</span>
-                </div>
-            </div>
-        `).join('');
+        container.replaceChildren();
+        channels.forEach((channel, index) => {
+            const row = document.createElement('div');
+            row.className = 'd-flex justify-content-between align-items-center mb-2';
+            const identity = document.createElement('div');
+            identity.className = 'd-flex align-items-center';
+            const channelName = this.makeTextElement('span', channel.channel, 'fw-bold text-truncate');
+            channelName.style.maxWidth = '200px';
+            channelName.title = String(channel.channel ?? '');
+            identity.append(this.makeBadge(index + 1, 'bg-primary me-2'), channelName);
+            const counts = document.createElement('div');
+            counts.className = 'text-end';
+            counts.append(
+                this.makeBadge(`${channel.messages} msgs`, 'bg-secondary me-1'),
+                this.makeBadge(`${channel.users} users`, 'bg-info'),
+            );
+            row.append(identity, counts);
+            container.appendChild(row);
+        });
+    }
+
+    makeTextElement(tagName, value, className = '') {
+        const element = document.createElement(tagName);
+        element.className = className;
+        element.textContent = String(value ?? '');
+        return element;
+    }
+
+    makeBadge(value, classes) {
+        return this.makeTextElement('span', value, `badge ${classes}`);
+    }
+
+    setEmptyList(containerId, message) {
+        const empty = this.makeTextElement('div', message, 'text-muted text-center');
+        document.getElementById(containerId).replaceChildren(empty);
     }
     
     updateDatabaseStatus(status, type) {
         const statusElement = document.getElementById('database-status');
-        statusElement.innerHTML = `
-            <div class="d-flex align-items-center justify-content-center mb-2">
-                <span class="status-indicator status-${type} me-2"></span>
-                <span>${status}</span>
-            </div>
-        `;
+        const wrapper = document.createElement('div');
+        wrapper.className = 'd-flex align-items-center justify-content-center mb-2';
+        const indicator = document.createElement('span');
+        const safeType = ['success', 'danger', 'warning'].includes(type) ? type : 'warning';
+        indicator.className = `status-indicator status-${safeType} me-2`;
+        wrapper.append(indicator, this.makeTextElement('span', status));
+        statusElement.replaceChildren(wrapper);
     }
     
     updateUptime() {
@@ -1168,7 +1208,7 @@ class ModernDashboard {
         loading.style.display = '';
         empty.style.display   = 'none';
         table.style.display   = 'none';
-        tbody.innerHTML       = '';
+        tbody.replaceChildren();
         try {
             const resp = await fetch('/api/connected_clients');
             const clients = await resp.json();
@@ -1186,7 +1226,11 @@ class ModernDashboard {
                     ? new Date(c.last_activity * 1000).toLocaleTimeString()
                     : '—';
                 const tr = document.createElement('tr');
-                tr.innerHTML = `<td><code>${c.client_id}</code></td><td>${connAt}</td><td>${lastAct}</td>`;
+                const clientCell = document.createElement('td');
+                clientCell.appendChild(this.makeTextElement('code', c.client_id));
+                const connectedCell = this.makeTextElement('td', connAt);
+                const activityCell = this.makeTextElement('td', lastAct);
+                tr.append(clientCell, connectedCell, activityCell);
                 tbody.appendChild(tr);
             }
         } catch (e) {
@@ -1199,10 +1243,14 @@ class ModernDashboard {
     showError(message) {
         const errorDiv = document.createElement('div');
         errorDiv.className = 'alert alert-danger alert-dismissible fade show';
-        errorDiv.innerHTML = `
-            ${message}
-            <button type="button" class="btn-close" data-bs-dismiss="alert"></button>
-        `;
+        const errorText = document.createElement('span');
+        errorText.textContent = String(message ?? '');
+        const closeButton = document.createElement('button');
+        closeButton.type = 'button';
+        closeButton.className = 'btn-close';
+        closeButton.setAttribute('data-bs-dismiss', 'alert');
+        closeButton.setAttribute('aria-label', 'Close');
+        errorDiv.append(errorText, closeButton);
         
         // Insert at the top of the content
         const content = document.querySelector('.container-fluid');
@@ -1242,6 +1290,10 @@ function initMultibyteCapableTooltips() {
 document.addEventListener('DOMContentLoaded', () => {
     console.log('DOM loaded, initializing dashboard...');
     window.dashboard = new ModernDashboard();
+    document.getElementById('connected-clients')?.addEventListener('click', (event) => {
+        event.preventDefault();
+        window.dashboard.loadConnectedClients();
+    });
     initMultibyteCapableTooltips();
 });
 
@@ -1253,7 +1305,7 @@ window.addEventListener('beforeunload', () => {
 });
 </script>
 
-<script>
+<script nonce="{{ g.csp_nonce }}">
 // ── Live Activity Feed (SocketIO) ─────────────────────────────────────────────
 (function () {
     const feed      = document.getElementById('live-feed');
@@ -1270,10 +1322,6 @@ window.addEventListener('beforeunload', () => {
         message: '#0dcaf0',
     };
 
-    function escHtml(s) {
-        return String(s || '').replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;');
-    }
-
     // Track active type filters
     const activeFilters = { packet: true, command: true, message: true };
 
@@ -1301,7 +1349,15 @@ window.addEventListener('beforeunload', () => {
         const el = document.createElement('div');
         el.dataset.type = type;
         el.style.cssText = `border-left:3px solid ${color};padding:3px 8px;margin-bottom:3px;font-size:0.82rem;border-radius:2px;`;
-        el.innerHTML = `<span class="text-muted me-2">${ts}</span><strong>${escHtml(label)}</strong> <span class="text-muted">${escHtml(text)}</span>`;
+        const time = document.createElement('span');
+        time.className = 'text-muted me-2';
+        time.textContent = ts;
+        const entryLabel = document.createElement('strong');
+        entryLabel.textContent = String(label ?? '');
+        const entryText = document.createElement('span');
+        entryText.className = 'text-muted';
+        entryText.textContent = ` ${String(text ?? '')}`;
+        el.append(time, entryLabel, entryText);
         if (!activeFilters[type]) el.style.display = 'none';
         feed.insertBefore(el, feed.firstChild);
         total++;
@@ -1317,13 +1373,17 @@ window.addEventListener('beforeunload', () => {
         icon.className = paused ? 'fas fa-play' : 'fas fa-pause';
     };
     window.clearLiveFeed = function () {
-        feed.innerHTML = '';
+        feed.replaceChildren();
         total = 0;
         countBadge.textContent = '0';
     };
     window.scrollLiveFeed = function (dir) {
         feed.scrollTop = dir === 'top' ? 0 : feed.scrollHeight;
     };
+    document.getElementById('live-pause-btn')?.addEventListener('click', window.toggleLivePause);
+    document.getElementById('live-clear-btn')?.addEventListener('click', window.clearLiveFeed);
+    document.getElementById('live-scroll-top')?.addEventListener('click', () => window.scrollLiveFeed('top'));
+    document.getElementById('live-scroll-bottom')?.addEventListener('click', () => window.scrollLiveFeed('bottom'));
 
     const socket = window.connectionManager.socket;
 
diff --git a/modules/web_viewer/templates/logs.html b/modules/web_viewer/templates/logs.html
index eb7775f..b0131cb 100644
--- a/modules/web_viewer/templates/logs.html
+++ b/modules/web_viewer/templates/logs.html
@@ -137,13 +137,13 @@
                 <button type="button" class="log-level-toggle is-on" data-level="ERROR" aria-pressed="true" title="Toggle ERROR lines">ERROR</button>
                 <button type="button" class="log-level-toggle is-on" data-level="CRITICAL" aria-pressed="true" title="Toggle CRITICAL lines">CRITICAL</button>
             </div>
-            <button class="btn btn-sm btn-outline-secondary" id="pause-btn" onclick="togglePause()">
+            <button class="btn btn-sm btn-outline-secondary" id="pause-btn">
                 <i class="fas fa-pause" id="pause-icon"></i> Pause
             </button>
-            <button class="btn btn-sm btn-outline-secondary" onclick="clearLog()">
+            <button class="btn btn-sm btn-outline-secondary" id="clear-log-btn">
                 <i class="fas fa-trash"></i> Clear
             </button>
-            <button class="btn btn-sm btn-outline-secondary" onclick="scrollToBottom()">
+            <button class="btn btn-sm btn-outline-secondary" id="scroll-log-btn">
                 <i class="fas fa-arrow-down"></i> Bottom
             </button>
         </div>
@@ -159,7 +159,7 @@
 {% endblock %}
 
 {% block extra_js %}
-<script>
+<script nonce="{{ g.csp_nonce }}">
 (function () {
     const MAX_LINES = 2000;
     const LEVELS = ['DEBUG', 'INFO', 'WARNING', 'ERROR', 'CRITICAL'];
@@ -295,7 +295,7 @@
     }
 
     function clearLog() {
-        container.innerHTML = '';
+        container.replaceChildren();
         lineCount = 0;
         document.getElementById('line-count').textContent = '0 lines';
     }
@@ -318,10 +318,9 @@
         autoScroll = atBottom;
     });
 
-    // Expose for inline handlers
-    window.togglePause = togglePause;
-    window.clearLog = clearLog;
-    window.scrollToBottom = scrollToBottom;
+    document.getElementById('pause-btn').addEventListener('click', togglePause);
+    document.getElementById('clear-log-btn').addEventListener('click', clearLog);
+    document.getElementById('scroll-log-btn').addEventListener('click', scrollToBottom);
 })();
 </script>
 {% endblock %}
diff --git a/modules/web_viewer/templates/mesh.html b/modules/web_viewer/templates/mesh.html
index 10432b6..7fcdf21 100644
--- a/modules/web_viewer/templates/mesh.html
+++ b/modules/web_viewer/templates/mesh.html
@@ -173,10 +173,10 @@
     </div>
     <div class="ms-auto d-flex align-items-center flex-wrap gap-2">
         <div class="btn-group mesh-view-switch" role="group" aria-label="View">
-            <button type="button" class="btn btn-sm active" id="btn-view-map" onclick="switchView('map')" title="Map view">
+            <button type="button" class="btn btn-sm active" id="btn-view-map" title="Map view">
                 <i class="fas fa-map"></i><span class="mesh-btn-text"> Map</span>
             </button>
-            <button type="button" class="btn btn-sm" id="btn-view-graph" onclick="switchView('graph')" title="Graph view">
+            <button type="button" class="btn btn-sm" id="btn-view-graph" title="Graph view">
                 <i class="fas fa-project-diagram"></i><span class="mesh-btn-text"> Graph</span>
             </button>
         </div>
@@ -184,19 +184,19 @@
             <button class="btn btn-sm" type="button" data-bs-toggle="collapse" data-bs-target="#filterPanel" title="Filters">
                 <i class="fas fa-filter"></i>
             </button>
-            <button class="btn btn-sm" type="button" id="btn-heat" onclick="toggleHeatMode()" title="Hot connections: color edges by traffic (viridis)">
+            <button class="btn btn-sm" type="button" id="btn-heat" title="Hot connections: color edges by traffic (viridis)">
                 <i class="fas fa-fire"></i>
             </button>
-            <button class="btn btn-sm" type="button" id="btn-mesh-theme" onclick="toggleMeshTheme()" title="Toggle map dark mode (independent of site theme)">
+            <button class="btn btn-sm" type="button" id="btn-mesh-theme" title="Toggle map dark mode (independent of site theme)">
                 <i class="fas fa-moon" id="mesh-theme-icon"></i>
             </button>
-            <button class="btn btn-sm" type="button" onclick="refreshData()" title="Refresh data">
+            <button class="btn btn-sm" type="button" id="btn-mesh-refresh" title="Refresh data">
                 <i class="fas fa-sync-alt"></i>
             </button>
-            <button class="btn btn-sm" type="button" onclick="exportView()" title="Export JSON">
+            <button class="btn btn-sm" type="button" id="btn-mesh-export" title="Export JSON">
                 <i class="fas fa-download"></i>
             </button>
-            <button class="btn btn-sm" type="button" id="btn-fullscreen" onclick="toggleFullscreen()" title="Fullscreen">
+            <button class="btn btn-sm" type="button" id="btn-fullscreen" title="Fullscreen">
                 <i class="fas fa-expand"></i>
             </button>
         </div>
@@ -214,12 +214,12 @@
                 <div class="row">
                     <div class="col-md-2">
                         <label for="filter-min-obs" class="form-label">Min Observations</label>
-                        <input type="range" class="form-range" id="filter-min-obs" min="0" max="100" value="0" oninput="onMinObsInput();">
+                        <input type="range" class="form-range" id="filter-min-obs" min="0" max="100" value="0">
                         <small id="label-min-obs" class="text-muted">1</small>
                     </div>
                     <div class="col-md-2">
                         <label for="filter-edge-days" class="form-label">Edge Timeframe</label>
-                        <select class="form-select" id="filter-edge-days" onchange="applyFilters(); saveFilters();">
+                        <select class="form-select" id="filter-edge-days">
                             <option value="">All Time</option>
                             <option value="1">Last 24 Hours</option>
                             <option value="2">Last 48 Hours</option>
@@ -231,7 +231,7 @@
                     </div>
                     <div class="col-md-2">
                         <label for="filter-node-days" class="form-label">Node Timeframe</label>
-                        <select class="form-select" id="filter-node-days" onchange="applyFilters(); saveFilters();">
+                        <select class="form-select" id="filter-node-days">
                             <option value="">All Time</option>
                             <option value="1">Last 24 Hours</option>
                             <option value="2">Last 48 Hours</option>
@@ -243,7 +243,7 @@
                     </div>
                     <div class="col-md-2">
                         <label for="filter-evidence" class="form-label">Evidence</label>
-                        <select class="form-select" id="filter-evidence" onchange="onEvidenceChange();" title="Multi-byte only: build the graph solely from unique multi-byte path observations, ignoring ambiguous single-byte evidence">
+                        <select class="form-select" id="filter-evidence" title="Multi-byte only: build the graph solely from unique multi-byte path observations, ignoring ambiguous single-byte evidence">
                             <option value="all">All Evidence</option>
                             <option value="multibyte" selected>Multi-byte Only</option>
                         </select>
@@ -252,14 +252,14 @@
                         <label for="filter-starred" class="form-label">&nbsp;</label>
                         <div class="d-flex align-items-center" style="min-height: 38px;">
                             <div class="form-check mb-0">
-                                <input type="checkbox" class="form-check-input" id="filter-starred" onchange="applyFilters(); saveFilters();">
+                                <input type="checkbox" class="form-check-input" id="filter-starred">
                                 <label class="form-check-label" for="filter-starred">Show Only Starred</label>
                             </div>
                         </div>
                     </div>
                     <div class="col-md-2">
                         <label for="filter-search" class="form-label">Search Node</label>
-                        <input type="text" class="form-control" id="filter-search" placeholder="Name, prefix, or path..." oninput="handleSearchInput();">
+                        <input type="text" class="form-control" id="filter-search" placeholder="Name, prefix, or path...">
                     </div>
                 </div>
             </div>
@@ -619,7 +619,7 @@
 <!-- vis-network JS -->
 <script src="https://unpkg.com/vis-network@9.1.9/standalone/umd/vis-network.min.js"></script>
 
-<script>
+<script nonce="{{ g.csp_nonce }}">
     // Global state
     let currentView = 'map';
     let map = null;
@@ -1376,6 +1376,23 @@
     
     // Initialize on page load
     document.addEventListener('DOMContentLoaded', async function() {
+        document.getElementById('btn-view-map').addEventListener('click', () => switchView('map'));
+        document.getElementById('btn-view-graph').addEventListener('click', () => switchView('graph'));
+        document.getElementById('btn-heat').addEventListener('click', toggleHeatMode);
+        document.getElementById('btn-mesh-theme').addEventListener('click', toggleMeshTheme);
+        document.getElementById('btn-mesh-refresh').addEventListener('click', refreshData);
+        document.getElementById('btn-mesh-export').addEventListener('click', exportView);
+        document.getElementById('btn-fullscreen').addEventListener('click', toggleFullscreen);
+        document.getElementById('filter-min-obs').addEventListener('input', onMinObsInput);
+        ['filter-edge-days', 'filter-node-days', 'filter-starred'].forEach(id => {
+            document.getElementById(id).addEventListener('change', () => {
+                applyFilters();
+                saveFilters();
+            });
+        });
+        document.getElementById('filter-evidence').addEventListener('change', onEvidenceChange);
+        document.getElementById('filter-search').addEventListener('input', handleSearchInput);
+
         // Initialize modal instances once
         const nodeModalElement = document.getElementById('nodeDetailsModal');
         if (nodeModalElement) {
@@ -3061,18 +3078,28 @@
         const outgoing = connections.filter(e => prefixesCompatible(e.from_prefix, node.prefix)).length;
         
         document.getElementById('nodeDetailsTitle').textContent = node.name;
-        document.getElementById('nodeDetailsBody').innerHTML = `
-            <table class="table">
-                <tr><th>Prefix</th><td>${escapeHtml(node.prefix)}</td></tr>
-                <tr><th>Public Key</th><td><code>${formatPublicKey(node.public_key)}</code></td></tr>
-                <tr><th>Role</th><td>${escapeHtml(node.role)}</td></tr>
-                <tr><th>Location</th><td>${node.latitude.toFixed(6)}, ${node.longitude.toFixed(6)}</td></tr>
-                <tr><th>Starred</th><td>${node.is_starred ? '<i class="fas fa-star text-warning"></i> Yes' : 'No'}</td></tr>
-                <tr><th>Last Heard</th><td>${node.last_heard || 'Never'}</td></tr>
-                <tr><th>Last Advert</th><td>${node.last_advert_timestamp || 'Never'}</td></tr>
-                <tr><th>Connections</th><td>${connections.length} total (${incoming} incoming, ${outgoing} outgoing)</td></tr>
-            </table>
-        `;
+        const table = document.createElement('table');
+        table.className = 'table';
+        const addRow = (label, value, code = false) => {
+            const row = document.createElement('tr');
+            const heading = document.createElement('th');
+            heading.textContent = label;
+            const cell = document.createElement('td');
+            const valueElement = document.createElement(code ? 'code' : 'span');
+            valueElement.textContent = String(value ?? '');
+            cell.appendChild(valueElement);
+            row.append(heading, cell);
+            table.appendChild(row);
+        };
+        addRow('Prefix', node.prefix);
+        addRow('Public Key', formatPublicKeyText(node.public_key), true);
+        addRow('Role', node.role);
+        addRow('Location', `${Number(node.latitude).toFixed(6)}, ${Number(node.longitude).toFixed(6)}`);
+        addRow('Starred', node.is_starred ? 'Yes' : 'No');
+        addRow('Last Heard', node.last_heard || 'Never');
+        addRow('Last Advert', node.last_advert_timestamp || 'Never');
+        addRow('Connections', `${connections.length} total (${incoming} incoming, ${outgoing} outgoing)`);
+        document.getElementById('nodeDetailsBody').replaceChildren(table);
         
         // Reuse modal instance or create new one
         if (!nodeModal) {
@@ -3093,13 +3120,17 @@
     }
     
     function formatPublicKey(publicKey) {
+        return escapeHtml(formatPublicKeyText(publicKey));
+    }
+
+    function formatPublicKeyText(publicKey) {
         if (!publicKey || publicKey.length < 32) {
-            return escapeHtml(publicKey || '');
+            return String(publicKey || '');
         }
         // First 8 bytes = 16 hex characters, last 8 bytes = 16 hex characters
         const first8Bytes = publicKey.substring(0, 16);
         const last8Bytes = publicKey.substring(publicKey.length - 16);
-        return escapeHtml(`${first8Bytes}...${last8Bytes}`);
+        return `${first8Bytes}...${last8Bytes}`;
     }
     
     function refreshData() {
@@ -3151,7 +3182,7 @@
             const exitBtn = document.createElement('button');
             exitBtn.className = 'fullscreen-exit-btn';
             exitBtn.innerHTML = '<i class="fas fa-times"></i> Exit Fullscreen';
-            exitBtn.onclick = toggleFullscreen;
+            exitBtn.addEventListener('click', toggleFullscreen);
             mapContainer.appendChild(exitBtn);
 
             setTimeout(() => { if (map) map.invalidateSize(); }, 100);
diff --git a/modules/web_viewer/templates/multibyte_rollout.html b/modules/web_viewer/templates/multibyte_rollout.html
index 661c023..ba854fc 100644
--- a/modules/web_viewer/templates/multibyte_rollout.html
+++ b/modules/web_viewer/templates/multibyte_rollout.html
@@ -228,7 +228,7 @@
     </div><!-- /main-content -->
 </div><!-- /container-fluid -->
 
-<script>
+<script nonce="{{ g.csp_nonce }}">
 (function () {
     'use strict';
 
@@ -248,14 +248,14 @@
     };
 
     const STATUS_BADGE = {
-        multibyte_direct:  '<span class="badge" style="background:#198754;">Multibyte (Advert)</span>',
-        multibyte_relayed: '<span class="badge" style="background:#0dcaf0;color:#000;">Multibyte (Relay)</span>',
-        single_byte:       '<span class="badge" style="background:#ffc107;color:#000;">No MB</span>',
-        unknown:           '<span class="badge bg-secondary">Unknown</span>',
+        multibyte_direct:  { text: 'Multibyte (Advert)', classes: 'bg-success' },
+        multibyte_relayed: { text: 'Multibyte (Relay)', classes: 'bg-info text-dark' },
+        single_byte:       { text: 'No MB', classes: 'bg-warning text-dark' },
+        unknown:           { text: 'Unknown', classes: 'bg-secondary' },
     };
 
     const NODE_TYPE_LABELS = {
-        all:        { total: 'Total Relay Nodes',  sub: 'Repeaters &amp; Room Servers' },
+        all:        { total: 'Total Relay Nodes',  sub: 'Repeaters & Room Servers' },
         repeater:   { total: 'Total Repeaters',    sub: 'Repeater role only' },
         roomserver: { total: 'Total Room Servers', sub: 'Room Server role only' },
     };
@@ -292,12 +292,24 @@
         } catch { return String(ts); }
     }
 
-    function bphLabel(v) {
-        if (v === null || v === undefined) return '<span class="text-muted small">—</span>';
-        if (v === 1) return '<span class="text-warning small">1-byte</span>';
-        if (v === 2) return '<span class="text-success small">2-byte</span>';
-        if (v === 3) return '<span class="text-success small">3-byte</span>';
-        return esc(String(v));
+    function bphText(v) {
+        if (v === null || v === undefined) return '—';
+        if (v >= 1 && v <= 3) return `${v}-byte`;
+        return String(v);
+    }
+
+    function makeCell(value, classes = '') {
+        const cell = document.createElement('td');
+        cell.className = classes;
+        cell.textContent = String(value ?? '');
+        return cell;
+    }
+
+    function makeBadge(value, classes) {
+        const badge = document.createElement('span');
+        badge.className = `badge ${classes}`;
+        badge.textContent = String(value ?? '');
+        return badge;
     }
 
     function isDark() {
@@ -497,46 +509,50 @@
         document.getElementById('priority-count').textContent = list.length;
 
         if (list.length === 0) {
-            tbody.innerHTML = '';
+            tbody.replaceChildren();
             empty.style.display = 'block';
             return;
         }
         empty.style.display = 'none';
 
-        tbody.innerHTML = list.map((r, i) => {
+        tbody.replaceChildren();
+        list.forEach((r, i) => {
             const peers = r.prefix_peers || [];
-            let relayCell;
+            const row = document.createElement('tr');
+            row.append(
+                makeCell(i + 1, 'text-muted'),
+                makeCell(r.name, 'fw-semibold'),
+            );
+            const roleCell = document.createElement('td');
+            roleCell.appendChild(makeBadge(r.role, 'bg-secondary'));
+            row.appendChild(roleCell);
+            const relayCell = makeCell((r.relay_score || 0).toLocaleString(), 'text-end');
             if (peers.length > 0) {
                 const mbPeers  = peers.filter(p => p.status === 'multibyte_direct' || p.status === 'multibyte_relayed');
                 const sbPeers  = peers.filter(p => p.status === 'single_byte');
                 const parts = [];
-                if (mbPeers.length)  parts.push('Confirmed multibyte: ' + mbPeers.map(p => esc(p.name)).join(', '));
-                if (sbPeers.length)  parts.push('Also unconfirmed: '    + sbPeers.map(p => esc(p.name)).join(', '));
+                if (mbPeers.length)  parts.push('Confirmed multibyte: ' + mbPeers.map(p => String(p.name ?? '')).join(', '));
+                if (sbPeers.length)  parts.push('Also unconfirmed: '    + sbPeers.map(p => String(p.name ?? '')).join(', '));
                 const tipText = 'Shared 1-byte prefix — score may overlap with: ' + parts.join(' · ');
-                const iconColor = mbPeers.length ? '#0dcaf0' : '#adb5bd';
-                relayCell = `${(r.relay_score || 0).toLocaleString()} <span
-                       style="cursor:default; color:${iconColor};"
-                       data-bs-toggle="tooltip"
-                       data-bs-placement="top"
-                       title="${tipText}"
-                   >ⓘ</span>`;
-            } else {
-                relayCell = (r.relay_score || 0).toLocaleString();
+                const info = document.createElement('span');
+                info.className = mbPeers.length ? 'text-info' : 'text-secondary';
+                info.style.cursor = 'default';
+                info.dataset.bsToggle = 'tooltip';
+                info.dataset.bsPlacement = 'top';
+                info.title = tipText;
+                info.textContent = ' ⓘ';
+                relayCell.appendChild(info);
             }
-
-            return `
-            <tr>
-                <td class="text-muted">${i + 1}</td>
-                <td class="fw-semibold">${esc(r.name)}</td>
-                <td><span class="badge bg-secondary">${esc(r.role)}</span></td>
-                <td class="text-end">${relayCell}</td>
-                <td class="text-end">${(r.unique_sources || 0).toLocaleString()}</td>
-                <td class="text-end">${(r.unique_dests || 0).toLocaleString()}</td>
-                <td class="text-end">${(r.legacy_degree || 0).toLocaleString()}</td>
-                <td>${fmtDate(r.last_seen)}</td>
-                <td>${r.location ? esc(r.location) : '<span class="text-muted">—</span>'}</td>
-            </tr>`;
-        }).join('');
+            row.append(
+                relayCell,
+                makeCell((r.unique_sources || 0).toLocaleString(), 'text-end'),
+                makeCell((r.unique_dests || 0).toLocaleString(), 'text-end'),
+                makeCell((r.legacy_degree || 0).toLocaleString(), 'text-end'),
+                makeCell(fmtDate(r.last_seen)),
+                makeCell(r.location || '—', r.location ? '' : 'text-muted'),
+            );
+            tbody.appendChild(row);
+        });
 
         /* activate Bootstrap tooltips on new elements */
         tbody.querySelectorAll('[data-bs-toggle="tooltip"]').forEach(el => {
@@ -580,7 +596,7 @@
         const count = document.getElementById('all-count');
 
         if (rows.length === 0) {
-            tbody.innerHTML = '';
+            tbody.replaceChildren();
             empty.style.display = 'block';
             count.textContent = '';
             return;
@@ -588,17 +604,25 @@
         empty.style.display = 'none';
         count.textContent = `Showing ${rows.length.toLocaleString()} of ${allRepeaters.length.toLocaleString()} relay nodes`;
 
-        tbody.innerHTML = rows.map(r => `
-            <tr>
-                <td>${esc(r.name)}</td>
-                <td><span class="badge bg-secondary">${esc(r.role)}</span></td>
-                <td>${STATUS_BADGE[r.status] || ''}</td>
-                <td>${bphLabel(r.out_bytes_per_hop)}</td>
-                <td>${(r.advert_count || 0).toLocaleString()}</td>
-                <td>${fmtDate(r.last_seen)}</td>
-                <td>${r.location ? esc(r.location) : '<span class="text-muted">—</span>'}</td>
-            </tr>
-        `).join('');
+        tbody.replaceChildren();
+        rows.forEach(r => {
+            const row = document.createElement('tr');
+            row.appendChild(makeCell(r.name));
+            const role = document.createElement('td');
+            role.appendChild(makeBadge(r.role, 'bg-secondary'));
+            row.appendChild(role);
+            const statusCell = document.createElement('td');
+            const status = STATUS_BADGE[r.status] || STATUS_BADGE.unknown;
+            statusCell.appendChild(makeBadge(status.text, status.classes));
+            row.append(
+                statusCell,
+                makeCell(bphText(r.out_bytes_per_hop)),
+                makeCell((r.advert_count || 0).toLocaleString()),
+                makeCell(fmtDate(r.last_seen)),
+                makeCell(r.location || '—', r.location ? '' : 'text-muted'),
+            );
+            tbody.appendChild(row);
+        });
     }
 
     /* ── main render ─────────────────────────────────────────────────── */
@@ -610,7 +634,7 @@
         /* KPI labels for node_type */
         const lbl = NODE_TYPE_LABELS[data.node_type] || NODE_TYPE_LABELS.all;
         document.getElementById('kpi-total-label').textContent = lbl.total;
-        document.getElementById('kpi-total-sub').innerHTML    = lbl.sub;
+        document.getElementById('kpi-total-sub').textContent = lbl.sub;
 
         /* KPI values */
         const mbTotal   = s.multibyte_direct + s.multibyte_relayed;
diff --git a/modules/web_viewer/templates/plugins.html b/modules/web_viewer/templates/plugins.html
index 2d0d61d..559d7de 100644
--- a/modules/web_viewer/templates/plugins.html
+++ b/modules/web_viewer/templates/plugins.html
@@ -152,7 +152,7 @@
 {% endblock %}
 
 {% block extra_js %}
-<script>
+<script nonce="{{ g.csp_nonce }}">
 class PluginsManager {
     constructor() {
         this.loadingEl = document.getElementById('plugins-loading');
@@ -181,8 +181,8 @@ class PluginsManager {
     async load() {
         this.loadingEl.classList.remove('d-none');
         this.errorEl.classList.add('d-none');
-        this.commandsList.innerHTML = '';
-        this.servicesList.innerHTML = '';
+        this.commandsList.replaceChildren();
+        this.servicesList.replaceChildren();
         this.cards = [];
         try {
             const resp = await fetch('/api/plugins');
@@ -246,17 +246,30 @@ class PluginsManager {
 
         const header = document.createElement('div');
         header.className = 'plugin-header';
-        header.innerHTML = `
-            <div class="form-check form-switch mb-0">
-                <input class="form-check-input" type="checkbox" role="switch" id="${toggleId}" ${plugin.enabled ? 'checked' : ''}>
-            </div>
-            <div class="flex-grow-1 plugin-headtext">
-                <span class="plugin-title">${escapeHtml(plugin.label)}</span>
-                <span class="plugin-section-label">[${escapeHtml(plugin.section)}]</span>
-                <div class="plugin-desc">${escapeHtml(plugin.description || '')}</div>
-            </div>
-            <i class="fas fa-chevron-down plugin-chevron"></i>
-        `;
+        const switchWrapper = document.createElement('div');
+        switchWrapper.className = 'form-check form-switch mb-0';
+        const toggle = document.createElement('input');
+        toggle.className = 'form-check-input';
+        toggle.type = 'checkbox';
+        toggle.role = 'switch';
+        toggle.id = toggleId;
+        toggle.checked = Boolean(plugin.enabled);
+        switchWrapper.appendChild(toggle);
+        const headText = document.createElement('div');
+        headText.className = 'flex-grow-1 plugin-headtext';
+        const title = document.createElement('span');
+        title.className = 'plugin-title';
+        title.textContent = String(plugin.label ?? '');
+        const section = document.createElement('span');
+        section.className = 'plugin-section-label';
+        section.textContent = `[${String(plugin.section ?? '')}]`;
+        const description = document.createElement('div');
+        description.className = 'plugin-desc';
+        description.textContent = String(plugin.description ?? '');
+        headText.append(title, section, description);
+        const chevron = document.createElement('i');
+        chevron.className = 'fas fa-chevron-down plugin-chevron';
+        header.append(switchWrapper, headText, chevron);
         card.appendChild(header);
 
         const body = document.createElement('div');
@@ -388,7 +401,6 @@ class PluginsManager {
         body.appendChild(inner);
         card.appendChild(body);
 
-        const toggle = header.querySelector('#' + CSS.escape(toggleId));
         const collapse = new bootstrap.Collapse(body, { toggle: false });
 
         // Header click expands/collapses; clicking the enable switch must not.
@@ -645,16 +657,23 @@ function buildDynamicEditor(ds) {
     el.className = 'dynamic-section mt-3';
 
     const head = document.createElement('div');
-    head.innerHTML = `<div class="fw-semibold small mb-1">${escapeHtml(ds.label)}</div>`;
+    const heading = document.createElement('div');
+    heading.className = 'fw-semibold small mb-1';
+    heading.textContent = String(ds.label ?? '');
+    head.appendChild(heading);
     if (ds.help) head.appendChild(helpText(ds.help));
     el.appendChild(head);
 
     // Column headers
     const colhead = document.createElement('div');
     colhead.className = 'row g-2 text-muted small mt-1 d-none d-md-flex';
-    colhead.innerHTML =
-        `<div class="col-md-5">${escapeHtml(ds.key_label)}</div>` +
-        `<div class="col-md-6">${escapeHtml(ds.value_label)}</div>`;
+    const keyHeading = document.createElement('div');
+    keyHeading.className = 'col-md-5';
+    keyHeading.textContent = String(ds.key_label ?? '');
+    const valueHeading = document.createElement('div');
+    valueHeading.className = 'col-md-6';
+    valueHeading.textContent = String(ds.value_label ?? '');
+    colhead.append(keyHeading, valueHeading);
     el.appendChild(colhead);
 
     const rowsContainer = document.createElement('div');
@@ -730,7 +749,10 @@ function buildRepeatingBlockEditor(rb) {
     const el = document.createElement('div');
     el.className = 'repeating-section mt-3';
     const head = document.createElement('div');
-    head.innerHTML = `<div class="fw-semibold small mb-1">${escapeHtml(rb.label)}</div>`;
+    const heading = document.createElement('div');
+    heading.className = 'fw-semibold small mb-1';
+    heading.textContent = String(rb.label ?? '');
+    head.appendChild(heading);
     if (rb.help) head.appendChild(helpText(rb.help));
     el.appendChild(head);
 
@@ -801,7 +823,9 @@ function buildRepeatingBlockEditor(rb) {
     const addBtn = document.createElement('button');
     addBtn.type = 'button';
     addBtn.className = 'btn btn-outline-secondary btn-sm mt-1';
-    addBtn.innerHTML = `<i class="fas fa-plus me-1"></i>Add ${escapeHtml(rb.item_label)}`;
+    const addIcon = document.createElement('i');
+    addIcon.className = 'fas fa-plus me-1';
+    addBtn.append(addIcon, document.createTextNode(`Add ${String(rb.item_label ?? '')}`));
     addBtn.addEventListener('click', () => addBlock({ enabled: true, values: {} }));
     el.appendChild(addBtn);
 
diff --git a/modules/web_viewer/templates/radio.html b/modules/web_viewer/templates/radio.html
index 6e10120..b3ebb85 100644
--- a/modules/web_viewer/templates/radio.html
+++ b/modules/web_viewer/templates/radio.html
@@ -410,7 +410,7 @@
 {% endblock %}
 
 {% block extra_js %}
-<script>
+<script nonce="{{ g.csp_nonce }}">
 class RadioManager {
     constructor() {
         this.channels = [];
@@ -466,7 +466,7 @@ class RadioManager {
             const feedCounts = data.channel_feed_counts || {};
             let emptyChannels = 0;
             for (const channel of this.channels) {
-                const channelName = channel.name || channel.channel_name || `Channel ${channel.channel_idx || channel.index}`;
+                const channelName = channel.name || channel.channel_name || `Channel ${channel.channel_idx ?? channel.index}`;
                 const feedCount = feedCounts[channelName] || 0;
                 if (feedCount === 0) {
                     emptyChannels++;
@@ -542,9 +542,16 @@ class RadioManager {
     
     renderChannels() {
         const tbody = document.getElementById('channelsTableBody');
+        tbody.replaceChildren();
         
         if (this.channels.length === 0) {
-            tbody.innerHTML = '<tr><td colspan="6" class="text-center">No channels configured</td></tr>';
+            const row = document.createElement('tr');
+            const cell = document.createElement('td');
+            cell.colSpan = 6;
+            cell.className = 'text-center';
+            cell.textContent = 'No channels configured';
+            row.appendChild(cell);
+            tbody.appendChild(row);
             return;
         }
         
@@ -552,33 +559,86 @@ class RadioManager {
         fetch('/api/channels/stats').then(r => r.json()).then(stats => {
             const feedCounts = stats.channel_feed_counts || {};
             
-            tbody.innerHTML = this.channels.map(channel => {
-                const channelName = channel.name || channel.channel_name || `Channel ${channel.channel_idx || channel.index}`;
+            tbody.replaceChildren();
+            this.channels.forEach(channel => {
+                const channelIdx = channel.channel_idx ?? channel.index;
+                const channelName = channel.name || channel.channel_name || `Channel ${channelIdx}`;
                 const feedCount = feedCounts[channelName] || 0;
-                const typeBadge = channel.type === 'hashtag' 
-                    ? '<span class="badge bg-primary">Hashtag</span>'
-                    : '<span class="badge bg-secondary">Custom</span>';
-                
-                return `
-                    <tr>
-                        <td>${channel.channel_idx || channel.index}</td>
-                        <td>${channelName}</td>
-                        <td>${typeBadge}</td>
-                        <td>${feedCount > 0 ? `<a href="/feeds?channel=${encodeURIComponent(channelName)}">${feedCount}</a>` : '0'}</td>
-                        <td><span class="badge bg-success">Active</span></td>
-                        <td>
-                            <button class="btn btn-sm btn-info" onclick="radioManager.viewChannel(${channel.channel_idx || channel.index})" title="View Details">
-                                <i class="fas fa-eye"></i>
-                            </button>
-                            <button class="btn btn-sm btn-danger" onclick="radioManager.deleteChannel(${channel.channel_idx || channel.index})" title="Delete" ${feedCount > 0 ? 'disabled' : ''}>
-                                <i class="fas fa-trash"></i>
-                            </button>
-                        </td>
-                    </tr>
-                `;
-            }).join('');
+
+                const row = document.createElement('tr');
+                row.appendChild(this.makeTextCell(channelIdx));
+                row.appendChild(this.makeTextCell(channelName));
+
+                const typeCell = document.createElement('td');
+                typeCell.appendChild(this.makeBadge(
+                    channel.type === 'hashtag' ? 'Hashtag' : 'Custom',
+                    channel.type === 'hashtag' ? 'bg-primary' : 'bg-secondary'
+                ));
+                row.appendChild(typeCell);
+
+                const feedCell = document.createElement('td');
+                if (feedCount > 0) {
+                    const link = document.createElement('a');
+                    link.href = `/feeds?channel=${encodeURIComponent(String(channelName))}`;
+                    link.textContent = String(feedCount);
+                    feedCell.appendChild(link);
+                } else {
+                    feedCell.textContent = '0';
+                }
+                row.appendChild(feedCell);
+
+                const statusCell = document.createElement('td');
+                statusCell.appendChild(this.makeBadge('Active', 'bg-success'));
+                row.appendChild(statusCell);
+
+                const actionCell = document.createElement('td');
+                const viewButton = this.makeIconButton('btn-info', 'fa-eye', 'View Details');
+                viewButton.addEventListener('click', () => this.viewChannel(channelIdx));
+                actionCell.appendChild(viewButton);
+
+                const deleteButton = this.makeIconButton('btn-danger', 'fa-trash', 'Delete');
+                deleteButton.dataset.channelIndex = String(channelIdx);
+                deleteButton.disabled = feedCount > 0;
+                deleteButton.addEventListener('click', () => this.deleteChannel(channelIdx));
+                actionCell.appendChild(deleteButton);
+                row.appendChild(actionCell);
+                tbody.appendChild(row);
+            });
         });
     }
+
+    makeTextCell(value) {
+        const cell = document.createElement('td');
+        cell.textContent = String(value ?? '');
+        return cell;
+    }
+
+    makeBadge(text, colorClass) {
+        const badge = document.createElement('span');
+        badge.className = `badge ${colorClass}`;
+        badge.textContent = String(text ?? '');
+        return badge;
+    }
+
+    makeIconButton(colorClass, iconClass, title) {
+        const button = document.createElement('button');
+        button.type = 'button';
+        button.className = `btn btn-sm ${colorClass}`;
+        button.title = title;
+        const icon = document.createElement('i');
+        icon.className = `fas ${iconClass}`;
+        button.appendChild(icon);
+        return button;
+    }
+
+    setLoadingButton(button, label = '') {
+        const spinner = document.createElement('span');
+        spinner.className = 'spinner-border spinner-border-sm';
+        spinner.setAttribute('role', 'status');
+        if (label) spinner.classList.add('me-2');
+        button.replaceChildren(spinner);
+        if (label) button.appendChild(document.createTextNode(label));
+    }
     
     setupEventHandlers() {
         // Channel name input - update key preview and toggle key input
@@ -690,7 +750,7 @@ class RadioManager {
                     await this.loadRadioStatus();
                     this.showSuccess(`Radio ${action}ed successfully`);
                     return;
-                } else if (result.status === 'failed') {
+                } else if (result.status === 'failed' || result.status === 'interrupted') {
                     spinner.style.display = 'none';
                     btn.disabled = false;
                     this.updateConnectButton();
@@ -729,7 +789,7 @@ class RadioManager {
         const form = document.getElementById('createChannelForm');
         const formData = new FormData(form);
         const saveBtn = document.getElementById('saveChannelBtn');
-        const originalBtnText = saveBtn.innerHTML;
+        const originalBtnText = saveBtn.textContent;
         
         const channelName = formData.get('channel_name')?.trim();
         const channelKey = formData.get('channel_key')?.trim();
@@ -781,7 +841,7 @@ class RadioManager {
         
         // Disable button and show loading state
         saveBtn.disabled = true;
-        saveBtn.innerHTML = '<span class="spinner-border spinner-border-sm me-2" role="status"></span>Creating...';
+        this.setLoadingButton(saveBtn, 'Creating...');
         
         try {
             const pr = await MeshCoreChannelOps.postChannel(data);
@@ -789,7 +849,7 @@ class RadioManager {
             
             if (pr.ok) {
                 if (result.pending && result.operation_id) {
-                    saveBtn.innerHTML = '<span class="spinner-border spinner-border-sm me-2" role="status"></span>Processing...';
+                    this.setLoadingButton(saveBtn, 'Processing...');
                     const pollStatus = await MeshCoreChannelOps.pollChannelOperation(result.operation_id, {
                         button: saveBtn,
                         originalButtonText: originalBtnText,
@@ -812,7 +872,7 @@ class RadioManager {
                         await this.loadStatistics();
                     }
                     saveBtn.disabled = false;
-                    saveBtn.innerHTML = originalBtnText;
+                    saveBtn.textContent = originalBtnText;
                 } else {
                     this.showSuccess('Channel created successfully');
                     bootstrap.Modal.getInstance(document.getElementById('createChannelModal')).hide();
@@ -821,17 +881,17 @@ class RadioManager {
                     await this.loadChannels();
                     await this.loadStatistics();
                     saveBtn.disabled = false;
-                    saveBtn.innerHTML = originalBtnText;
+                    saveBtn.textContent = originalBtnText;
                 }
             } else {
                 this.showError(result.error || 'Failed to create channel');
                 saveBtn.disabled = false;
-                saveBtn.innerHTML = originalBtnText;
+                saveBtn.textContent = originalBtnText;
             }
         } catch (error) {
             this.showError('Error creating channel: ' + error.message);
             saveBtn.disabled = false;
-            saveBtn.innerHTML = originalBtnText;
+            saveBtn.textContent = originalBtnText;
         }
     }
     
@@ -841,45 +901,86 @@ class RadioManager {
             const feedsResponse = await fetch(`/api/channels/${channelIdx}/feeds`);
             const feedsData = await feedsResponse.json();
             
-            const channel = this.channels.find(c => (c.channel_idx || c.index) === channelIdx);
+            const channel = this.channels.find(c => (c.channel_idx ?? c.index) === channelIdx);
             if (!channel) {
                 this.showError('Channel not found');
                 return;
             }
             
             const channelKey = channel.key_hex || '';
-            const keyDisplay = channelKey 
-                ? `<code style="font-size: 0.9em; word-break: break-all;">${channelKey}</code> <button class="btn btn-sm btn-outline-secondary ms-2" onclick="navigator.clipboard.writeText('${channelKey}'); radioManager.showSuccess('Key copied to clipboard');"><i class="fas fa-copy"></i> Copy</button>`
-                : '<em>No key available</em>';
-            
-            const content = `
-                <div class="row">
-                    <div class="col-md-6">
-                        <h6>Channel Information</h6>
-                        <p><strong>Name:</strong> ${channel.name || channel.channel_name}</p>
-                        <p><strong>Index:</strong> ${channel.channel_idx || channel.index}</p>
-                        <p><strong>Type:</strong> ${channel.type || 'Unknown'}</p>
-                        <p><strong>Key:</strong> ${keyDisplay}</p>
-                    </div>
-                    <div class="col-md-6">
-                        <h6>Feed Subscriptions</h6>
-                        ${feedsData.feeds && feedsData.feeds.length > 0
-                            ? `<ul>${feedsData.feeds.map(f => `<li><a href="/feeds?id=${f.id}">${f.feed_name || f.feed_url}</a></li>`).join('')}</ul>`
-                            : '<p>No feed subscriptions</p>'}
-                    </div>
-                </div>
-            `;
-            
-            document.getElementById('channelDetailsContent').innerHTML = content;
+            const content = document.getElementById('channelDetailsContent');
+            const row = document.createElement('div');
+            row.className = 'row';
+            const infoColumn = document.createElement('div');
+            infoColumn.className = 'col-md-6';
+            const infoHeading = document.createElement('h6');
+            infoHeading.textContent = 'Channel Information';
+            infoColumn.appendChild(infoHeading);
+            infoColumn.appendChild(this.makeDetailLine('Name:', channel.name || channel.channel_name || ''));
+            infoColumn.appendChild(this.makeDetailLine('Index:', channel.channel_idx ?? channel.index));
+            infoColumn.appendChild(this.makeDetailLine('Type:', channel.type || 'Unknown'));
+
+            const keyLine = this.makeDetailLine('Key:', '');
+            if (channelKey) {
+                const code = document.createElement('code');
+                code.style.fontSize = '0.9em';
+                code.style.wordBreak = 'break-all';
+                code.textContent = String(channelKey);
+                keyLine.appendChild(code);
+                const copyButton = this.makeIconButton('btn-outline-secondary ms-2', 'fa-copy', 'Copy key');
+                copyButton.appendChild(document.createTextNode(' Copy'));
+                copyButton.addEventListener('click', () => {
+                    navigator.clipboard.writeText(String(channelKey));
+                    this.showSuccess('Key copied to clipboard');
+                });
+                keyLine.appendChild(copyButton);
+            } else {
+                const emptyKey = document.createElement('em');
+                emptyKey.textContent = 'No key available';
+                keyLine.appendChild(emptyKey);
+            }
+            infoColumn.appendChild(keyLine);
+
+            const feedsColumn = document.createElement('div');
+            feedsColumn.className = 'col-md-6';
+            const feedsHeading = document.createElement('h6');
+            feedsHeading.textContent = 'Feed Subscriptions';
+            feedsColumn.appendChild(feedsHeading);
+            if (Array.isArray(feedsData.feeds) && feedsData.feeds.length > 0) {
+                const list = document.createElement('ul');
+                feedsData.feeds.forEach(feed => {
+                    const item = document.createElement('li');
+                    const link = document.createElement('a');
+                    link.href = `/feeds?id=${encodeURIComponent(String(feed.id ?? ''))}`;
+                    link.textContent = String(feed.feed_name || feed.feed_url || 'Unnamed feed');
+                    item.appendChild(link);
+                    list.appendChild(item);
+                });
+                feedsColumn.appendChild(list);
+            } else {
+                const emptyFeeds = document.createElement('p');
+                emptyFeeds.textContent = 'No feed subscriptions';
+                feedsColumn.appendChild(emptyFeeds);
+            }
+            row.append(infoColumn, feedsColumn);
+            content.replaceChildren(row);
             const modal = new bootstrap.Modal(document.getElementById('channelDetailsModal'));
             modal.show();
         } catch (error) {
             this.showError('Error loading channel details: ' + error.message);
         }
     }
+
+    makeDetailLine(label, value) {
+        const line = document.createElement('p');
+        const strong = document.createElement('strong');
+        strong.textContent = `${label} `;
+        line.append(strong, document.createTextNode(String(value ?? '')));
+        return line;
+    }
     
     async deleteChannel(channelIdx) {
-        const channel = this.channels.find(c => (c.channel_idx || c.index) === channelIdx);
+        const channel = this.channels.find(c => (c.channel_idx ?? c.index) === channelIdx);
         if (!channel) {
             this.showError('Channel not found');
             return;
@@ -904,13 +1005,11 @@ class RadioManager {
         }
         
         // Find the delete button and show loading state
-        const deleteButtons = document.querySelectorAll(`button[onclick*="deleteChannel(${channelIdx})"]`);
-        let deleteBtn = null;
-        if (deleteButtons.length > 0) {
-            deleteBtn = deleteButtons[0];
-            const originalHtml = deleteBtn.innerHTML;
+        const deleteBtn = Array.from(document.querySelectorAll('button[data-channel-index]'))
+            .find(button => button.dataset.channelIndex === String(channelIdx)) || null;
+        if (deleteBtn) {
             deleteBtn.disabled = true;
-            deleteBtn.innerHTML = '<span class="spinner-border spinner-border-sm" role="status"></span>';
+            this.setLoadingButton(deleteBtn);
             
             try {
                 const response = await fetch(`/api/channels/${channelIdx}`, {
@@ -923,25 +1022,25 @@ class RadioManager {
                 if (response.ok) {
                     if (result.pending && result.operation_id) {
                         // Operation is queued, poll for status
-                        await this.pollDeleteOperationStatus(result.operation_id, deleteBtn, originalHtml);
+                        await this.pollDeleteOperationStatus(result.operation_id, deleteBtn);
                     } else {
                         // Immediate success
                         this.showSuccess('Channel deleted successfully');
                         await this.loadChannels();
                         await this.loadStatistics();
                         deleteBtn.disabled = false;
-                        deleteBtn.innerHTML = originalHtml;
+                        this.restoreDeleteButton(deleteBtn);
                     }
                 } else {
                     this.showError(result.error || 'Failed to delete channel');
                     deleteBtn.disabled = false;
-                    deleteBtn.innerHTML = originalHtml;
+                    this.restoreDeleteButton(deleteBtn);
                 }
             } catch (error) {
                 this.showError('Error deleting channel: ' + error.message);
                 if (deleteBtn) {
                     deleteBtn.disabled = false;
-                    deleteBtn.innerHTML = originalHtml;
+                    this.restoreDeleteButton(deleteBtn);
                 }
             }
         } else {
@@ -971,7 +1070,13 @@ class RadioManager {
         }
     }
     
-    async pollDeleteOperationStatus(operationId, button = null, originalButtonHtml = null, maxWait = 60) {
+    restoreDeleteButton(button) {
+        const icon = document.createElement('i');
+        icon.className = 'fas fa-trash';
+        button.replaceChildren(icon);
+    }
+
+    async pollDeleteOperationStatus(operationId, button = null, maxWait = 60) {
         const startTime = Date.now();
         const checkInterval = 1000; // Check every second
         let attempts = 0;
@@ -991,14 +1096,14 @@ class RadioManager {
                     await this.loadStatistics();
                     if (button) {
                         button.disabled = false;
-                        button.innerHTML = originalButtonHtml;
+                        this.restoreDeleteButton(button);
                     }
                     return;
-                } else if (result.status === 'failed') {
+                } else if (result.status === 'failed' || result.status === 'interrupted') {
                     this.showError(result.error_message || 'Channel deletion failed');
                     if (button) {
                         button.disabled = false;
-                        button.innerHTML = originalButtonHtml;
+                        this.restoreDeleteButton(button);
                     }
                     return;
                 }
@@ -1014,7 +1119,7 @@ class RadioManager {
         this.showError('Channel deletion is taking longer than expected. Please check the channel list to see if it was deleted.');
         if (button) {
             button.disabled = false;
-            button.innerHTML = originalButtonHtml;
+            this.restoreDeleteButton(button);
         }
         // Still refresh the channel list in case it was deleted
         await this.loadChannels();
@@ -1126,7 +1231,7 @@ class RadioManager {
             try {
                 const resp = await fetch(`/api/channel-operations/${opId}`);
                 const data = await resp.json();
-                if (data.status === 'completed' || data.status === 'failed') return data;
+                if (data.status === 'completed' || data.status === 'failed' || data.status === 'interrupted') return data;
             } catch (_) {}
         }
         return { status: 'failed', error_message: 'Timed out waiting for device response' };
@@ -1368,7 +1473,13 @@ class RadioManager {
         const alert = document.createElement('div');
         alert.className = 'alert alert-danger alert-dismissible fade show position-fixed';
         alert.style.cssText = 'top: 20px; right: 20px; z-index: 9999; max-width: 300px;';
-        alert.innerHTML = `${message}<button type="button" class="btn-close" data-bs-dismiss="alert"></button>`;
+        const messageNode = document.createElement('span');
+        messageNode.textContent = String(message ?? '');
+        const closeButton = document.createElement('button');
+        closeButton.type = 'button';
+        closeButton.className = 'btn-close';
+        closeButton.dataset.bsDismiss = 'alert';
+        alert.append(messageNode, closeButton);
         document.body.appendChild(alert);
         setTimeout(() => alert.remove(), 5000);
     }
@@ -1377,7 +1488,13 @@ class RadioManager {
         const alert = document.createElement('div');
         alert.className = 'alert alert-success alert-dismissible fade show position-fixed';
         alert.style.cssText = 'top: 20px; right: 20px; z-index: 9999; max-width: 300px;';
-        alert.innerHTML = `${message}<button type="button" class="btn-close" data-bs-dismiss="alert"></button>`;
+        const messageNode = document.createElement('span');
+        messageNode.textContent = String(message ?? '');
+        const closeButton = document.createElement('button');
+        closeButton.type = 'button';
+        closeButton.className = 'btn-close';
+        closeButton.dataset.bsDismiss = 'alert';
+        alert.append(messageNode, closeButton);
         document.body.appendChild(alert);
         setTimeout(() => alert.remove(), 3000);
     }
@@ -1432,4 +1549,3 @@ document.addEventListener('DOMContentLoaded', () => {
 }
 </style>
 {% endblock %}
-
diff --git a/modules/web_viewer/templates/realtime.html b/modules/web_viewer/templates/realtime.html
index e534a44..d173b7d 100644
--- a/modules/web_viewer/templates/realtime.html
+++ b/modules/web_viewer/templates/realtime.html
@@ -545,9 +545,9 @@
                 <h6><i class="fas fa-comments"></i> Command Stream</h6>
                 <div class="d-flex align-items-center gap-1">
                     <span class="badge bg-warning" id="command-status">Connecting…</span>
-                    <button class="btn btn-sm btn-outline-secondary ms-2" id="cmd-scroll-top" onclick="scrollStream('command-stream','top')" title="Scroll to newest"><i class="fas fa-arrow-up"></i></button>
-                    <button class="btn btn-sm btn-outline-secondary" id="cmd-scroll-bottom" onclick="scrollStream('command-stream','bottom')" title="Scroll to oldest"><i class="fas fa-arrow-down"></i></button>
-                    <button class="btn btn-sm btn-outline-secondary ms-1" onclick="clearCommands()">Clear</button>
+                    <button class="btn btn-sm btn-outline-secondary ms-2" id="cmd-scroll-top" title="Scroll to newest"><i class="fas fa-arrow-up"></i></button>
+                    <button class="btn btn-sm btn-outline-secondary" id="cmd-scroll-bottom" title="Scroll to oldest"><i class="fas fa-arrow-down"></i></button>
+                    <button class="btn btn-sm btn-outline-secondary ms-1" id="cmd-clear">Clear</button>
                 </div>
             </div>
             <div class="card-body">
@@ -566,10 +566,10 @@
                 <h6><i class="fas fa-comment-dots"></i> Live Channel Messages</h6>
                 <div class="d-flex align-items-center gap-1">
                     <span class="badge bg-warning" id="message-status">Connecting…</span>
-                    <button class="btn btn-sm btn-outline-secondary ms-2" id="msg-scroll-top" onclick="scrollStream('message-stream','top')" title="Scroll to newest"><i class="fas fa-arrow-up"></i></button>
-                    <button class="btn btn-sm btn-outline-secondary" id="msg-scroll-bottom" onclick="scrollStream('message-stream','bottom')" title="Scroll to oldest"><i class="fas fa-arrow-down"></i></button>
-                    <button class="btn btn-sm btn-outline-secondary ms-1" onclick="clearMessages()">Clear</button>
-                    <button class="btn btn-sm btn-outline-secondary ms-1" id="msg-pause-btn" onclick="toggleMessagePause()">
+                    <button class="btn btn-sm btn-outline-secondary ms-2" id="msg-scroll-top" title="Scroll to newest"><i class="fas fa-arrow-up"></i></button>
+                    <button class="btn btn-sm btn-outline-secondary" id="msg-scroll-bottom" title="Scroll to oldest"><i class="fas fa-arrow-down"></i></button>
+                    <button class="btn btn-sm btn-outline-secondary ms-1" id="msg-clear">Clear</button>
+                    <button class="btn btn-sm btn-outline-secondary ms-1" id="msg-pause-btn">
                         <i class="fas fa-pause" id="msg-pause-icon"></i> Pause
                     </button>
                 </div>
@@ -590,9 +590,9 @@
                 <h6><i class="fas fa-route"></i> Packet Stream</h6>
                 <div class="d-flex align-items-center gap-1">
                     <span class="badge bg-warning" id="packet-status">Connecting…</span>
-                    <button class="btn btn-sm btn-outline-secondary ms-2" id="pkt-scroll-top" onclick="scrollStream('packet-stream','top')" title="Scroll to newest"><i class="fas fa-arrow-up"></i></button>
-                    <button class="btn btn-sm btn-outline-secondary" id="pkt-scroll-bottom" onclick="scrollStream('packet-stream','bottom')" title="Scroll to oldest"><i class="fas fa-arrow-down"></i></button>
-                    <button class="btn btn-sm btn-outline-secondary ms-1" onclick="clearPackets()">Clear</button>
+                    <button class="btn btn-sm btn-outline-secondary ms-2" id="pkt-scroll-top" title="Scroll to newest"><i class="fas fa-arrow-up"></i></button>
+                    <button class="btn btn-sm btn-outline-secondary" id="pkt-scroll-bottom" title="Scroll to oldest"><i class="fas fa-arrow-down"></i></button>
+                    <button class="btn btn-sm btn-outline-secondary ms-1" id="pkt-clear">Clear</button>
                 </div>
             </div>
             <div class="card-body">
@@ -794,7 +794,7 @@
             </div>
             <div class="modal-footer">
                 <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
-                <button type="button" class="btn btn-outline-primary" onclick="copyRawPacket()">
+                <button type="button" class="btn btn-outline-primary" id="copy-raw-packet">
                     <i class="fas fa-copy"></i> Copy Raw Hex
                 </button>
             </div>
@@ -804,10 +804,10 @@
 {% endblock %}
 
 {% block extra_js %}
-<script>
+<script nonce="{{ g.csp_nonce }}">
     // Load meshcore-decoder asynchronously so it doesn't block socket init.
-    // Dynamic import() works in regular <script> tags on all modern browsers and
-    // avoids the <script type="module"> scope/timing issues that prevented
+    // Dynamic import() works in regular script blocks on all modern browsers and
+    // avoids module-script scope/timing issues that previously prevented
     // socket.on('connect') from firing (the module deferred execution caused a
     // race between two Socket.IO managers, with the module's socket never
     // receiving its connect event).
@@ -1089,24 +1089,48 @@
     let messagePaused = false;
     const MAX_MESSAGES = 200;
 
+    function makeElement(tagName, className = '', text = null) {
+        const element = document.createElement(tagName);
+        if (className) element.className = className;
+        if (text !== null && text !== undefined) element.textContent = String(text);
+        return element;
+    }
+
+    function makeIcon(className) {
+        return makeElement('i', className);
+    }
+
+    function setButtonIconAndLabel(button, iconClass, label) {
+        const icon = makeIcon(iconClass);
+        button.replaceChildren(icon, document.createTextNode(` ${String(label)}`));
+    }
+
+    function renderWaitingState(container, message) {
+        const placeholder = makeElement('div', 'text-muted text-center py-3');
+        placeholder.append(
+            makeIcon('fas fa-hourglass-half'),
+            document.createTextNode(` ${String(message)}`)
+        );
+        container.replaceChildren(placeholder);
+    }
+
     function toggleMessagePause() {
         messagePaused = !messagePaused;
-        const icon = document.getElementById('msg-pause-icon');
         const btn  = document.getElementById('msg-pause-btn');
         if (messagePaused) {
-            icon.className = 'fas fa-play';
-            btn.innerHTML  = '<i class="fas fa-play"></i> Resume';
+            setButtonIconAndLabel(btn, 'fas fa-play', 'Resume');
             updateStatus('message-status', 'Paused', 'warning');
         } else {
-            icon.className = 'fas fa-pause';
-            btn.innerHTML  = '<i class="fas fa-pause"></i> Pause';
+            setButtonIconAndLabel(btn, 'fas fa-pause', 'Pause');
             updateStatus('message-status', 'Active', 'success');
         }
     }
 
     function clearMessages() {
-        document.getElementById('message-stream').innerHTML =
-            '<div class="text-muted text-center py-3"><i class="fas fa-hourglass-half"></i> Waiting for channel messages…</div>';
+        renderWaitingState(
+            document.getElementById('message-stream'),
+            'Waiting for channel messages…'
+        );
     }
 
     function normalizeChannelKeyForColor(channel) {
@@ -1187,33 +1211,37 @@
             ? { border: '#6f42c1', badgeBg: '#6f42c1', badgeFg: '#fff' }
             : channelAccentStyles(data.channel || '');
 
-        let ch = '';
+        let channelBadge = null;
         if (data.channel) {
-            ch = '<span class="badge live-msg-channel-badge me-1" style="background-color:' + accent.badgeBg + ';color:' + accent.badgeFg + ';">' +
-                escapeHtml(data.channel) + '</span>';
+            channelBadge = makeElement(
+                'span',
+                'badge live-msg-channel-badge me-1',
+                data.channel
+            );
+            channelBadge.style.backgroundColor = accent.badgeBg;
+            channelBadge.style.color = accent.badgeFg;
         }
-        const dm = isDm ? '<span class="badge bg-secondary me-1">DM</span>' : '';
 
-        const snr = (data.snr && data.snr !== 'unknown')
-            ? '<span class="badge rounded-pill bg-primary live-msg-meta-badge">SNR ' + escapeHtml(String(data.snr)) + '</span>'
-            : '';
+        const snrBadge = (data.snr && data.snr !== 'unknown')
+            ? makeElement(
+                'span',
+                'badge rounded-pill bg-primary live-msg-meta-badge',
+                `SNR ${String(data.snr)}`
+            )
+            : null;
 
         // 255 = unknown hop count from radio; omit badge (same as before).
-        let hopsHtml = '';
+        let hopsBadge = null;
         const h = data.hops;
         if (h != null && h !== '' && h !== 255) {
-            if (h === 0) {
-                hopsHtml = '<span class="badge rounded-pill bg-info text-dark live-msg-meta-badge">Direct</span>';
-            } else {
-                hopsHtml = '<span class="badge rounded-pill bg-info text-dark live-msg-meta-badge">' +
-                    escapeHtml(String(h)) + ' hop' + (h !== 1 ? 's' : '') + '</span>';
-            }
+            const hopsText = h === 0 ? 'Direct' : `${String(h)} hop${h !== 1 ? 's' : ''}`;
+            hopsBadge = makeElement(
+                'span',
+                'badge rounded-pill bg-info text-dark live-msg-meta-badge',
+                hopsText
+            );
         }
 
-        const badgesRow = (snr || hopsHtml)
-            ? '<div class="live-msg-meta-badges-row">' + snr + hopsHtml + '</div>'
-            : '';
-
         const bodyRaw = stripLeadingChannelBracketTag(data.content || '', isDm);
 
         const entry = document.createElement('div');
@@ -1221,16 +1249,26 @@
         entry.style.borderLeftColor = accent.border;
         entry.style.borderLeftWidth = '3px';
         entry.style.borderLeftStyle = 'solid';
-        entry.innerHTML = `
-            <div class="d-flex justify-content-between align-items-start mb-1 flex-wrap gap-2 w-100">
-                <span class="d-flex flex-wrap align-items-center gap-1 min-w-0">${ch}${dm}<strong>${escapeHtml(data.sender || '?')}</strong></span>
-                <div class="live-msg-meta-stack ms-auto flex-shrink-0 text-end">
-                    ${badgesRow}
-                    <small class="text-muted live-msg-time">${ts}</small>
-                </div>
-            </div>
-            <div class="text-break">${escapeHtml(bodyRaw)}</div>
-        `;
+
+        const header = makeElement(
+            'div',
+            'd-flex justify-content-between align-items-start mb-1 flex-wrap gap-2 w-100'
+        );
+        const sender = makeElement('span', 'd-flex flex-wrap align-items-center gap-1 min-w-0');
+        if (channelBadge) sender.appendChild(channelBadge);
+        if (isDm) sender.appendChild(makeElement('span', 'badge bg-secondary me-1', 'DM'));
+        sender.appendChild(makeElement('strong', '', data.sender || '?'));
+
+        const metadata = makeElement('div', 'live-msg-meta-stack ms-auto flex-shrink-0 text-end');
+        if (snrBadge || hopsBadge) {
+            const badges = makeElement('div', 'live-msg-meta-badges-row');
+            if (snrBadge) badges.appendChild(snrBadge);
+            if (hopsBadge) badges.appendChild(hopsBadge);
+            metadata.appendChild(badges);
+        }
+        metadata.appendChild(makeElement('small', 'text-muted live-msg-time', ts));
+        header.append(sender, metadata);
+        entry.append(header, makeElement('div', 'text-break', bodyRaw));
 
         container.insertBefore(entry, container.firstChild);
 
@@ -1241,18 +1279,7 @@
         }
     }
 
-    function escapeHtml(str) {
-        return String(str)
-            .replace(/&/g, '&amp;')
-            .replace(/</g, '&lt;')
-            .replace(/>/g, '&gt;')
-            .replace(/"/g, '&quot;');
-    }
-
-    window.clearMessages = clearMessages;
-    window.toggleMessagePause = toggleMessagePause;
-
-    window.scrollStream = function(containerId, dir) {
+    function scrollStream(containerId, dir) {
         const c = document.getElementById(containerId);
         if (!c) return;
         if (dir === 'top') {
@@ -1260,7 +1287,7 @@
         } else {
             c.scrollTop = c.scrollHeight;
         }
-    };
+    }
 
     // Stream panel visibility filters
     document.querySelectorAll('.rt-filter-cb').forEach(function(cb) {
@@ -1304,6 +1331,80 @@
         element.textContent = text;
         element.className = `badge bg-${type}`;
     }
+
+    function buildRepeatInfo(data) {
+        const repeatCount = Number(data.repeat_count) || 0;
+        if (repeatCount <= 0) return null;
+
+        const repeaterPrefixes = Array.isArray(data.repeater_prefixes)
+            ? data.repeater_prefixes.map(prefix => String(prefix))
+            : [];
+        const repeaterCounts = data.repeater_counts || {};
+        let tooltipText;
+        if (repeaterPrefixes.length > 0) {
+            const prefixDetails = repeaterPrefixes.map(prefix => {
+                const count = Number(repeaterCounts[prefix]) || 1;
+                return count > 1 ? `${prefix} (${count}x)` : prefix;
+            }).join(', ');
+            tooltipText = `Repeater prefixes: ${prefixDetails}`;
+            if (repeatCount > repeaterPrefixes.length) {
+                tooltipText += `\n\nTotal: ${repeatCount} repeats from ${repeaterPrefixes.length} unique repeater${repeaterPrefixes.length !== 1 ? 's' : ''}`;
+            }
+        } else {
+            tooltipText = 'Heard by radio (no repeater prefixes identified)';
+        }
+
+        const info = makeElement('div', 'small text-info mt-1');
+        info.append(makeIcon('fas fa-broadcast-tower'), document.createTextNode(' Heard '));
+        const count = makeElement(
+            'span',
+            'text-decoration-underline',
+            `${repeatCount} repeat${repeatCount !== 1 ? 's' : ''}`
+        );
+        count.style.cursor = 'help';
+        count.dataset.bsToggle = 'tooltip';
+        count.dataset.bsPlacement = 'top';
+        count.title = tooltipText;
+        info.appendChild(count);
+        return info;
+    }
+
+    function populateBotCard(card, data) {
+        const responseClass = data.success ? 'success' : 'danger';
+        const botMessageClass = data.success ? 'bot-message-success' : 'bot-message-danger';
+        card.className = `bot-message p-2 rounded ${botMessageClass}`;
+        card.style.maxWidth = '80%';
+
+        const header = makeElement('div', 'd-flex align-items-center mb-1');
+        header.append(
+            makeElement('strong', 'text-success me-2', '🤖 Bot'),
+            makeElement(
+                'span',
+                `badge bg-${responseClass} small me-2`,
+                data.success ? 'Success' : 'Failed'
+            ),
+            makeElement(
+                'small',
+                'text-muted ms-auto',
+                data.timestamp
+                    ? new Date(data.timestamp * 1000).toLocaleTimeString()
+                    : new Date().toLocaleTimeString()
+            )
+        );
+        const response = makeElement('div', 'response-text', data.response || 'No response');
+        const repeatInfo = buildRepeatInfo(data);
+        card.replaceChildren(header, response);
+        if (repeatInfo) card.appendChild(repeatInfo);
+    }
+
+    function initializeEntryTooltips(entry) {
+        if (typeof bootstrap === 'undefined' || !bootstrap.Tooltip) return;
+        entry.querySelectorAll('[data-bs-toggle="tooltip"]').forEach(element => {
+            const existingTooltip = bootstrap.Tooltip.getInstance(element);
+            if (existingTooltip) existingTooltip.dispose();
+            new bootstrap.Tooltip(element);
+        });
+    }
     
     function addCommandEntry(data) {
         const container = document.getElementById('command-stream');
@@ -1316,63 +1417,15 @@
         
         // Check if we already have this command (by command_id) and update it instead
         if (data.command_id) {
-            const existingEntry = container.querySelector(`[data-command-id="${data.command_id}"]`);
+            const commandId = String(data.command_id);
+            const existingEntry = Array.from(container.querySelectorAll('[data-command-id]'))
+                .find(entry => entry.dataset.commandId === commandId);
             if (existingEntry) {
                 // Update existing entry with new repeat information
                 const botMessage = existingEntry.querySelector('.bot-message');
                 if (botMessage) {
-                    const responseText = data.response || 'No response';
-                    const responseClass = data.success ? 'success' : 'danger';
-                    const botMessageClass = data.success ? 'bot-message-success' : 'bot-message-danger';
-                    
-                    // Display repeat information if available
-                    const repeatCount = data.repeat_count || 0;
-                    const repeaterPrefixes = data.repeater_prefixes || [];
-                    const repeaterCounts = data.repeater_counts || {};
-                    let repeatInfo = '';
-                    if (repeatCount > 0) {
-                        let tooltipText = '';
-                        if (repeaterPrefixes.length > 0) {
-                            // Build detailed tooltip with counts per repeater
-                            const prefixDetails = repeaterPrefixes.map(prefix => {
-                                const count = repeaterCounts[prefix] || 1;
-                                return count > 1 ? `${prefix} (${count}x)` : prefix;
-                            }).join(', ');
-                            tooltipText = `Repeater prefixes: ${prefixDetails}`;
-                            if (repeatCount > repeaterPrefixes.length) {
-                                tooltipText += `\n\nTotal: ${repeatCount} repeats from ${repeaterPrefixes.length} unique repeater${repeaterPrefixes.length !== 1 ? 's' : ''}`;
-                            }
-                        } else {
-                            tooltipText = 'Heard by radio (no repeater prefixes identified)';
-                        }
-                        repeatInfo = `<div class="small text-info mt-1">
-                            <i class="fas fa-broadcast-tower"></i> Heard <span class="text-decoration-underline" style="cursor: help;" data-bs-toggle="tooltip" data-bs-placement="top" title="${escapeHtml(tooltipText)}">${repeatCount} repeat${repeatCount !== 1 ? 's' : ''}</span>
-                        </div>`;
-                    }
-                    
-                    botMessage.innerHTML = `
-                        <div class="d-flex align-items-center mb-1">
-                            <strong class="text-success me-2">🤖 Bot</strong>
-                            <span class="badge bg-${responseClass} small me-2">${data.success ? 'Success' : 'Failed'}</span>
-                            <small class="text-muted ms-auto">${data.timestamp ? new Date(data.timestamp * 1000).toLocaleTimeString() : new Date().toLocaleTimeString()}</small>
-                        </div>
-                        <div class="response-text">${escapeHtml(responseText)}</div>
-                        ${repeatInfo}
-                    `;
-                    
-                    // Initialize Bootstrap tooltips for repeat counts in updated entry
-                    if (typeof bootstrap !== 'undefined' && bootstrap.Tooltip) {
-                        const tooltipElements = botMessage.querySelectorAll('[data-bs-toggle="tooltip"]');
-                        tooltipElements.forEach(el => {
-                            // Destroy existing tooltip if any
-                            const existingTooltip = bootstrap.Tooltip.getInstance(el);
-                            if (existingTooltip) {
-                                existingTooltip.dispose();
-                            }
-                            // Create new tooltip
-                            new bootstrap.Tooltip(el);
-                        });
-                    }
+                    populateBotCard(botMessage, data);
+                    initializeEntryTooltips(botMessage);
                 }
                 return; // Don't create a new entry
             }
@@ -1382,84 +1435,44 @@
         const entry = document.createElement('div');
         entry.className = 'conversation-entry mb-3';
         if (data.command_id) {
-            entry.setAttribute('data-command-id', data.command_id);
+            entry.dataset.commandId = String(data.command_id);
         }
         
         // User command message
         const userMessage = document.createElement('div');
         userMessage.className = 'd-flex justify-content-start mb-2';
-        userMessage.innerHTML = `
-            <div class="user-message p-2 rounded" style="max-width: 80%;">
-                <div class="d-flex align-items-center mb-1">
-                    <strong class="text-primary me-2">${data.user || 'Unknown'}</strong>
-                    <small class="text-muted me-2">${data.channel || 'Unknown'}</small>
-                    <small class="text-muted ms-auto">${data.timestamp ? new Date(data.timestamp * 1000).toLocaleTimeString() : new Date().toLocaleTimeString()}</small>
-                </div>
-                <div class="fw-bold">${escapeHtml(data.user_input || `/${data.command || 'Unknown Command'}`)}</div>
-            </div>
-        `;
+        const userCard = makeElement('div', 'user-message p-2 rounded');
+        userCard.style.maxWidth = '80%';
+        const userHeader = makeElement('div', 'd-flex align-items-center mb-1');
+        userHeader.append(
+            makeElement('strong', 'text-primary me-2', data.user || 'Unknown'),
+            makeElement('small', 'text-muted me-2', data.channel || 'Unknown'),
+            makeElement(
+                'small',
+                'text-muted ms-auto',
+                data.timestamp
+                    ? new Date(data.timestamp * 1000).toLocaleTimeString()
+                    : new Date().toLocaleTimeString()
+            )
+        );
+        userCard.append(
+            userHeader,
+            makeElement('div', 'fw-bold', data.user_input || `/${data.command || 'Unknown Command'}`)
+        );
+        userMessage.appendChild(userCard);
         
         // Bot response message
         const botMessage = document.createElement('div');
         botMessage.className = 'd-flex justify-content-end mb-2';
-        const responseText = data.response || 'No response';
-        const responseClass = data.success ? 'success' : 'danger';
-        const botMessageClass = data.success ? 'bot-message-success' : 'bot-message-danger';
-        
-        // Display repeat information if available
-        const repeatCount = data.repeat_count || 0;
-        const repeaterPrefixes = data.repeater_prefixes || [];
-        const repeaterCounts = data.repeater_counts || {};
-        let repeatInfo = '';
-        if (repeatCount > 0) {
-            let tooltipText = '';
-            if (repeaterPrefixes.length > 0) {
-                // Build detailed tooltip with counts per repeater
-                const prefixDetails = repeaterPrefixes.map(prefix => {
-                    const count = repeaterCounts[prefix] || 1;
-                    return count > 1 ? `${prefix} (${count}x)` : prefix;
-                }).join(', ');
-                tooltipText = `Repeater prefixes: ${prefixDetails}`;
-                if (repeatCount > repeaterPrefixes.length) {
-                    tooltipText += `\n\nTotal: ${repeatCount} repeats from ${repeaterPrefixes.length} unique repeater${repeaterPrefixes.length !== 1 ? 's' : ''}`;
-                }
-            } else {
-                tooltipText = 'Heard by radio (no repeater prefixes identified)';
-            }
-            repeatInfo = `<div class="small text-info mt-1">
-                <i class="fas fa-broadcast-tower"></i> Heard <span class="text-decoration-underline" style="cursor: help;" data-bs-toggle="tooltip" data-bs-placement="top" title="${escapeHtml(tooltipText)}">${repeatCount} repeat${repeatCount !== 1 ? 's' : ''}</span>
-            </div>`;
-        }
-        
-        botMessage.innerHTML = `
-            <div class="bot-message p-2 rounded ${botMessageClass}" style="max-width: 80%;">
-                <div class="d-flex align-items-center mb-1">
-                    <strong class="text-success me-2">🤖 Bot</strong>
-                    <span class="badge bg-${responseClass} small me-2">${data.success ? 'Success' : 'Failed'}</span>
-                    <small class="text-muted ms-auto">${data.timestamp ? new Date(data.timestamp * 1000).toLocaleTimeString() : new Date().toLocaleTimeString()}</small>
-                </div>
-                <div class="response-text">${escapeHtml(responseText)}</div>
-                ${repeatInfo}
-            </div>
-        `;
+        const botCard = document.createElement('div');
+        populateBotCard(botCard, data);
+        botMessage.appendChild(botCard);
         
         entry.appendChild(userMessage);
         entry.appendChild(botMessage);
         container.insertBefore(entry, container.firstChild);
         
-        // Initialize Bootstrap tooltips for repeat counts
-        if (typeof bootstrap !== 'undefined' && bootstrap.Tooltip) {
-            const tooltipElements = entry.querySelectorAll('[data-bs-toggle="tooltip"]');
-            tooltipElements.forEach(el => {
-                // Destroy existing tooltip if any
-                const existingTooltip = bootstrap.Tooltip.getInstance(el);
-                if (existingTooltip) {
-                    existingTooltip.dispose();
-                }
-                // Create new tooltip
-                new bootstrap.Tooltip(el);
-            });
-        }
+        initializeEntryTooltips(entry);
         
         // Limit to 25 conversation pairs (50 total messages)
         while (container.children.length > 25) {
@@ -1491,32 +1504,32 @@
             : 'No path';
         
         // Format header with resolved components (human-readable with names and numbers)
-        let headerInfo = '';
+        let headerText = null;
         if (data.header) {
             const routeName = data.route_type_name || 'Unknown';
             const routeValue = data.route_type !== undefined ? `0x${data.route_type.toString(16).padStart(2, '0')}` : 'Unknown';
             const payloadName = data.payload_type_name || 'Unknown';
             const payloadValue = data.payload_type !== undefined ? `0x${data.payload_type.toString(16).padStart(2, '0')}` : 'Unknown';
             const version = data.payload_version !== undefined ? `v${data.payload_version}` : 'v?';
-            headerInfo = `<div class="small text-muted">Header: ${data.header} (${routeName} (${routeValue}) | ${payloadName} (${payloadValue}) | ${version})</div>`;
+            headerText = `Header: ${data.header} (${routeName} (${routeValue}) | ${payloadName} (${payloadValue}) | ${version})`;
         }
         
         // Format transport info (only show if present)
-        const transportInfo = data.has_transport_codes && data.transport_codes ? 
-            `<div class="small text-warning">Transport: ${data.transport_codes.hex || 'Unknown'}</div>` : '';
+        const transportText = data.has_transport_codes && data.transport_codes
+            ? `Transport: ${data.transport_codes.hex || 'Unknown'}`
+            : null;
         
         // Format payload info (only show if present)
-        const payloadInfo = data.payload_bytes > 0 ? 
-            `<div class="small text-muted">Payload: ${data.payload_bytes} bytes</div>` : '';
+        const payloadText = data.payload_bytes > 0
+            ? `Payload: ${data.payload_bytes} bytes`
+            : null;
         
         // Format advert info (only show if this is an ADVERT packet with advert data)
-        const advertInfo = data.advert_name && data.payload_type_name === 'ADVERT' ? 
-            `<div class="small text-success"><strong>Advertised:</strong> ${escapeHtml(data.advert_name)} (${data.advert_mode || 'Unknown'})</div>` : '';
+        const hasAdvertInfo = data.advert_name && data.payload_type_name === 'ADVERT';
         
         // Check if raw packet hex is available for detailed view
         const hasRawHex = !!(data.raw_packet_hex || data.payload_hex);
         const clickableClass = hasRawHex ? 'packet-clickable' : '';
-        const clickHint = hasRawHex ? '<span class="click-hint"><i class="fas fa-search-plus"></i></span>' : '';
         
         // Determine packet type class for color-coding
         const payloadTypeName = (data.payload_type_name || data.payload_type || '').toString().toUpperCase();
@@ -1548,7 +1561,7 @@
         entry.dataset.packetId = packetId;
         
         if (hasRawHex) {
-            entry.onclick = () => showPacketDetail(packetId);
+            entry.addEventListener('click', () => showPacketDetail(packetId));
             entry.title = 'Click to view packet details';
         }
         
@@ -1568,36 +1581,64 @@
         };
         const badgeColor = badgeColorMap[packetTypeClass] || 'bg-secondary';
         
-        entry.innerHTML = `
-            <div class="d-flex justify-content-between align-items-start">
-                <div class="flex-grow-1">
-                    <div class="d-flex align-items-center mb-2">
-                        <div class="fw-bold text-info me-2">${data.route_type_name || data.route_type || 'Unknown Route'}</div>
-                        <span class="badge ${badgeColor}">${data.payload_type_name || data.payload_type || 'Unknown'}</span>
-                        ${data.payload_version !== undefined ? `<span class="badge bg-light text-dark ms-1">v${data.payload_version}</span>` : ''}
-                        ${clickHint}
-                    </div>
-                    
-                    <div class="small text-muted mb-1 packet-stream-path">
-                        <strong>Path:</strong> ${pathDisplay}
-                        ${data.path_len > 0 ? ` (${data.path_len} bytes)` : ''}
-                    </div>
-                    
-                    ${advertInfo}
-                    ${headerInfo}
-                    ${transportInfo}
-                    ${payloadInfo}
-                </div>
-                
-                <div class="text-end">
-                    <div class="small text-muted mb-1">${timestamp}</div>
-                    <div class="d-flex flex-column align-items-end">
-                        <span class="badge bg-info mb-1">${data.hops || data.path_len || 0} hops</span>
-                        ${data.has_transport_codes ? '<span class="badge bg-warning small">Transport</span>' : ''}
-                    </div>
-                </div>
-            </div>
-        `;
+        const layout = makeElement('div', 'd-flex justify-content-between align-items-start');
+        const main = makeElement('div', 'flex-grow-1');
+        const heading = makeElement('div', 'd-flex align-items-center mb-2');
+        heading.append(
+            makeElement(
+                'div',
+                'fw-bold text-info me-2',
+                data.route_type_name || data.route_type || 'Unknown Route'
+            ),
+            makeElement(
+                'span',
+                `badge ${badgeColor}`,
+                data.payload_type_name || data.payload_type || 'Unknown'
+            )
+        );
+        if (data.payload_version !== undefined) {
+            heading.appendChild(
+                makeElement('span', 'badge bg-light text-dark ms-1', `v${data.payload_version}`)
+            );
+        }
+        if (hasRawHex) {
+            const hint = makeElement('span', 'click-hint');
+            hint.appendChild(makeIcon('fas fa-search-plus'));
+            heading.appendChild(hint);
+        }
+        main.appendChild(heading);
+
+        const path = makeElement('div', 'small text-muted mb-1 packet-stream-path');
+        path.append(
+            makeElement('strong', '', 'Path:'),
+            document.createTextNode(` ${String(pathDisplay)}${data.path_len > 0 ? ` (${data.path_len} bytes)` : ''}`)
+        );
+        main.appendChild(path);
+
+        if (hasAdvertInfo) {
+            const advert = makeElement('div', 'small text-success');
+            advert.append(
+                makeElement('strong', '', 'Advertised:'),
+                document.createTextNode(` ${String(data.advert_name)} (${String(data.advert_mode || 'Unknown')})`)
+            );
+            main.appendChild(advert);
+        }
+        if (headerText) main.appendChild(makeElement('div', 'small text-muted', headerText));
+        if (transportText) main.appendChild(makeElement('div', 'small text-warning', transportText));
+        if (payloadText) main.appendChild(makeElement('div', 'small text-muted', payloadText));
+
+        const right = makeElement('div', 'text-end');
+        right.appendChild(makeElement('div', 'small text-muted mb-1', timestamp));
+        const packetBadges = makeElement('div', 'd-flex flex-column align-items-end');
+        packetBadges.appendChild(
+            makeElement('span', 'badge bg-info mb-1', `${data.hops || data.path_len || 0} hops`)
+        );
+        if (data.has_transport_codes) {
+            packetBadges.appendChild(makeElement('span', 'badge bg-warning small', 'Transport'));
+        }
+        right.appendChild(packetBadges);
+        layout.append(main, right);
+        entry.appendChild(layout);
         
         container.insertBefore(entry, container.firstChild);
         
@@ -1817,15 +1858,17 @@
     // Render color-coded hex breakdown
     function renderHexBreakdown(rawHex, structure) {
         const container = document.getElementById('hex-breakdown');
+        container.replaceChildren();
         
         if (!structure || !structure.segments) {
             // Simple hex display without structure
-            container.innerHTML = formatHexSimple(rawHex);
+            container.appendChild(
+                makeElement('span', 'hex-unknown', formatHexSpaced(rawHex.toUpperCase()))
+            );
             return;
         }
         
         // Build color-coded hex display from segments
-        let html = '';
         const hexUpper = rawHex.toUpperCase();
         const segments = structure.segments;
         
@@ -1847,23 +1890,31 @@
             
             // Add any gap before this segment
             if (currentPos < startHex) {
-                html += `<span class="hex-unknown">${hexUpper.slice(currentPos, startHex)}</span>`;
+                container.appendChild(
+                    makeElement('span', 'hex-unknown', hexUpper.slice(currentPos, startHex))
+                );
             }
             
             // Add the segment with color
             const colorClass = colorMap[segment.name] || 'hex-unknown';
             const segmentHex = hexUpper.slice(startHex, endHex);
-            html += `<span class="${colorClass}" title="${segment.name}: ${segment.description || ''}">${formatHexSpaced(segmentHex)}</span>`;
+            const segmentElement = makeElement(
+                'span',
+                colorClass,
+                formatHexSpaced(segmentHex)
+            );
+            segmentElement.title = `${String(segment.name)}: ${String(segment.description || '')}`;
+            container.appendChild(segmentElement);
             
             currentPos = endHex;
         }
         
         // Add any remaining bytes
         if (currentPos < hexUpper.length) {
-            html += `<span class="hex-unknown">${hexUpper.slice(currentPos)}</span>`;
+            container.appendChild(
+                makeElement('span', 'hex-unknown', hexUpper.slice(currentPos))
+            );
         }
-        
-        container.innerHTML = html;
     }
     
     // Format hex with spaces every 2 characters
@@ -1871,12 +1922,6 @@
         return hex.match(/.{1,2}/g)?.join(' ') || hex;
     }
     
-    // Simple hex format
-    function formatHexSimple(hex) {
-        const upper = hex.toUpperCase();
-        return `<span class="hex-unknown">${formatHexSpaced(upper)}</span>`;
-    }
-    
     // Populate header analysis using decoded data
     function populateHeaderAnalysis(decoded, serverData) {
         // Get route type, payload type, version - prefer decoder output
@@ -1902,33 +1947,37 @@
         
         // Parse header bits
         const tbody = document.getElementById('header-bits-body');
+        tbody.replaceChildren();
         
         if (routeType !== undefined && payloadType !== undefined) {
             const routeTypeName = getRouteTypeName(routeType);
             const payloadTypeName = getPayloadTypeName(payloadType);
-            
-            tbody.innerHTML = `
-                <tr>
-                    <td>0-1</td>
-                    <td>Route Type</td>
-                    <td>${routeTypeName}</td>
-                    <td class="text-danger">${(routeType).toString(2).padStart(2, '0')}</td>
-                </tr>
-                <tr>
-                    <td>2-5</td>
-                    <td>Payload Type</td>
-                    <td>${payloadTypeName}</td>
-                    <td class="text-danger">${(payloadType).toString(2).padStart(4, '0')}</td>
-                </tr>
-                <tr>
-                    <td>6-7</td>
-                    <td>Version</td>
-                    <td>${version ?? '?'}</td>
-                    <td class="text-danger">${version !== null && version !== undefined ? version.toString(2).padStart(2, '0') : '??'}</td>
-                </tr>
-            `;
+            const appendHeaderRow = (bits, field, value, binary) => {
+                const row = document.createElement('tr');
+                row.append(
+                    makeElement('td', '', bits),
+                    makeElement('td', '', field),
+                    makeElement('td', '', value),
+                    makeElement('td', 'text-danger', binary)
+                );
+                tbody.appendChild(row);
+            };
+            appendHeaderRow('0-1', 'Route Type', routeTypeName, routeType.toString(2).padStart(2, '0'));
+            appendHeaderRow('2-5', 'Payload Type', payloadTypeName, payloadType.toString(2).padStart(4, '0'));
+            appendHeaderRow(
+                '6-7',
+                'Version',
+                version ?? '?',
+                version !== null && version !== undefined
+                    ? version.toString(2).padStart(2, '0')
+                    : '??'
+            );
         } else {
-            tbody.innerHTML = '<tr><td colspan="4">Unable to parse header</td></tr>';
+            const row = document.createElement('tr');
+            const cell = makeElement('td', '', 'Unable to parse header');
+            cell.colSpan = 4;
+            row.appendChild(cell);
+            tbody.appendChild(row);
         }
     }
     
@@ -2071,9 +2120,23 @@
         const mac = hex.slice(2, 6);
         const ciphertext = hex.slice(6);
         
-        container.innerHTML = `<span class="hex-channel-hash" title="Channel Hash">${channelHash}</span> ` +
-            `<span class="hex-cipher-mac" title="Cipher MAC">${formatHexSpaced(mac)}</span> ` +
-            `<span class="hex-ciphertext" title="Ciphertext">${formatHexSpaced(ciphertext)}</span>`;
+        const channelElement = makeElement('span', 'hex-channel-hash', channelHash);
+        channelElement.title = 'Channel Hash';
+        const macElement = makeElement('span', 'hex-cipher-mac', formatHexSpaced(mac));
+        macElement.title = 'Cipher MAC';
+        const ciphertextElement = makeElement(
+            'span',
+            'hex-ciphertext',
+            formatHexSpaced(ciphertext)
+        );
+        ciphertextElement.title = 'Ciphertext';
+        container.replaceChildren(
+            channelElement,
+            document.createTextNode(' '),
+            macElement,
+            document.createTextNode(' '),
+            ciphertextElement
+        );
     }
     
     // Populate Advert breakdown using decoded data
@@ -2097,28 +2160,43 @@
             ? getDeviceRoleName(appData.deviceRole)
             : (serverData.advert_mode || 'Unknown');
         
+        const appendNodeInfo = (label, value) => {
+            const line = document.createElement('div');
+            line.append(
+                makeElement('strong', '', `${label}:`),
+                document.createTextNode(` ${String(value)}`)
+            );
+            nodeInfo.appendChild(line);
+        };
+        nodeInfo.replaceChildren();
+        appendNodeInfo('Name', name);
+        appendNodeInfo('Role', role);
+
         // Location
-        let locationHtml = '';
         if (appData?.location) {
-            locationHtml = `<div><strong>Location:</strong> ${appData.location.latitude.toFixed(4)}, ${appData.location.longitude.toFixed(4)}</div>`;
+            appendNodeInfo(
+                'Location',
+                `${appData.location.latitude.toFixed(4)}, ${appData.location.longitude.toFixed(4)}`
+            );
         } else if (serverData.advert_latitude !== undefined && serverData.advert_longitude !== undefined) {
-            locationHtml = `<div><strong>Location:</strong> ${serverData.advert_latitude.toFixed(4)}, ${serverData.advert_longitude.toFixed(4)}</div>`;
+            appendNodeInfo(
+                'Location',
+                `${serverData.advert_latitude.toFixed(4)}, ${serverData.advert_longitude.toFixed(4)}`
+            );
         }
         
         // Timestamp from decoded advert or server
-        let timestampHtml = '';
         if (decodedPayload?.timestamp) {
-            timestampHtml = `<div><strong>Advert Time:</strong> ${new Date(decodedPayload.timestamp * 1000).toLocaleString()}</div>`;
+            appendNodeInfo(
+                'Advert Time',
+                new Date(decodedPayload.timestamp * 1000).toLocaleString()
+            );
         } else if (serverData.advert_timestamp) {
-            timestampHtml = `<div><strong>Advert Time:</strong> ${new Date(serverData.advert_timestamp * 1000).toLocaleString()}</div>`;
+            appendNodeInfo(
+                'Advert Time',
+                new Date(serverData.advert_timestamp * 1000).toLocaleString()
+            );
         }
-        
-        nodeInfo.innerHTML = `
-            <div><strong>Name:</strong> ${escapeHtml(name)}</div>
-            <div><strong>Role:</strong> ${role}</div>
-            ${locationHtml}
-            ${timestampHtml}
-        `;
     }
     
     // Helper: Get payload type name
@@ -2162,25 +2240,16 @@
         return names[role] || `Role${role}`;
     }
     
-    // Helper: Escape HTML
-    function escapeHtml(text) {
-        if (!text) return '';
-        const div = document.createElement('div');
-        div.textContent = text;
-        return div.innerHTML;
-    }
-    
     // Copy raw packet hex to clipboard
     function copyRawPacket() {
         const hex = window.currentPacketHex || currentPacketHex;
         if (hex) {
             navigator.clipboard.writeText(hex).then(() => {
                 // Show brief feedback
-                const btn = document.querySelector('[onclick="copyRawPacket()"]');
-                const originalText = btn.innerHTML;
-                btn.innerHTML = '<i class="fas fa-check"></i> Copied!';
+                const btn = document.getElementById('copy-raw-packet');
+                setButtonIconAndLabel(btn, 'fas fa-check', 'Copied!');
                 setTimeout(() => {
-                    btn.innerHTML = originalText;
+                    setButtonIconAndLabel(btn, 'fas fa-copy', 'Copy Raw Hex');
                 }, 1500);
             }).catch(err => {
                 console.error('Failed to copy:', err);
@@ -2189,26 +2258,43 @@
     }
     
     function clearCommands() {
-        document.getElementById('command-stream').innerHTML = `
-            <div class="text-muted text-center py-3">
-                <i class="fas fa-hourglass-half"></i> Waiting for command data...
-            </div>
-        `;
+        renderWaitingState(
+            document.getElementById('command-stream'),
+            'Waiting for command data...'
+        );
     }
     
     function clearPackets() {
-        document.getElementById('packet-stream').innerHTML = `
-            <div class="text-muted text-center py-3">
-                <i class="fas fa-hourglass-half"></i> Waiting for packet data...
-            </div>
-        `;
+        renderWaitingState(
+            document.getElementById('packet-stream'),
+            'Waiting for packet data...'
+        );
         packetStore.clear();
         packetCounter = 0;
     }
-    
-    // Export functions to global scope for onclick handlers
-    window.clearCommands = clearCommands;
-    window.clearPackets = clearPackets;
-    window.copyRawPacket = copyRawPacket;
+
+    document.getElementById('cmd-scroll-top').addEventListener(
+        'click', () => scrollStream('command-stream', 'top')
+    );
+    document.getElementById('cmd-scroll-bottom').addEventListener(
+        'click', () => scrollStream('command-stream', 'bottom')
+    );
+    document.getElementById('cmd-clear').addEventListener('click', clearCommands);
+    document.getElementById('msg-scroll-top').addEventListener(
+        'click', () => scrollStream('message-stream', 'top')
+    );
+    document.getElementById('msg-scroll-bottom').addEventListener(
+        'click', () => scrollStream('message-stream', 'bottom')
+    );
+    document.getElementById('msg-clear').addEventListener('click', clearMessages);
+    document.getElementById('msg-pause-btn').addEventListener('click', toggleMessagePause);
+    document.getElementById('pkt-scroll-top').addEventListener(
+        'click', () => scrollStream('packet-stream', 'top')
+    );
+    document.getElementById('pkt-scroll-bottom').addEventListener(
+        'click', () => scrollStream('packet-stream', 'bottom')
+    );
+    document.getElementById('pkt-clear').addEventListener('click', clearPackets);
+    document.getElementById('copy-raw-packet').addEventListener('click', copyRawPacket);
 </script>
 {% endblock %}
diff --git a/modules/web_viewer/templates/stats.html b/modules/web_viewer/templates/stats.html
index ad88653..6523892 100644
--- a/modules/web_viewer/templates/stats.html
+++ b/modules/web_viewer/templates/stats.html
@@ -149,7 +149,7 @@
 {% endblock %}
 
 {% block extra_js %}
-<script>
+<script nonce="{{ g.csp_nonce }}">
 class ModernStatsManager {
     constructor() {
         this.statsData = {};
@@ -218,24 +218,17 @@ class ModernStatsManager {
             const contactsPercent = Math.round((recentContacts / total) * 100);
             const advertsPercent = Math.round((recentAdverts / total) * 100);
             
-            activityChart.innerHTML = `
-                <div class="row">
-                    <div class="col-6">
-                        <div class="text-center">
-                            <h4 class="text-primary">${contactsPercent}%</h4>
-                            <small class="text-muted">Contacts</small>
-                        </div>
-                    </div>
-                    <div class="col-6">
-                        <div class="text-center">
-                            <h4 class="text-warning">${advertsPercent}%</h4>
-                            <small class="text-muted">Adverts</small>
-                        </div>
-                    </div>
-                </div>
-            `;
+            const row = document.createElement('div');
+            row.className = 'row';
+            row.append(
+                this.makeMetricColumn(`${contactsPercent}%`, 'Contacts', 'text-primary'),
+                this.makeMetricColumn(`${advertsPercent}%`, 'Adverts', 'text-warning'),
+            );
+            activityChart.replaceChildren(row);
         } else {
-            activityChart.innerHTML = '<div class="text-muted text-center">No recent activity</div>';
+            activityChart.replaceChildren(
+                this.makeTextElement('div', 'No recent activity', 'text-muted text-center'),
+            );
         }
         
         // Trends chart
@@ -243,56 +236,86 @@ class ModernStatsManager {
         const growthRate = this.statsData.contact_count > 0 ? 
             Math.round(((this.statsData.recent_contacts_24h || 0) / this.statsData.contact_count) * 100) : 0;
         
-        trendsChart.innerHTML = `
-            <div class="text-center">
-                <h4 class="text-${growthRate > 0 ? 'success' : 'secondary'}">${growthRate}%</h4>
-                <small class="text-muted">Daily growth rate</small>
-            </div>
-        `;
+        const trend = document.createElement('div');
+        trend.className = 'text-center';
+        trend.append(
+            this.makeTextElement('h4', `${growthRate}%`, `text-${growthRate > 0 ? 'success' : 'secondary'}`),
+            this.makeTextElement('small', 'Daily growth rate', 'text-muted'),
+        );
+        trendsChart.replaceChildren(trend);
     }
     
     renderDetailedStats() {
         // Contact statistics
         const contactStats = document.getElementById('contact-stats');
-        contactStats.innerHTML = `
-            <li><strong>Total Contacts:</strong> ${this.statsData.contact_count || 0}</li>
-            <li><strong>Recent (24h):</strong> ${this.statsData.recent_contacts_24h || 0}</li>
-            <li><strong>Growth Rate:</strong> ${this.calculateGrowthRate()}%</li>
-            <li><strong>Last Updated:</strong> ${new Date().toLocaleString()}</li>
-        `;
+        this.renderLabeledList(contactStats, [
+            ['Total Contacts', this.statsData.contact_count || 0],
+            ['Recent (24h)', this.statsData.recent_contacts_24h || 0],
+            ['Growth Rate', `${this.calculateGrowthRate()}%`],
+            ['Last Updated', new Date().toLocaleString()],
+        ], false);
         
         // Advert statistics
         const advertStats = document.getElementById('advert-stats');
-        advertStats.innerHTML = `
-            <li><strong>Total Adverts:</strong> ${this.statsData.total_advertisements || 0}</li>
-            <li><strong>Recent (24h):</strong> ${this.statsData.advertisements_24h || 0}</li>
-            <li><strong>Active Users:</strong> ${this.statsData.active_users_24h || 0}</li>
-            <li><strong>Last Updated:</strong> ${new Date().toLocaleString()}</li>
-        `;
+        this.renderLabeledList(advertStats, [
+            ['Total Adverts', this.statsData.total_advertisements || 0],
+            ['Recent (24h)', this.statsData.advertisements_24h || 0],
+            ['Active Users', this.statsData.active_users_24h || 0],
+            ['Last Updated', new Date().toLocaleString()],
+        ], false);
     }
     
     renderSystemInfo() {
         // System performance
         const systemPerformance = document.getElementById('system-performance');
-        systemPerformance.innerHTML = `
-            <ul class="list-unstyled">
-                <li><strong>Connected Clients:</strong> ${this.statsData.connected_clients || 0}</li>
-                <li><strong>Database Status:</strong> <span class="badge bg-success">Healthy</span></li>
-                <li><strong>Last Activity:</strong> ${new Date().toLocaleString()}</li>
-                <li><strong>Uptime:</strong> ${this.calculateUptime()}</li>
-            </ul>
-        `;
+        this.renderLabeledList(systemPerformance, [
+            ['Connected Clients', this.statsData.connected_clients || 0],
+            ['Database Status', 'Healthy'],
+            ['Last Activity', new Date().toLocaleString()],
+            ['Uptime', this.calculateUptime()],
+        ]);
         
         // System configuration
         const systemConfig = document.getElementById('system-config');
-        systemConfig.innerHTML = `
-            <ul class="list-unstyled">
-                <li><strong>Version:</strong> Modern v2.0</li>
-                <li><strong>Flask-SocketIO:</strong> 5.x</li>
-                <li><strong>Database:</strong> SQLite</li>
-                <li><strong>Real-time:</strong> <span class="badge bg-success">Enabled</span></li>
-            </ul>
-        `;
+        this.renderLabeledList(systemConfig, [
+            ['Version', 'Modern v2.0'],
+            ['Flask-SocketIO', '5.x'],
+            ['Database', 'SQLite'],
+            ['Real-time', 'Enabled'],
+        ]);
+    }
+
+    makeTextElement(tagName, value, className = '') {
+        const element = document.createElement(tagName);
+        element.className = className;
+        element.textContent = String(value ?? '');
+        return element;
+    }
+
+    makeMetricColumn(value, label, valueClass) {
+        const column = document.createElement('div');
+        column.className = 'col-6';
+        const content = document.createElement('div');
+        content.className = 'text-center';
+        content.append(
+            this.makeTextElement('h4', value, valueClass),
+            this.makeTextElement('small', label, 'text-muted'),
+        );
+        column.appendChild(content);
+        return column;
+    }
+
+    renderLabeledList(container, rows, wrap = true) {
+        const list = document.createElement(wrap ? 'ul' : 'div');
+        if (wrap) list.className = 'list-unstyled';
+        rows.forEach(([label, value]) => {
+            const item = document.createElement('li');
+            const strong = document.createElement('strong');
+            strong.textContent = `${label}:`;
+            item.append(strong, document.createTextNode(` ${String(value ?? '')}`));
+            list.appendChild(item);
+        });
+        container.replaceChildren(...(wrap ? [list] : Array.from(list.children)));
     }
     
     calculateGrowthRate() {
diff --git a/pyproject.toml b/pyproject.toml
index 2278306..dc1d12f 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -50,19 +50,24 @@ meshcore-bot = "meshcore_bot:main"
 meshcore-viewer = "modules.web_viewer.app:main"
 
 [tool.setuptools]
-# Include both the main module and the modules package
 py-modules = ["meshcore_bot"]
-packages = ["modules", "modules.commands", "modules.commands.alternatives", 
-            "modules.commands.alternatives.inactive", "modules.service_plugins", "modules.web_viewer"]
+include-package-data = false
+
+[tool.setuptools.packages.find]
+where = ["."]
+include = ["modules*", "translations*", "data*"]
+exclude = ["tests*", "local*"]
 
 [tool.setuptools.package-data]
-"*" = ["*.json"]
 modules = [
     "web_viewer/templates/*.html",
+    "web_viewer/templates/**/*.html",
     "web_viewer/static/*",
     "web_viewer/static/*/*",
     "web_viewer/static/*/*/*",
 ]
+translations = ["*.json"]
+"data.randomlines" = ["*.txt"]
 
 [tool.ruff]
 # Match CI/Makefile installs so lint rules do not drift on unpinned `pip install ruff`.
diff --git a/scripts/build-deb.sh b/scripts/build-deb.sh
index a5514c6..deafc01 100755
--- a/scripts/build-deb.sh
+++ b/scripts/build-deb.sh
@@ -70,12 +70,25 @@ rsync -a \
     --exclude='*.db' \
     --exclude='*.log' \
     --exclude='config.ini' \
+    --exclude='.env' \
+    --exclude='*.key' \
+    --exclude='*.pem' \
+    --exclude='*.p12' \
+    --exclude='*.pfx' \
     --exclude='node_modules' \
     "${PROJECT_ROOT}/" "${BUILD_DIR}${INSTALL_ROOT}/"
 
 # ── Default config ────────────────────────────────────────────────────────────
 echo "==> Installing default config…"
 cp "${PROJECT_ROOT}/config.ini.example" "${BUILD_DIR}${CONF_DIR}/config.ini"
+# Service installs keep mutable state and local plugins out of the root-owned
+# application tree.  Only replace the documented defaults; custom package
+# builders can still provide absolute paths of their own.
+sed -i \
+    -e "s|^db_path = meshcore_bot.db$|db_path = ${DATA_DIR}/meshcore_bot.db|" \
+    -e "s|^#local_dir_path = local$|local_dir_path = ${DATA_DIR}/local|" \
+    -e "s|^log_file = meshcore_bot.log$|log_file = ${LOG_DIR}/meshcore_bot.log|" \
+    "${BUILD_DIR}${CONF_DIR}/config.ini"
 # Symlink so the app finds it in the install root
 ln -sf "${CONF_DIR}/config.ini" "${BUILD_DIR}${INSTALL_ROOT}/config.ini"
 
@@ -106,7 +119,13 @@ NoNewPrivileges=true
 PrivateTmp=true
 ProtectSystem=strict
 ProtectHome=true
-ReadWritePaths=/opt/meshcore-bot
+UMask=0077
+ConfigurationDirectory=meshcore-bot
+ConfigurationDirectoryMode=0700
+StateDirectory=meshcore-bot
+StateDirectoryMode=0700
+LogsDirectory=meshcore-bot
+LogsDirectoryMode=0750
 ReadWritePaths=/etc/meshcore-bot
 ReadWritePaths=/var/log/meshcore-bot
 ReadWritePaths=/var/lib/meshcore-bot
@@ -131,7 +150,7 @@ Section: net
 Priority: optional
 Architecture: ${ARCH}
 Installed-Size: ${INSTALLED_SIZE}
-Depends: python3 (>= 3.9), python3-pip, python3-venv, adduser
+Depends: python3 (>= 3.10), python3-pip, python3-venv, adduser
 Recommends: systemd
 Suggests: sqlite3
 Maintainer: MeshCore Bot Team <noreply@example.com>
@@ -145,6 +164,12 @@ EOF
 # ── DEBIAN/conffiles ──────────────────────────────────────────────────────────
 echo "${CONF_DIR}/config.ini" > "${BUILD_DIR}/DEBIAN/conffiles"
 
+# Debian runs the old prerm before this new preinst.  The helper preserves
+# markers written by hardened prerm versions and recognizes the first legacy
+# transition through a root-owned persistent policy marker.
+cp "${PROJECT_ROOT}/scripts/debian_service_state.sh" "${BUILD_DIR}/DEBIAN/preinst"
+chmod 0755 "${BUILD_DIR}/DEBIAN/preinst"
+
 # ── DEBIAN/postinst ───────────────────────────────────────────────────────────
 cat > "${BUILD_DIR}/DEBIAN/postinst" << 'POSTINST'
 #!/bin/bash
@@ -165,27 +190,53 @@ if ! id -u "${SERVICE_USER}" >/dev/null 2>&1; then
         "${SERVICE_USER}"
 fi
 
-# Create directories
-install -d -o "${SERVICE_USER}" -g "${SERVICE_USER}" -m 0755 "${LOG_DIR}"
-install -d -o "${SERVICE_USER}" -g "${SERVICE_USER}" -m 0755 "${DATA_DIR}"
-install -d -o root -g root -m 0755 "${CONF_DIR}"
-chown -R "${SERVICE_USER}:${SERVICE_USER}" "${INSTALL_ROOT}"
+# Root owns executable code and the virtualenv; the service can write only its
+# explicit configuration/state/log trees.  0700/0600 also protect API keys,
+# database contents, local plugin config, and backups from other local users.
+chown -R root:root "${INSTALL_ROOT}"
+find "${INSTALL_ROOT}" -type d -exec chmod 0755 {} +
+find "${INSTALL_ROOT}" -type f -exec chmod go-w {} +
+install -d -o "${SERVICE_USER}" -g "${SERVICE_USER}" -m 0750 "${LOG_DIR}"
+install -d -o "${SERVICE_USER}" -g "${SERVICE_USER}" -m 0700 \
+    "${DATA_DIR}" "${DATA_DIR}/local" "${DATA_DIR}/local/commands" \
+    "${DATA_DIR}/local/service_plugins" "${DATA_DIR}/backups"
+install -d -o "${SERVICE_USER}" -g "${SERVICE_USER}" -m 0700 "${CONF_DIR}"
+# Previous package versions resolved relative settings from /etc/meshcore-bot.
+# The service is stopped by prerm, so SQLite backup migration is coherent.
+python3 "${INSTALL_ROOT}/scripts/migrate_service_layout.py" \
+    --config "${CONF_DIR}/config.ini" \
+    --legacy-base "${CONF_DIR}" \
+    --state-dir "${DATA_DIR}" \
+    --log-dir "${LOG_DIR}"
+chown -R "${SERVICE_USER}:${SERVICE_USER}" "${CONF_DIR}" "${DATA_DIR}" "${LOG_DIR}"
+find "${CONF_DIR}" "${DATA_DIR}" -type d -exec chmod 0700 {} +
+find "${CONF_DIR}" "${DATA_DIR}" -type f -exec chmod 0600 {} +
+chmod 0750 "${LOG_DIR}"
+find "${LOG_DIR}" -type f -exec chmod 0600 {} +
 
-# Create virtualenv and install dependencies
-if [ ! -d "${INSTALL_ROOT}/venv" ]; then
-    echo "Creating Python virtualenv…"
-    python3 -m venv "${INSTALL_ROOT}/venv"
+# Rebuild the venv from trusted requirements.  Older releases made it writable
+# by the service user, so an in-place upgrade could preserve executable .pth or
+# module persistence.
+VENV_BUILD="${INSTALL_ROOT}/.venv-build-$$"
+VENV_OLD="${INSTALL_ROOT}/.venv-old-$$"
+rm -rf "${VENV_BUILD}" "${VENV_OLD}"
+echo "Building fresh Python virtualenv…"
+python3 -m venv "${VENV_BUILD}"
+"${VENV_BUILD}/bin/pip" install --quiet --upgrade pip
+"${VENV_BUILD}/bin/pip" install --quiet -r "${INSTALL_ROOT}/requirements.txt"
+if [ -d "${INSTALL_ROOT}/venv" ]; then
+    mv "${INSTALL_ROOT}/venv" "${VENV_OLD}"
 fi
-echo "Installing Python dependencies…"
-"${INSTALL_ROOT}/venv/bin/pip" install --quiet --upgrade pip
-"${INSTALL_ROOT}/venv/bin/pip" install --quiet -r "${INSTALL_ROOT}/requirements.txt"
+if ! mv "${VENV_BUILD}" "${INSTALL_ROOT}/venv"; then
+    [ -d "${VENV_OLD}" ] && mv "${VENV_OLD}" "${INSTALL_ROOT}/venv"
+    exit 1
+fi
+rm -rf "${VENV_OLD}"
 
-# Enable and start systemd service
-if command -v systemctl >/dev/null 2>&1; then
-    systemctl daemon-reload
-    systemctl enable meshcore-bot.service || true
-    echo "Service enabled. Start with: sudo systemctl start meshcore-bot"
-fi
+# A legacy prerm destroys the prior state before new package code can observe
+# it.  The helper uses an explicit availability-first policy for that one
+# transition, then preserves enablement/activity exactly on later upgrades.
+bash "${INSTALL_ROOT}/scripts/debian_service_state.sh" restore "${2:-}"
 
 echo ""
 echo "meshcore-bot installed successfully."
@@ -198,10 +249,7 @@ cat > "${BUILD_DIR}/DEBIAN/prerm" << 'PRERM'
 #!/bin/bash
 set -e
 
-if command -v systemctl >/dev/null 2>&1; then
-    systemctl stop meshcore-bot.service 2>/dev/null || true
-    systemctl disable meshcore-bot.service 2>/dev/null || true
-fi
+bash /opt/meshcore-bot/scripts/debian_service_state.sh preremove "${1:-}"
 PRERM
 chmod 0755 "${BUILD_DIR}/DEBIAN/prerm"
 
@@ -224,7 +272,9 @@ chmod 0755 "${BUILD_DIR}/DEBIAN/postrm"
 echo "==> Setting permissions…"
 find "${BUILD_DIR}" -type d -exec chmod 0755 {} \;
 find "${BUILD_DIR}" -type f -exec chmod 0644 {} \;
-chmod 0755 "${BUILD_DIR}/DEBIAN/postinst" "${BUILD_DIR}/DEBIAN/prerm" "${BUILD_DIR}/DEBIAN/postrm"
+chmod 0755 "${BUILD_DIR}/DEBIAN/preinst" "${BUILD_DIR}/DEBIAN/postinst" \
+    "${BUILD_DIR}/DEBIAN/prerm" "${BUILD_DIR}/DEBIAN/postrm"
+chmod 0600 "${BUILD_DIR}${CONF_DIR}/config.ini"
 # Make Python entry point executable
 chmod 0755 "${BUILD_DIR}${INSTALL_ROOT}/meshcore_bot.py" 2>/dev/null || true
 
diff --git a/scripts/debian_service_state.sh b/scripts/debian_service_state.sh
new file mode 100644
index 0000000..98568f3
--- /dev/null
+++ b/scripts/debian_service_state.sh
@@ -0,0 +1,79 @@
+#!/bin/bash
+# Preserve systemd enablement and activity across Debian package upgrades.
+
+set -e
+
+STATE_DIR="${MESHCORE_MAINT_STATE_DIR:-/run}"
+SERVICE_NAME="${MESHCORE_MAINT_SERVICE_NAME:-meshcore-bot.service}"
+ACTIVE_MARKER="${STATE_DIR}/meshcore-bot-was-active"
+ENABLED_MARKER="${STATE_DIR}/meshcore-bot-was-enabled"
+POLICY_MARKER="${MESHCORE_MAINT_POLICY_MARKER:-/opt/meshcore-bot/.service-state-policy-v1}"
+
+preinstall() {
+    local action="${1:-}"
+    # Debian invokes old-prerm before new-preinst.  Once the hardened policy is
+    # installed, old-prerm has already written the markers and preinst must
+    # preserve them.  A fresh install or first transition clears stale state.
+    if [ "${action}" != "upgrade" ] || [ ! -f "${POLICY_MARKER}" ]; then
+        rm -f "${ACTIVE_MARKER}" "${ENABLED_MARKER}"
+    fi
+}
+
+preremove() {
+    local action="${1:-}"
+    command -v systemctl >/dev/null 2>&1 || return 0
+
+    if systemctl is-active --quiet "${SERVICE_NAME}" 2>/dev/null; then
+        if [ "${action}" = "upgrade" ]; then
+            touch "${ACTIVE_MARKER}"
+        fi
+        systemctl stop "${SERVICE_NAME}" 2>/dev/null || true
+    fi
+    if [ "${action}" = "upgrade" ] && systemctl is-enabled --quiet "${SERVICE_NAME}" 2>/dev/null; then
+        touch "${ENABLED_MARKER}"
+    elif [ "${action}" != "upgrade" ]; then
+        systemctl disable "${SERVICE_NAME}" 2>/dev/null || true
+    fi
+}
+
+restore() {
+    local previous_version="${1:-}"
+    command -v systemctl >/dev/null 2>&1 || return 0
+    local first_hardened_upgrade=false
+    if [ -n "${previous_version}" ] && [ ! -f "${POLICY_MARKER}" ]; then
+        first_hardened_upgrade=true
+    fi
+
+    systemctl daemon-reload
+    if [ "${first_hardened_upgrade}" = true ] || [ -z "${previous_version}" ] || [ -f "${ENABLED_MARKER}" ]; then
+        systemctl enable "${SERVICE_NAME}" || true
+    else
+        systemctl disable "${SERVICE_NAME}" 2>/dev/null || true
+    fi
+
+    if [ "${first_hardened_upgrade}" = true ] || [ -f "${ACTIVE_MARKER}" ]; then
+        systemctl start "${SERVICE_NAME}"
+        echo "Upgraded service restarted."
+    else
+        echo "Service installed but not started."
+    fi
+    rm -f "${ACTIVE_MARKER}" "${ENABLED_MARKER}"
+    touch "${POLICY_MARKER}"
+    chmod 0600 "${POLICY_MARKER}"
+}
+
+case "$(basename "$0")" in
+    preinst)
+        preinstall "${1:-}"
+        ;;
+    *)
+        operation="${1:-}"
+        shift || true
+        case "${operation}" in
+            preinstall) preinstall "${1:-}" ;;
+            preremove) preremove "${1:-}" ;;
+            restore) restore "${1:-}" ;;
+            *) echo "Usage: $0 {preinstall|preremove|restore} [dpkg-argument]" >&2; exit 2 ;;
+        esac
+        ;;
+esac
diff --git a/scripts/migrate_service_layout.py b/scripts/migrate_service_layout.py
new file mode 100644
index 0000000..9a0b900
--- /dev/null
+++ b/scripts/migrate_service_layout.py
@@ -0,0 +1,206 @@
+#!/usr/bin/env python3
+"""Move legacy relative runtime paths into service-owned directories safely."""
+
+from __future__ import annotations
+
+import argparse
+import configparser
+import os
+import shutil
+import sqlite3
+import sys
+import tempfile
+from datetime import datetime, timezone
+from pathlib import Path
+
+# This script is invoked from an installed source tree before the virtualenv is
+# ready, so make the adjacent application package importable explicitly.
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+
+from modules.ini_writer import update_ini_values  # noqa: E402
+
+
+def _copy_sqlite(source: Path, target: Path) -> None:
+    """Atomically create a verified SQLite copy, including committed WAL data."""
+    target.parent.mkdir(parents=True, exist_ok=True)
+    source_uri = f"{source.resolve().as_uri()}?mode=ro"
+    source_conn = sqlite3.connect(source_uri, uri=True)
+    fd, temporary_name = tempfile.mkstemp(
+        dir=target.parent,
+        prefix=f".{target.name}.",
+        suffix=".migrating",
+    )
+    os.close(fd)
+    temporary = Path(temporary_name)
+    try:
+        target_conn = sqlite3.connect(temporary)
+        try:
+            source_conn.backup(target_conn)
+            result = target_conn.execute("PRAGMA integrity_check").fetchone()
+            if not result or result[0] != "ok":
+                raise sqlite3.DatabaseError(f"migrated database failed integrity_check: {result!r}")
+        finally:
+            target_conn.close()
+        os.chmod(temporary, 0o600)
+        with temporary.open("rb") as migrated_file:
+            os.fsync(migrated_file.fileno())
+        os.replace(temporary, target)
+        # Persist the rename itself where directory fsync is supported.
+        try:
+            directory_fd = os.open(target.parent, os.O_RDONLY)
+            try:
+                os.fsync(directory_fd)
+            finally:
+                os.close(directory_fd)
+        except OSError:
+            pass
+    finally:
+        source_conn.close()
+        try:
+            temporary.unlink()
+        except FileNotFoundError:
+            pass
+
+
+def _backup_path(path: Path, label: str) -> Path:
+    """Return a collision-safe sibling path for a pre-migration backup."""
+
+    timestamp = datetime.now(timezone.utc).strftime("%Y%m%dT%H%M%S%fZ")
+    if path.suffix and path.is_file():
+        base_name = f"{path.stem}.{label}-{timestamp}"
+        candidate = path.with_name(f"{base_name}{path.suffix}")
+    else:
+        base_name = f"{path.name}.{label}-{timestamp}"
+        candidate = path.with_name(base_name)
+    counter = 1
+    while candidate.exists():
+        if path.suffix and path.is_file():
+            candidate = path.with_name(f"{base_name}-{counter}{path.suffix}")
+        else:
+            candidate = path.with_name(f"{base_name}-{counter}")
+        counter += 1
+    return candidate
+
+
+def _migrate_sqlite(source: Path, target: Path) -> None:
+    """Make the config-selected legacy DB authoritative without losing target data."""
+
+    if source == target or not source.is_file():
+        return
+    if target.exists():
+        # A relative config value proves the legacy source is still the active
+        # database.  Preserve any stale/partial prior target before replacing it
+        # instead of silently switching the service to that target.
+        _copy_sqlite(target, _backup_path(target, "pre-layout"))
+    _copy_sqlite(source, target)
+
+
+def _migrate_runtime_database_paths(
+    parser: configparser.ConfigParser,
+    legacy_base: Path,
+    state_dir: Path,
+    updates: dict[str, dict[str, str]],
+) -> None:
+    """Migrate Bot and optional split Web_Viewer DB paths without collisions."""
+
+    configured: list[tuple[str, str, str]] = [
+        ("Bot", "db_path", parser.get("Bot", "db_path", fallback="meshcore_bot.db").strip()),
+    ]
+    viewer_raw = parser.get("Web_Viewer", "db_path", fallback="").strip()
+    if viewer_raw:
+        configured.append(("Web_Viewer", "db_path", viewer_raw))
+
+    source_targets: dict[Path, Path] = {}
+    claimed_targets: dict[Path, Path] = {}
+    for section, key, raw in configured:
+        if not raw or Path(raw).is_absolute() or raw == ":memory:":
+            continue
+        source = (legacy_base / raw).resolve()
+        if source in source_targets:
+            target = source_targets[source]
+        else:
+            filename = Path(raw).name or "meshcore_bot.db"
+            target = (state_dir / filename).resolve()
+            if target in claimed_targets and claimed_targets[target] != source:
+                prefix = "viewer-" if section == "Web_Viewer" else "bot-"
+                target = (state_dir / f"{prefix}{filename}").resolve()
+            suffix = 1
+            original_target = target
+            while target in claimed_targets and claimed_targets[target] != source:
+                target = original_target.with_name(
+                    f"{original_target.stem}-{suffix}{original_target.suffix}"
+                )
+                suffix += 1
+            source_targets[source] = target
+            claimed_targets[target] = source
+            _migrate_sqlite(source, target)
+        updates.setdefault(section, {})[key] = str(target)
+
+
+def migrate_service_layout(
+    config_path: Path,
+    legacy_base: Path,
+    state_dir: Path,
+    log_dir: Path,
+) -> dict[str, dict[str, str]]:
+    """Migrate relative DB/local/log settings and return applied INI updates."""
+    parser = configparser.ConfigParser()
+    loaded = parser.read(config_path, encoding="utf-8")
+    if not loaded:
+        raise FileNotFoundError(config_path)
+
+    state_dir.mkdir(parents=True, exist_ok=True)
+    log_dir.mkdir(parents=True, exist_ok=True)
+    updates: dict[str, dict[str, str]] = {}
+
+    _migrate_runtime_database_paths(parser, legacy_base, state_dir, updates)
+
+    local_raw = parser.get("Bot", "local_dir_path", fallback="local").strip() or "local"
+    if not Path(local_raw).is_absolute():
+        source = (legacy_base / local_raw).resolve()
+        target = (state_dir / "local").resolve()
+        if source.is_dir() and source != target:
+            if target.exists() and any(target.iterdir()):
+                os.replace(target, _backup_path(target, "pre-layout"))
+            elif target.exists():
+                target.rmdir()
+            shutil.copytree(source, target, dirs_exist_ok=True)
+        else:
+            target.mkdir(parents=True, exist_ok=True)
+        updates.setdefault("Bot", {})["local_dir_path"] = str(target)
+
+    log_raw = parser.get("Logging", "log_file", fallback="").strip()
+    if log_raw and not Path(log_raw).is_absolute():
+        source = (legacy_base / log_raw).resolve()
+        target = (log_dir / Path(log_raw).name).resolve()
+        if source.is_file() and source != target:
+            if target.exists():
+                shutil.copy2(target, _backup_path(target, "pre-layout"))
+            shutil.copy2(source, target)
+            os.chmod(target, 0o600)
+        updates.setdefault("Logging", {})["log_file"] = str(target)
+
+    if updates:
+        update_ini_values(str(config_path), updates)
+    return updates
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--config", required=True, type=Path)
+    parser.add_argument("--legacy-base", required=True, type=Path)
+    parser.add_argument("--state-dir", required=True, type=Path)
+    parser.add_argument("--log-dir", required=True, type=Path)
+    args = parser.parse_args()
+    updates = migrate_service_layout(
+        args.config.resolve(),
+        args.legacy_base.resolve(),
+        args.state_dir.resolve(),
+        args.log_dir.resolve(),
+    )
+    changed = sum(len(values) for values in updates.values())
+    print(f"service layout migration complete ({changed} path setting(s) updated)")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/scripts/smoke_test_wheel.py b/scripts/smoke_test_wheel.py
new file mode 100644
index 0000000..4d2f9b6
--- /dev/null
+++ b/scripts/smoke_test_wheel.py
@@ -0,0 +1,66 @@
+#!/usr/bin/env python3
+"""Smoke-test an installed MeshCore Bot wheel from outside its source tree."""
+
+from __future__ import annotations
+
+import importlib
+import importlib.metadata
+import json
+from importlib import resources
+
+
+def _module_names(distribution: importlib.metadata.Distribution) -> list[str]:
+    names: set[str] = set()
+    for file in distribution.files or ():
+        parts = file.parts
+        if not parts or parts[0] != "modules" or file.suffix != ".py":
+            continue
+        if parts[-1] == "__init__.py":
+            names.add(".".join(parts[:-1]))
+        else:
+            names.add(".".join((*parts[:-1], file.stem)))
+    return sorted(names)
+
+
+def main() -> None:
+    distribution = importlib.metadata.distribution("meshcore-bot")
+    files = {str(file) for file in distribution.files or ()}
+
+    required_files = {
+        "translations/en.json",
+        "data/randomlines/funfacts.txt",
+        "modules/clients/espn_client.py",
+    }
+    missing = sorted(required_files - files)
+    if missing:
+        raise SystemExit(f"wheel is missing required files: {', '.join(missing)}")
+
+    translations = resources.files("translations")
+    english = json.loads(translations.joinpath("en.json").read_text(encoding="utf-8"))
+    if not english:
+        raise SystemExit("bundled English translation catalog is empty")
+
+    randomlines = resources.files("data.randomlines")
+    if not randomlines.joinpath("funfacts.txt").read_text(encoding="utf-8").strip():
+        raise SystemExit("bundled RandomLine data is empty")
+
+    failures: list[str] = []
+    for module_name in _module_names(distribution):
+        try:
+            importlib.import_module(module_name)
+        except Exception as exc:  # noqa: BLE001 - aggregate all artifact failures
+            failures.append(f"{module_name}: {type(exc).__name__}: {exc}")
+    if failures:
+        raise SystemExit("wheel module import failures:\n  " + "\n  ".join(failures))
+
+    for script in ("meshcore-bot", "meshcore-viewer"):
+        matches = [ep for ep in distribution.entry_points if ep.group == "console_scripts" and ep.name == script]
+        if len(matches) != 1:
+            raise SystemExit(f"expected one {script!r} console entry point, found {len(matches)}")
+        matches[0].load()
+
+    print(f"wheel smoke test passed ({len(_module_names(distribution))} modules imported)")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tests/test_contacts_template_xss.py b/tests/test_contacts_template_xss.py
index 5b04e68..b434372 100644
--- a/tests/test_contacts_template_xss.py
+++ b/tests/test_contacts_template_xss.py
@@ -84,7 +84,7 @@ def test_untrusted_advert_fields_are_escaped_in_dom_interpolations(template_sour
 def test_specific_known_sinks_are_escaped(template_source: str) -> None:
     """Guard the exact sinks identified in the audit against regressions."""
     assert "${this.escapeHtml(contact.username || 'Unknown')}" in template_source
-    assert "${this.escapeHtml(s.name)}" in template_source
+    assert "String(s.name ?? '')" in template_source
     # raw advert JSON blob is HTML-escaped before landing in the <pre>
     # (advert data is fetched on demand into `advertData` via /api/contact-detail)
     assert "this.escapeHtml(JSON.stringify(advertData" in template_source
@@ -240,55 +240,28 @@ def test_mesh_known_title_sinks_are_escaped(mesh_source: str) -> None:
 
 REALTIME_TEMPLATE_PATH = TEMPLATES_DIR / "realtime.html"
 
-# Free-text mesh fields (advert name, message sender, message body) that must be
-# escaped before reaching innerHTML.  Each ${...} interpolation referencing one
-# of these must go through escapeHtml(...).
-REALTIME_UNTRUSTED_TOKENS = (
-    "data.advert_name",
-    "data.sender",
-    "bodyRaw",  # message body, assigned from data.content
-)
-
-
 @pytest.fixture(scope="module")
 def realtime_source() -> str:
     assert REALTIME_TEMPLATE_PATH.is_file(), f"missing template: {REALTIME_TEMPLATE_PATH}"
     return REALTIME_TEMPLATE_PATH.read_text(encoding="utf-8")
 
 
-def test_realtime_escape_helper_exists(realtime_source: str) -> None:
-    """realtime.html must define an escapeHtml helper."""
-    assert "function escapeHtml(" in realtime_source
+def test_realtime_uses_dom_text_sinks(realtime_source: str) -> None:
+    """Untrusted packet fields must be assigned through non-parsing DOM APIs."""
+    assert "function makeElement(" in realtime_source
+    assert "element.textContent = String(text)" in realtime_source
 
 
-def test_realtime_untrusted_fields_escaped_in_interpolations(realtime_source):
-    """Every DOM interpolation of an advert name / message field is escaped."""
-    offenders = []
-    for match in INTERPOLATION_RE.finditer(realtime_source):
-        expr = match.group(1)
-        if not any(token in expr for token in REALTIME_UNTRUSTED_TOKENS):
-            continue
-        if "escapeHtml(" not in expr:
-            line_no = realtime_source.count("\n", 0, match.start()) + 1
-            offenders.append(f"line {line_no}: ${{{expr.strip()}}}")
-
-    assert not offenders, (
-        "Unescaped mesh field rendered into the live stream DOM (stored XSS):\n  "
-        + "\n  ".join(offenders)
-    )
+def test_realtime_untrusted_fields_never_reach_html_parsers(realtime_source):
+    """The live stream has no HTML parser sink for mesh-controlled values."""
+    for parser_sink in (".innerHTML", "insertAdjacentHTML", "document.write"):
+        assert parser_sink not in realtime_source
 
 
 def test_realtime_known_safe_sinks(realtime_source: str) -> None:
-    """Lock in the audited escaping of advert name, sender, body, and channel."""
-    # Advert name (the article's adv_name) -- escaped in both render paths.
-    assert "escapeHtml(data.advert_name)" in realtime_source
-    assert "<strong>Name:</strong> ${escapeHtml(name)}" in realtime_source
-    # Message sender, body, and channel badge.
-    assert "escapeHtml(data.sender || '?')" in realtime_source
-    assert "escapeHtml(bodyRaw)" in realtime_source
-    assert "escapeHtml(data.channel)" in realtime_source
-    # Raw (unescaped) forms must be absent.
-    assert "${data.advert_name}" not in realtime_source
-    assert "${data.sender}" not in realtime_source
-    assert "${data.sender || '?'}" not in realtime_source
-    assert "${bodyRaw}" not in realtime_source
+    """Lock in DOM text sinks for advert name, sender, body, and channel."""
+    assert "makeElement('strong', '', data.sender || '?')" in realtime_source
+    assert "entry.append(header, makeElement('div', 'text-break', bodyRaw))" in realtime_source
+    assert "data.channel\n            )" in realtime_source
+    assert "document.createTextNode(` ${String(data.advert_name)}" in realtime_source
+    assert "appendNodeInfo('Name', name)" in realtime_source
diff --git a/tests/test_database_restore.py b/tests/test_database_restore.py
new file mode 100644
index 0000000..08344c3
--- /dev/null
+++ b/tests/test_database_restore.py
@@ -0,0 +1,269 @@
+"""Regression tests for the staged, startup-only database restore workflow."""
+
+from __future__ import annotations
+
+import logging
+import sqlite3
+from pathlib import Path
+
+import pytest
+
+import modules.database_restore as database_restore_module
+from modules.database_restore import (
+    DatabaseRestoreError,
+    apply_pending_database_restore,
+    apply_pending_restores_from_config,
+    pending_restore_path,
+    stage_database_restore,
+    validate_restore_database,
+)
+from modules.db_migrations import MigrationRunner
+
+
+def _create_meshcore_database(path: Path, marker: str) -> None:
+    with sqlite3.connect(path) as conn:
+        MigrationRunner(conn, logging.getLogger(__name__)).run()
+        conn.execute(
+            "INSERT OR REPLACE INTO bot_metadata (key, value) VALUES ('restore.marker', ?)",
+            (marker,),
+        )
+        conn.commit()
+
+
+def _marker(path: Path) -> str:
+    with sqlite3.connect(path) as conn:
+        row = conn.execute(
+            "SELECT value FROM bot_metadata WHERE key = 'restore.marker'"
+        ).fetchone()
+    assert row is not None
+    return str(row[0])
+
+
+def test_stage_does_not_replace_live_database(tmp_path: Path) -> None:
+    active = tmp_path / "active.db"
+    backup = tmp_path / "backup.db"
+    _create_meshcore_database(active, "active")
+    _create_meshcore_database(backup, "backup")
+
+    pending = stage_database_restore(backup, active)
+
+    assert pending == pending_restore_path(active)
+    assert pending.exists()
+    assert _marker(active) == "active"
+    assert _marker(pending) == "backup"
+    assert pending.stat().st_mode & 0o007 == 0
+
+
+def test_apply_pending_restore_creates_recovery_and_clears_sidecars(
+    tmp_path: Path,
+) -> None:
+    active = tmp_path / "active.db"
+    backup = tmp_path / "backup.db"
+    _create_meshcore_database(active, "active")
+    _create_meshcore_database(backup, "backup")
+    pending = stage_database_restore(backup, active)
+    Path(f"{active}-wal").write_bytes(b"stale")
+    Path(f"{active}-shm").write_bytes(b"stale")
+
+    result = apply_pending_database_restore(active)
+
+    assert result is not None
+    assert result.database_path == active.resolve()
+    assert result.recovery_backup_path is not None
+    assert result.recovery_backup_path.exists()
+    assert _marker(result.recovery_backup_path) == "active"
+    assert _marker(active) == "backup"
+    assert not pending.exists()
+    assert not Path(f"{active}-wal").exists()
+    assert not Path(f"{active}-shm").exists()
+
+
+@pytest.mark.parametrize("contents", [b"not sqlite", b"SQLite format 3\x00broken"])
+def test_invalid_pending_restore_never_changes_active_database(
+    tmp_path: Path,
+    contents: bytes,
+) -> None:
+    active = tmp_path / "active.db"
+    _create_meshcore_database(active, "active")
+    pending_restore_path(active).write_bytes(contents)
+
+    with pytest.raises(DatabaseRestoreError):
+        apply_pending_database_restore(active)
+
+    assert _marker(active) == "active"
+
+
+def test_foreign_sqlite_database_is_rejected(tmp_path: Path) -> None:
+    foreign = tmp_path / "foreign.db"
+    with sqlite3.connect(foreign) as conn:
+        conn.execute("CREATE TABLE unrelated (id INTEGER)")
+        conn.commit()
+
+    with pytest.raises(DatabaseRestoreError, match="missing table"):
+        validate_restore_database(foreign)
+
+
+def test_recognizable_pre_migration_database_is_accepted_and_upgradable(
+    tmp_path: Path,
+) -> None:
+    legacy = tmp_path / "legacy.db"
+    active = tmp_path / "active.db"
+    with sqlite3.connect(legacy) as conn:
+        conn.executescript(
+            """
+            CREATE TABLE bot_metadata (
+                key TEXT PRIMARY KEY,
+                value TEXT NOT NULL,
+                updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+            );
+            CREATE TABLE generic_cache (
+                id INTEGER PRIMARY KEY,
+                cache_key TEXT UNIQUE NOT NULL,
+                cache_value TEXT NOT NULL,
+                cache_type TEXT NOT NULL,
+                expires_at TIMESTAMP NOT NULL
+            );
+            CREATE TABLE channels (
+                channel_idx INTEGER PRIMARY KEY,
+                channel_name TEXT NOT NULL
+            );
+            INSERT INTO bot_metadata (key, value)
+            VALUES ('restore.marker', 'legacy');
+            """
+        )
+        conn.commit()
+
+    validate_restore_database(legacy)
+    stage_database_restore(legacy, active)
+    apply_pending_database_restore(active)
+    with sqlite3.connect(active) as conn:
+        MigrationRunner(conn, logging.getLogger(__name__)).run()
+        assert conn.execute("SELECT MAX(version) FROM schema_version").fetchone()[0]
+    assert _marker(active) == "legacy"
+
+
+def test_restore_size_limit_is_enforced_before_staging(tmp_path: Path) -> None:
+    active = tmp_path / "active.db"
+    backup = tmp_path / "backup.db"
+    _create_meshcore_database(active, "active")
+    _create_meshcore_database(backup, "backup")
+
+    with pytest.raises(DatabaseRestoreError, match="safety limit"):
+        stage_database_restore(backup, active, max_bytes=1024)
+
+    assert not pending_restore_path(active).exists()
+    assert _marker(active) == "active"
+
+
+def test_post_replace_failure_automatically_rolls_back(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    active = tmp_path / "active.db"
+    backup = tmp_path / "backup.db"
+    _create_meshcore_database(active, "active")
+    _create_meshcore_database(backup, "backup")
+    stage_database_restore(backup, active)
+    real_validate = database_restore_module.validate_restore_database
+    validation_count = 0
+
+    def fail_first_post_replace_validation(path: str | Path) -> None:
+        nonlocal validation_count
+        validation_count += 1
+        # pending validation, recovery validation, then replaced active DB
+        if validation_count == 3:
+            raise DatabaseRestoreError("simulated post-replace validation failure")
+        real_validate(path)
+
+    monkeypatch.setattr(
+        database_restore_module,
+        "validate_restore_database",
+        fail_first_post_replace_validation,
+    )
+
+    with pytest.raises(DatabaseRestoreError, match="candidate was re-queued"):
+        apply_pending_database_restore(active)
+
+    assert _marker(active) == "active"
+    assert _marker(pending_restore_path(active)) == "backup"
+
+
+def test_configured_bot_and_viewer_restores_apply_before_startup(tmp_path: Path) -> None:
+    active_bot = tmp_path / "bot.db"
+    active_viewer = tmp_path / "viewer.db"
+    backup_bot = tmp_path / "bot-backup.db"
+    backup_viewer = tmp_path / "viewer-backup.db"
+    for path, marker in (
+        (active_bot, "old-bot"),
+        (active_viewer, "old-viewer"),
+        (backup_bot, "new-bot"),
+        (backup_viewer, "new-viewer"),
+    ):
+        _create_meshcore_database(path, marker)
+    stage_database_restore(backup_bot, active_bot)
+    stage_database_restore(backup_viewer, active_viewer)
+    config_path = tmp_path / "config.ini"
+    config_path.write_text(
+        "[Bot]\n"
+        "db_path = bot.db\n"
+        "local_dir_path = local\n"
+        "[Web_Viewer]\n"
+        "db_path = viewer.db\n",
+        encoding="utf-8",
+    )
+
+    results = apply_pending_restores_from_config(config_path)
+
+    assert {result.database_path for result in results} == {
+        active_bot.resolve(),
+        active_viewer.resolve(),
+    }
+    assert _marker(active_bot) == "new-bot"
+    assert _marker(active_viewer) == "new-viewer"
+
+
+def test_configured_restore_failure_rolls_back_and_requeues_prior_database(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    active_bot = tmp_path / "bot.db"
+    active_viewer = tmp_path / "viewer.db"
+    backup_bot = tmp_path / "bot-backup.db"
+    backup_viewer = tmp_path / "viewer-backup.db"
+    for path, marker in (
+        (active_bot, "old-bot"),
+        (active_viewer, "old-viewer"),
+        (backup_bot, "new-bot"),
+        (backup_viewer, "new-viewer"),
+    ):
+        _create_meshcore_database(path, marker)
+    stage_database_restore(backup_bot, active_bot)
+    stage_database_restore(backup_viewer, active_viewer)
+    config_path = tmp_path / "config.ini"
+    config_path.write_text(
+        "[Bot]\n"
+        "db_path = bot.db\n"
+        "[Web_Viewer]\n"
+        "db_path = viewer.db\n",
+        encoding="utf-8",
+    )
+    real_apply = database_restore_module.apply_pending_database_restore
+
+    def fail_viewer(path: str | Path):
+        if Path(path).resolve() == active_viewer.resolve():
+            raise DatabaseRestoreError("simulated viewer restore failure")
+        return real_apply(path)
+
+    monkeypatch.setattr(
+        database_restore_module,
+        "apply_pending_database_restore",
+        fail_viewer,
+    )
+
+    with pytest.raises(DatabaseRestoreError, match="rolled back and re-queued"):
+        apply_pending_restores_from_config(config_path)
+
+    assert _marker(active_bot) == "old-bot"
+    assert _marker(active_viewer) == "old-viewer"
+    assert _marker(pending_restore_path(active_bot)) == "new-bot"
+    assert _marker(pending_restore_path(active_viewer)) == "new-viewer"
diff --git a/tests/test_i18n.py b/tests/test_i18n.py
index dc5ad37..b956d8d 100644
--- a/tests/test_i18n.py
+++ b/tests/test_i18n.py
@@ -118,6 +118,13 @@ class TestTranslatorWithRealFiles:
         t = Translator(language="en", translation_path=str(tmp_path / "nonexistent"))
         assert t.get_available_languages() == []
 
+    def test_default_catalog_loads_outside_source_tree(self, tmp_path, monkeypatch):
+        """Installed wheels must not depend on the process working directory."""
+        monkeypatch.chdir(tmp_path)
+        t = Translator(language="en")
+        assert t.fallback_translations
+        assert "en" in t.get_available_languages()
+
     def test_get_value_returns_raw_value(self, tmp_path):
         en = {"commands": {"list": ["a", "b", "c"]}}
         (tmp_path / "en.json").write_text(json.dumps(en))
diff --git a/tests/test_randomline.py b/tests/test_randomline.py
index e5508a5..7acd854 100644
--- a/tests/test_randomline.py
+++ b/tests/test_randomline.py
@@ -5,6 +5,29 @@ from modules.command_manager import CommandManager
 
 
 class TestRandomLine:
+    def test_bundled_default_loads_outside_source_tree(self, mock_bot, tmp_path, monkeypatch):
+        if not mock_bot.config.has_section("RandomLine"):
+            mock_bot.config.add_section("RandomLine")
+        mock_bot.config.set("RandomLine", "prefix.default", "")
+        mock_bot.config.set("RandomLine", "triggers.funfact", "funfact")
+        mock_bot.config.set("RandomLine", "file.funfact", "data/randomlines/funfacts.txt")
+
+        manager = CommandManager(mock_bot)
+        manager.command_prefix = ""
+        monkeypatch.chdir(tmp_path)
+        msg = SimpleNamespace(
+            content="funfact",
+            is_dm=True,
+            sender_id="abc",
+            channel="general",
+        )
+
+        with patch("modules.command_manager.random.choice", return_value="bundled fact") as choice:
+            result = manager.match_randomline(msg)
+
+        assert result == ("funfact", "bundled fact")
+        assert choice.call_args.args[0]
+
     def test_match_randomline_exact_match_normalizes_spaces_and_case(self, mock_bot, tmp_path):
         f = tmp_path / "momjoke.txt"
         f.write_text("line one\n\nline two\n", encoding="utf-8")
diff --git a/tests/test_scheduler_operation_claims.py b/tests/test_scheduler_operation_claims.py
new file mode 100644
index 0000000..bbd066a
--- /dev/null
+++ b/tests/test_scheduler_operation_claims.py
@@ -0,0 +1,373 @@
+"""Concurrency regression tests for durable web-viewer operation claims."""
+
+import asyncio
+import logging
+import socket
+import sqlite3
+import threading
+from concurrent.futures import ThreadPoolExecutor
+from configparser import ConfigParser
+from contextlib import contextmanager
+from types import SimpleNamespace
+from unittest.mock import AsyncMock, Mock, patch
+
+from modules.db_migrations import MigrationRunner
+from modules.scheduler import MessageScheduler
+
+
+class _FileDBManager:
+    def __init__(self, db_path):
+        self.db_path = db_path
+
+    @contextmanager
+    def connection(self):
+        conn = sqlite3.connect(self.db_path, timeout=5.0)
+        conn.row_factory = sqlite3.Row
+        try:
+            yield conn
+        finally:
+            conn.close()
+
+
+def _config() -> ConfigParser:
+    config = ConfigParser()
+    config.add_section("Bot")
+    config.set("Bot", "scheduled_message_max_stagger_seconds", "0")
+    return config
+
+
+def _make_scheduler(db_manager: _FileDBManager, **bot_values) -> MessageScheduler:
+    values = {
+        "logger": Mock(),
+        "config": _config(),
+        "db_manager": db_manager,
+    }
+    values.update(bot_values)
+    return MessageScheduler(SimpleNamespace(**values))
+
+
+def _operation(db_manager: _FileDBManager, op_id: int) -> sqlite3.Row:
+    with db_manager.connection() as conn:
+        return conn.execute(
+            "SELECT * FROM channel_operations WHERE id = ?",
+            (op_id,),
+        ).fetchone()
+
+
+def _insert_operation(
+    db_manager: _FileDBManager,
+    operation_type: str,
+    *,
+    status: str = "pending",
+    channel_idx: int | None = None,
+    owner_host: str | None = None,
+    owner_pid: int | None = None,
+    owner_boot_id: str | None = None,
+) -> int:
+    with db_manager.connection() as conn:
+        cursor = conn.execute(
+            """INSERT INTO channel_operations
+               (operation_type, channel_idx, status, claimed_at,
+                claim_owner_host, claim_owner_pid, claim_owner_boot_id)
+               VALUES (?, ?, ?, CASE WHEN ? = 'processing' THEN CURRENT_TIMESTAMP END,
+                       ?, ?, ?)""",
+            (
+                operation_type,
+                channel_idx,
+                status,
+                status,
+                owner_host,
+                owner_pid,
+                owner_boot_id,
+            ),
+        )
+        conn.commit()
+        return cursor.lastrowid
+
+
+def _initialize_database(tmp_path) -> _FileDBManager:
+    manager = _FileDBManager(tmp_path / "operations.db")
+    with manager.connection() as conn:
+        MigrationRunner(conn, logging.getLogger(__name__)).run()
+    return manager
+
+
+def test_claimed_at_migration_is_present(tmp_path):
+    manager = _initialize_database(tmp_path)
+
+    with manager.connection() as conn:
+        columns = {
+            row[1] for row in conn.execute("PRAGMA table_info(channel_operations)")
+        }
+
+    assert "claimed_at" in columns
+    assert {
+        "claim_owner_host",
+        "claim_owner_pid",
+        "claim_owner_boot_id",
+    } <= columns
+
+
+def test_simultaneous_database_claim_has_exactly_one_winner(tmp_path):
+    manager = _initialize_database(tmp_path)
+    op_id = _insert_operation(manager, "radio_reboot")
+    first = _make_scheduler(manager)
+    second = _make_scheduler(manager)
+    barrier = threading.Barrier(2)
+
+    def claim(scheduler):
+        barrier.wait(timeout=1)
+        return scheduler._claim_operation(("radio_reboot",))
+
+    with ThreadPoolExecutor(max_workers=2) as pool:
+        results = list(pool.map(claim, (first, second)))
+
+    winners = [result for result in results if result is not None]
+    assert len(winners) == 1
+    assert winners[0]["id"] == op_id
+    assert _operation(manager, op_id)["status"] == "processing"
+
+
+def test_two_workers_execute_slow_channel_operation_once(tmp_path):
+    manager = _initialize_database(tmp_path)
+    op_id = _insert_operation(manager, "remove", channel_idx=7)
+    call_count = 0
+
+    async def scenario():
+        nonlocal call_count
+        started = asyncio.Event()
+        release = asyncio.Event()
+
+        async def slow_remove(channel_idx):
+            nonlocal call_count
+            call_count += 1
+            assert channel_idx == 7
+            started.set()
+            await release.wait()
+            return True
+
+        first = _make_scheduler(
+            manager,
+            channel_manager=SimpleNamespace(remove_channel=AsyncMock(side_effect=slow_remove)),
+        )
+        second = _make_scheduler(
+            manager,
+            channel_manager=SimpleNamespace(remove_channel=AsyncMock(side_effect=slow_remove)),
+        )
+
+        first_run = asyncio.create_task(first._process_channel_operations())
+        await asyncio.wait_for(started.wait(), timeout=1)
+
+        claimed = _operation(manager, op_id)
+        assert claimed["status"] == "processing"
+        assert claimed["claimed_at"] is not None
+
+        # A second tick sees the durable claim and must not invoke the device.
+        await asyncio.wait_for(second._process_channel_operations(), timeout=1)
+        assert call_count == 1
+
+        release.set()
+        await first_run
+
+    asyncio.run(scenario())
+
+    finished = _operation(manager, op_id)
+    assert finished["status"] == "completed"
+    assert finished["processed_at"] is not None
+    assert call_count == 1
+
+
+def test_channel_group_preserves_order_while_first_operation_is_slow(tmp_path):
+    manager = _initialize_database(tmp_path)
+    first_id = _insert_operation(manager, "remove", channel_idx=1)
+    second_id = _insert_operation(manager, "remove", channel_idx=2)
+    calls: list[int] = []
+
+    async def scenario():
+        started = asyncio.Event()
+        release = asyncio.Event()
+
+        async def slow_remove(channel_idx):
+            calls.append(channel_idx)
+            if channel_idx == 1:
+                started.set()
+                await release.wait()
+            return True
+
+        worker_one = _make_scheduler(
+            manager,
+            channel_manager=SimpleNamespace(remove_channel=AsyncMock(side_effect=slow_remove)),
+        )
+        worker_two = _make_scheduler(
+            manager,
+            channel_manager=SimpleNamespace(remove_channel=AsyncMock(side_effect=slow_remove)),
+        )
+
+        first_run = asyncio.create_task(worker_one._process_channel_operations())
+        await asyncio.wait_for(started.wait(), timeout=1)
+        await worker_two._process_channel_operations()
+
+        assert _operation(manager, first_id)["status"] == "processing"
+        assert _operation(manager, second_id)["status"] == "pending"
+        assert calls == [1]
+
+        release.set()
+        await first_run
+        await worker_two._process_channel_operations()
+
+    asyncio.run(scenario())
+
+    assert calls == [1, 2]
+    assert _operation(manager, first_id)["status"] == "completed"
+    assert _operation(manager, second_id)["status"] == "completed"
+
+
+def test_two_workers_execute_slow_radio_operation_once(tmp_path):
+    manager = _initialize_database(tmp_path)
+    op_id = _insert_operation(manager, "radio_reboot")
+    call_count = 0
+
+    async def scenario():
+        nonlocal call_count
+        started = asyncio.Event()
+        release = asyncio.Event()
+
+        async def slow_reboot():
+            nonlocal call_count
+            call_count += 1
+            started.set()
+            await release.wait()
+            return True
+
+        first = _make_scheduler(manager, reboot_radio=AsyncMock(side_effect=slow_reboot))
+
+        first_run = asyncio.create_task(first._process_radio_operations())
+        await asyncio.wait_for(started.wait(), timeout=1)
+
+        claimed = _operation(manager, op_id)
+        assert claimed["claim_owner_host"] == first._claim_owner_host
+        assert claimed["claim_owner_pid"] == first._claim_owner_pid
+        assert claimed["claim_owner_boot_id"] == first._claim_owner_boot_id
+
+        # Constructing another scheduler while A holds a slow claim must not
+        # treat A's live local PID as a dead process or clear its ownership.
+        second = _make_scheduler(manager, reboot_radio=AsyncMock(side_effect=slow_reboot))
+        assert second._claim_owner_boot_id != first._claim_owner_boot_id
+        await asyncio.wait_for(second._process_radio_operations(), timeout=1)
+        assert call_count == 1
+        still_claimed = _operation(manager, op_id)
+        assert still_claimed["status"] == "processing"
+        assert still_claimed["claim_owner_boot_id"] == first._claim_owner_boot_id
+
+        release.set()
+        await first_run
+
+    asyncio.run(scenario())
+
+    assert _operation(manager, op_id)["status"] == "completed"
+    assert call_count == 1
+
+
+def test_config_reload_uses_same_claim_and_result_contract(tmp_path):
+    manager = _initialize_database(tmp_path)
+    op_id = _insert_operation(manager, "config_reload")
+    reload_config = Mock(return_value=(True, "configuration reloaded"))
+    first = _make_scheduler(manager, reload_config=reload_config)
+    second = _make_scheduler(manager, reload_config=reload_config)
+
+    async def scenario():
+        await asyncio.gather(
+            first._process_config_operations(),
+            second._process_config_operations(),
+        )
+
+    asyncio.run(scenario())
+
+    row = _operation(manager, op_id)
+    assert row["status"] == "completed"
+    assert "configuration reloaded" in row["result_data"]
+    reload_config.assert_called_once_with()
+
+
+def test_startup_interrupts_old_claim_without_replay_and_allows_pending_work(tmp_path):
+    manager = _initialize_database(tmp_path)
+    stale_id = _insert_operation(
+        manager,
+        "radio_disconnect",
+        status="processing",
+        owner_host=socket.gethostname(),
+        owner_pid=987654321,
+        owner_boot_id="dead-process-boot",
+    )
+    pending_id = _insert_operation(manager, "radio_reboot")
+    disconnect_radio = AsyncMock(return_value=True)
+    reboot_radio = AsyncMock(return_value=True)
+    with patch.object(MessageScheduler, "_is_local_pid_alive", return_value=False):
+        scheduler = _make_scheduler(
+            manager,
+            disconnect_radio=disconnect_radio,
+            reboot_radio=reboot_radio,
+        )
+
+    interrupted = _operation(manager, stale_id)
+    assert interrupted["status"] == "interrupted"
+    assert interrupted["processed_at"] is not None
+    assert "Automatic retry is disabled" in interrupted["error_message"]
+    assert _operation(manager, pending_id)["status"] == "pending"
+
+    asyncio.run(scheduler._process_radio_operations())
+
+    disconnect_radio.assert_not_awaited()
+    reboot_radio.assert_awaited_once_with()
+    assert _operation(manager, stale_id)["status"] == "interrupted"
+    assert _operation(manager, pending_id)["status"] == "completed"
+
+
+def test_startup_recovery_is_idempotent(tmp_path):
+    manager = _initialize_database(tmp_path)
+    stale_id = _insert_operation(manager, "remove", status="processing", channel_idx=3)
+
+    first = _make_scheduler(manager)
+    after_first = dict(_operation(manager, stale_id))
+    second = _make_scheduler(manager)
+    after_second = dict(_operation(manager, stale_id))
+
+    assert after_first["status"] == "interrupted"
+    assert after_second == after_first
+    assert first._recover_interrupted_operations() == 0
+    assert second._recover_interrupted_operations() == 0
+
+
+def test_processing_claim_created_after_startup_is_not_time_recovered(tmp_path):
+    manager = _initialize_database(tmp_path)
+    reboot_radio = AsyncMock(return_value=True)
+    scheduler = _make_scheduler(manager, reboot_radio=reboot_radio)
+    active_id = _insert_operation(manager, "radio_reboot", status="processing")
+    pending_id = _insert_operation(manager, "radio_reboot")
+
+    asyncio.run(scheduler._process_radio_operations())
+
+    reboot_radio.assert_not_awaited()
+    assert _operation(manager, active_id)["status"] == "processing"
+    assert _operation(manager, pending_id)["status"] == "pending"
+
+
+def test_other_host_processing_owner_stays_blocked_conservatively(tmp_path):
+    manager = _initialize_database(tmp_path)
+    active_id = _insert_operation(
+        manager,
+        "radio_reboot",
+        status="processing",
+        owner_host="another-host.example",
+        owner_pid=1234,
+        owner_boot_id="remote-boot",
+    )
+    pending_id = _insert_operation(manager, "radio_reboot")
+    reboot_radio = AsyncMock(return_value=True)
+
+    scheduler = _make_scheduler(manager, reboot_radio=reboot_radio)
+    asyncio.run(scheduler._process_radio_operations())
+
+    reboot_radio.assert_not_awaited()
+    assert _operation(manager, active_id)["status"] == "processing"
+    assert _operation(manager, pending_id)["status"] == "pending"
diff --git a/tests/test_service_packaging.py b/tests/test_service_packaging.py
new file mode 100644
index 0000000..92b9ae0
--- /dev/null
+++ b/tests/test_service_packaging.py
@@ -0,0 +1,330 @@
+"""Regression tests for wheel contents and hardened service deployment policy."""
+
+from __future__ import annotations
+
+import configparser
+import os
+import shutil
+import sqlite3
+import subprocess
+from pathlib import Path
+
+from scripts.migrate_service_layout import migrate_service_layout
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+
+
+def test_service_units_do_not_make_code_tree_writable():
+    unit = (REPO_ROOT / "meshcore-bot.service").read_text(encoding="utf-8")
+    assert "--config /etc/meshcore-bot/config.ini" in unit
+    assert "ReadWritePaths=/opt/meshcore-bot" not in unit
+    assert "ReadWritePaths=/var/lib/meshcore-bot" in unit
+    assert "ReadWritePaths=/etc/meshcore-bot" in unit
+    assert "UMask=0077" in unit
+
+    deb_builder = (REPO_ROOT / "scripts/build-deb.sh").read_text(encoding="utf-8")
+    assert 'chown -R "${SERVICE_USER}:${SERVICE_USER}" "${INSTALL_ROOT}"' not in deb_builder
+    assert "migrate_service_layout.py" in deb_builder
+    assert 'chmod 0600 "${BUILD_DIR}${CONF_DIR}/config.ini"' in deb_builder
+    assert (
+        'chown -R "${SERVICE_USER}:${SERVICE_USER}" "${CONF_DIR}" "${DATA_DIR}" "${LOG_DIR}"'
+        in deb_builder
+    )
+    assert 'find "${CONF_DIR}" "${DATA_DIR}" -type f -exec chmod 0600' in deb_builder
+    assert 'VENV_BUILD="${INSTALL_ROOT}/.venv-build-$$"' in deb_builder
+    assert 'if [ ! -d "${INSTALL_ROOT}/venv" ]' not in deb_builder
+    assert 'scripts/debian_service_state.sh" "${BUILD_DIR}/DEBIAN/preinst"' in deb_builder
+    assert 'debian_service_state.sh" restore "${2:-}"' in deb_builder
+    assert 'debian_service_state.sh preremove "${1:-}"' in deb_builder
+
+
+def test_standalone_installer_separates_code_and_private_state():
+    installer = (REPO_ROOT / "install-service.sh").read_text(encoding="utf-8")
+    assert 'chown -R "root:$CODE_GROUP" "$INSTALL_DIR"' in installer
+    assert 'chown -R "$SERVICE_USER:$SERVICE_GROUP" "$CONF_DIR" "$STATE_DIR"' in installer
+    assert 'find "$CONF_DIR" "$STATE_DIR" -type f -exec chmod 600' in installer
+    assert 'systemctl stop "$SERVICE_NAME"' in installer
+    assert "migrate_service_layout.py" in installer
+    assert "rsync -a --delete" in installer
+    assert "rsync -a --update" not in installer
+    assert "source-authoritative secure install" in installer
+    assert 'VENV_BUILD="$INSTALL_DIR/.venv-build-$$"' in installer
+    assert 'Preserving existing virtual environment' not in installer
+    assert "Python 3.10+ installed" in installer
+    assert "sys.version_info < (3, 10)" in installer
+
+
+def _service_state_test_environment(tmp_path: Path) -> tuple[dict[str, str], Path, Path]:
+    fake_bin = tmp_path / "bin"
+    fake_state = tmp_path / "systemctl-state"
+    maint_state = tmp_path / "maint-state"
+    fake_bin.mkdir()
+    fake_state.mkdir()
+    maint_state.mkdir()
+    systemctl = fake_bin / "systemctl"
+    systemctl.write_text(
+        """#!/bin/bash
+set -e
+state="${FAKE_SYSTEMCTL_STATE:?}"
+case "${1:-}" in
+    is-active) [ -f "$state/active" ] ;;
+    is-enabled) [ -f "$state/enabled" ] ;;
+    start) touch "$state/active" ;;
+    stop) rm -f "$state/active" ;;
+    enable) touch "$state/enabled" ;;
+    disable) rm -f "$state/enabled" ;;
+    daemon-reload) : ;;
+    *) exit 2 ;;
+esac
+""",
+        encoding="utf-8",
+    )
+    systemctl.chmod(0o755)
+    env = os.environ.copy()
+    env["PATH"] = f"{fake_bin}{os.pathsep}{env['PATH']}"
+    env["FAKE_SYSTEMCTL_STATE"] = str(fake_state)
+    env["MESHCORE_MAINT_STATE_DIR"] = str(maint_state)
+    env["MESHCORE_MAINT_POLICY_MARKER"] = str(tmp_path / "policy-marker")
+    return env, fake_state, maint_state
+
+
+def _run_service_state(script: Path, *args: str, env: dict[str, str]) -> None:
+    subprocess.run(
+        ["bash", str(script), *args],
+        check=True,
+        env=env,
+        capture_output=True,
+        text=True,
+    )
+
+
+def test_first_hardened_deb_upgrade_survives_legacy_prerm(tmp_path: Path) -> None:
+    """Model Debian's old prerm -> new preinst -> new postinst ordering."""
+    env, service_state, maint_state = _service_state_test_environment(tmp_path)
+    helper = REPO_ROOT / "scripts/debian_service_state.sh"
+    preinst = tmp_path / "preinst"
+    shutil.copy2(helper, preinst)
+
+    # The baseline package's old prerm destroys state before new code runs.
+    # The one-time migration policy favors availability and records completion.
+    (service_state / "enabled").touch()
+    (service_state / "active").touch()
+    (service_state / "enabled").unlink()
+    (service_state / "active").unlink()
+    _run_service_state(preinst, "upgrade", "0.9.2", env=env)
+    assert not list(maint_state.iterdir())
+
+    _run_service_state(helper, "restore", "0.9.2", env=env)
+
+    assert (service_state / "enabled").is_file()
+    assert (service_state / "active").is_file()
+    assert not list(maint_state.iterdir())
+    assert Path(env["MESHCORE_MAINT_POLICY_MARKER"]).is_file()
+
+
+def test_deb_upgrade_preserves_intentionally_disabled_stopped_service(
+    tmp_path: Path,
+) -> None:
+    env, service_state, maint_state = _service_state_test_environment(tmp_path)
+    helper = REPO_ROOT / "scripts/debian_service_state.sh"
+    preinst = tmp_path / "preinst"
+    shutil.copy2(helper, preinst)
+    Path(env["MESHCORE_MAINT_POLICY_MARKER"]).touch()
+
+    # Hardened old prerm runs first and writes no state markers because this
+    # service was intentionally disabled/stopped.  New preinst preserves that.
+    _run_service_state(helper, "preremove", "upgrade", env=env)
+    _run_service_state(preinst, "upgrade", "0.9.2", env=env)
+    _run_service_state(helper, "restore", "0.9.2", env=env)
+
+    assert not (service_state / "enabled").exists()
+    assert not (service_state / "active").exists()
+    assert not list(maint_state.iterdir())
+
+
+def test_later_deb_upgrade_preserves_enabled_active_service(tmp_path: Path) -> None:
+    env, service_state, maint_state = _service_state_test_environment(tmp_path)
+    helper = REPO_ROOT / "scripts/debian_service_state.sh"
+    preinst = tmp_path / "preinst"
+    shutil.copy2(helper, preinst)
+    Path(env["MESHCORE_MAINT_POLICY_MARKER"]).touch()
+    (service_state / "enabled").touch()
+    (service_state / "active").touch()
+
+    # Real Debian order: hardened old prerm, new preinst, new postinst.
+    _run_service_state(helper, "preremove", "upgrade", env=env)
+    assert not (service_state / "active").exists()
+    assert (maint_state / "meshcore-bot-was-enabled").is_file()
+    assert (maint_state / "meshcore-bot-was-active").is_file()
+    _run_service_state(preinst, "upgrade", "0.9.2", env=env)
+    _run_service_state(helper, "restore", "0.9.2", env=env)
+
+    assert (service_state / "enabled").is_file()
+    assert (service_state / "active").is_file()
+    assert not list(maint_state.iterdir())
+
+
+def test_relative_legacy_paths_are_migrated_without_losing_data(tmp_path):
+    # URI-significant characters prove the read-only SQLite URI is encoded.
+    legacy = tmp_path / "legacy #1?"
+    state = tmp_path / "state"
+    logs = tmp_path / "logs"
+    config_dir = tmp_path / "config"
+    legacy.mkdir()
+    config_dir.mkdir()
+    (legacy / "local" / "commands").mkdir(parents=True)
+    (legacy / "local" / "commands" / "custom.py").write_text("VALUE = 1\n", encoding="utf-8")
+    (legacy / "meshcore_bot.log").write_text("old log\n", encoding="utf-8")
+
+    db_path = legacy / "meshcore_bot.db"
+    connection = sqlite3.connect(db_path)
+    connection.execute("PRAGMA journal_mode=WAL")
+    connection.execute("CREATE TABLE messages (body TEXT)")
+    connection.execute("INSERT INTO messages VALUES ('preserved')")
+    connection.commit()
+
+    config_path = config_dir / "config.ini"
+    config_path.write_text(
+        "# keep this comment\n"
+        "[Bot]\n"
+        "db_path = meshcore_bot.db\n"
+        "local_dir_path = local\n"
+        "\n[Logging]\n"
+        "log_file = meshcore_bot.log\n",
+        encoding="utf-8",
+    )
+
+    try:
+        updates = migrate_service_layout(config_path, legacy, state, logs)
+    finally:
+        connection.close()
+
+    assert set(updates) == {"Bot", "Logging"}
+    migrated = sqlite3.connect(state / "meshcore_bot.db")
+    try:
+        assert migrated.execute("SELECT body FROM messages").fetchall() == [("preserved",)]
+    finally:
+        migrated.close()
+    assert (state / "local" / "commands" / "custom.py").is_file()
+    assert (logs / "meshcore_bot.log").read_text(encoding="utf-8") == "old log\n"
+    assert config_path.read_text(encoding="utf-8").startswith("# keep this comment\n")
+
+    parsed = configparser.ConfigParser()
+    parsed.read(config_path)
+    assert parsed.get("Bot", "db_path") == str((state / "meshcore_bot.db").resolve())
+    assert parsed.get("Bot", "local_dir_path") == str((state / "local").resolve())
+    assert parsed.get("Logging", "log_file") == str((logs / "meshcore_bot.log").resolve())
+
+
+def test_absolute_custom_paths_are_preserved(tmp_path):
+    config_path = tmp_path / "config.ini"
+    config_path.write_text(
+        "[Bot]\n"
+        f"db_path = {tmp_path / 'custom.db'}\n"
+        f"local_dir_path = {tmp_path / 'custom-local'}\n"
+        "[Logging]\nlog_file = \n",
+        encoding="utf-8",
+    )
+    before = config_path.read_text(encoding="utf-8")
+
+    updates = migrate_service_layout(
+        config_path,
+        tmp_path / "legacy",
+        tmp_path / "state",
+        tmp_path / "logs",
+    )
+
+    assert updates == {}
+    assert config_path.read_text(encoding="utf-8") == before
+
+
+def test_relative_legacy_database_replaces_but_preserves_stale_target(tmp_path):
+    legacy = tmp_path / "legacy"
+    state = tmp_path / "state"
+    logs = tmp_path / "logs"
+    legacy.mkdir()
+    state.mkdir()
+    logs.mkdir()
+
+    def create_db(path: Path, marker: str) -> None:
+        with sqlite3.connect(path) as conn:
+            conn.execute("CREATE TABLE marker (value TEXT)")
+            conn.execute("INSERT INTO marker VALUES (?)", (marker,))
+            conn.commit()
+
+    create_db(legacy / "meshcore_bot.db", "current-legacy")
+    create_db(state / "meshcore_bot.db", "stale-target")
+    config_path = tmp_path / "config.ini"
+    config_path.write_text("[Bot]\ndb_path = meshcore_bot.db\n", encoding="utf-8")
+
+    migrate_service_layout(config_path, legacy, state, logs)
+
+    with sqlite3.connect(state / "meshcore_bot.db") as conn:
+        assert conn.execute("SELECT value FROM marker").fetchone() == ("current-legacy",)
+    backups = list(state.glob("meshcore_bot.pre-layout-*.db"))
+    assert len(backups) == 1
+    with sqlite3.connect(backups[0]) as conn:
+        assert conn.execute("SELECT value FROM marker").fetchone() == ("stale-target",)
+
+
+def test_split_bot_and_viewer_databases_migrate_without_filename_collision(tmp_path):
+    legacy = tmp_path / "legacy"
+    state = tmp_path / "state"
+    logs = tmp_path / "logs"
+    (legacy / "bot").mkdir(parents=True)
+    (legacy / "viewer").mkdir(parents=True)
+
+    for path, marker in (
+        (legacy / "bot" / "shared.db", "bot"),
+        (legacy / "viewer" / "shared.db", "viewer"),
+    ):
+        with sqlite3.connect(path) as conn:
+            conn.execute("CREATE TABLE marker (value TEXT)")
+            conn.execute("INSERT INTO marker VALUES (?)", (marker,))
+            conn.commit()
+
+    config_path = tmp_path / "config.ini"
+    config_path.write_text(
+        "[Bot]\n"
+        "db_path = bot/shared.db\n"
+        "[Web_Viewer]\n"
+        "db_path = viewer/shared.db\n",
+        encoding="utf-8",
+    )
+
+    migrate_service_layout(config_path, legacy, state, logs)
+
+    parsed = configparser.ConfigParser()
+    parsed.read(config_path)
+    bot_target = Path(parsed.get("Bot", "db_path"))
+    viewer_target = Path(parsed.get("Web_Viewer", "db_path"))
+    assert bot_target != viewer_target
+    with sqlite3.connect(bot_target) as conn:
+        assert conn.execute("SELECT value FROM marker").fetchone() == ("bot",)
+    with sqlite3.connect(viewer_target) as conn:
+        assert conn.execute("SELECT value FROM marker").fetchone() == ("viewer",)
+
+
+def test_legacy_local_plugins_replace_and_preserve_stale_target_tree(tmp_path):
+    legacy = tmp_path / "legacy"
+    state = tmp_path / "state"
+    logs = tmp_path / "logs"
+    (legacy / "local" / "commands").mkdir(parents=True)
+    (legacy / "local" / "commands" / "current.py").write_text("CURRENT = 1\n")
+    (state / "local" / "commands").mkdir(parents=True)
+    (state / "local" / "commands" / "stale.py").write_text("STALE = 1\n")
+    config_path = tmp_path / "config.ini"
+    config_path.write_text(
+        "[Bot]\n"
+        f"db_path = {tmp_path / 'absolute.db'}\n"
+        "local_dir_path = local\n",
+        encoding="utf-8",
+    )
+
+    migrate_service_layout(config_path, legacy, state, logs)
+
+    assert (state / "local" / "commands" / "current.py").is_file()
+    assert not (state / "local" / "commands" / "stale.py").exists()
+    backups = list(state.glob("local.pre-layout-*"))
+    assert len(backups) == 1
+    assert (backups[0] / "commands" / "stale.py").is_file()
diff --git a/tests/test_web_viewer.py b/tests/test_web_viewer.py
index f5d8660..b6b1f5a 100644
--- a/tests/test_web_viewer.py
+++ b/tests/test_web_viewer.py
@@ -665,6 +665,37 @@ class TestChannelRoutes:
         resp = client.get("/api/channel-operations/99999")
         assert resp.status_code in (200, 404)
 
+    def test_api_interrupted_operation_is_terminal_and_exposes_claim_time(
+        self, client, viewer
+    ):
+        with sqlite3.connect(viewer.db_path) as conn:
+            cursor = conn.execute(
+                """INSERT INTO channel_operations
+                   (operation_type, status, error_message, claimed_at, processed_at)
+                   VALUES ('remove', 'interrupted', 'Verify device state',
+                           CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)"""
+            )
+            operation_id = cursor.lastrowid
+            conn.commit()
+
+        resp = client.get(f"/api/channel-operations/{operation_id}")
+
+        assert resp.status_code == 200
+        data = resp.get_json()
+        assert data["status"] == "interrupted"
+        assert data["error_message"] == "Verify device state"
+        assert data["claimed_at"] is not None
+
+    def test_shared_operation_poller_recognizes_interrupted_as_terminal(self):
+        source = (
+            Path(__file__).resolve().parents[1]
+            / "modules/web_viewer/static/js/channel_operations.js"
+        ).read_text(encoding="utf-8")
+
+        assert source.count("result.status === 'interrupted'") == 1
+        assert source.count("result2.status === 'interrupted'") == 1
+        assert source.count("result3.status === 'interrupted'") == 1
+
 
 # ===========================================================================
 # Feeds routes
@@ -2122,29 +2153,32 @@ class TestRestoreRoute:
                           json={"db_file": str(bad)},
                           content_type="application/json")
         assert resp.status_code == 400
-        assert "valid SQLite" in resp.get_json()["error"]
+        assert "sqlite" in resp.get_json()["error"].lower()
 
-    def test_valid_sqlite_restore_returns_200(self, viewer, tmp_path):
-        """Returns 200 with warning when a valid SQLite backup is restored."""
+    def test_valid_sqlite_restore_is_staged_without_replacing_active_db(self, viewer, tmp_path):
+        """Returns 202 and stages a valid MeshCore backup for service restart."""
         import sqlite3 as _sql
         backup_dir = tmp_path / "backups"
         backup_dir.mkdir()
         viewer.db_manager.set_metadata('maint.db_backup_dir', str(backup_dir))
         backup = backup_dir / "backup.db"
-        conn = _sql.connect(str(backup))
-        conn.execute("CREATE TABLE t (id INTEGER)")
-        conn.commit()
-        conn.close()
-        # Patch db_path to a temp destination so the real test DB is not overwritten
-        dest = str(tmp_path / "restored.db")
-        with patch.object(viewer, "db_path", dest):
+        with _sql.connect(viewer.db_path) as source_conn:
+            with _sql.connect(str(backup)) as destination_conn:
+                source_conn.backup(destination_conn)
+        # Patch db_path to a temp destination and verify the request does not create it.
+        dest = tmp_path / "restored.db"
+        with patch.object(viewer, "db_path", str(dest)):
             with viewer.app.test_client() as c:
                 resp = c.post("/api/maintenance/restore",
                               json={"db_file": str(backup)},
                               content_type="application/json")
-        assert resp.status_code == 200
+        assert resp.status_code == 202
         data = resp.get_json()
         assert data["success"] is True
+        assert data["requires_restart"] is True
+        assert data["pending_path"] == str(tmp_path / ".restored.db.restore-pending")
+        assert not dest.exists()
+        assert Path(data["pending_path"]).exists()
         assert "warning" in data
         assert "Restart" in data["warning"]
 
diff --git a/tests/test_web_viewer_xss_hardening.py b/tests/test_web_viewer_xss_hardening.py
new file mode 100644
index 0000000..4174216
--- /dev/null
+++ b/tests/test_web_viewer_xss_hardening.py
@@ -0,0 +1,309 @@
+"""Regression coverage for the admin viewer's API-to-DOM trust boundary."""
+
+import configparser
+import logging
+import re
+from pathlib import Path
+from unittest.mock import patch
+
+import pytest
+
+from modules.web_viewer.app import BotDataViewer
+
+TEMPLATES = Path(__file__).resolve().parents[1] / "modules" / "web_viewer" / "templates"
+
+
+def _source(name: str) -> str:
+    return (TEMPLATES / name).read_text(encoding="utf-8")
+
+
+def _fake_setup_logging(viewer: BotDataViewer) -> None:
+    viewer.logger = logging.getLogger("test_web_viewer_xss_hardening")
+    viewer.logger.addHandler(logging.NullHandler())
+
+
+@pytest.fixture(scope="module")
+def client(tmp_path_factory):
+    tmp = tmp_path_factory.mktemp("viewer_xss")
+    db_path = tmp / "viewer.db"
+    config_path = tmp / "config.ini"
+    config = configparser.ConfigParser()
+    config["Connection"] = {
+        "connection_type": "serial",
+        "serial_port": "/dev/ttyUSB0",
+    }
+    config["Bot"] = {
+        "bot_name": "TestBot",
+        "db_path": str(db_path),
+        "prefix_bytes": "1",
+    }
+    config["Channels"] = {"monitor_channels": "general"}
+    config["Web_Viewer"] = {"multibyte_monitor_enabled": "true"}
+    with config_path.open("w", encoding="utf-8") as handle:
+        config.write(handle)
+
+    with (
+        patch.object(BotDataViewer, "_setup_logging", _fake_setup_logging),
+        patch.object(BotDataViewer, "_start_database_polling", lambda self: None),
+        patch.object(BotDataViewer, "_start_log_tailing", lambda self: None),
+        patch.object(BotDataViewer, "_start_cleanup_scheduler", lambda self: None),
+    ):
+        viewer = BotDataViewer(db_path=str(db_path), config_path=str(config_path))
+    viewer.app.config["TESTING"] = True
+    with viewer.app.test_client() as test_client:
+        yield test_client
+
+
+def test_dashboard_has_no_html_parser_sink_for_api_or_mesh_values() -> None:
+    source = _source("index.html")
+    assert ".innerHTML" not in source
+    # Representative attacker-controlled sender, channel/title, path, client,
+    # and error values all terminate in textContent-backed DOM construction.
+    for safe_sink in (
+        "entryLabel.textContent = String(label ?? '')",
+        "entryText.textContent = ` ${String(text ?? '')}`",
+        "channelName.title = String(channel.channel ?? '')",
+        "pathCode = this.makeTextElement('code', path.path_string",
+        "clientCell.appendChild(this.makeTextElement('code', c.client_id))",
+        "errorText.textContent = String(message ?? '')",
+    ):
+        assert safe_sink in source
+
+
+def test_feed_metadata_preview_details_and_alerts_use_text_nodes() -> None:
+    source = _source("feeds.html")
+    # Payload classes include markup, event attributes, attribute breakouts,
+    # script URLs, and malformed-looking close tags. They must never be placed
+    # in a template literal that an HTML parser consumes.
+    unsafe_fragments = (
+        "tbody.innerHTML = this.feeds.map",
+        "${feed.feed_name",
+        "${feed.channel_name}",
+        "${item.formatted}",
+        "${feed.output_format.replace",
+        "alert.innerHTML = `${message}",
+        "onclick=\"feedManager.",
+    )
+    assert all(fragment not in source for fragment in unsafe_fragments)
+    for safe_sink in (
+        "addTextCell(feed.feed_name || String(feed.feed_url || '').substring(0, 30))",
+        "addTextCell(feed.channel_name)",
+        "formatted.textContent = String(item.formatted ?? '')",
+        "format.textContent = String(feed.output_format)",
+        "messageNode.textContent = String(message ?? '')",
+    ):
+        assert safe_sink in source
+
+
+def test_restore_backup_rows_do_not_interpolate_names_or_paths() -> None:
+    source = _source("config.html")
+    restore_source = source.split("class RestoreManager", 1)[1].split(
+        "class PurgeManager", 1
+    )[0]
+    assert "tr.innerHTML" not in restore_source
+    assert "onclick=" not in restore_source
+    assert "small.textContent = String(value ?? '')" in restore_source
+    assert "this.pathEl.value = String(b.path ?? '')" in restore_source
+    assert "active database remains unchanged" in source
+    assert "Restart the complete MeshCore Bot service" in source
+
+
+def test_config_api_data_and_errors_do_not_reach_inner_html() -> None:
+    source = _source("config.html")
+    unsafe_fragments = (
+        "this.tbody.innerHTML = jobs.map",
+        "this.tbody.innerHTML = `<tr><td colspan=\"3\"",
+        "this.resultsBody.innerHTML = Object.entries(deleted)",
+        "infoElement.innerHTML = this.dbData.tables.map",
+        "tablesInfo.innerHTML = `<div class=\"alert alert-danger\">${message}",
+    )
+    assert all(fragment not in source for fragment in unsafe_fragments)
+    for safe_sink in (
+        "outcome.title = String(j.outcome)",
+        "cell.textContent = `Failed to load: ${err.message}`",
+        "code.textContent = String(tableName)",
+        "heading.append(icon, document.createTextNode(String(table.name ?? '')))",
+        "alert.textContent = String(message ?? '')",
+    ):
+        assert safe_sink in source
+
+
+def test_inherited_notification_message_uses_text_content() -> None:
+    source = _source("base.html")
+    assert "${message}" not in source
+    assert "notificationText.textContent = String(message ?? '')" in source
+
+
+def test_legacy_admin_pages_encode_or_text_render_untrusted_values() -> None:
+    contacts = _source("contacts.html")
+    assert "return `${contact.city}, ${contact.state}`" not in contacts
+    assert "this.escapeHtml(contact.city)" in contacts
+    assert "this.escapeHtml(displayText)" in contacts
+    assert "customTooltip.textContent = pathContent" in contacts
+    assert "text.textContent = `Error: ${String(message ?? '')}`" in contacts
+    assert "previewText.textContent = `${data.count} contact(s)" in contacts
+    assert "onclick=\"contactsManager" not in contacts
+
+    greeter = _source("greeter.html")
+    assert "tableBody.innerHTML = users.map" not in greeter
+    assert "button.addEventListener('click', () => this.ungreetUser" in greeter
+    assert "sample_greeting" in greeter and "makeTextElement(" in greeter
+
+    multibyte = _source("multibyte_rollout.html")
+    assert "tbody.innerHTML = list.map" not in multibyte
+    assert "tbody.innerHTML = rows.map" not in multibyte
+    assert "info.title = tipText" in multibyte
+
+    mesh = _source("mesh.html")
+    assert "nodeDetailsBody').innerHTML" not in mesh
+    assert "nodeDetailsBody').replaceChildren(table)" in mesh
+
+    plugins = _source("plugins.html")
+    assert "header.innerHTML = `" not in plugins
+    assert "description.textContent = String(plugin.description ?? '')" in plugins
+
+    stats = _source("stats.html")
+    assert ".innerHTML" not in stats
+
+
+def test_nonce_hardened_templates_have_no_inline_event_attributes() -> None:
+    event_attribute = re.compile(r"<[^>]*\son[a-z]+\s*=", re.IGNORECASE)
+    for template_name in (
+        "base.html",
+        "index.html",
+        "feeds.html",
+        "config.html",
+        "radio.html",
+        "realtime.html",
+        "contacts.html",
+        "stats.html",
+        "plugins.html",
+        "greeter.html",
+        "logs.html",
+        "multibyte_rollout.html",
+        "mesh.html",
+        "api_explorer.html",
+    ):
+        assert not event_attribute.search(_source(template_name)), template_name
+
+
+@pytest.mark.parametrize(
+    "path",
+    [
+        "/",
+        "/feeds",
+        "/config",
+        "/radio",
+        "/realtime",
+        "/contacts",
+        "/stats",
+        "/plugins",
+        "/greeter",
+        "/logs",
+        "/multibyte-rollout",
+        "/mesh",
+        "/api-explorer",
+    ],
+)
+def test_csp_nonce_matches_every_rendered_inline_script(client, path: str) -> None:
+    response = client.get(path)
+    assert response.status_code == 200
+    csp = response.headers["Content-Security-Policy"]
+    script_directive = next(
+        directive.strip()
+        for directive in csp.split(";")
+        if directive.strip().startswith("script-src ")
+    )
+    assert "'unsafe-inline'" not in script_directive
+    nonce_match = re.search(r"'nonce-([^']+)'", script_directive)
+    assert nonce_match, csp
+    expected_nonce = nonce_match.group(1)
+
+    html = response.get_data(as_text=True)
+    inline_scripts = [
+        attributes
+        for attributes in re.findall(r"<script\b([^>]*)>", html, re.IGNORECASE)
+        if not re.search(r"\bsrc\s*=", attributes, re.IGNORECASE)
+    ]
+    assert inline_scripts
+    for attributes in inline_scripts:
+        rendered_nonce = re.search(r'\bnonce="([^"]+)"', attributes)
+        assert rendered_nonce, attributes
+        assert rendered_nonce.group(1) == expected_nonce
+
+
+def test_nonce_is_unique_per_response(client) -> None:
+    nonces = []
+    for _ in range(2):
+        csp = client.get("/").headers["Content-Security-Policy"]
+        nonces.append(re.search(r"'nonce-([^']+)'", csp).group(1))
+    assert nonces[0] != nonces[1]
+
+
+@pytest.mark.parametrize(
+    ("payload_class", "payload"),
+    [
+        ("channel", '"><img src=x onerror="window.channelOwned=1">'),
+        ("message", "</div><script>window.messageOwned=1</script>"),
+        ("path", "' onmouseover='window.pathOwned=1"),
+        ("error", "<svg/onload=window.errorOwned=1>"),
+    ],
+)
+@pytest.mark.parametrize("template_name", ["radio.html", "realtime.html"])
+def test_radio_and_realtime_payload_classes_never_reach_an_html_parser(
+    template_name: str,
+    payload_class: str,
+    payload: str,
+) -> None:
+    """The representative payload is documentation for each trust class.
+
+    These screens receive the values asynchronously, so the regression guard
+    is static: there must be no API-to-parser sink capable of interpreting any
+    payload as markup, regardless of its exact spelling.
+    """
+    assert payload_class
+    assert payload
+    source = _source(template_name)
+    for parser_sink in (
+        ".innerHTML",
+        ".outerHTML",
+        "insertAdjacentHTML",
+        "document.write",
+        ".onclick",
+    ):
+        assert parser_sink not in source, (template_name, payload_class, parser_sink)
+
+
+def test_radio_dynamic_channel_feed_key_and_error_values_use_dom_text_nodes() -> None:
+    source = _source("radio.html")
+    for safe_sink in (
+        "cell.textContent = String(value ?? '')",
+        "link.textContent = String(feed.feed_name || feed.feed_url || 'Unnamed feed')",
+        "code.textContent = String(channelKey)",
+        "messageNode.textContent = String(message ?? '')",
+        "viewButton.addEventListener('click'",
+        "deleteButton.addEventListener('click'",
+    ):
+        assert safe_sink in source
+
+
+def test_all_direct_radio_pollers_treat_interrupted_as_terminal() -> None:
+    source = _source("radio.html")
+
+    assert source.count("result.status === 'interrupted'") == 2
+    assert "data.status === 'interrupted'" in source
+
+
+def test_realtime_mesh_user_message_path_and_error_values_use_dom_text_nodes() -> None:
+    source = _source("realtime.html")
+    for safe_sink in (
+        "element.textContent = String(text)",
+        "data.channel\n            )",
+        "makeElement('strong', '', data.sender || '?')",
+        "entry.append(header, makeElement('div', 'text-break', bodyRaw))",
+        "makeElement('strong', 'text-primary me-2', data.user || 'Unknown')",
+        "makeElement('div', 'response-text', data.response || 'No response')",
+        "document.createTextNode(` ${String(pathDisplay)}",
+        "document.getElementById('decoder-error-message').textContent = decodeError",
+    ):
+        assert safe_sink in source
diff --git a/translations/__init__.py b/translations/__init__.py
new file mode 100644
index 0000000..3f95068
--- /dev/null
+++ b/translations/__init__.py
@@ -0,0 +1,6 @@
+"""Bundled MeshCore Bot translation catalogs.
+
+The JSON files in this package are runtime data.  Keeping them in an importable
+package lets installed wheels load the defaults through ``importlib.resources``
+without depending on the process working directory.
+"""